@enbox/gitd 0.0.1

package/src/shims/oci/registry.ts

@@ -0,0 +1,334 @@
+/**
+ * OCI Distribution registry shim — translates Docker/Podman pull
+ * requests into DWN queries.
+ *
+ * Implements the read-only subset of the OCI Distribution Spec v2
+ * needed by `docker pull` and `podman pull`.
+ *
+ * Container images are stored in the DWN using the forge-registry
+ * protocol with the `oci` ecosystem.  The mapping is:
+ *
+ *   OCI concept       → DWN record
+ *   ──────────────────────────────────────
+ *   Repository         → `package` (ecosystem: 'oci')
+ *   Tag / version      → `package/version` (semver = tag)
+ *   Manifest           → `package/version/tarball` (application/vnd.oci.image.manifest.v1+json)
+ *   Blob / layer       → queried by digest from version data
+ *
+ * Image naming:
+ *   `localhost:5555/did:dht:abc123/my-image:v1.0.0`
+ *
+ * The DID and image name are extracted from the Docker repository name.
+ *
+ * Endpoints (OCI Distribution Spec v2):
+ *   GET /v2/                                      API version check
+ *   GET /v2/{name}/manifests/{reference}           Pull manifest (by tag or digest)
+ *   HEAD /v2/{name}/manifests/{reference}          Check manifest existence
+ *   GET /v2/{name}/blobs/{digest}                  Pull blob
+ *   GET /v2/{name}/tags/list                       List tags
+ *
+ * @module
+ */
+
+import type { AgentContext } from '../../cli/agent.js';
+
+import {
+  fetchTarball,
+  listVersions,
+  resolvePackage,
+  resolveVersion,
+} from '../../resolver/resolve.js';
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+/** OCI registry HTTP response. */
+export type OciResponse = {
+  status : number;
+  headers : Record<string, string>;
+  body : string | Uint8Array;
+};
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** OCI-required headers for all responses. */
+function ociHeaders(extra?: Record<string, string>): Record<string, string> {
+  return {
+    'Docker-Distribution-Api-Version' : 'registry/2.0',
+    'Access-Control-Allow-Origin'     : '*',
+    ...extra,
+  };
+}
+
+/** Build a 404 response with OCI error envelope. */
+function notFound(code: string, message: string): OciResponse {
+  return {
+    status  : 404,
+    headers : ociHeaders({ 'Content-Type': 'application/json' }),
+    body    : JSON.stringify({
+      errors: [{ code, message, detail: null }],
+    }),
+  };
+}
+
+/**
+ * Parse an OCI repository name into DID + image name.
+ *
+ * OCI repositories use the format: `did:<method>:<id>/<image-name>`
+ * Docker CLI sends this as the `name` portion of the v2 API path.
+ */
+export function parseOciName(
+  name: string,
+): { did: string; imageName: string } | null {
+  const match = name.match(
+    /^(did:[a-z0-9]+:[a-zA-Z0-9._:%-]+)\/([a-zA-Z0-9._/-]+)$/,
+  );
+
+  if (!match) { return null; }
+
+  return { did: match[1], imageName: match[2] };
+}
+
+/**
+ * Compute a SHA-256 digest of the given data.
+ *
+ * Returns the digest in OCI format: `sha256:<hex>`.
