@generacy-ai/control-plane 0.4.0 → 0.6.0

package/README.md

@@ -20,9 +20,14 @@ Socket is created with mode `0660` (owner + group read/write).
 | GET | `/roles/:id` | Returns stub role config |
 | PUT | `/roles/:id` | Accepts role update, returns `{ ok: true }` |
 | POST | `/lifecycle/:action` | Triggers lifecycle action (`clone-peer-repos`, `code-server-start`, `code-server-stop`) |
+| POST | `/git-token` | Returns a fresh GitHub installation token + `expiresAt` for git ops (#766) |
 
 All routes are stubs in this phase. Real wiring to credhelper daemon and orchestrator lands in later phases.
 
+## `git-credential-generacy` bin
+
+Companion CLI bin shipped from this package. Speaks the git credential-helper line protocol — on `get` it connects to the control socket, POSTs `/git-token`, and prints `username=x-access-token\npassword=<token>\n` to stdout. `store` and `erase` are no-ops. Failures surface as `generacy-git-helper: <CODE>: <message>` on stderr with distinct exit codes per failure mode (2–9). See [`specs/766-summary-implement-git/quickstart.md`](../../specs/766-summary-implement-git/quickstart.md) for the protocol details and integration steps.
+
 ## Actor Headers
 
 The relay dispatcher injects identity headers on every forwarded request:

package/dist/bin/control-plane.js

@@ -10,6 +10,11 @@ import { AppConfigEnvStore } from '../src/services/app-config-env-store.js';
 import { AppConfigFileStore } from '../src/services/app-config-file-store.js';
 import { AppConfigSecretEnvStore } from '../src/services/app-config-secret-env-store.js';
 import { setAppConfigStores, readManifest } from '../src/routes/app-config.js';
+import YAML from 'yaml';
+import { createClusterApiKeyReader } from '../src/services/cluster-api-key.js';
+import { createCloudPullClient } from '../src/services/cloud-pull-client.js';
+import { createGitTokenManager } from '../src/services/git-token-manager.js';
+import { setGitTokenManager } from '../src/routes/git-token.js';
 const DEFAULT_SOCKET_PATH = '/run/generacy-control-plane/control.sock';
 const socketPath = process.env['CONTROL_PLANE_SOCKET_PATH'] ?? DEFAULT_SOCKET_PATH;
 const deploymentMode = (process.env['DEPLOYMENT_MODE'] ?? 'local');
@@ -77,11 +82,44 @@ async function writeInitResult(initResult) {
         console.error('[control-plane] Failed to write init-result.json:', err instanceof Error ? err.message : String(err));
     }
 }
+async function resolveDefaultGithubAppCredentialId(agencyDir) {
+    const yamlPath = path.join(agencyDir, 'credentials.yaml');
+    try {
+        const raw = await fs.readFile(yamlPath, 'utf8');
+        const parsed = YAML.parse(raw);
+        if (parsed?.credentials && typeof parsed.credentials === 'object') {
+            for (const [id, entry] of Object.entries(parsed.credentials)) {
+                if (entry && typeof entry === 'object' && entry.type === 'github-app') {
+                    return id;
+                }
+            }
+        }
+    }
+    catch {
+        // Fall through to literal default below.
+    }
+    return 'github-app';
+}
 credentialBackend
     .init()
     .then(async () => {
     setCredentialBackend(credentialBackend);
     console.log('[control-plane] Credential backend initialized');
+    // Wire JIT git credential helper services (#766). Cluster API key reader
+    // reads /var/lib/generacy/cluster-api-key (mtime-cached); cloud pull client
+    // talks to generacy-cloud#817; git-token manager fronts both with an
+    // in-memory token cache + concurrent-call dedup.
+    const agencyDir = process.env['CREDHELPER_AGENCY_DIR'] ?? '.agency';
+    const defaultGithubAppCredentialId = await resolveDefaultGithubAppCredentialId(agencyDir);
+    const clusterApiKeyReader = createClusterApiKeyReader();
+    const cloudPullClient = createCloudPullClient({ apiKeyReader: clusterApiKeyReader });
+    const gitTokenManager = createGitTokenManager({ cloudPullClient });
+    setGitTokenManager(gitTokenManager, defaultGithubAppCredentialId);
+    console.log(JSON.stringify({
+        event: 'git-token-init',
+        defaultCredentialId: defaultGithubAppCredentialId,
+        apiUrlConfigured: Boolean(process.env['GENERACY_API_URL']),
+    }));
     // Initialize app-config stores individually with structured error handling
     const initResult = { stores: {}, warnings: [] };
     try {

