@mh-gg/git 0.1.1-alpha.20260626T104441232Z

package/src/originUrl.cjs

@@ -0,0 +1,163 @@
+const DEFAULT_TRANSPORT = "matterhorn-sdk";
+
+function decode(value) {
+  return decodeURIComponent(String(value || ""));
+}
+
+function encode(value) {
+  return encodeURIComponent(String(value || ""));
+}
+
+function cleanText(value, label, max = 180) {
+  const text = String(value || "").trim();
+  if (!text) throw new Error(`${label} is required`);
+  if (text.length > max) throw new Error(`${label} is too long`);
+  return text;
+}
+
+function parseSemiAddress(address) {
+  const out = {};
+  for (const part of String(address || "").split(";")) {
+    if (!part.trim()) continue;
+    const index = part.indexOf("=");
+    if (index === -1) {
+      if (!out.repo) out.repo = decode(part.trim());
+      continue;
+    }
+    const key = part.slice(0, index).trim();
+    const value = part.slice(index + 1).trim();
+    if (key) out[key] = decode(value);
+  }
+  return out;
+}
+
+function parseFriendlyPlus(value) {
+  const input = String(value || "").trim();
+  const match = input.match(/^matterhorn\+([^+:/?#]+)\+([^:/?#]+):\/\/?([^?#]*)(?:\?([^#]*))?$/);
+  if (!match) return undefined;
+  const params = new URLSearchParams(match[4] || "");
+  return {
+    transport: DEFAULT_TRANSPORT,
+    room: decode(match[1]),
+    signing: decode(match[2]),
+    repo: decode((match[3] || "").replace(/^\/+/, "")),
+    backend: params.get("backend") || undefined,
+    relay: params.get("relay") || undefined
+  };
+}
+
+function parseCompactAddress(address) {
+  const input = String(address || "").trim();
+  const [head, ...rest] = input.split(";");
+  const match = head.match(/^matterhorn\+([^+\/]+)\+([^\/]+)\/?(.*)$/);
+  if (!match) return undefined;
+  const params = parseSemiAddress(rest.join(";"));
+  return {
+    transport: DEFAULT_TRANSPORT,
+    room: decode(match[1]),
+    signing: decode(match[2]),
+    repo: decode((match[3] || "").replace(/^\/+/, "")),
+    backend: params.backend,
+    relay: params.relay
+  };
+}
+
+function parseMatterhornOrigin(value, defaults = {}) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const parsed = {
+      transport: DEFAULT_TRANSPORT,
+      room: cleanText(value.room || value.roomName || defaults.room, "room"),
+      repo: cleanText(value.repo || value.repository || defaults.repo, "repo"),
+      signing: cleanText(value.signing || value.userSigning || value.profile || defaults.signing || "default", "signing profile"),
+      backend: value.backend || defaults.backend,
+      relay: value.relay || defaults.relay
+    };
+    return parsed;
+  }
+
+  const raw = String(value || "").trim();
+  if (!raw) throw new Error("Matterhorn origin URL is required");
+
+  const friendly = parseFriendlyPlus(raw);
+  if (friendly) return finalize(friendly, defaults);
+
+  const bareCompact = raw.startsWith("matterhorn+") ? parseCompactAddress(raw) : undefined;
+  if (bareCompact) return finalize(bareCompact, defaults);
+
+  if (raw.startsWith("matterhorn::")) {
+    const address = raw.slice("matterhorn::".length);
+    const compact = parseCompactAddress(address);
+    if (compact) return finalize(compact, defaults);
+    return finalize({ transport: DEFAULT_TRANSPORT, ...parseSemiAddress(address) }, defaults);
+  }
+
+  if (raw.startsWith("matterhorn://")) {
+    const url = new URL(raw);
+    const parts = url.pathname.replace(/^\/+/, "").split("/").filter(Boolean);
+    return finalize({
+      transport: DEFAULT_TRANSPORT,
+      room: url.hostname,
+      repo: parts.join("/") || url.searchParams.get("repo"),
+      signing: url.searchParams.get("signing") || url.searchParams.get("profile"),
+      backend: url.searchParams.get("backend") || undefined,
+      relay: url.searchParams.get("relay") || undefined
+    }, defaults);
+  }
+
+  return finalize({ transport: DEFAULT_TRANSPORT, ...parseSemiAddress(raw) }, defaults);
+}
+
+function finalize(input, defaults) {
+  const parsed = {
+    transport: DEFAULT_TRANSPORT,
+    room: cleanText(input.room || input.roomName || defaults.room, "room"),
+    repo: cleanText(input.repo || input.repository || defaults.repo, "repo"),
+    signing: cleanText(input.signing || input.userSigning || input.profile || defaults.signing || "default", "signing profile"),
+    backend: input.backend || defaults.backend,
+    relay: input.relay || defaults.relay
+  };
+  return parsed;
+}
+
+function formatMatterhornOrigin(input) {
+  const origin = parseMatterhornOrigin(input);
+  const parts = [
+    `room=${encode(origin.room)}`,
+    `repo=${encode(origin.repo)}`,
+    `signing=${encode(origin.signing)}`
+  ];
+  if (origin.backend) parts.push(`backend=${encode(origin.backend)}`);
+  if (origin.relay) parts.push(`relay=${encode(origin.relay)}`);
+  return `matterhorn::${parts.join(";")}`;
+}
+
+function formatCompactMatterhornOrigin(input) {
+  const origin = parseMatterhornOrigin(input);
+  const tail = origin.repo ? `/${encode(origin.repo)}` : "";
+  const params = [];
+  if (origin.backend) params.push(`backend=${encode(origin.backend)}`);
+  if (origin.relay) params.push(`relay=${encode(origin.relay)}`);
+  return `matterhorn::matterhorn+${encode(origin.room)}+${encode(origin.signing)}${tail}${params.length ? `;${params.join(";")}` : ""}`;
+}
+
+function formatFriendlyOrigin(input) {
+  const origin = parseMatterhornOrigin(input);
+  const query = new URLSearchParams();
+  if (origin.backend) query.set("backend", origin.backend);
+  if (origin.relay) query.set("relay", origin.relay);
+  const suffix = query.toString() ? `?${query.toString()}` : "";
+  return `matterhorn+${encode(origin.room)}+${encode(origin.signing)}://${encode(origin.repo)}${suffix}`;
+}
+
+function originSlug(input) {
+  const origin = parseMatterhornOrigin(input);
+  return `${origin.room}--${origin.repo}--${origin.signing}`.replace(/[^A-Za-z0-9_.-]+/g, "_").slice(0, 180) || "matterhorn-origin";
+}
+
+module.exports = {
+  formatCompactMatterhornOrigin,
+  formatFriendlyOrigin,
+  formatMatterhornOrigin,
+  originSlug,
+  parseMatterhornOrigin
+};

