bkper 4.24.2 → 4.24.3

package/lib/commands/apps/git/clone.js

@@ -0,0 +1,161 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as YAML from 'yaml';
+import { runGit } from './run-git.js';
+import { createPlatformSourceApi, stripRepositoryTokenSecret, } from './platform-source.js';
+import { configureManagedOrigin } from './remote.js';
+import { writeManagedSourceMarker } from './markers.js';
+import { ManagedGitError } from './types.js';
+function resolveDestination(appId, destination, cwd) {
+    if (destination) {
+        return path.resolve(cwd, destination);
+    }
+    return path.resolve(cwd, appId);
+}
+function readClonedAppId(repoDir) {
+    for (const fileName of ['bkper.yaml', 'bkper.json']) {
+        const fullPath = path.join(repoDir, fileName);
+        if (!fs.existsSync(fullPath)) {
+            continue;
+        }
+        const content = fs.readFileSync(fullPath, 'utf8');
+        const config = fileName.endsWith('.json')
+            ? JSON.parse(content)
+            : YAML.parse(content);
+        if (typeof (config === null || config === void 0 ? void 0 : config.id) === 'string') {
+            return config.id;
+        }
+    }
+    return undefined;
+}
+function cloneWithReadToken(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const password = stripRepositoryTokenSecret(args.token);
+        // Use an absolute credential helper so the token never appears in argv or remote URL.
+        const helperScript = [
+            '#!/bin/sh',
+            'set -eu',
+            '[ "${1:-}" = "get" ] || exit 0',
+            'printf "username=x\\npassword=%s\\n" "$BKPER_CLONE_TOKEN"',
+            '',
+        ].join('\n');
+        const helperPath = path.join(os.tmpdir(), `bkper-clone-helper-${process.pid}-${Date.now()}.sh`);
+        fs.writeFileSync(helperPath, helperScript, { mode: 0o700 });
+        try {
+            yield args.runner([
+                '-c',
+                'credential.helper=',
+                '-c',
+                `credential.helper=${helperPath}`,
+                'clone',
+                '--branch',
+                'main',
+                args.remote,
+                args.tempDir,
+            ], {
+                env: Object.assign(Object.assign({}, process.env), { BKPER_CLONE_TOKEN: password, GIT_TERMINAL_PROMPT: '0' }),
+            });
+        }
+        finally {
+            fs.rmSync(helperPath, { force: true });
+        }
+    });
+}
+/**
+ * Atomically clones a managed App source repository.
+ * Never installs dependencies or executes repository lifecycle scripts.
+ */
+export function cloneManagedApp(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        const cwd = (_a = options.cwd) !== null && _a !== void 0 ? _a : process.cwd();
+        const destination = resolveDestination(options.appId, options.destination, cwd);
+        const runner = (_b = options.runner) !== null && _b !== void 0 ? _b : runGit;
+        const api = (_c = options.api) !== null && _c !== void 0 ? _c : createPlatformSourceApi();
+        if (fs.existsSync(destination)) {
+            throw new ManagedGitError('CLONE_DESTINATION_EXISTS', [
+                `Destination already exists: ${destination}`,
+                'Choose another path or remove the existing directory, then retry:',
+                `  bkper app clone ${options.appId} <path>`,
+            ].join('\n'));
+        }
+        const status = yield api.getStatus(options.appId);
+        if (status === 'feature_disabled') {
+            throw new ManagedGitError('MANAGED_SOURCE_UNAVAILABLE', 'Managed source control is not enabled in this Platform environment.');
+        }
+        if (status === 'app_not_found' || status.mode !== 'managed') {
+            throw new ManagedGitError('EXTERNAL_SOURCE_CLONE', [
+                `App '${options.appId}' does not use Bkper-managed source.`,
+                'Clone it from its external Git provider (GitHub, GitLab, etc.).',
+                'If the App publishes a repository URL, use that provider clone command instead of `bkper app clone`.',
+            ].join('\n'));
+        }
+        const credential = yield api.issueCredential(options.appId, 'read');
+        const parentDir = path.dirname(destination);
+        fs.mkdirSync(parentDir, { recursive: true });
+        const tempDir = fs.mkdtempSync(path.join(parentDir, `.${options.appId}-clone-`));
+        try {
+            const cloneImpl = (_d = options.cloneImpl) !== null && _d !== void 0 ? _d : cloneWithReadToken;
+            try {
+                yield cloneImpl({
+                    remote: credential.remote,
+                    token: credential.token,
+                    tempDir,
+                    runner,
+                });
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                if (/empty|not found|could not find remote|Remote branch main not found/i.test(message)) {
+                    throw new ManagedGitError('CLONE_EMPTY_REPOSITORY', [
+                        `Managed repository for '${options.appId}' has no commit on main yet.`,
+                        'Ask the App owner to complete the first managed sync/push, then retry clone.',
+                    ].join('\n'));
+                }
+                throw error;
+            }
+            const clonedAppId = readClonedAppId(tempDir);
+            if (!clonedAppId) {
+                throw new ManagedGitError('APP_ID_MISMATCH', 'Cloned repository is missing bkper.yaml/bkper.json with an id field.');
+            }
+            if (clonedAppId !== options.appId) {
+                throw new ManagedGitError('APP_ID_MISMATCH', [
+                    'Cloned bkper.yaml id does not match the requested App ID.',
+                    `Requested: ${options.appId}`,
+                    `Found:     ${clonedAppId}`,
+                ].join('\n'));
+            }
+            yield configureManagedOrigin(tempDir, credential.remote, options.appId, runner);
+            writeManagedSourceMarker(tempDir, options.appId, credential.remote);
+            fs.renameSync(tempDir, destination);
+            return destination;
+        }
+        catch (error) {
+            fs.rmSync(tempDir, { recursive: true, force: true });
+            throw error;
+        }
+    });
+}
+export function cloneManagedAppCommand(appId, destination) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const dest = yield cloneManagedApp({ appId, destination });
+        console.log(`Cloned managed App '${appId}' into ${dest}`);
+        console.log('');
+        console.log('Next steps:');
+        console.log(`  cd ${path.relative(process.cwd(), dest) || '.'}`);
+        console.log('  bun install');
+        console.log('');
+        console.log('Clone never installs dependencies or runs repository scripts.');
+    });
+}
+//# sourceMappingURL=clone.js.map