package/dist/bin/control-plane.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../../bin/control-plane.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAG/E,MAAM,mBAAmB,GAAG,0CAA0C,CAAC;AAEvE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,mBAAmB,CAAC;AAEnF,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAmB,CAAC;AACrF,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,cAAc,CAAmB,CAAC;AACrF,gBAAgB,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,IAAI,mBAAmB,EAAE,CAAC;AAEpD,MAAM,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;AAExC,SAAS,QAAQ;IACf,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACvB,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/B,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;IACtC,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;IAC1C,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,uBAAuB,CAAC;AACnF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAEpE,IAAI,cAAc,EAAE,CAAC;IACnB,iBAAiB,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAChC,KAAK,CAAC,GAAG,eAAe,wBAAwB,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,cAAc,EAAE;aAC5C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;SAC3E,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACjH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AACvD,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;AAChH,CAAC;AAED,+BAA+B;AAC/B,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAClD,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;AAErE,MAAM,gBAAgB,GAAG,8CAA8C,CAAC;AAExE,KAAK,UAAU,eAAe,CAAC,UAAsB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,gBAAgB,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QACpG,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvH,CAAC;AACH,CAAC;AAED,iBAAiB;KACd,IAAI,EAAE;KACN,IAAI,CAAC,KAAK,IAAI,EAAE;IACf,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAE9D,2EAA2E;IAC3E,MAAM,UAAU,GAAe,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,4DAA4D,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChI,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,EAAE,CAAC;IACpD,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1F,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,6DAA6D,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,aAAa,EAAE,CAAC;IACtD,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,UAAU,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,uBAAuB,GAAG,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;IACnG,IAAI,CAAC;QACH,MAAM,uBAAuB,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kEAAkE,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACtI,CAAC;IACD,MAAM,eAAe,GAAG,uBAAuB,CAAC,aAAa,EAAE,CAAC;IAChE,UAAU,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,eAAe,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC;IACtG,IAAI,eAAe,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACpC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,eAAe,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,CAAC;QAC/D,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,0CAA0C,YAAY,CAAC,QAAQ,CAAC,MAAM,QAAQ,YAAY,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC;YAChI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,YAAY,CAAC,MAAM,CAAC,MAAM,2BAA2B,CAAC,CAAC;QAChH,CAAC;aAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,4BAA4B,YAAY,CAAC,QAAQ,CAAC,MAAM,sBAAsB,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9G,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC1E,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,wCAAwC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,QAAQ,gBAAgB,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC;YACtI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,gBAAgB,CAAC,MAAM,CAAC,MAAM,yBAAyB,CAAC,CAAC;QAC7G,CAAC;aAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,4BAA4B,gBAAgB,CAAC,QAAQ,CAAC,MAAM,uBAAuB,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACxG,CAAC;IAED,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAE7D,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC,CAAC;KACD,IAAI,CAAC,GAAG,EAAE;IACT,OAAO,CAAC,GAAG,CAAC,gCAAgC,UAAU,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../../bin/control-plane.