@fungi.computer/oyster 0.0.0-stage → 0.0.1

package/dist/git-admission.js

@@ -0,0 +1,188 @@
+/** One admitted path for external and installation-authored repository writes. */
+import { appGitPushFactSchema, gitPushQuestionSchema, gitPushVerdictSchema, gitWriterSchema, } from "@fungi.computer/agar/git";
+import { gitRepositoryNameSchema } from "@fungi.computer/puffball/git-representation";
+import { acceptedRefs, parseReceivePack, refusalReport, } from "@fungi.computer/agar/git-wire";
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+/** Reuse the live installation/verified Release rule without opening provider storage. */
+export function createInstallationGitAdmission(ports) {
+    return async (writer) => {
+        const current = await ports.currentInstallation();
+        if (current === null)
+            return false;
+        const declaration = await ports.declaration(current);
+        return (declaration?.capabilities.includes("git.repository") === true &&
+            (writer !== null || current.visibility === "public"));
+    };
+}
+const ids = defineIdFamily({
+    family: "oyster-git-push",
+    version: 1,
+    kinds: { event: { prefix: "gitpush" } },
+});
+const ZERO = "0".repeat(40);
+const MAX_BYTES = 64 * 1024 * 1024;
+/** Fixed order: host grant, Workflow ceiling, App policy, provider exchange, durable journal. */
+export function createAdmittedGit(ports) {
+    const { store, grants, policy, journal } = ports;
+    async function admit(writer, repository, scope) {
+        gitRepositoryNameSchema.parse(repository);
+        if (writer !== null)
+            gitWriterSchema.parse(writer);
+        if (writer?.kind === "installation" &&
+            writer.installationId !== ports.installationId)
+            throw new Error("Git installation authority mismatch");
+        if (!(await grants.admits(writer, repository, scope)))
+            throw new Error("Git host grant refused");
+        ports.beforeProvider?.();
+    }
+    const refusal = (updates, capabilities, verdict) => ({
+        status: 200,
+        headers: {
+            "content-type": "application/x-git-receive-pack-result",
+            "cache-control": "no-store",
+        },
+        body: refusalReport(verdict, updates, capabilities),
+    });
+    async function exchange(writer, repository, request) {
+        if (request.service !== "receive-pack") {
+            await admit(writer, repository, "read");
+            return store.exchange(repository, request);
+        }
+        if (request.phase === "advertise") {
+            await admit(writer, repository, "write");
+            return store.exchange(repository, request);
+        }
+        if (request.body === null || request.body.byteLength > MAX_BYTES)
+            throw new Error("Invalid or oversized Git push");
+        const parsed = parseReceivePack(request.body);
+        if (parsed.kind === "invalid")
+            return {
+                status: 400,
+                headers: {},
+                body: new TextEncoder().encode(`Invalid Git push: ${parsed.reason}`),
+            };
+        if (parsed.kind === "probe") {
+            // Git's pre-flight for a chunked push asks only whether a write would
+            // be admitted; the pack follows in the next request.
+            await admit(writer, repository, "write");
+            return {
+                status: 200,
+                headers: {
+                    "content-type": "application/x-git-receive-pack-result",
+                    "cache-control": "no-store",
+                },
+                body: new Uint8Array(),
+            };
+        }
+        const { updates, capabilities } = parsed;
+        await admit(writer, repository, "write");
+        if (writer.kind === "actor") {
+            const outside = writer.workflow === undefined
+                ? []
+                : updates.filter(({ ref }) => !writer.workflow?.branches.includes(ref));
+            if (outside.length > 0)
+                return refusal(updates, capabilities, {
+                    allowed: false,
+                    refused: outside.map(({ ref }) => ({
+                        ref,