package/lib/commands/apps/git/clone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clone.js","sourceRoot":"","sources":["../../../../src/commands/apps/git/clone.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAC,MAAM,EAAiB,MAAM,cAAc,CAAC;AACpD,OAAO,EACH,uBAAuB,EACvB,0BAA0B,GAE7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAC,sBAAsB,EAAC,MAAM,aAAa,CAAC;AACnD,OAAO,EAAC,wBAAwB,EAAC,MAAM,cAAc,CAAC;AACtD,OAAO,EAAC,eAAe,EAAC,MAAM,YAAY,CAAC;AAiB3C,SAAS,kBAAkB,CAAC,KAAa,EAAE,WAA+B,EAAE,GAAW;IACnF,IAAI,WAAW,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACpC,KAAK,MAAM,QAAQ,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,SAAS;QACb,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YACrC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB;YACzC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;QAC9C,IAAI,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,EAAE,CAAA,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,EAAE,CAAC;QACrB,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAe,kBAAkB,CAAC,IAKjC;;QACG,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,sFAAsF;QACtF,MAAM,YAAY,GAAG;YACjB,WAAW;YACX,SAAS;YACT,gCAAgC;YAChC,2DAA2D;YAC3D,EAAE;SACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChG,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,YAAY,EAAE,EAAC,IAAI,EAAE,KAAK,EAAC,CAAC,CAAC;QAC1D,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,CACb;gBACI,IAAI;gBACJ,oBAAoB;gBACpB,IAAI;gBACJ,qBAAqB,UAAU,EAAE;gBACjC,OAAO;gBACP,UAAU;gBACV,MAAM;gBACN,IAAI,CAAC,MAAM;gBACX,IAAI,CAAC,OAAO;aACf,EACD;gBACI,GAAG,kCACI,OAAO,CAAC,GAAG,KACd,iBAAiB,EAAE,QAAQ,EAC3B,mBAAmB,EAAE,GAAG,GAC3B;aACJ,CACJ,CAAC;QACN,CAAC;gBAAS,CAAC;YACP,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAC,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;QACzC,CAAC;IACL,CAAC;CAAA;AAED;;;GAGG;AACH,MAAM,UAAgB,eAAe,CAAC,OAA+B;;;QACjE,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,MAAM,CAAC;QACxC,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,uBAAuB,EAAE,CAAC;QAErD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CACrB,0BAA0B,EAC1B;gBACI,+BAA+B,WAAW,EAAE;gBAC5C,mEAAmE;gBACnE,qBAAqB,OAAO,CAAC,KAAK,SAAS;aAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAChC,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,qEAAqE,CACxE,CAAC;QACN,CAAC;QACD,IAAI,MAAM,KAAK,eAAe,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,eAAe,CACrB,uBAAuB,EACvB;gBACI,QAAQ,OAAO,CAAC,KAAK,sCAAsC;gBAC3D,iEAAiE;gBACjE,sGAAsG;aACzG,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;QACN,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;QAEjF,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,SAAS,mCAAI,kBAAkB,CAAC;YAC1D,IAAI,CAAC;gBACD,MAAM,SAAS,CAAC;oBACZ,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,KAAK,EAAE,UAAU,CAAC,KAAK;oBACvB,OAAO;oBACP,MAAM;iBACT,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,IAAI,qEAAqE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtF,MAAM,IAAI,eAAe,CACrB,wBAAwB,EACxB;wBACI,2BAA2B,OAAO,CAAC,KAAK,8BAA8B;wBACtE,8EAA8E;qBACjF,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;gBACN,CAAC;gBACD,MAAM,KAAK,CAAC;YAChB,CAAC;YAED,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,MAAM,IAAI,eAAe,CACrB,iBAAiB,EACjB,sEAAsE,CACzE,CAAC;YACN,CAAC;YACD,IAAI,WAAW,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChC,MAAM,IAAI,eAAe,CACrB,iBAAiB,EACjB;oBACI,2DAA2D;oBAC3D,cAAc,OAAO,CAAC,KAAK,EAAE;oBAC7B,cAAc,WAAW,EAAE;iBAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;YACN,CAAC;YAED,MAAM,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChF,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAEpE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACpC,OAAO,WAAW,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;YACnD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,MAAM,UAAgB,sBAAsB,CACxC,KAAa,EACb,WAAoB;;QAEpB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,EAAC,KAAK,EAAE,WAAW,EAAC,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,UAAU,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;CAAA"}