+ */
+async function sha256Digest(data: Uint8Array | string): Promise<string> {
+  const bytes = typeof data === 'string' ? new TextEncoder().encode(data) : data;
+  const hash = new Uint8Array(
+    await crypto.subtle.digest('SHA-256', bytes),
+  );
+  const hex = Array.from(hash).map((b) => b.toString(16).padStart(2, '0')).join('');
+  return `sha256:${hex}`;
+}
+
+// ---------------------------------------------------------------------------
+// Handlers
+// ---------------------------------------------------------------------------
+
+/** GET /v2/ — API version check. */
+function handleApiVersionCheck(): OciResponse {
+  return {
+    status  : 200,
+    headers : ociHeaders({ 'Content-Type': 'application/json' }),
+    body    : JSON.stringify({}),
+  };
+}
+
+/** GET /v2/{name}/tags/list — list tags for a repository. */
+async function handleTagsList(
+  ctx: AgentContext,
+  did: string,
+  imageName: string,
+): Promise<OciResponse> {
+  const pkg = await resolvePackage(ctx, did, imageName, 'oci');
+  if (!pkg) {
+    return notFound('NAME_UNKNOWN', `repository not found: ${did}/${imageName}`);
+  }
+
+  const versions = await listVersions(ctx, did, pkg.contextId);
+  const tags = versions.map((v) => v.semver);
+
+  return {
+    status  : 200,
+    headers : ociHeaders({ 'Content-Type': 'application/json' }),
+    body    : JSON.stringify({
+      name: `${did}/${imageName}`,
+      tags,
+    }),
+  };
+}
+
+/**
+ * GET /v2/{name}/manifests/{reference} — pull manifest.
+ *
+ * The manifest is stored as the tarball record's data.  The `reference`
+ * can be a tag (semver string) or a digest (`sha256:…`).
+ */
+async function handleGetManifest(
+  ctx: AgentContext,
+  did: string,
+  imageName: string,
+  reference: string,
+  headOnly: boolean,
+): Promise<OciResponse> {
+  const pkg = await resolvePackage(ctx, did, imageName, 'oci');
+  if (!pkg) {
+    return notFound('NAME_UNKNOWN', `repository not found: ${did}/${imageName}`);
+  }
+
+  // Resolve by tag or digest.
+  let manifestBytes: Uint8Array | null = null;
+
+  if (reference.startsWith('sha256:')) {
+    // Digest-based lookup: iterate versions and match by content digest.
+    const versions = await listVersions(ctx, did, pkg.contextId);
+    for (const ver of versions) {
+      const data = await fetchTarball(ctx, did, ver.contextId);
+      if (data) {
+        const digest = await sha256Digest(data);
+        if (digest === reference) {
+          manifestBytes = data;
+          break;
+        }
+      }
+    }
+  } else {
+    // Tag-based lookup.
+    const ver = await resolveVersion(ctx, did, pkg.contextId, reference);
+    if (ver) {
+      manifestBytes = await fetchTarball(ctx, did, ver.contextId);
+    }
+  }
+
+  if (!manifestBytes) {
+    return notFound('MANIFEST_UNKNOWN', `manifest unknown: ${reference}`);
+  }
+
+  const digest = await sha256Digest(manifestBytes);
+
+  // Determine content type from manifest content.
+  let contentType = 'application/vnd.oci.image.manifest.v1+json';
+  try {
+    const parsed = JSON.parse(new TextDecoder().decode(manifestBytes));
+    if (parsed.mediaType) {
+      contentType = parsed.mediaType as string;
+    }
+  } catch {
+    // Not valid JSON — treat as raw manifest.
+  }
+
+  if (headOnly) {
+    return {
+      status  : 200,
+      headers : ociHeaders({
+        'Content-Type'          : contentType,
+        'Content-Length'        : String(manifestBytes.byteLength),
+        'Docker-Content-Digest' : digest,
+      }),
+      body: '',
+    };
+  }
+
+  return {
+    status  : 200,
+    headers : ociHeaders({
+      'Content-Type'          : contentType,
+      'Content-Length'        : String(manifestBytes.byteLength),
+      'Docker-Content-Digest' : digest,
+    }),
+    body: manifestBytes,
+  };
+}
+
+/**
+ * GET /v2/{name}/blobs/{digest} — pull a blob.
+ *
+ * In this shim, blobs are also stored as version tarballs.  The digest
+ * is matched against all version tarballs for the repository.