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,mBAAmB,GAAG,0CAA0C,CAAC;AAEvE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,mBAAmB,CAAC;AAEnF,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAmB,CAAC;AACrF,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,cAAc,CAAmB,CAAC;AACrF,gBAAgB,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,IAAI,mBAAmB,EAAE,CAAC;AAEpD,MAAM,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;AAExC,SAAS,QAAQ;IACf,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACvB,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/B,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;IACtC,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;IAC1C,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,uBAAuB,CAAC;AACnF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAEpE,IAAI,cAAc,EAAE,CAAC;IACnB,iBAAiB,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAChC,KAAK,CAAC,GAAG,eAAe,wBAAwB,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,cAAc,EAAE;aAC5C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;SAC3E,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACjH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AACvD,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;AAChH,CAAC;AAED,+BAA+B;AAC/B,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAClD,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;AAErE,MAAM,gBAAgB,GAAG,8CAA8C,CAAC;AAExE,KAAK,UAAU,eAAe,CAAC,UAAsB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,gBAAgB,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QACpG,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mCAAmC,CAAC,SAAiB;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+D,CAAC;QAC7F,IAAI,MAAM,EAAE,WAAW,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAClE,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACtE,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iBAAiB;KACd,IAAI,EAAE;KACN,IAAI,CAAC,KAAK,IAAI,EAAE;IACf,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAE9D,yEAAyE;IACzE,4EAA4E;IAC5E,qEAAqE;IACrE,iDAAiD;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,SAAS,CAAC;IACpE,MAAM,4BAA4B,GAAG,MAAM,mCAAmC,CAAC,SAAS,CAAC,CAAC;IAC1F,MAAM,mBAAmB,GAAG,yBAAyB,EAAE,CAAC;IACxD,MAAM,eAAe,GAAG,qBAAqB,CAAC,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,qBAAqB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC;IACnE,kBAAkB,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;QACzB,KAAK,EAAE,gBAAgB;QACvB,mBAAmB,EAAE,4BAA4B;QACjD,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;KAC3D,CAAC,CAAC,CAAC;IAEJ,2EAA2E;IAC3E,MAAM,UAAU,GAAe,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,4DAA4D,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChI,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,EAAE,CAAC;IACpD,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1F,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,6DAA6D,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,aAAa,EAAE,CAAC;IACtD,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,UAAU,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,uBAAuB,GAAG,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;IACnG,IAAI,CAAC;QACH,MAAM,uBAAuB,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kEAAkE,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACtI,CAAC;IACD,MAAM,eAAe,GAAG,uBAAuB,CAAC,aAAa,EAAE,CAAC;IAChE,UAAU,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,eAAe,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC;IACtG,IAAI,eAAe,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACpC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,eAAe,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,CAAC;QAC/D,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,0CAA0C,YAAY,CAAC,QAAQ,CAAC,MAAM,QAAQ,YAAY,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC;YAChI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,YAAY,CAAC,MAAM,CAAC,MAAM,2BAA2B,CAAC,CAAC;QAChH,CAAC;aAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,4BAA4B,YAAY,CAAC,QAAQ,CAAC,MAAM,sBAAsB,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9G,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC1E,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,wCAAwC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,QAAQ,gBAAgB,CAAC,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC;YACtI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,gBAAgB,CAAC,MAAM,CAAC,MAAM,yBAAyB,CAAC,CAAC;QAC7G,CAAC;aAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,4BAA4B,gBAAgB,CAAC,QAAQ,CAAC,MAAM,uBAAuB,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACxG,CAAC;IAED,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAE7D,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC,CAAC;KACD,IAAI,CAAC,GAAG,EAAE;IACT,OAAO,CAAC,GAAG,CAAC,gCAAgC,UAAU,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/bin/git-credential-generacy.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=git-credential-generacy.d.ts.map

