@hasna/infinity 0.1.0

package/dist/types/brokers/composition.d.ts

@@ -0,0 +1,86 @@
+import { CheckpointBroker, type CheckpointProvenanceVerifierPort, type CheckpointProvenanceReceiptCryptographyPort, type FenceAuthorityPort, type ManifestSignerPort } from "./checkpoint/service";
+import { CleanCheckpointVerifier, type CleanCheckpointVerifierLimits, type ManagedVerifierResultAttestationPort, type ManagedVerifierSandboxPort, type SandboxesVerifierAllocationReceiptVerifierPort, type SandboxesVerifierCleanupReceiptVerifierPort, type SandboxesVerifierQuarantineReceiptVerifierPort, type VerifierCleanupGrantAuthorityPort, type VerifierEvidenceLoaderPort } from "./checkpoint/clean-verifier";
+import type { CheckpointManifestSignatureVerifierPort, CheckpointManifestSigningTrustHeadResolverPort, CheckpointManifestSigningTrustHeadVerifierPort, CheckpointManifestSigningTrustResolverPort } from "./checkpoint/manifest-signature";
+import type { VersionedObjectStore } from "./checkpoint/store";
+import { S3VersionedObjectStore, type S3EvidenceClient, type S3VersionedObjectStoreConfig } from "./checkpoint/s3-store";
+import { type AuthorityReceiptCryptographyPort } from "./checkpoint/seal-authority";
+import { type VerificationReceiptCryptographyPort, type VerificationReceiptFinalTrustCryptographyPort } from "./checkpoint/verifier";
+import { GitPromotionBroker, type ExpectedBaseGitPort, type PromotionApprovalAuthorityPort, type PromotionResultAuthorityPort, type PromotionSecretScannerPort, type PromotionFenceAuthorityPort } from "./git/promotion";
+import { GitHubAppExpectedBaseGitPort, type GitHubAppCredentialBrokerPort, type GitHubAppExpectedBaseConfig, type GitHubSessionAuthorityPort, type RepositoryAutomationAdmissionPort } from "./git/github-app";
+import { type PostgresLedgerOptions, type ProviderEffectJournalAuthorityPort, type SqlExecutor } from "./persistence/postgres";
+export interface DurableCheckpointBrokerDependencies {
+    sql: SqlExecutor;
+    authority: FenceAuthorityPort;
+    store: VersionedObjectStore;
+    manifestSigner: ManifestSignerPort;
+    manifestSignatureVerifier: CheckpointManifestSignatureVerifierPort;
+    manifestSigningTrustHeadResolver: CheckpointManifestSigningTrustHeadResolverPort;
+    manifestSigningTrustHeadVerifier: CheckpointManifestSigningTrustHeadVerifierPort;
+    authorityCryptography: AuthorityReceiptCryptographyPort;
+    verificationReceiptFinalTrustCryptography: VerificationReceiptFinalTrustCryptographyPort;
+    provenanceVerifier: CheckpointProvenanceVerifierPort;
+    provenanceReceiptCryptography: CheckpointProvenanceReceiptCryptographyPort;
+    providerEffectJournal: ProviderEffectJournalAuthorityPort;
+    ledgerOptions?: PostgresLedgerOptions;
+}
+export declare function createDurableCheckpointBroker(dependencies: DurableCheckpointBrokerDependencies): CheckpointBroker;
+export interface DurableGitPromotionBrokerDependencies {
+    sql: SqlExecutor;
+    authority: PromotionFenceAuthorityPort;
+    git: ExpectedBaseGitPort;
+    secretScanner: PromotionSecretScannerPort;
+    approvalAuthority: PromotionApprovalAuthorityPort;
+    resultAuthority: PromotionResultAuthorityPort;
+    verificationReceiptCryptography: VerificationReceiptCryptographyPort;
+    verificationReceiptFinalTrustCryptography: VerificationReceiptFinalTrustCryptographyPort;
+    providerEffectJournal: ProviderEffectJournalAuthorityPort;
+    ledgerOptions?: PostgresLedgerOptions;
+}
+export declare function createDurableGitPromotionBroker(dependencies: DurableGitPromotionBrokerDependencies): GitPromotionBroker;
+/**
+ * Constructor-only production wiring for the checkpoint -> clean verification ->
+ * GitHub App promotion path. Provider clients and authority ports remain explicit
+ * so this package never reads ambient credentials or creates live clients itself.