package/lib/commands/apps/git/credentials.d.ts

@@ -0,0 +1,35 @@
+import { type GitRunner } from './run-git.js';
+import { type PlatformSourceApi } from './platform-source.js';
+export interface CredentialRequest {
+    protocol?: string;
+    host?: string;
+    path?: string;
+    username?: string;
+}
+export interface CredentialHelperOptions {
+    appId?: string;
+    stdin?: string;
+    operation?: string;
+    api?: PlatformSourceApi;
+    stdout?: (chunk: string) => void;
+    stderr?: (chunk: string) => void;
+}
+/**
+ * Parses Git's credential helper stdin protocol.
+ */
+export declare function parseCredentialInput(input: string): CredentialRequest;
+export declare function buildCredentialHelperCommand(appId: string): string;
+export declare function buildCredentialConfigSection(remote: string, appId: string): string;
+/**
+ * Configures exact URL/path-scoped credentials for the managed remote.
+ * Clears inherited helpers for that credential context and pins the App ID.
+ */
+export declare function configureManagedCredentialHelper(repoRoot: string, remote: string, appId: string, runner?: GitRunner): Promise<void>;
+export declare function formatCredentialGetResponse(password: string): string;
+/**
+ * Implements `bkper app git-credential <appId>` for Git's credential helper protocol.
+ * - get: issues a short-lived write token and prints protocol fields only
+ * - store/erase: no-op (never persists)
+ */
+export declare function runGitCredentialHelper(options?: CredentialHelperOptions): Promise<number>;
+//# sourceMappingURL=credentials.d.ts.map