+                        message: "outside the Workflow branch grant",
+                    })),
+                });
+            const question = gitPushQuestionSchema.parse({
+                repository,
+                writer,
+                updates,
+            });
+            const verdict = gitPushVerdictSchema.parse(await policy.authorize(question));
+            if (!verdict.allowed)
+                return refusal(updates, capabilities, verdict);
+        }
+        const unexplained = [];
+        for (const { ref, before } of updates) {
+            const tip = await journal.tip(repository, ref);
+            if ((before === ZERO ? null : before) !== tip)
+                unexplained.push({ ref, journaled: tip });
+        }
+        // Reopen the grant after asynchronous App/journal work, immediately before I/O.
+        await admit(writer, repository, "write");
+        const response = await store.exchange(repository, request);
+        if (response.status < 200 || response.status >= 300)
+            return response;
+        const accepted = acceptedRefs(response.body, capabilities.includes("side-band") ||
+            capabilities.includes("side-band-64k"));
+        const moved = updates.filter(({ ref }) => accepted.has(ref));
+        if (moved.length > 0) {
+            const fact = appGitPushFactSchema.parse({
+                repository,
+                writer,
+                updates: moved,
+                eventId: ids.event.generate(),
+            });
+            const unknownMoves = unexplained.filter(({ ref }) => accepted.has(ref));
+            if (unknownMoves.length > 0)
+                fact.unexplained = unknownMoves;
+            await journal.record(fact);
+        }
+        return response;
+    }
+    return {
+        push: exchange,
+        async read(writer, repository, request) {
+            if (request.service !== "upload-pack")
+                throw new Error("Git read cannot push");
+            await admit(writer, repository, "read");
+            return store.exchange(repository, request);
+        },
+        binding(onBehalfOf) {
+            const writer = {
+                kind: "installation",
+                installationId: ports.installationId,
+                onBehalfOf,
+            };
+            return {
+                async create(name, options) {
+                    await admit(writer, name, "write");
+                    return store.create(name, options);
+                },
+                async fork(source, target, options) {
+                    await admit(writer, source, "read");
+                    await admit(writer, target, "write");
+                    return store.fork(source, target, options);
+                },
+                async cloneUrl(name) {
+                    await admit(writer, name, "read");
+                    return store.cloneUrl(name);
+                },
+                async info(name) {
+                    await admit(writer, name, "read");
+                    return store.info(name);
+                },
+                async delete(name) {
+                    await admit(writer, name, "write");
+                    return store.delete(name);
+                },
+                async log(name, options) {
+                    await admit(writer, name, "read");
+                    return store.log(name, options);
+                },
+                async readCommit(name, hash) {
+                    await admit(writer, name, "read");
+                    return store.readCommit(name, hash);
+                },
+                async readTree(name, hash) {
+                    await admit(writer, name, "read");
+                    return store.readTree(name, hash);
+                },
+                async readBlob(name, hash) {
+                    await admit(writer, name, "read");
+                    return store.readBlob(name, hash);
+                },
+                async refs(name) {
+                    await admit(writer, name, "read");
+                    return store.refs(name);
+                },
+                exchange: (name, request) => exchange(writer, name, request),
+            };
+        },
+    };
+}