package/src/remoteHelper.cjs

@@ -0,0 +1,85 @@
+const { spawn } = require("node:child_process");
+const readline = require("node:readline");
+const { ensureLocalMirror, listMirrorRefs, readSavedRefs, saveRefs } = require("./localMirror.cjs");
+const { parseMatterhornOrigin } = require("./originUrl.cjs");
+const { publishChangedRefs, publishPointersForMirrorRefs } = require("./controlPlane.cjs");
+
+function writeLine(line = "") {
+  process.stdout.write(`${line}\n`);
+}
+
+function log(options, message) {
+  if (options.quiet) return;
+  process.stderr.write(`[matterhorn-git] ${message}\n`);
+}
+
+function parseHelperArgs(argv = process.argv.slice(2)) {
+  const remoteName = argv[0];
+  const url = argv[1] || argv[0];
+  return { remoteName, url };
+}
+
+async function connectService(service, mirrorPath, origin, beforeRefs, options = {}) {
+  if (service !== "git-upload-pack" && service !== "git-receive-pack") {
+    writeLine("fallback");
+    return;
+  }
+  writeLine("");
+  const child = spawn(service, [mirrorPath], { stdio: ["pipe", "pipe", "inherit"] });
+  process.stdin.pipe(child.stdin);
+  child.stdout.pipe(process.stdout);
+  const code = await new Promise((resolve) => child.on("close", resolve));
+  process.stdin.unpipe(child.stdin);
+  if (service === "git-receive-pack") {
+    const afterRefs = listMirrorRefs(mirrorPath);
+    try {
+      const pointerPublishes = await publishPointersForMirrorRefs(origin, mirrorPath, afterRefs, options);
+      for (const item of pointerPublishes) log(options, `published pointer metadata for ${item.filepath}`);
+      const changes = await publishChangedRefs(origin, beforeRefs, afterRefs, options);
+      saveRefs(origin, afterRefs, options);
+      for (const change of changes) {
+        const result = change.result.mode === "http" ? "posted" : `queued ${change.result.file}`;
+        log(options, `${change.ref} ${change.oldOid || "0000000"} -> ${change.newOid || "deleted"}: ${result}`);
+      }
+    } catch (error) {
+      log(options, `control-plane publish failed: ${error.message || error}`);
+      process.exitCode = 1;
+    }
+  }
+  process.exit(code || process.exitCode || 0);
+}
+
+async function runRemoteHelper(argv = process.argv.slice(2), options = {}) {
+  const { url } = parseHelperArgs(argv);
+  const origin = parseMatterhornOrigin(url || process.env.MATTERHORN_GIT_ORIGIN);
+  const { mirrorPath } = ensureLocalMirror(origin, options);
+  const savedRefs = readSavedRefs(origin, options);
+  const mirrorRefs = listMirrorRefs(mirrorPath);
+  const beforeRefs = Object.keys(savedRefs).length ? savedRefs : mirrorRefs;
+
+  const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity, terminal: false });
+  for await (const line of rl) {
+    const command = line.trim();
+    if (!command) break;
+    if (command === "capabilities") {
+      writeLine("connect");
+      writeLine("option");
+      writeLine("");
+      continue;
+    }
+    if (command.startsWith("option ")) {
+      const [, name] = command.split(/\s+/, 3);
+      if (name === "verbosity" || name === "progress") writeLine("ok");
+      else writeLine("unsupported");
+      continue;
+    }
+    if (command.startsWith("connect ")) {
+      await connectService(command.slice("connect ".length).trim(), mirrorPath, origin, beforeRefs, options);
+      return;
+    }
+    writeLine(`error unsupported command ${command.replace(/\s+/g, " ")}`);
+    writeLine("");
+  }
+}
+
+module.exports = { parseHelperArgs, runRemoteHelper };