+ *
+ * For a production implementation, blobs would be stored as separate
+ * DWN records keyed by content digest.
+ */
+async function handleGetBlob(
+  ctx: AgentContext,
+  did: string,
+  imageName: string,
+  digest: string,
+): Promise<OciResponse> {
+  const pkg = await resolvePackage(ctx, did, imageName, 'oci');
+  if (!pkg) {
+    return notFound('NAME_UNKNOWN', `repository not found: ${did}/${imageName}`);
+  }
+
+  // Search all versions for a tarball matching the digest.
+  const versions = await listVersions(ctx, did, pkg.contextId);
+  for (const ver of versions) {
+    const data = await fetchTarball(ctx, did, ver.contextId);
+    if (data) {
+      const d = await sha256Digest(data);
+      if (d === digest) {
+        return {
+          status  : 200,
+          headers : ociHeaders({
+            'Content-Type'          : 'application/octet-stream',
+            'Content-Length'        : String(data.byteLength),
+            'Docker-Content-Digest' : digest,
+          }),
+          body: data,
+        };
+      }
+    }
+  }
+
+  return notFound('BLOB_UNKNOWN', `blob unknown: ${digest}`);
+}
+
+// ---------------------------------------------------------------------------
+// Router
+// ---------------------------------------------------------------------------
+
+/**
+ * Route an OCI registry request to the appropriate handler.
+ *
+ * Exported for testing — tests can call this directly without starting
+ * an HTTP server.
+ */
+export async function handleOciRequest(
+  ctx: AgentContext,
+  url: URL,
+  method: string = 'GET',
+): Promise<OciResponse> {
+  const path = url.pathname;
+
+  // --- /v2/ — API version check ----------------------------------------
+  if (path === '/v2/' || path === '/v2') {
+    return handleApiVersionCheck();
+  }
+
+  // All other endpoints are under /v2/{name}/…
+  const v2Match = path.match(/^\/v2\/(.+)\/(manifests|blobs|tags)\/(.+)$/);
+  if (!v2Match) {
+    // Check for tags/list format: /v2/{name}/tags/list
+    const tagsMatch = path.match(/^\/v2\/(.+)\/tags\/list$/);
+    if (tagsMatch) {
+      const parsed = parseOciName(tagsMatch[1]);
+      if (!parsed) {
+        return notFound('NAME_INVALID', 'Invalid repository name. Expected did:<method>:<id>/<name>');
+      }
+      return handleTagsList(ctx, parsed.did, parsed.imageName);
+    }
+
+    return notFound('NAME_INVALID', 'Invalid v2 API path');
+  }
+
+  const repoName = v2Match[1];
+  const endpoint = v2Match[2];
+  const reference = v2Match[3];
+
+  const parsed = parseOciName(repoName);
+  if (!parsed) {
+    return notFound('NAME_INVALID', 'Invalid repository name. Expected did:<method>:<id>/<name>');
+  }
+
+  switch (endpoint) {
+    case 'manifests':
+      return handleGetManifest(ctx, parsed.did, parsed.imageName, reference, method === 'HEAD');
+
+    case 'blobs':
+      return handleGetBlob(ctx, parsed.did, parsed.imageName, reference);
+
+    case 'tags':
+      if (reference === 'list') {
+        return handleTagsList(ctx, parsed.did, parsed.imageName);
+      }
+      return notFound('NAME_INVALID', `Unknown tags endpoint: ${reference}`);
+
+    default:
+      return notFound('NAME_INVALID', `Unknown endpoint: ${endpoint}`);
+  }
+}

package/src/shims/oci/server.ts

@@ -0,0 +1,94 @@
+/**
+ * OCI Distribution registry shim — HTTP server.
+ *
+ * Starts a local OCI-compatible registry that resolves DID-scoped
+ * container images from DWN records.