package/dist/git-auth.d.ts

@@ -0,0 +1,11 @@
+/** Credential parsing never logs the presented header or its decoding error. */
+/** A Workflow Git pass presented as `Authorization: Bearer` starts with this. */
+export declare const workflowGitPassPrefix = "wgp.";
+/** A build job's clone pass starts with this; only the host's egress presents it. */
+export declare const buildGitPassPrefix = "obp.";
+export declare function presentedGitKey(request: Request): Readonly<{
+    kind: "key";
+    value: string;
+}> | Readonly<{
+    kind: "absent" | "invalid";
+}>;

package/dist/git-auth.js

@@ -0,0 +1,27 @@
+/** Credential parsing never logs the presented header or its decoding error. */
+/** A Workflow Git pass presented as `Authorization: Bearer` starts with this. */
+export const workflowGitPassPrefix = "wgp.";
+/** A build job's clone pass starts with this; only the host's egress presents it. */
+export const buildGitPassPrefix = "obp.";
+export function presentedGitKey(request) {
+    const header = request.headers.get("Authorization");
+    if (header === null)
+        return { kind: "absent" };
+    if (header.startsWith("Bearer ")) {
+        const value = header.slice(7).trim();
+        return value ? { kind: "key", value } : { kind: "invalid" };
+    }
+    if (!header.startsWith("Basic "))
+        return { kind: "invalid" };
+    try {
+        const decoded = atob(header.slice(6).trim());
+        const colon = decoded.indexOf(":");
+        const value = colon === -1 ? "" : decoded.slice(colon + 1);
+        return value ? { kind: "key", value } : { kind: "invalid" };
+    }
+    catch (error) {
+        if (error instanceof DOMException && error.name === "InvalidCharacterError")
+            return { kind: "invalid" };
+        throw error;
+    }
+}

package/dist/git-door.d.ts

@@ -0,0 +1,35 @@
+/** Smart-HTTP routing; all writes enter the same admitted Git path. */
+import { Hono } from "hono";
+import type { GitWriter } from "@fungi.computer/agar/git";
+import type { AdmittedGit } from "./git-admission.js";
+/** The repository and access one smart-HTTP request names. */
+export type GitDoorTarget = Readonly<{
+    installationId: string;
+    repository: string;
+    scope: "read" | "write";
+}>;
+/** Identity and selected installation come only from host-held ports. */
+export type GitDoorHost = Readonly<{
+    /** Resolve a host-authenticated actor for this exact repository and scope;
+     * null means an anonymous request. */
+    authenticate(request: Request, target: GitDoorTarget): Promise<Extract<GitWriter, {
+        kind: "actor";
+    }> | null>;
+    /** Decide whether anonymous reads may reach the selected installation. */
+    isPublic(installationId: string): Promise<boolean>;
+    /** Resolve the installation's admitted path without exposing provider credentials. */
+    git(installationId: string): Promise<AdmittedGit | null>;
+}>;
+/** One smart-HTTP exchange: the method, `service` query and path suffix a
+ * Git client sends, whatever path names the repository. Null otherwise. */
+export declare function smartHttpExchange(method: string, url: URL, suffix: string): Readonly<{
+    scope: "read" | "write";
+    advertise: boolean;
+}> | null;
+/** Oyster's own Git address: the repository, scope and phase one request
+ * names, or null when it is not an exact Oyster Git exchange. */
+export declare function gitDoorRoute(method: string, url: URL): (GitDoorTarget & Readonly<{
+    advertise: boolean;
+}>) | null;
+/** Mount one smart-HTTP door with no provider credentials or alternate write branch. */
+export declare function createGitDoor(host: GitDoorHost): Hono;