package/src/signing.cjs

@@ -0,0 +1,110 @@
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const crypto = require("node:crypto");
+const { gitDirFromEnv, writeJsonFile } = require("./localMirror.cjs");
+
+function safeName(value) {
+  return String(value || "default").replace(/[^A-Za-z0-9_.-]+/g, "_").slice(0, 120) || "default";
+}
+
+function homeProfilePath(profile) {
+  return path.join(os.homedir(), ".matterhorn", "git", "signing", `${safeName(profile)}.json`);
+}
+
+function repoProfilePath(profile, options = {}) {
+  const gitDir = options.gitDir || gitDirFromEnv(options.cwd);
+  return path.join(gitDir, "matterhorn-sdk", "signing", `${safeName(profile)}.json`);
+}
+
+function loadJson(file) {
+  return JSON.parse(fs.readFileSync(file, "utf8"));
+}
+
+function defaultActor(profile) {
+  const username = process.env.USER || process.env.USERNAME || "member";
+  const memberId = profile && profile !== "default" ? profile : username;
+  return {
+    memberId,
+    deviceId: `git-${os.hostname().replace(/[^A-Za-z0-9_.-]+/g, "_")}`,
+    role: "member",
+    displayName: memberId
+  };
+}
+
+function loadUserSigningProfile(profile = "default", options = {}) {
+  if (process.env.MATTERHORN_GIT_SIGNING_PROFILE_JSON) {
+    return normalizeProfile(JSON.parse(process.env.MATTERHORN_GIT_SIGNING_PROFILE_JSON), profile);
+  }
+  const explicit = options.file || process.env.MATTERHORN_GIT_SIGNING_PROFILE_FILE;
+  const candidates = [explicit, repoProfilePath(profile, options), homeProfilePath(profile)].filter(Boolean);
+  for (const file of candidates) {
+    if (fs.existsSync(file)) return normalizeProfile({ ...loadJson(file), file }, profile);
+  }
+  return normalizeProfile({ profile, actor: defaultActor(profile), devUnsigned: process.env.MATTERHORN_GIT_DEV_UNSIGNED === "1" }, profile);
+}
+
+function normalizeProfile(input = {}, fallbackProfile = "default") {
+  const profile = input.profile || input.name || fallbackProfile || "default";
+  const actor = input.actor || defaultActor(profile);
+  return {
+    profile,
+    actor: {
+      memberId: actor.memberId || profile,
+      deviceId: actor.deviceId || `git-${profile}`,
+      role: actor.role || "member",
+      displayName: actor.displayName || actor.name || actor.memberId || profile
+    },
+    auth: input.auth,
+    grant: input.grant,
+    privateKeyPem: input.privateKeyPem || input.privateKey,
+    file: input.file,
+    devUnsigned: input.devUnsigned === true
+  };
+}
+
+function createDevSigningProfile(profile, input = {}, options = {}) {
+  const actor = {
+    ...defaultActor(profile),
+    memberId: input.memberId || input.member || profile,
+    role: input.role || "member",
+    displayName: input.displayName || input.name || input.memberId || profile
+  };
+  const secret = crypto.randomBytes(32).toString("base64url");
+  const data = {
+    version: 1,
+    profile,
+    actor,
+    auth: {
+      kind: "matterhorn.git-dev-signing.v1",
+      credentialId: `git-dev-${safeName(profile)}`,
+      secret
+    },
+    warning: "Development profile only. Production should use a Matterhorn operation role-key or device signing profile."
+  };
+  const file = options.repo ? repoProfilePath(profile, options) : homeProfilePath(profile);
+  writeJsonFile(file, data);
+  return { file, profile: normalizeProfile({ ...data, file }, profile) };
+}
+
+function authForDraft(profile, draft) {
+  if (profile.auth?.kind === "matterhorn.git-dev-signing.v1" && profile.auth.secret) {
+    const payload = JSON.stringify({ type: draft.type, payload: draft.payload, actor: profile.actor, id: draft.id });
+    return {
+      kind: profile.auth.kind,
+      credentialId: profile.auth.credentialId,
+      signature: crypto.createHmac("sha256", profile.auth.secret).update(payload).digest("base64url")
+    };
+  }
+  if (profile.auth) return profile.auth;
+  if (profile.devUnsigned) return { kind: "matterhorn.git-dev-unsigned.v1", credentialId: `dev-unsigned-${profile.actor.memberId}`, unsigned: true };
+  throw new Error("No git signing profile configured. Run: matterhorn-git profile init <name>, or set MATTERHORN_GIT_DEV_UNSIGNED=1 for local development.");
+}
+
+module.exports = {
+  authForDraft,
+  createDevSigningProfile,
+  homeProfilePath,
+  loadUserSigningProfile,
+  repoProfilePath
+};