+ *
+ * Usage:
+ *   gitd shim oci [--port 5555]
+ *
+ * Then:
+ *   docker pull localhost:5555/did:dht:abc123/my-image:v1.0.0
+ *
+ * @module
+ */
+
+import type { Server } from 'node:http';
+
+import { createServer } from 'node:http';
+
+import type { AgentContext } from '../../cli/agent.js';
+import type { OciResponse } from './registry.js';
+
+import { handleOciRequest } from './registry.js';
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+export type OciShimOptions = {
+  ctx : AgentContext;
+  port : number;
+};
+
+// ---------------------------------------------------------------------------
+// Server
+// ---------------------------------------------------------------------------
+
+/** Start the OCI registry shim server. Returns the server instance. */
+export function startOciShim(options: OciShimOptions): Server {
+  const { ctx, port } = options;
+
+  const server = createServer(async (req, res) => {
+    // CORS preflight.
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204, {
+        'Access-Control-Allow-Origin'  : '*',
+        'Access-Control-Allow-Methods' : 'GET, HEAD, OPTIONS',
+        'Access-Control-Allow-Headers' : 'Authorization, Accept, Docker-Distribution-Api-Version',
+        'Access-Control-Max-Age'       : '86400',
+      });
+      res.end();
+      return;
+    }
+
+    // Only support GET and HEAD — this is a pull-only registry.
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+      res.writeHead(405, {
+        'Content-Type'                    : 'application/json',
+        'Docker-Distribution-Api-Version' : 'registry/2.0',
+      });
+      res.end(JSON.stringify({
+        errors: [{ code: 'UNSUPPORTED', message: 'This is a read-only registry shim.', detail: null }],
+      }));
+      return;
+    }
+
+    try {
+      const url = new URL(req.url ?? '/', `http://localhost:${port}`);
+      const result: OciResponse = await handleOciRequest(ctx, url, req.method);
+
+      res.writeHead(result.status, result.headers);
+      res.end(result.body);
+    } catch (err) {
+      console.error(`[oci-shim] Error: ${(err as Error).message}`);
+      res.writeHead(500, {
+        'Content-Type'                    : 'application/json',
+        'Docker-Distribution-Api-Version' : 'registry/2.0',
+      });
+      res.end(JSON.stringify({
+        errors: [{ code: 'UNKNOWN', message: 'Internal server error', detail: null }],
+      }));
+    }
+  });
+
+  server.listen(port, () => {
+    console.log(`[oci-shim] OCI registry shim running at http://localhost:${port}`);
+    console.log('[oci-shim] Usage:');
+    console.log(`  docker pull localhost:${port}/did:dht:<id>/<image>:<tag>`);
+    console.log(`  podman pull localhost:${port}/did:dht:<id>/<image>:<tag>`);
+    console.log('');
+  });
+
+  return server;
+}

package/src/social.ts

@@ -0,0 +1,116 @@
+/**
+ * Forge Social Protocol — stars, follows, and activity feeds.
+ *
+ * Stars and follows live on the actor's DWN, not the target's. This preserves
+ * data sovereignty: your social graph is yours. Aggregate counts (e.g., "how
+ * many stars does this repo have?") are computed by indexers.