package/dist/bin/git-credential-generacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credential-generacy.d.ts","sourceRoot":"","sources":["../../bin/git-credential-generacy.ts"],"names":[],"mappings":""}

package/dist/bin/git-credential-generacy.js

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+import http from 'node:http';
+const DEFAULT_SOCKET_PATH = '/run/generacy-control-plane/control.sock';
+const EXIT_CODE_BY_CODE = {
+    CONTROL_SOCKET_UNREACHABLE: 2,
+    CLUSTER_API_KEY_MISSING: 3,
+    CLOUD_UNREACHABLE: 4,
+    CLOUD_AUTH_REJECTED: 5,
+    CLOUD_REQUEST_INVALID: 6,
+    CLOUD_UPSTREAM_ERROR: 7,
+    CLOUD_RESPONSE_INVALID: 8,
+    CREDENTIAL_NOT_CONFIGURED: 9,
+    INTERNAL_ERROR: 1,
+};
+function exitErr(outcome) {
+    process.stderr.write(`generacy-git-helper: ${outcome.code}: ${outcome.message}\n`);
+    process.exit(outcome.exitCode);
+}
+function readStdin() {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        process.stdin.on('data', (c) => chunks.push(c));
+        process.stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        process.stdin.on('error', reject);
+        // If stdin is closed before any data, 'end' fires naturally.
+    });
+}
+function parseInput(raw) {
+    const attrs = {};
+    for (const line of raw.split('\n')) {
+        if (line === '')
+            break;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = line.slice(0, eq);
+        const value = line.slice(eq + 1);
+        if (key === 'protocol')
+            attrs.protocol = value;
+        else if (key === 'host')
+            attrs.host = value;
+    }
+    return attrs;
+}
+function postToControlSocket(socketPath) {
+    return new Promise((resolve, reject) => {
+        const req = http.request({
+            socketPath,
+            path: '/git-token',
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'content-length': '2',
+            },
+        }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => {
+                resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf8') });
+            });
+            res.on('error', reject);
+        });
+        req.on('error', reject);
+        req.write('{}');
+        req.end();
+    });
+}
+async function runGet(socketPath, input) {
+    if (input.host !== 'github.com') {
+        // Defensive bypass — git's per-host config should already prevent this.
+        process.exit(0);
+    }
+    let response;
+    try {
+        response = await postToControlSocket(socketPath);
+    }
+    catch (err) {
+        const cause = err.code ?? err.message;
+        exitErr({
+            code: 'CONTROL_SOCKET_UNREACHABLE',
+            message: `control socket at ${socketPath} unreachable (${cause})`,
+            exitCode: EXIT_CODE_BY_CODE.CONTROL_SOCKET_UNREACHABLE,
+        });
+    }
+    if (response.status >= 200 && response.status < 300) {
+        let parsed;
+        try {
+            parsed = JSON.parse(response.body);
+        }
+        catch {
+            exitErr({
+                code: 'CLOUD_RESPONSE_INVALID',
+                message: 'control-plane returned a non-JSON body on success',
+                exitCode: EXIT_CODE_BY_CODE.CLOUD_RESPONSE_INVALID,
+            });
+        }
+        if (typeof parsed.token !== 'string' || parsed.token.length === 0) {
+            exitErr({
+                code: 'CLOUD_RESPONSE_INVALID',
+                message: 'control-plane response missing token',
+                exitCode: EXIT_CODE_BY_CODE.CLOUD_RESPONSE_INVALID,
+            });
+        }
+        const out = [];
+        if (input.protocol)
+            out.push(`protocol=${input.protocol}`);
+        if (input.host)
+            out.push(`host=${input.host}`);
+        out.push('username=x-access-token');
+        out.push(`password=${parsed.token}`);
+        out.push(''); // trailing blank line
+        process.stdout.write(out.join('\n'));
+        process.exit(0);
+    }
+    // Non-2xx — extract code/message from error body if possible.
+    let code = 'INTERNAL_ERROR';
+    let message = `control-plane returned HTTP ${response.status}`;
+    try {
+        const errBody = JSON.parse(response.body);
+        if (typeof errBody.code === 'string' && errBody.code in EXIT_CODE_BY_CODE) {
+            code = errBody.code;
+        }
+        if (typeof errBody.error === 'string') {
+            message = errBody.error;
+        }
+    }
+    catch {
+        // Fall through to defaults.
+    }
+    const exitCode = EXIT_CODE_BY_CODE[code] ?? EXIT_CODE_BY_CODE.INTERNAL_ERROR;
+    exitErr({ code, message, exitCode });
+}
+async function main() {
+    const action = process.argv[2];
+    if (action !== 'get' && action !== 'store' && action !== 'erase') {
+        exitErr({
+            code: 'INTERNAL_ERROR',
+            message: `unknown action ${action ?? '<none>'}`,
+            exitCode: EXIT_CODE_BY_CODE.INTERNAL_ERROR,
+        });
+    }
+    const raw = await readStdin();
+    if (action === 'store' || action === 'erase') {
+        process.exit(0);
+    }
+    const input = parseInput(raw);
+    const socketPath = process.env['CONTROL_PLANE_SOCKET_PATH'] ?? DEFAULT_SOCKET_PATH;
+    await runGet(socketPath, input);
+}
+main().catch((err) => {
+    // Defensive catch — main() should never throw past runGet/exitErr.
+    exitErr({
+        code: 'INTERNAL_ERROR',
+        message: err instanceof Error ? err.message : String(err),
+        exitCode: EXIT_CODE_BY_CODE.INTERNAL_ERROR,
+    });
+});
+//# sourceMappingURL=git-credential-generacy.js.map