package/dist/git-door.js

@@ -0,0 +1,108 @@
+/** Smart-HTTP routing; all writes enter the same admitted Git path. */
+import { Hono } from "hono";
+import { z } from "zod";
+const route = /^\/git\/([a-zA-Z0-9_-]{1,256})\/([a-zA-Z0-9._-]{1,128}?)(?:\.git)?\/(info\/refs|git-upload-pack|git-receive-pack)$/u;
+/** One smart-HTTP exchange: the method, `service` query and path suffix a
+ * Git client sends, whatever path names the repository. Null otherwise. */
+export function smartHttpExchange(method, url, suffix) {
+    const advertise = suffix === "info/refs";
+    const service = advertise ? url.searchParams.get("service") : suffix;
+    if ((service !== "git-upload-pack" && service !== "git-receive-pack") ||
+        method !== (advertise ? "GET" : "POST") ||
+        (advertise ? url.search !== `?service=${service}` : url.search !== ""))
+        return null;
+    return {
+        scope: service === "git-receive-pack" ? "write" : "read",
+        advertise,
+    };
+}
+/** Oyster's own Git address: the repository, scope and phase one request
+ * names, or null when it is not an exact Oyster Git exchange. */
+export function gitDoorRoute(method, url) {
+    const match = route.exec(url.pathname);
+    if (match === null)
+        return null;
+    const [, installationId = "", repository = "", suffix = ""] = match;
+    const exchange = smartHttpExchange(method, url, suffix);
+    return exchange === null ? null : { installationId, repository, ...exchange };
+}
+const MAX_BYTES = 64 * 1024 * 1024;
+const byteChunk = z.instanceof(Uint8Array);
+async function bodyOf(request) {
+    if (request.body === null)
+        return new Uint8Array();
+    const reader = request.body.getReader();
+    const parts = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            const chunk = byteChunk.parse(next.value);
+            size += chunk.byteLength;
+            if (size > MAX_BYTES) {
+                await reader.cancel();
+                return new Response("Git request too large", { status: 413 });
+            }
+            parts.push(chunk);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const body = new Uint8Array(size);
+    let offset = 0;
+    for (const part of parts) {
+        body.set(part, offset);
+        offset += part.byteLength;
+    }
+    return body;
+}
+/** Mount one smart-HTTP door with no provider credentials or alternate write branch. */
+export function createGitDoor(host) {
+    const door = new Hono();
+    const smartHttp = async (context) => {
+        const routed = gitDoorRoute(context.req.method, new URL(context.req.url));
+        if (routed === null)
+            return context.text("Not a git route", 404);
+        const { advertise, ...target } = routed;
+        const { installationId, repository } = target;
+        const writing = target.scope === "write";
+        const writer = await host.authenticate(context.req.raw, target);
+        if (writer === null && (writing || !(await host.isPublic(installationId))))
+            return new Response("A key is required", {
+                status: 401,
+                headers: { "WWW-Authenticate": 'Basic realm="Oyster git"' },
+            });
+        const git = await host.git(installationId);
+        if (git === null)
+            return context.text("Installation Git unavailable", 403);
+        if (context.req.header("content-encoding") !== undefined)
+            return context.text("Compressed Git requests are not supported", 400);
+        const body = advertise ? null : await bodyOf(context.req.raw);
+        if (body instanceof Response)
+            return body;
+        const headers = {};
+        for (const name of ["content-type", "accept", "git-protocol"]) {
+            const value = context.req.header(name);
+            if (value !== undefined)
+                headers[name] = value;
+        }
+        const request = {
+            service: writing ? "receive-pack" : "upload-pack",
+            phase: advertise ? "advertise" : "exchange",
+            headers,
+            body,
+        };
+        const response = writing && writer !== null
+            ? await git.push(writer, repository, request)
+            : await git.read(writer, repository, request);
+        return new Response(new Uint8Array(response.body), {
+            status: response.status,
+            headers: response.headers,
+        });
+    };
+    door.all("/git/*", smartHttp);
+    return door;
+}

package/dist/git-journal.d.ts

@@ -0,0 +1,31 @@
+import { type AppGitPushFact } from "@fungi.computer/agar/git";
+import { type BackgroundWake } from "@fungi.computer/puffball/background-replay";
+import { type PostDeliveryResult } from "@fungi.computer/carrier/post";
+import { type WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+/** The standalone composition supplies selected-Instance admission and its alarm. */
+export type GitPushJournalPorts = Readonly<{
+    owner: WatchdogSqliteOwner;
+    /** Deliver a retained fact through the selected installation's lifecycle admission. */
+    deliver(installationId: string, fact: AppGitPushFact): Promise<void>;
+    /** Re-admit a retained member through the host gate before an ordinary continuation call. */
+    deliverSync(wake: BackgroundWake): Promise<PostDeliveryResult>;
+    /** Arm no later than an already scheduled alarm. */
+    scheduleWake(at: number): Promise<void>;
+    /** Host clock for delivery scheduling; defaults to Date.now. */
+    now?: () => number;
+}>;
+/** The immutable Carrier key also fits the SDK's bounded call idempotency key. */
+export declare function backgroundWakeKey(wake: Pick<BackgroundWake, "installationId" | "lane" | "epoch">): string;
+/** Carrier owns delivery state; this journal owns accepted fact identity. */
+export declare function createGitPushJournal(ports: GitPushJournalPorts): Promise<{
+    /** Coalesce a pending member lane; terminal receipts receive a new immutable epoch. */
+    armSync(intent: Omit<BackgroundWake, "epoch">): Promise<number>;
+    /** Last journaled ref head; null includes a journaled deletion. */
+    tip(installation: string, repository: string, ref: string): string | null;
+    /** Record a host-accepted push; provider acceptance precedes this local transaction. */
+    accept(installation: string, raw: AppGitPushFact): Promise<"duplicate" | "recorded">;
+    /** One bounded alarm turn; Carrier retains unfinished work and retry backoff. */
+    alarm(): Promise<void>;
+    /** The next retained delivery deadline, or null when no wake is needed. */
+    nextWake: () => number | null;
+}>;