package/lib/commands/apps/git/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../src/commands/apps/git/credentials.ts"],"names":[],"mappings":"AACA,OAAO,EAAS,KAAK,SAAS,EAAC,MAAM,cAAc,CAAC;AACpD,OAAO,EAGH,KAAK,iBAAiB,EACzB,MAAM,sBAAsB,CAAC;AAQ9B,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAkBrE;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlE;AAMD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQlF;AAED;;;GAGG;AACH,wBAAsB,gCAAgC,CAClD,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,SAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAmBf;AA0BD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CACxC,OAAO,GAAE,uBAA4B,GACtC,OAAO,CAAC,MAAM,CAAC,CAgFjB"}

package/lib/commands/apps/git/credentials.js

@@ -0,0 +1,196 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+import { AUTHENTICATION_REQUIRED_MESSAGE } from '../../../auth/auth-errors.js';
+import { runGit } from './run-git.js';
+import { createPlatformSourceApi, stripRepositoryTokenSecret, } from './platform-source.js';
+import { CREDENTIAL_USERNAME, ManagedGitError, } from './types.js';
+import { isArtifactsRemoteUrl, normalizeRemoteUrl } from './inspect.js';
+/**
+ * Parses Git's credential helper stdin protocol.
+ */
+export function parseCredentialInput(input) {
+    const request = {};
+    for (const rawLine of input.split(/\r?\n/)) {
+        const line = rawLine.trimEnd();
+        if (!line) {
+            continue;
+        }
+        const eq = line.indexOf('=');
+        if (eq <= 0) {
+            continue;
+        }
+        const key = line.slice(0, eq);
+        const value = line.slice(eq + 1);
+        if (key === 'protocol' || key === 'host' || key === 'path' || key === 'username') {
+            request[key] = value;
+        }
+    }
+    return request;
+}
+export function buildCredentialHelperCommand(appId) {
+    // Git appends get|store|erase to this exact shell helper command.
+    return `!bkper app git-credential ${shellSingleQuote(appId)}`;
+}
+function shellSingleQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+export function buildCredentialConfigSection(remote, appId) {
+    return [
+        `[credential ${JSON.stringify(normalizeRemoteUrl(remote))}]`,
+        '    useHttpPath = true',
+        '    helper =',
+        `    helper = ${buildCredentialHelperCommand(appId)}`,
+        '',
+    ].join('\n');
+}
+/**
+ * Configures exact URL/path-scoped credentials for the managed remote.
+ * Clears inherited helpers for that credential context and pins the App ID.
+ */
+export function configureManagedCredentialHelper(repoRoot_1, remote_1, appId_1) {
+    return __awaiter(this, arguments, void 0, function* (repoRoot, remote, appId, runner = runGit) {
+        if (!isArtifactsRemoteUrl(remote)) {
+            throw new ManagedGitError('INVALID_CREDENTIAL_REQUEST', 'Managed credentials can only be configured for an Artifacts HTTPS remote.');
+        }
+        const remoteKey = normalizeRemoteUrl(remote);
+        yield runner(['config', `credential.${remoteKey}.useHttpPath`, 'true'], { cwd: repoRoot });
+        // Replace all local values with the empty helper so retries remain idempotent
+        // while clearing inherited persistent helpers for this credential context.
+        yield runner(['config', '--replace-all', `credential.${remoteKey}.helper`, ''], {
+            cwd: repoRoot,
+        });
+        yield runner(['config', '--add', `credential.${remoteKey}.helper`, buildCredentialHelperCommand(appId)], { cwd: repoRoot });
+    });
+}
+function requestMatchesRemote(request, remote) {
+    let parsed;
+    try {
+        parsed = new URL(remote);
+    }
+    catch (_a) {
+        return false;
+    }
+    if (request.protocol && request.protocol !== parsed.protocol.replace(/:$/, '')) {
+        return false;
+    }
+    if (request.host && request.host !== parsed.host) {
+        return false;
+    }
+    if (request.path) {
+        const expectedPath = parsed.pathname.replace(/^\//, '');
+        const actualPath = request.path.replace(/^\//, '');
+        if (actualPath !== expectedPath) {
+            return false;
+        }
+    }
+    return true;
+}
+export function formatCredentialGetResponse(password) {
+    return `username=${CREDENTIAL_USERNAME}\npassword=${password}\n`;
+}
+/**