+ *
+ * @module
+ */
+
+import type { ProtocolDefinition } from '@enbox/dwn-sdk-js';
+
+import { defineProtocol } from '@enbox/api';
+
+// ---------------------------------------------------------------------------
+// Data types
+// ---------------------------------------------------------------------------
+
+/** Data shape for a star record (lives on the starrer's DWN). */
+export type StarData = {
+  repoDid : string;
+  repoRecordId : string;
+  repoName? : string;
+};
+
+/** Data shape for a follow record (lives on the follower's DWN). */
+export type FollowData = {
+  targetDid : string;
+  alias? : string;
+};
+
+/** Data shape for an activity feed entry. */
+export type ActivityData = {
+  type : string;
+  repoDid? : string;
+  repoRecordId? : string;
+  recordId? : string;
+  summary? : string;
+};
+
+// ---------------------------------------------------------------------------
+// Schema map
+// ---------------------------------------------------------------------------
+
+/** Maps protocol type names to their TypeScript data shapes. */
+export type ForgeSocialSchemaMap = {
+  star : StarData;
+  follow : FollowData;
+  activity : ActivityData;
+};
+
+// ---------------------------------------------------------------------------
+// Protocol definition
+// ---------------------------------------------------------------------------
+
+export const ForgeSocialDefinition = {
+  protocol  : 'https://enbox.org/protocols/forge/social',
+  published : true,
+  types     : {
+    star: {
+      schema      : 'https://enbox.org/schemas/forge/star',
+      dataFormats : ['application/json'],
+    },
+    follow: {
+      schema      : 'https://enbox.org/schemas/forge/follow',
+      dataFormats : ['application/json'],
+    },
+    activity: {
+      schema      : 'https://enbox.org/schemas/forge/activity',
+      dataFormats : ['application/json'],
+    },
+  },
+  structure: {
+    star: {
+      // Stars live on the STARRER's DWN — owner-only write, public read
+      $actions : [{ who: 'anyone', can: ['read'] }],
+      $tags    : {
+        $requiredTags       : ['repoDid', 'repoRecordId'],
+        $allowUndefinedTags : false,
+        repoDid             : { type: 'string' },
+        repoRecordId        : { type: 'string' },
+      },
+    },
+    follow: {
+      // Follows live on the FOLLOWER's DWN — owner-only write, public read
+      $actions : [{ who: 'anyone', can: ['read'] }],
+      $tags    : {
+        $requiredTags       : ['targetDid'],
+        $allowUndefinedTags : false,
+        targetDid           : { type: 'string' },
+      },
+    },
+    activity: {
+      // Activity feed on the actor's DWN — public read
+      $actions : [{ who: 'anyone', can: ['read'] }],
+      $tags    : {
+        $requiredTags       : ['type'],
+        $allowUndefinedTags : true,
+        type                : {
+          type : 'string',
+          enum : ['push', 'issue_open', 'issue_close', 'patch_open', 'patch_merge', 'release', 'star', 'fork'],
+        },
+      },
+    },
+  },
+} as const satisfies ProtocolDefinition;
+
+// ---------------------------------------------------------------------------
+// Typed protocol export
+// ---------------------------------------------------------------------------
+
+/** Typed Forge Social protocol for use with `dwn.using()`. */
+export const ForgeSocialProtocol = defineProtocol(
+  ForgeSocialDefinition,
+  {} as ForgeSocialSchemaMap,
+);

package/src/web/html.ts

@@ -0,0 +1,120 @@
+/**
+ * HTML template helpers for the read-only web UI.
+ *
+ * Server-rendered HTML with minimal inline CSS — no frontend framework,
+ * no build step, no client-side JavaScript.
+ *
+ * @module
+ */
+
+// ---------------------------------------------------------------------------
+// Layout
+// ---------------------------------------------------------------------------
+
+/**
+ * Wrap page content in a full HTML document with navigation.