package/dist/git-journal.js

@@ -0,0 +1,188 @@
+import { createHash } from "node:crypto";
+import * as Schema from "effect/Schema";
+import { z } from "zod";
+import { appGitPushFactSchema, } from "@fungi.computer/agar/git";
+import { backgroundWakeSchema, } from "@fungi.computer/puffball/background-replay";
+import { createPost, definePostRoute, } from "@fungi.computer/carrier/post";
+import { Watchdog, } from "@fungi.computer/watchdog";
+const storedFact = z.strictObject({ fact: z.string() });
+const storedEpoch = z.strictObject({
+    epoch: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+});
+const syncKey = (installationId, lane, epoch) => `appsync:${createHash("sha256")
+    .update(JSON.stringify([installationId, lane, epoch]))
+    .digest("hex")}`;
+/** The immutable Carrier key also fits the SDK's bounded call idempotency key. */
+export function backgroundWakeKey(wake) {
+    return syncKey(wake.installationId, wake.lane, wake.epoch);
+}
+const installationIdSchema = z.string().min(1).max(256);
+const postKey = (installationId, eventId) => `gitpush:${createHash("sha256")
+    .update(JSON.stringify([installationId, eventId]))
+    .digest("hex")}`;
+/** Carrier owns delivery state; this journal owns accepted fact identity. */
+export async function createGitPushJournal(ports) {
+    const { owner } = ports;
+    const now = ports.now ?? Date.now;
+    owner.sql.exec("CREATE TABLE IF NOT EXISTS oyster_git_push_facts (installation_id TEXT NOT NULL, event_id TEXT NOT NULL, fact TEXT NOT NULL, PRIMARY KEY (installation_id,event_id)) STRICT");
+    owner.sql.exec("CREATE TABLE IF NOT EXISTS oyster_git_tips (installation_id TEXT NOT NULL, repository TEXT NOT NULL, ref TEXT NOT NULL, hash TEXT NOT NULL, PRIMARY KEY(installation_id,repository,ref)) STRICT");
+    owner.sql.exec("CREATE TABLE IF NOT EXISTS oyster_app_sync_epochs (installation_id TEXT NOT NULL, lane TEXT NOT NULL, epoch INTEGER NOT NULL, PRIMARY KEY(installation_id,lane)) STRICT");
+    const deliveringSync = new Set();
+    const routes = {
+        appSync: definePostRoute({
+            addressKind: "appSync",
+            address: Schema.String,
+            event: Schema.String,
+            name: (address) => address,
+            namespace: {
+                getByName: () => ({
+                    deliver: (envelope) => {
+                        const encoded = Schema.decodeUnknownSync(Schema.String)(envelope.event);
+                        const wake = backgroundWakeSchema.parse(JSON.parse(encoded));
+                        const key = syncKey(wake.installationId, wake.lane, wake.epoch);
+                        deliveringSync.add(key);
+                        return ports.deliverSync(wake);
+                    },
+                }),
+            },
+        }),
+        installation: definePostRoute({
+            addressKind: "installation",
+            address: Schema.String,
+            // The canonical Agar decoder owns the fact grammar, including stored JSON.
+            event: Schema.String,
+            name: (address) => address,
+            namespace: {
+                getByName: (installationId) => ({
+                    deliver: async (envelope) => {
+                        const raw = Schema.decodeUnknownSync(Schema.String)(envelope.event);
+                        const fact = appGitPushFactSchema.parse(JSON.parse(raw));
+                        await ports.deliver(installationId, fact);
+                        return { status: "accepted", receipt: { eventId: fact.eventId } };
+                    },
+                }),
+            },
+        }),
+    };
+    const scheduleNext = async () => {
+        const at = post.nextWake();
+        if (at !== null)
+            await ports.scheduleWake(at);
+    };
+    const watchdog = await Watchdog.make({
+        owner,
+        isAlive: () => Promise.resolve(false),
+        execute: (job) => post.execute(job),
+        wake: { recompute: scheduleNext },
+    });
+    const post = createPost({
+        owner,
+        routes,
+        transactional: watchdog.transactional,
+        readJob: watchdog.read,
+        now,
+        scheduleWake: ports.scheduleWake,
+    });
+    let settling;
+    const drain = async () => {
+        let cursor;
+        do {
+            cursor = await post.enqueueDue(64, cursor);
+        } while (cursor !== undefined);
+        try {
+            for (let count = 0; count < 64; count += 1) {
+                if ((await watchdog.tick()).status !== "settled" ||
+                    deliveringSync.size > 0)
+                    break;
+            }
+        }
+        finally {
+            // Keep delivery marked until Carrier's receipt transaction has finished.