package/dist/bin/git-credential-generacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credential-generacy.js","sourceRoot":"","sources":["../../bin/git-credential-generacy.ts"],"names":[],"mappings":";AAEA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,mBAAmB,GAAG,0CAA0C,CAAC;AAUvE,MAAM,iBAAiB,GAA2B;IAChD,0BAA0B,EAAE,CAAC;IAC7B,uBAAuB,EAAE,CAAC;IAC1B,iBAAiB,EAAE,CAAC;IACpB,mBAAmB,EAAE,CAAC;IACtB,qBAAqB,EAAE,CAAC;IACxB,oBAAoB,EAAE,CAAC;IACvB,sBAAsB,EAAE,CAAC;IACzB,yBAAyB,EAAE,CAAC;IAC5B,cAAc,EAAE,CAAC;CAClB,CAAC;AAEF,SAAS,OAAO,CAAC,OAAqB;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;IACnF,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,6DAA6D;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,IAAI,KAAK,EAAE;YAAE,MAAM;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,UAAU;YAAE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;aAC1C,IAAI,GAAG,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB;YACE,UAAU;YACV,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,GAAG;aACtB;SACF,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,UAAkB,EAAE,KAAiB;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAChC,wEAAwE;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,QAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAI,GAA6B,CAAC,IAAI,IAAK,GAAa,CAAC,OAAO,CAAC;QAC5E,OAAO,CAAC;YACN,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,qBAAqB,UAAU,iBAAiB,KAAK,GAAG;YACjE,QAAQ,EAAE,iBAAiB,CAAC,0BAA2B;SACxD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACpD,IAAI,MAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAkB,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC;gBACN,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,mDAAmD;gBAC5D,QAAQ,EAAE,iBAAiB,CAAC,sBAAuB;aACpD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC;gBACN,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,sCAAsC;gBAC/C,QAAQ,EAAE,iBAAiB,CAAC,sBAAuB;aACpD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,8DAA8D;IAC9D,IAAI,IAAI,GAAG,gBAAgB,CAAC;IAC5B,IAAI,OAAO,GAAG,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAwC,CAAC;QACjF,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;YAC1E,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,cAAe,CAAC;IAC9E,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAuB,CAAC;IACrD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACjE,OAAO,CAAC;YACN,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,kBAAkB,MAAM,IAAI,QAAQ,EAAE;YAC/C,QAAQ,EAAE,iBAAiB,CAAC,cAAe;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAE9B,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,mBAAmB,CAAC;IACnF,MAAM,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,mEAAmE;IACnE,OAAO,CAAC;QACN,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACzD,QAAQ,EAAE,iBAAiB,CAAC,cAAe;KAC5C,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/bin/git-token-proxy.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=git-token-proxy.d.ts.map

package/dist/bin/git-token-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-token-proxy.d.ts","sourceRoot":"","sources":["../../bin/git-token-proxy.ts"],"names":[],"mappings":""}

package/dist/bin/git-token-proxy.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+import http from 'node:http';
+import fs from 'node:fs/promises';
+import { createHandler, logProxyInit, } from '../src/git-token-proxy/index.js';
+const DEFAULT_LISTEN_SOCKET = '/run/generacy-git-token/control.sock';
+const DEFAULT_UPSTREAM_SOCKET = '/run/generacy-control-plane/control.sock';
+const LISTEN_SOCKET_MODE = 0o660;
+const SHUTDOWN_TIMEOUT_MS = 5_000;
+function fail(message, exitCode = 1) {
+    process.stderr.write(`git-token-proxy: ${message}\n`);
+    process.exit(exitCode);
+}
+async function main() {
+    const listenSocketPath = process.env['GIT_TOKEN_PROXY_SOCKET'] ?? DEFAULT_LISTEN_SOCKET;
+    const upstreamSocketPath = process.env['CONTROL_PLANE_SOCKET_PATH'] ?? DEFAULT_UPSTREAM_SOCKET;
+    try {
+        await fs.unlink(listenSocketPath);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== 'ENOENT') {
+            fail(`unlink failed: ${listenSocketPath}: ${code ?? 'unknown'}`);
+        }
+    }
+    const server = http.createServer(createHandler({ upstreamSocketPath }));
+    await new Promise((resolve, reject) => {
+        const onError = (err) => {
+            reject(err);
+        };
+        server.once('error', onError);
+        server.listen({ path: listenSocketPath }, () => {
+            server.removeListener('error', onError);
+            resolve();
+        });
+    }).catch((err) => {
+        const code = err.code ?? 'unknown';
+        fail(`bind failed: ${listenSocketPath}: ${code}`);
+    });
+    try {
+        await fs.chmod(listenSocketPath, LISTEN_SOCKET_MODE);
+    }
+    catch (err) {
+        const code = err.code ?? 'unknown';
+        fail(`chmod failed: ${listenSocketPath}: ${code}`);
+    }
+    let shuttingDown = false;
+    const shutdown = () => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        const forceTimer = setTimeout(() => process.exit(1), SHUTDOWN_TIMEOUT_MS);
+        forceTimer.unref();
+        server.close(() => {
+            fs.unlink(listenSocketPath)
+                .catch(() => undefined)
+                .finally(() => process.exit(0));
+        });
+    };
+    // Register signal handlers before announcing readiness: a consumer that acts
+    // on the init line (e.g. sends SIGTERM) must not hit the default-terminate
+    // window between logging and handler registration.
+    process.on('SIGTERM', shutdown);
+    process.on('SIGINT', shutdown);
+    logProxyInit({ listenSocket: listenSocketPath, upstreamSocket: upstreamSocketPath });
+}
+main().catch((err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    fail(`startup failed: ${message}`);
+});
+//# sourceMappingURL=git-token-proxy.js.map