+ * Implements `bkper app git-credential <appId>` for Git's credential helper protocol.
+ * - get: issues a short-lived write token and prints protocol fields only
+ * - store/erase: no-op (never persists)
+ */
+export function runGitCredentialHelper() {
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        var _a, _b, _c, _d, _e, _f;
+        const operation = (_b = (_a = options.operation) !== null && _a !== void 0 ? _a : process.argv[2]) !== null && _b !== void 0 ? _b : 'get';
+        const writeOut = (_c = options.stdout) !== null && _c !== void 0 ? _c : (chunk => process.stdout.write(chunk));
+        // stderr is available for hard failures only; never print tokens.
+        const writeErr = (_d = options.stderr) !== null && _d !== void 0 ? _d : (chunk => process.stderr.write(chunk));
+        if (operation === 'store' || operation === 'erase') {
+            return 0;
+        }
+        if (operation !== 'get') {
+            writeErr(`Unsupported credential operation '${operation}'. Expected get, store, or erase.\n`);
+            return 1;
+        }
+        try {
+            const appId = options.appId;
+            if (!appId) {
+                throw new ManagedGitError('INVALID_CREDENTIAL_REQUEST', 'The managed Git credential helper requires a pinned App ID.');
+            }
+            const stdin = (_e = options.stdin) !== null && _e !== void 0 ? _e : (yield readStdin());
+            const request = parseCredentialInput(stdin);
+            if (!request.protocol || !request.host) {
+                throw new ManagedGitError('INVALID_CREDENTIAL_REQUEST', 'Git credential request is missing protocol or host.');
+            }
+            if (request.protocol !== 'https') {
+                throw new ManagedGitError('INVALID_CREDENTIAL_REQUEST', 'Managed source credentials only support https.');
+            }
+            const api = (_f = options.api) !== null && _f !== void 0 ? _f : createPlatformSourceApi();
+            let credential;
+            try {
+                credential = yield api.issueCredential(appId, 'write');
+            }
+            catch (error) {
+                if (error instanceof ManagedGitError) {
+                    throw error;
+                }
+                throw new ManagedGitError('MANAGED_SOURCE_UNAVAILABLE', 'Failed to issue managed source credentials. Run: bkper auth login');
+            }
+            if (!requestMatchesRemote(request, credential.remote)) {
+                throw new ManagedGitError('INVALID_CREDENTIAL_REQUEST', [
+                    'Git credential request does not match the Platform-registered Artifacts remote.',
+                    'Repair managed origin configuration, then retry the Git operation.',
+                ].join('\n'));
+            }
+            const password = stripRepositoryTokenSecret(credential.token);
+            // Credential protocol output only — never log this string.
+            writeOut(formatCredentialGetResponse(password));
+            return 0;
+        }
+        catch (error) {
+            if (error instanceof ManagedGitError) {
+                if (error.code === 'AUTHENTICATION_REQUIRED') {
+                    writeErr(`${AUTHENTICATION_REQUIRED_MESSAGE}\n`);
+                }
+                else {
+                    writeErr(`${error.message}\n`);
+                }
+                return 1;
+            }
+            writeErr('Managed source credential helper failed.\n');
+            return 1;
+        }
+    });
+}
+function readStdin() {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, e_1, _b, _c;
+        const chunks = [];
+        try {
+            for (var _d = true, _e = __asyncValues(process.stdin), _f; _f = yield _e.next(), _a = _f.done, !_a; _d = true) {
+                _c = _f.value;
+                _d = false;
+                const chunk = _c;
+                chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            }
+        }
+        catch (e_1_1) { e_1 = { error: e_1_1 }; }
+        finally {
+            try {
+                if (!_d && !_a && (_b = _e.return)) yield _b.call(_e);
+            }
+            finally { if (e_1) throw e_1.error; }
+        }
+        return Buffer.concat(chunks).toString('utf8');
+    });
+}
+//# sourceMappingURL=credentials.js.map