+            deliveringSync.clear();
+        }
+        await scheduleNext();
+    };
+    await scheduleNext();
+    return {
+        /** Coalesce a pending member lane; terminal receipts receive a new immutable epoch. */
+        async armSync(intent) {
+            const identity = backgroundWakeSchema.parse({ ...intent, epoch: 1 });
+            const wake = owner.transactionSync(() => {
+                const row = owner.sql
+                    .exec("SELECT epoch FROM oyster_app_sync_epochs WHERE installation_id=? AND lane=?", identity.installationId, identity.lane)
+                    .toArray()[0];
+                const previous = row === undefined ? 0 : storedEpoch.parse(row).epoch;
+                if (previous > 0 &&
+                    !deliveringSync.has(syncKey(identity.installationId, identity.lane, previous)) &&
+                    post.read(syncKey(identity.installationId, identity.lane, previous))
+                        ?.state === "pending")
+                    return previous;
+                const epoch = previous + 1;
+                const next = backgroundWakeSchema.parse({ ...identity, epoch });
+                owner.sql.exec("INSERT INTO oyster_app_sync_epochs VALUES(?,?,?) ON CONFLICT(installation_id,lane) DO UPDATE SET epoch=excluded.epoch", next.installationId, next.lane, next.epoch);
+                post.send({
+                    key: syncKey(next.installationId, next.lane, next.epoch),
+                    kind: "appSync",
+                    address: createHash("sha256")
+                        .update(JSON.stringify([next.installationId, next.lane]))
+                        .digest("hex"),
+                    event: JSON.stringify(next),
+                });
+                return epoch;
+            });
+            await scheduleNext();
+            return wake;
+        },
+        /** Last journaled ref head; null includes a journaled deletion. */
+        tip(installation, repository, ref) {
+            const row = owner.sql
+                .exec("SELECT hash FROM oyster_git_tips WHERE installation_id=? AND repository=? AND ref=?", installationIdSchema.parse(installation), repository, ref)
+                .toArray()[0];
+            return row === undefined
+                ? null
+                : z
+                    .strictObject({ hash: z.string().regex(/^[0-9a-f]{40}$/u) })
+                    .parse(row).hash;
+        },
+        /** Record a host-accepted push; provider acceptance precedes this local transaction. */
+        async accept(installation, raw) {
+            const installationId = installationIdSchema.parse(installation);
+            const fact = appGitPushFactSchema.parse(raw);
+            const encoded = JSON.stringify(fact);
+            const result = owner.transactionSync(() => {
+                const previous = owner.sql
+                    .exec("SELECT fact FROM oyster_git_push_facts WHERE installation_id=? AND event_id=?", installationId, fact.eventId)
+                    .toArray()[0];
+                if (previous !== undefined) {
+                    if (storedFact.parse(previous).fact !== encoded)
+                        throw new Error("Git push event conflicts with its accepted fact");
+                    return "duplicate";
+                }
+                owner.sql.exec("INSERT INTO oyster_git_push_facts VALUES (?,?,?)", installationId, fact.eventId, encoded);
+                for (const update of fact.updates) {
+                    if (update.after === "0".repeat(40))
+                        owner.sql.exec("DELETE FROM oyster_git_tips WHERE installation_id=? AND repository=? AND ref=?", installationId, fact.repository, update.ref);
+                    else
+                        owner.sql.exec("INSERT INTO oyster_git_tips VALUES(?,?,?,?) ON CONFLICT(installation_id,repository,ref) DO UPDATE SET hash=excluded.hash", installationId, fact.repository, update.ref, update.after);
+                }
+                post.send({
+                    key: postKey(installationId, fact.eventId),
+                    kind: "installation",
+                    address: installationId,
+                    event: encoded,
+                });
+                return "recorded";
+            });
+            await scheduleNext();
+            return result;
+        },
+        /** One bounded alarm turn; Carrier retains unfinished work and retry backoff. */
+        alarm() {
+            return (settling ??= drain().finally(() => {
+                settling = undefined;
+            }));
+        },
+        /** The next retained delivery deadline, or null when no wake is needed. */
+        nextWake: () => post.nextWake(),
+    };
+}