package/dist/bin/git-token-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-token-proxy.js","sourceRoot":"","sources":["../../bin/git-token-proxy.ts"],"names":[],"mappings":";AAEA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EACL,aAAa,EACb,YAAY,GACb,MAAM,iCAAiC,CAAC;AAEzC,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AACrE,MAAM,uBAAuB,GAAG,0CAA0C,CAAC;AAC3E,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,SAAS,IAAI,CAAC,OAAe,EAAE,QAAQ,GAAG,CAAC;IACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,qBAAqB,CAAC;IACxF,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,uBAAuB,CAAC;IAE/F,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,kBAAkB,gBAAgB,KAAK,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAExE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,CAAC,GAA0B,EAAE,EAAE;YAC7C,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE;YAC7C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACf,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,SAAS,CAAC;QAC9D,IAAI,CAAC,gBAAgB,gBAAgB,KAAK,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,SAAS,CAAC;QAC9D,IAAI,CAAC,iBAAiB,gBAAgB,KAAK,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1E,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;iBACxB,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;iBACtB,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,mDAAmD;IACnD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE/B,YAAY,CAAC,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC"}

package/dist/src/git-token-proxy/allowlists.d.ts

@@ -0,0 +1,17 @@
+import type http from 'node:http';
+/**
+ * Single-route privilege boundary. Returns true iff this method+path pair is
+ * allowed through to upstream. The only true case is POST /git-token (with
+ * optional query string). Trailing slash is significant; the query string is
+ * stripped before comparison.
+ */
+export declare function isAllowedRoute(method: string | undefined, url: string | undefined): boolean;
+/**
+ * Returns a new headers object containing ONLY 'content-type' and
+ * 'content-length' (when present in the input). All other keys are dropped.
+ * Header names are normalized to lowercase. The caller is expected to
+ * overwrite 'content-length' with the actual buffered body length before
+ * forwarding upstream.
+ */
+export declare function pickAllowedHeaders(headers: http.IncomingHttpHeaders): Record<string, string>;
+//# sourceMappingURL=allowlists.d.ts.map

package/dist/src/git-token-proxy/allowlists.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlists.d.ts","sourceRoot":"","sources":["../../../src/git-token-proxy/allowlists.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAM3F;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW5F"}

package/dist/src/git-token-proxy/allowlists.js

@@ -0,0 +1,38 @@
+/**
+ * Single-route privilege boundary. Returns true iff this method+path pair is
+ * allowed through to upstream. The only true case is POST /git-token (with
+ * optional query string). Trailing slash is significant; the query string is
+ * stripped before comparison.
+ */
+export function isAllowedRoute(method, url) {
+    if (method !== 'POST')
+        return false;
+    if (typeof url !== 'string')
+        return false;
+    const queryIdx = url.indexOf('?');
+    const path = queryIdx === -1 ? url : url.slice(0, queryIdx);
+    return path === '/git-token';
+}
+/**
+ * Returns a new headers object containing ONLY 'content-type' and
+ * 'content-length' (when present in the input). All other keys are dropped.
+ * Header names are normalized to lowercase. The caller is expected to
+ * overwrite 'content-length' with the actual buffered body length before
+ * forwarding upstream.
+ */
+export function pickAllowedHeaders(headers) {
+    const out = {};
+    for (const [rawKey, rawValue] of Object.entries(headers)) {
+        const key = rawKey.toLowerCase();
+        if (key !== 'content-type' && key !== 'content-length')
+            continue;
+        if (rawValue === undefined)
+            continue;
+        const value = Array.isArray(rawValue) ? rawValue[0] : rawValue;
+        if (typeof value !== 'string')
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+//# sourceMappingURL=allowlists.js.map

package/dist/src/git-token-proxy/allowlists.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlists.js","sourceRoot":"","sources":["../../../src/git-token-proxy/allowlists.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAA0B,EAAE,GAAuB;IAChF,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5D,OAAO,IAAI,KAAK,YAAY,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAiC;IAClE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,gBAAgB;YAAE,SAAS;QACjE,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/git-token-proxy/handler.d.ts