+ */
+export interface ProductionCheckpointGitBrokerStackDependencies {
+    sql: SqlExecutor;
+    checkpointAuthority: FenceAuthorityPort;
+    checkpointProvenanceVerifier: CheckpointProvenanceVerifierPort;
+    promotionAuthority: PromotionFenceAuthorityPort;
+    gitHubSessionAuthority: GitHubSessionAuthorityPort;
+    manifestSigner: ManifestSignerPort;
+    manifestSigningTrustResolver: CheckpointManifestSigningTrustResolverPort;
+    manifestSigningTrustHeadResolver: CheckpointManifestSigningTrustHeadResolverPort;
+    manifestSigningTrustHeadVerifier: CheckpointManifestSigningTrustHeadVerifierPort;
+    authorityCryptography: AuthorityReceiptCryptographyPort;
+    verificationReceiptFinalTrustCryptography: VerificationReceiptFinalTrustCryptographyPort;
+    checkpointProvenanceReceiptCryptography: CheckpointProvenanceReceiptCryptographyPort;
+    verificationReceiptCryptography: VerificationReceiptCryptographyPort;
+    manifestSignatureVerifier: CheckpointManifestSignatureVerifierPort;
+    verifierEvidence: VerifierEvidenceLoaderPort;
+    verifierSandbox: ManagedVerifierSandboxPort;
+    verifierResultAttestation: ManagedVerifierResultAttestationPort;
+    verifierCleanupGrantAuthority: VerifierCleanupGrantAuthorityPort;
+    sandboxesAllocationReceiptVerifier: SandboxesVerifierAllocationReceiptVerifierPort;
+    sandboxesCleanupReceiptVerifier: SandboxesVerifierCleanupReceiptVerifierPort;
+    sandboxesQuarantineReceiptVerifier: SandboxesVerifierQuarantineReceiptVerifierPort;
+    verifierLimits: CleanCheckpointVerifierLimits;
+    promotionSecretScanner: PromotionSecretScannerPort;
+    promotionApprovalAuthority: PromotionApprovalAuthorityPort;
+    promotionResultAuthority: PromotionResultAuthorityPort;
+    s3Client: S3EvidenceClient;
+    s3Config: S3VersionedObjectStoreConfig;
+    gitHubCredentials: GitHubAppCredentialBrokerPort;
+    repositoryAdmission: RepositoryAutomationAdmissionPort;
+    providerEffectJournal: ProviderEffectJournalAuthorityPort;
+    gitHubConfig: GitHubAppExpectedBaseConfig;
+    ledgerOptions?: PostgresLedgerOptions;
+}
+export interface ProductionCheckpointGitBrokerStack {
+    readonly checkpointBroker: CheckpointBroker;
+    readonly cleanVerifier: CleanCheckpointVerifier;
+    readonly gitPromotionBroker: GitPromotionBroker;
+    readonly evidenceStore: S3VersionedObjectStore;
+    readonly gitHubAdapter: GitHubAppExpectedBaseGitPort;
+}
+export declare function createProductionCheckpointGitBrokerStack(dependencies: ProductionCheckpointGitBrokerStackDependencies): ProductionCheckpointGitBrokerStack;

package/dist/types/brokers/git/github-app.d.ts

@@ -0,0 +1,216 @@
+import { type BrokerFence } from "../../contracts/fence";
+import { type ExpectedBaseGitPort, type GitBranchCasReceipt, type GitBranchCreateReceipt, type GitCandidateObjectSource, type GitPullRequestCreateReceipt, type GitPullRequestReadReceipt, type GitPullRequestRecord, type GitRefReadReceipt } from "./promotion";
+import type { VersionedObjectStore } from "../checkpoint/store";
+export interface RepositoryAutomationAdmission {
+    repositoryId: string;
+    installationId: string;
+    automationPolicySha256: string;
+    namespaceRulesetSha256: string;
+    integrationInventoryComplete: boolean;
+    infinityNamespaceRestrictedToApp: boolean;
+    namespaceHistoryRewriteDenied: boolean;
+    namespaceDeletionDenied: boolean;
+    namespaceTargetBypassDenied: boolean;
+    defaultAndTargetBranchWritesDenied: boolean;
+    candidateTriggeredAutomationSecretless: boolean;