package/dist/git.d.ts

@@ -0,0 +1,31 @@
+import type { GitBinding } from "@fungi.computer/agar/git";
+import * as Schema from "effect/Schema";
+/** The EVENTS binding: an App emits typed events the host routes. */
+export type EventSink = Readonly<{
+    /**
+     * Emit one event. `payload` is the Standard Webhooks body
+     * (type, timestamp, data); `eventId` is stable so redelivery is a no-op.
+     */
+    emit(type: string, payload: StandardWebhookPayload, eventId: string): Promise<void>;
+}>;
+/** The Standard Webhooks payload shape. */
+export type StandardWebhookPayload = Readonly<{
+    type: string;
+    timestamp: string;
+    data: Schema.Json;
+}>;
+/** The protocol-v2 ls-refs request body. */
+export declare function lsRefsRequest(): Uint8Array;
+/** Parse an ls-refs response into refs. */
+export declare function parseLsRefs(response: Uint8Array): Awaited<ReturnType<GitBinding["refs"]>>;
+/** The Standard Webhooks `webhook-signature` value for one delivery. */
+export declare function signStandardWebhook(secret: string, id: string, timestamp: number, body: string): Promise<string>;
+/** Headers for one signed delivery: Standard Webhooks plus `X-Hub-Signature-256`. */
+export declare function webhookHeaders(secret: string, id: string, type: string, timestamp: number, body: string): Promise<Record<string, string>>;
+export { createGitDoor, gitDoorRoute, smartHttpExchange } from "./git-door.js";
+export type { GitDoorHost, GitDoorTarget } from "./git-door.js";
+export { workflowGitPassPrefix } from "./git-auth.js";
+export { createAdmittedGit, createInstallationGitAdmission, } from "./git-admission.js";
+export type { AdmittedGit, GitStore, GitGrants, GitPolicy, GitJournal, } from "./git-admission.js";
+export { createGitPushJournal } from "./git-journal.js";
+export type { GitPushJournalPorts } from "./git-journal.js";