package/lib/commands/apps/git/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../../src/commands/apps/git/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,OAAO,EAAC,+BAA+B,EAAC,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAC,MAAM,EAAiB,MAAM,cAAc,CAAC;AACpD,OAAO,EACH,uBAAuB,EACvB,0BAA0B,GAE7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACH,mBAAmB,EACnB,eAAe,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAC,oBAAoB,EAAE,kBAAkB,EAAC,MAAM,cAAc,CAAC;AAkBtE;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAC9C,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,SAAS;QACb,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACV,SAAS;QACb,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACtD,kEAAkE;IAClE,OAAO,6BAA6B,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACnC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAc,EAAE,KAAa;IACtE,OAAO;QACH,eAAe,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,GAAG;QAC5D,wBAAwB;QACxB,cAAc;QACd,gBAAgB,4BAA4B,CAAC,KAAK,CAAC,EAAE;QACrD,EAAE;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAgB,gCAAgC;yDAClD,QAAgB,EAChB,MAAc,EACd,KAAa,EACb,SAAoB,MAAM;QAE1B,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,2EAA2E,CAC9E,CAAC;QACN,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,cAAc,SAAS,cAAc,EAAE,MAAM,CAAC,EAAE,EAAC,GAAG,EAAE,QAAQ,EAAC,CAAC,CAAC;QACzF,8EAA8E;QAC9E,2EAA2E;QAC3E,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,cAAc,SAAS,SAAS,EAAE,EAAE,CAAC,EAAE;YAC5E,GAAG,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,CACR,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,SAAS,SAAS,EAAE,4BAA4B,CAAC,KAAK,CAAC,CAAC,EAC1F,EAAC,GAAG,EAAE,QAAQ,EAAC,CAClB,CAAC;IACN,CAAC;CAAA;AAED,SAAS,oBAAoB,CAAC,OAA0B,EAAE,MAAc;IACpE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,QAAgB;IACxD,OAAO,YAAY,mBAAmB,cAAc,QAAQ,IAAI,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAgB,sBAAsB;yDACxC,UAAmC,EAAE;;QAErC,MAAM,SAAS,GAAG,MAAA,MAAA,OAAO,CAAC,SAAS,mCAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,mCAAI,KAAK,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,kEAAkE;QAClE,MAAM,QAAQ,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAE1E,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACjD,OAAO,CAAC,CAAC;QACb,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACtB,QAAQ,CACJ,qCAAqC,SAAS,qCAAqC,CACtF,CAAC;YACF,OAAO,CAAC,CAAC;QACb,CAAC;QAED,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,6DAA6D,CAChE,CAAC;YACN,CAAC;YAED,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrC,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,qDAAqD,CACxD,CAAC;YACN,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,gDAAgD,CACnD,CAAC;YACN,CAAC;YAED,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,uBAAuB,EAAE,CAAC;YACrD,IAAI,UAAmC,CAAC;YACxC,IAAI,CAAC;gBACD,UAAU,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACnC,MAAM,KAAK,CAAC;gBAChB,CAAC;gBACD,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,mEAAmE,CACtE,CAAC;YACN,CAAC;YAED,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B;oBACI,iFAAiF;oBACjF,oEAAoE;iBACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;YACN,CAAC;YAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC9D,2DAA2D;YAC3D,QAAQ,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;gBACnC,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;oBAC3C,QAAQ,CAAC,GAAG,+BAA+B,IAAI,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACJ,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACnC,CAAC;gBACD,OAAO,CAAC,CAAC;YACb,CAAC;YACD,QAAQ,CAAC,4CAA4C,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;CAAA;AAED,SAAe,SAAS;;;QACpB,MAAM,MAAM,GAAa,EAAE,CAAC;;YAC5B,KAA0B,eAAA,KAAA,cAAA,OAAO,CAAC,KAAK,CAAA,IAAA,sDAAE,CAAC;gBAAhB,cAAa;gBAAb,WAAa;gBAA5B,MAAM,KAAK,KAAA,CAAA;gBAClB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,CAAC;;;;;;;;;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;CAAA"}