+    candidateControlFilesPolicyPassed: boolean;
+    oidcMintingDenied: boolean;
+    workflowWriteTokensDenied: boolean;
+    privilegedSelfHostedRunnersDenied: boolean;
+    webhookAndAppTriggersBounded: boolean;
+    environmentsPagesAndMergeQueuesBounded: boolean;
+    productionSideEffectsDenied: boolean;
+    evidenceLinksAuthenticated: boolean;
+    checkedAt: string;
+    validUntil: string;
+}
+export interface RepositoryAutomationAdmissionPort {
+    readCurrent(input: {
+        repositoryId: string;
+        installationId: string;
+    }): Promise<RepositoryAutomationAdmission>;
+}
+export interface GitHubAppSessionContext {
+    repositoryId: string;
+    installationId: string;
+    appPrincipal: string;
+    operationId: string;
+    operationDigest: string;
+    canonicalHost: "api.github.com";
+    redirectsAllowed: false;
+    repositoryVerifiedAfterAuthentication: true;
+    isolatedOneOperationWorkload: true;
+    credentialMaterialExposed: false;
+    genericCredentialHelperEnabled: false;
+    permissions: Readonly<{
+        metadata: "read";
+        contents: "write";
+        pullRequests: "write";
+    }>;
+    expiresAt: string;
+}
+export interface GitHubRawRefReceipt {
+    oid: string | null;
+    providerRequestId: string;
+}
+export interface GitHubRawBranchWriteReceipt {
+    status: "created" | "updated" | "conflict";
+    previousOid: string | null;
+    oid: string | null;
+    providerRequestId: string;
+}
+export interface GitHubBranchWriteEvidence {
+    repositoryId: string;
+    installationId: string;
+    appPrincipal: string;
+    namespaceRulesetSha256: string;
+    operationId: string;
+    action: "anchor_branch" | "cas_candidate";
+    ref: string;
+    previousOid: string | null;
+    oid: string;
+    ambiguousProviderRequestId: string;
+    providerWriteRequestId: string;
+    reconciliationRequestId: string;
+}
+export interface GitHubRepositorySession {
+    readRef(input: {
+        ref: string;
+    }): Promise<GitHubRawRefReceipt>;
+    compareAndCreateRef(input: {
+        ref: string;
+        oid: string;
+        expectedAbsent: true;
+        operationId: string;
+    }): Promise<GitHubRawBranchWriteReceipt>;
+    receivePackCompareAndSwap(input: {
+        ref: string;
+        expectedOldOid: string;
+        candidateOid: string;
+        objectFormat: "sha1" | "sha256";
+        gitBundleBytes: Uint8Array;
+        gitBundleSha256: string;
+        operationId: string;
+    }): Promise<GitHubRawBranchWriteReceipt>;
+    reconcileBranchWrite(input: {
+        operationId: string;
+        action: "anchor_branch" | "cas_candidate";
+        ref: string;
+    }): Promise<{
+        evidence: GitHubBranchWriteEvidence | null;
+        providerRequestId: string;
+    }>;
+    createDraftPullRequest(input: {
+        baseRef: string;
+        baseOid: string;
+        headRef: string;
+        headOid: string;
+        marker: string;
+        titleDigest: string;
+        bodyDigest: string;
+        operationId: string;
+    }): Promise<{
+        pullRequest: GitPullRequestRecord;
+        providerRequestId: string;
+    }>;
+    findExactPullRequests(input: {
+        repositoryId: string;
+        installationId: string;
+        baseRef: string;
+        baseOid: string;
+        headRef: string;
+        headOid: string;
+        marker: string;
+        titleDigest: string;
+        bodyDigest: string;
+        appPrincipal: string;
+    }): Promise<{