@@ -0,0 +1,10 @@
+import http from 'node:http';
+export declare const MAX_BODY_BYTES: number;
+export declare const UPSTREAM_TIMEOUT_MS = 30000;
+export interface CreateHandlerOptions {
+    upstreamSocketPath: string;
+    httpRequest?: typeof http.request;
+}
+export type ProxyRequestHandler = (req: http.IncomingMessage, res: http.ServerResponse) => void;
+export declare function createHandler(options: CreateHandlerOptions): ProxyRequestHandler;
+//# sourceMappingURL=handler.d.ts.map

package/dist/src/git-token-proxy/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/git-token-proxy/handler.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,eAAO,MAAM,cAAc,QAAY,CAAC;AACxC,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAE1C,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC;AAEhG,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CAuFhF"}

package/dist/src/git-token-proxy/handler.js

@@ -0,0 +1,86 @@
+import http from 'node:http';
+import { isAllowedRoute, pickAllowedHeaders } from './allowlists.js';
+import { mapUpstreamErrorToCode } from './upstream-errors.js';
+import { logUpstreamError } from './logging.js';
+export const MAX_BODY_BYTES = 64 * 1024;
+export const UPSTREAM_TIMEOUT_MS = 30_000;
+export function createHandler(options) {
+    const { upstreamSocketPath } = options;
+    const httpRequest = options.httpRequest ?? http.request;
+    return function handle(req, res) {
+        if (!isAllowedRoute(req.method, req.url)) {
+            res.writeHead(404).end();
+            return;
+        }
+        const chunks = [];
+        let received = 0;
+        let aborted = false;
+        req.on('data', (chunk) => {
+            if (aborted)
+                return;
+            received += chunk.length;
+            if (received > MAX_BODY_BYTES) {
+                aborted = true;
+                res.writeHead(413, { 'content-type': 'application/json' }).end(JSON.stringify({
+                    error: 'request body exceeds 64 KiB',
+                    code: 'PAYLOAD_TOO_LARGE',
+                }));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            if (aborted)
+                return;
+            const body = Buffer.concat(chunks);
+            const outboundHeaders = pickAllowedHeaders(req.headers);
+            outboundHeaders['content-length'] = String(body.length);
+            const upstreamReq = httpRequest({
+                socketPath: upstreamSocketPath,
+                method: 'POST',
+                path: '/git-token',
+                headers: outboundHeaders,
+            });
+            let settled = false;
+            const onFailure = (err) => {
+                if (settled)
+                    return;
+                settled = true;
+                const code = mapUpstreamErrorToCode(err);
+                logUpstreamError({ code });
+                if (!res.headersSent) {
+                    res.writeHead(502, { 'content-type': 'application/json' }).end(JSON.stringify({
+                        error: 'control-plane upstream unreachable',
+                        code,
+                    }));
+                }
+                else {
+                    res.end();
+                }
+            };
+            upstreamReq.setTimeout(UPSTREAM_TIMEOUT_MS, () => {
+                upstreamReq.destroy(new Error('timeout'));
+            });
+            upstreamReq.on('response', (upstreamRes) => {
+                if (settled)
+                    return;
+                settled = true;
+                res.writeHead(upstreamRes.statusCode ?? 502, upstreamRes.headers);
+                upstreamRes.pipe(res);
+                upstreamRes.on('error', () => {
+                    if (!res.writableEnded)
+                        res.end();
+                });
+            });
+            upstreamReq.on('error', onFailure);
+            upstreamReq.write(body);
+            upstreamReq.end();
+        });
+        req.on('error', () => {
+            if (!res.headersSent)
+                res.writeHead(400).end();
+        });
+    };
+}
+//# sourceMappingURL=handler.js.map