package/lib/commands/apps/git/index.d.ts

@@ -0,0 +1,12 @@
+export { ARTIFACTS_HOST_SUFFIX, CREDENTIAL_USERNAME, DEFAULT_MANAGED_BRANCH, ManagedGitError, SOURCE_MARKER_DIR, SOURCE_MARKER_FILE, type GitPreflightCode, type GitRemote, type GitRepositoryInfo, type ManagedSourceActivationResult, type ManagedSourceCredential, type ManagedSourcePlatformStatus, type SourceMarker, type SourceMode, type SourceModeDecision, type WorkingTreeStatus, } from './types.js';
+export { runGit, type GitCommandResult, type GitRunOptions, type GitRunner } from './run-git.js';
+export { ensureGitInitialized, findBkperYaml, findGitRoot, getCurrentBranch, getHeadSha, getOriginRemote, getWorkingTreeStatus, hasExternalRemote, inspectGitRepository, isArtifactsRemoteUrl, listRemotes, normalizeRemoteUrl, remoteUrlsEqual, requireGitRepository, } from './inspect.js';
+export { createActivationId, ensurePendingSourceMarker, getSourceMarkerPath, isUuidV4, readSourceMarker, writeManagedSourceMarker, } from './markers.js';
+export { requireManagedGitPreflight, requireManagedOrigin, type ManagedGitPreflightOptions, type ManagedGitPreflightResult, } from './preflight.js';
+export { detectSourceMode, type DetectSourceModeInput } from './mode.js';
+export { buildCredentialConfigSection, buildCredentialHelperCommand, configureManagedCredentialHelper, formatCredentialGetResponse, parseCredentialInput, runGitCredentialHelper, type CredentialHelperOptions, type CredentialRequest, } from './credentials.js';
+export { createPlatformSourceApi, getPlatformBaseUrl, stripRepositoryTokenSecret, type PlatformSourceApi, } from './platform-source.js';
+export { configureManagedOrigin } from './remote.js';
+export { assertFastForwardPush, pushCurrentBranchSafe, type SafePushOptions, type SafePushResult, } from './push.js';
+export { cloneManagedApp, cloneManagedAppCommand, type CloneManagedAppOptions, } from './clone.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/commands/apps/git/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/apps/git/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,6BAA6B,EAClC,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACzB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAC,MAAM,EAAE,KAAK,gBAAgB,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAC,MAAM,cAAc,CAAC;AAE/F,OAAO,EACH,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,oBAAoB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,kBAAkB,EAClB,yBAAyB,EACzB,mBAAmB,EACnB,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,GAC3B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GACjC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAC,gBAAgB,EAAE,KAAK,qBAAqB,EAAC,MAAM,WAAW,CAAC;AAEvE,OAAO,EACH,4BAA4B,EAC5B,4BAA4B,EAC5B,gCAAgC,EAChC,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACH,uBAAuB,EACvB,kBAAkB,EAClB,0BAA0B,EAC1B,KAAK,iBAAiB,GACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAC,sBAAsB,EAAC,MAAM,aAAa,CAAC;AAEnD,OAAO,EACH,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,GACtB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACH,eAAe,EACf,sBAAsB,EACtB,KAAK,sBAAsB,GAC9B,MAAM,YAAY,CAAC"}

package/lib/commands/apps/git/index.js

@@ -0,0 +1,12 @@
+export { ARTIFACTS_HOST_SUFFIX, CREDENTIAL_USERNAME, DEFAULT_MANAGED_BRANCH, ManagedGitError, SOURCE_MARKER_DIR, SOURCE_MARKER_FILE, } from './types.js';
+export { runGit } from './run-git.js';
+export { ensureGitInitialized, findBkperYaml, findGitRoot, getCurrentBranch, getHeadSha, getOriginRemote, getWorkingTreeStatus, hasExternalRemote, inspectGitRepository, isArtifactsRemoteUrl, listRemotes, normalizeRemoteUrl, remoteUrlsEqual, requireGitRepository, } from './inspect.js';
+export { createActivationId, ensurePendingSourceMarker, getSourceMarkerPath, isUuidV4, readSourceMarker, writeManagedSourceMarker, } from './markers.js';
+export { requireManagedGitPreflight, requireManagedOrigin, } from './preflight.js';
+export { detectSourceMode } from './mode.js';
+export { buildCredentialConfigSection, buildCredentialHelperCommand, configureManagedCredentialHelper, formatCredentialGetResponse, parseCredentialInput, runGitCredentialHelper, } from './credentials.js';
+export { createPlatformSourceApi, getPlatformBaseUrl, stripRepositoryTokenSecret, } from './platform-source.js';
+export { configureManagedOrigin } from './remote.js';
+export { assertFastForwardPush, pushCurrentBranchSafe, } from './push.js';
+export { cloneManagedApp, cloneManagedAppCommand, } from './clone.js';
+//# sourceMappingURL=index.js.map