+        matches: readonly GitPullRequestRecord[];
+        providerRequestId: string;
+    }>;
+    readPullRequest(input: {
+        providerPullRequestId: string;
+    }): Promise<{
+        pullRequest: GitPullRequestRecord | null;
+        providerRequestId: string;
+    }>;
+}
+export interface GitHubAppCredentialBrokerPort {
+    withInstallationSession<T>(input: {
+        repositoryId: string;
+        installationId: string;
+        operationId: string;
+        operationDigest: string;
+        fence: BrokerFence;
+        authorizationExpiresAt: string;
+        permissions: Readonly<{
+            metadata: "read";
+            contents: "write";
+            pullRequests: "write";
+        }>;
+    }, effect: (session: GitHubRepositorySession, context: GitHubAppSessionContext) => Promise<T>): Promise<T>;
+}
+export interface GitPromotionCandidateObjectLoaderPort {
+    loadExact(source: GitCandidateObjectSource): Promise<Uint8Array>;
+}
+export interface GitHubSessionAuthorityPort {
+    revalidate(fence: BrokerFence): Promise<{
+        fence: BrokerFence;
+        databaseTime: Date;
+    }>;
+}
+export interface GitHubAppExpectedBaseConfig {
+    repositoryId: string;
+    installationId: string;
+    targetRef: string;
+    automationPolicySha256: string;
+    namespaceRulesetSha256: string;
+    appPrincipal: string;
+}
+export declare class GitHubAmbiguousCreateError extends Error {
+    readonly providerRequestId: string;
+    constructor(providerRequestId: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare class GitHubAmbiguousBranchWriteError extends Error {
+    readonly providerRequestId: string;
+    constructor(providerRequestId: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare class GitHubAppExpectedBaseGitPort implements ExpectedBaseGitPort {
+    private readonly dependencies;
+    private readonly config;
+    private readonly operationSession;
+    constructor(dependencies: {
+        credentials: GitHubAppCredentialBrokerPort;
+        admission: RepositoryAutomationAdmissionPort;
+        candidateObjects: GitPromotionCandidateObjectLoaderPort;
+        authority: GitHubSessionAuthorityPort;
+    }, config: GitHubAppExpectedBaseConfig);
+    withOperation<T>(input: Parameters<ExpectedBaseGitPort["withOperation"]>[0], effect: () => Promise<T>): Promise<T>;
+    readRef(input: {
+        repositoryId: string;
+        ref: string;
+        fence: BrokerFence;
+    }): Promise<GitRefReadReceipt>;
+    compareAndCreateBranch(input: Parameters<ExpectedBaseGitPort["compareAndCreateBranch"]>[0]): Promise<GitBranchCreateReceipt>;
+    compareAndSwapBranch(input: Parameters<ExpectedBaseGitPort["compareAndSwapBranch"]>[0]): Promise<GitBranchCasReceipt>;
+    createDraftPullRequest(input: Parameters<ExpectedBaseGitPort["createDraftPullRequest"]>[0]): Promise<GitPullRequestCreateReceipt>;
+    readPullRequest(input: Parameters<ExpectedBaseGitPort["readPullRequest"]>[0]): Promise<GitPullRequestReadReceipt>;
+    private withSession;
+    private requireOperationSession;
+    private revalidateImmediatelyBeforeGit;
+    private revalidateAuthority;
+    private assertAdmission;
+    private assertCall;
+    private assertOperation;
+    private assertTransition;
+    private assertRecoveredBranchWrite;
+}
+export declare class VersionedGitCandidateObjectLoader implements GitPromotionCandidateObjectLoaderPort {
+    private readonly store;
+    constructor(store: VersionedObjectStore);
+    loadExact(source: GitCandidateObjectSource): Promise<Uint8Array>;
+}