package/dist/src/git-token-proxy/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/git-token-proxy/handler.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAS1C,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC;IAExD,OAAO,SAAS,MAAM,CAAC,GAAG,EAAE,GAAG;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,OAAO;gBAAE,OAAO;YACpB,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;YACzB,IAAI,QAAQ,GAAG,cAAc,EAAE,CAAC;gBAC9B,OAAO,GAAG,IAAI,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAC5D,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,6BAA6B;oBACpC,IAAI,EAAE,mBAAmB;iBAC1B,CAAC,CACH,CAAC;gBACF,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAEnC,MAAM,eAAe,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxD,eAAe,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAExD,MAAM,WAAW,GAAG,WAAW,CAAC;gBAC9B,UAAU,EAAE,kBAAkB;gBAC9B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;YAEH,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,SAAS,GAAG,CAAC,GAAY,EAAQ,EAAE;gBACvC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBACzC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3B,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAC5D,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,oCAAoC;wBAC3C,IAAI;qBACL,CAAC,CACH,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC;YAEF,WAAW,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE;gBAC/C,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE;gBACzC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,IAAI,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;gBAClE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBAC3B,IAAI,CAAC,GAAG,CAAC,aAAa;wBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;gBACpC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAEnC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxB,WAAW,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/git-token-proxy/index.d.ts

@@ -0,0 +1,5 @@
+export { isAllowedRoute, pickAllowedHeaders } from './allowlists.js';
+export { mapUpstreamErrorToCode, type UpstreamErrorCode } from './upstream-errors.js';
+export { logProxyInit, logUpstreamError } from './logging.js';
+export { createHandler, MAX_BODY_BYTES, UPSTREAM_TIMEOUT_MS, type CreateHandlerOptions, type ProxyRequestHandler, } from './handler.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/git-token-proxy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/git-token-proxy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EACL,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC"}

package/dist/src/git-token-proxy/index.js

@@ -0,0 +1,5 @@
+export { isAllowedRoute, pickAllowedHeaders } from './allowlists.js';
+export { mapUpstreamErrorToCode } from './upstream-errors.js';
+export { logProxyInit, logUpstreamError } from './logging.js';
+export { createHandler, MAX_BODY_BYTES, UPSTREAM_TIMEOUT_MS, } from './handler.js';
+//# sourceMappingURL=index.js.map

package/dist/src/git-token-proxy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/git-token-proxy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAA0B,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EACL,aAAa,EACb,cAAc,EACd,mBAAmB,GAGpB,MAAM,cAAc,CAAC"}

package/dist/src/git-token-proxy/logging.d.ts

@@ -0,0 +1,9 @@
+import type { UpstreamErrorCode } from './upstream-errors.js';
+export declare function logProxyInit(args: {
+    listenSocket: string;
+    upstreamSocket: string;
+}): void;
+export declare function logUpstreamError(args: {
+    code: UpstreamErrorCode;
+}): void;
+//# sourceMappingURL=logging.d.ts.map

package/dist/src/git-token-proxy/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../../src/git-token-proxy/logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQzF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAAG,IAAI,CAOxE"}

package/dist/src/git-token-proxy/logging.js

@@ -0,0 +1,14 @@
+export function logProxyInit(args) {
+    console.log(JSON.stringify({
+        event: 'git-token-proxy-init',
+        listenSocket: args.listenSocket,
+        upstreamSocket: args.upstreamSocket,
+    }));
+}
+export function logUpstreamError(args) {
+    console.log(JSON.stringify({
+        event: 'git-token-proxy-upstream-error',
+        code: args.code,
+    }));
+}
+//# sourceMappingURL=logging.js.map

package/dist/src/git-token-proxy/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../../src/git-token-proxy/logging.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,YAAY,CAAC,IAAsD;IACjF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,sBAAsB;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAiC;IAChE,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,gCAAgC;QACvC,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/src/git-token-proxy/upstream-errors.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The only upstream-side error code this bin emits. Single closed union: the
+ * CLI wrapper (#766) cares only that the upstream is unreachable; the per-
+ * request stdout log line tells operators which transport mode triggered it.
+ */
+export type UpstreamErrorCode = 'CONTROL_SOCKET_UNREACHABLE';
+/**
+ * Collapses every upstream-transport failure (ECONNREFUSED, ENOENT,
+ * ECONNRESET, EPIPE, timeout/AbortError, generic Error, undefined) to the
+ * single error code. Identity-style mapper — a single source of truth so the
+ * handler never branches on errno strings inline.
+ */
+export declare function mapUpstreamErrorToCode(_err: unknown): UpstreamErrorCode;
+//# sourceMappingURL=upstream-errors.d.ts.map

package/dist/src/git-token-proxy/upstream-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-errors.d.ts","sourceRoot":"","sources":["../../../src/git-token-proxy/upstream-errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAE7D;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAEvE"}