package/lib/commands/apps/git/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/apps/git/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GAWrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAC,MAAM,EAA4D,MAAM,cAAc,CAAC;AAE/F,OAAO,EACH,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,oBAAoB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,kBAAkB,EAClB,yBAAyB,EACzB,mBAAmB,EACnB,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,GAC3B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,0BAA0B,EAC1B,oBAAoB,GAGvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAC,gBAAgB,EAA6B,MAAM,WAAW,CAAC;AAEvE,OAAO,EACH,4BAA4B,EAC5B,4BAA4B,EAC5B,gCAAgC,EAChC,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,GAGzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACH,uBAAuB,EACvB,kBAAkB,EAClB,0BAA0B,GAE7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAC,sBAAsB,EAAC,MAAM,aAAa,CAAC;AAEnD,OAAO,EACH,qBAAqB,EACrB,qBAAqB,GAGxB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACH,eAAe,EACf,sBAAsB,GAEzB,MAAM,YAAY,CAAC"}

package/lib/commands/apps/git/inspect.d.ts

@@ -0,0 +1,26 @@
+import { type GitRunner } from './run-git.js';
+import { type GitRemote, type GitRepositoryInfo, type WorkingTreeStatus } from './types.js';
+export declare function isArtifactsRemoteUrl(url: string): boolean;
+export declare function normalizeRemoteUrl(url: string): string;
+export declare function remoteUrlsEqual(left: string, right: string): boolean;
+/**
+ * Resolves the Git repository root for a path, or null when outside a repo.
+ */
+export declare function findGitRoot(startDir: string, runner?: GitRunner): Promise<string | null>;
+export declare function findBkperYaml(dir: string): string | null;
+export declare function listRemotes(repoRoot: string, runner?: GitRunner): Promise<GitRemote[]>;
+export declare function hasExternalRemote(remotes: GitRemote[]): boolean;
+export declare function getOriginRemote(remotes: GitRemote[]): GitRemote | undefined;
+export declare function getCurrentBranch(repoRoot: string, runner?: GitRunner): Promise<{
+    branch: string | null;
+    detached: boolean;
+}>;
+export declare function getHeadSha(repoRoot: string, runner?: GitRunner): Promise<string | null>;
+export declare function getWorkingTreeStatus(repoRoot: string, runner?: GitRunner): Promise<WorkingTreeStatus>;
+/**
+ * Inspects the Git repository surrounding an app directory.
+ */
+export declare function inspectGitRepository(appDir: string, runner?: GitRunner): Promise<GitRepositoryInfo | null>;
+export declare function ensureGitInitialized(targetDir: string, runner?: GitRunner): Promise<boolean>;
+export declare function requireGitRepository(info: GitRepositoryInfo | null): asserts info is GitRepositoryInfo;
+//# sourceMappingURL=inspect.d.ts.map

package/lib/commands/apps/git/inspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../../../../src/commands/apps/git/inspect.ts"],"names":[],"mappings":"AAEA,OAAO,EAAS,KAAK,SAAS,EAAC,MAAM,cAAc,CAAC;AACpD,OAAO,EAGH,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACzB,MAAM,YAAY,CAAC;AAEpB,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAczD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,SAAkB,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUxB;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUxD;AAED,wBAAsB,WAAW,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,SAAkB,GAC3B,OAAO,CAAC,SAAS,EAAE,CAAC,CAyBtB;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAE/D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS,CAE3E;AAED,wBAAsB,gBAAgB,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,SAAkB,GAC3B,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAC,CAAC,CASrD;AAED,wBAAsB,UAAU,CAC5B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,SAAkB,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUxB;AAED,wBAAsB,oBAAoB,CACtC,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,SAAkB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAqC5B;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,SAAkB,GAC3B,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA2BnC;AAED,wBAAsB,oBAAoB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,SAAkB,GAC3B,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wBAAgB,oBAAoB,CAChC,IAAI,EAAE,iBAAiB,GAAG,IAAI,GAC/B,OAAO,CAAC,IAAI,IAAI,iBAAiB,CAanC"}