+ *
+ * @param basePath - URL prefix for all nav links, e.g. `/did:dht:abc123`
+ */
+export function layout(title: string, repoName: string, body: string, basePath: string = ''): string {
+  const base = basePath || '';
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${esc(title)} — ${esc(repoName)} — gitd</title>
+  <style>
+    *, *::before, *::after { box-sizing: border-box; }
+    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      line-height: 1.6; color: #24292f; margin: 0; padding: 0; background: #f6f8fa; }
+    a { color: #0969da; text-decoration: none; }
+    a:hover { text-decoration: underline; }
+    .container { max-width: 960px; margin: 0 auto; padding: 0 16px; }
+    header { background: #24292f; color: #fff; padding: 12px 0; }
+    header a { color: #fff; font-weight: 600; }
+    header .repo-name { font-size: 1.2em; }
+    nav { background: #fff; border-bottom: 1px solid #d0d7de; padding: 8px 0; }
+    nav a { margin-right: 16px; padding: 4px 8px; border-radius: 6px; color: #24292f; }
+    nav a:hover { background: #f3f4f6; text-decoration: none; }
+    nav a.active { font-weight: 600; border-bottom: 2px solid #fd8c73; }
+    main { padding: 24px 0; }
+    .card { background: #fff; border: 1px solid #d0d7de; border-radius: 6px; padding: 16px; margin-bottom: 16px; }
+    .card h2 { margin-top: 0; }
+    .badge { display: inline-block; padding: 2px 8px; border-radius: 12px; font-size: 0.85em; font-weight: 600; }
+    .badge-open { background: #dafbe1; color: #116329; }
+    .badge-closed { background: #ffd8d3; color: #82071e; }
+    .badge-merged { background: #ddf4ff; color: #0550ae; }
+    .badge-draft { background: #f6f8fa; color: #57606a; }
+    .meta { color: #57606a; font-size: 0.9em; }
+    .comment { border-left: 3px solid #d0d7de; padding-left: 12px; margin: 12px 0; }
+    .empty { color: #57606a; font-style: italic; }
+    table { width: 100%; border-collapse: collapse; }
+    td, th { padding: 8px 12px; text-align: left; border-bottom: 1px solid #d0d7de; }
+    th { font-weight: 600; background: #f6f8fa; }
+    pre { background: #f6f8fa; padding: 16px; border-radius: 6px; overflow-x: auto; white-space: pre-wrap; }
+    .wiki-body { line-height: 1.8; }
+    .did-input { width: 100%; padding: 10px 14px; font-size: 1em; border: 1px solid #d0d7de;
+      border-radius: 6px; font-family: monospace; }
+  </style>
+</head>
+<body>
+  <header>
+    <div class="container">
+      <a href="${base || '/'}" class="repo-name">${esc(repoName)}</a>
+      <span style="color:#8b949e;margin-left:8px">gitd</span>
+    </div>
+  </header>
+  <nav>
+    <div class="container">
+      <a href="${base}/">Overview</a>
+      <a href="${base}/issues">Issues</a>
+      <a href="${base}/patches">Patches</a>
+      <a href="${base}/releases">Releases</a>
+      <a href="${base}/wiki">Wiki</a>
+    </div>
+  </nav>
+  <main>
+    <div class="container">
+      ${body}
+    </div>
+  </main>
+</body>
+</html>`;
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Escape HTML special characters. */
+export function esc(text: string): string {
+  return text
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+}
+
+/** Format a status string as a colored badge. */
+export function statusBadge(status: string): string {
+  const lower = status.toLowerCase();
+  let cls = 'badge';
+  if (lower === 'open') { cls += ' badge-open'; }
+  else if (lower === 'closed') { cls += ' badge-closed'; }
+  else if (lower === 'merged') { cls += ' badge-merged'; }
+  else if (lower === 'draft') { cls += ' badge-draft'; }
+  return `<span class="${cls}">${esc(status.toUpperCase())}</span>`;
+}
+
+/** Format an ISO date string to a short date. */
+export function shortDate(iso: string | undefined): string {
+  return iso?.slice(0, 10) ?? '';
+}
+
+/** Simple markdown-like rendering: newlines to <br>, backticks to <code>. */
+export function renderBody(text: string): string {
+  return esc(text)
+    .replace(/`([^`]+)`/g, '<code>$1</code>')
+    .replace(/\n/g, '<br>');
+}

package/src/web/index.ts

@@ -0,0 +1,8 @@
+/**
+ * Web UI module — read-only web interface for gitd repositories.
+ *
+ * @module
+ */
+
+export { handleRequest, startWebServer } from './server.js';
+export type { WebServerOptions } from './server.js';