bkper 4.24.2 → 4.24.3

package/lib/commands/apps/git/platform-source.js

@@ -0,0 +1,151 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { AUTHENTICATION_REQUIRED_MESSAGE } from '../../../auth/auth-errors.js';
+import { getStoredOAuthToken } from '../../../auth/local-auth-service.js';
+import { createPlatformClient } from '../../../platform/client.js';
+import { ManagedGitError, } from './types.js';
+const PLATFORM_API_URL = process.env.BKPER_PLATFORM_URL || 'https://platform.bkper.app';
+function redactSecrets(value) {
+    return value
+        .replace(/(password=)[^\n\r]*/gi, '$1[redacted]')
+        .replace(/(Bearer\s+)[A-Za-z0-9._\-]+/gi, '$1[redacted]')
+        .replace(/([?&]token=)[^&\s]+/gi, '$1[redacted]');
+}
+function asErrorMessage(body, fallback) {
+    var _a, _b;
+    const message = (_b = (_a = body === null || body === void 0 ? void 0 : body.error) === null || _a === void 0 ? void 0 : _a.message) !== null && _b !== void 0 ? _b : fallback;
+    return redactSecrets(message);
+}
+function authorizedFetch(path_1) {
+    return __awaiter(this, arguments, void 0, function* (path, init = {}, requireAuthentication = true) {
+        var _a;
+        const token = yield getStoredOAuthToken();
+        if (!token && requireAuthentication) {
+            throw new ManagedGitError('AUTHENTICATION_REQUIRED', AUTHENTICATION_REQUIRED_MESSAGE);
+        }
+        const response = yield fetch(`${PLATFORM_API_URL}${path}`, Object.assign(Object.assign({}, init), { headers: Object.assign(Object.assign(Object.assign(Object.assign({}, (token ? { Authorization: `Bearer ${token}` } : {})), { Accept: 'application/json' }), (init.body ? { 'Content-Type': 'application/json' } : {})), ((_a = init.headers) !== null && _a !== void 0 ? _a : {})) }));
+        let body = undefined;
+        const text = yield response.text();
+        if (text) {
+            try {
+                body = JSON.parse(text);
+            }
+            catch (_b) {
+                body = undefined;
+            }
+        }
+        return { response, body };
+    });
+}
+function throwPlatformError(response, body, fallback) {
+    var _a;
+    const code = (_a = body === null || body === void 0 ? void 0 : body.error) === null || _a === void 0 ? void 0 : _a.code;
+    const message = asErrorMessage(body, fallback);
+    if (response.status === 401 || code === 'MISSING_TOKEN' || code === 'INVALID_TOKEN') {
+        throw new ManagedGitError('AUTHENTICATION_REQUIRED', `${AUTHENTICATION_REQUIRED_MESSAGE}${message ? ` (${message})` : ''}`);
+    }
+    if (code === 'SOURCE_FEATURE_DISABLED' || response.status === 503) {
+        throw new ManagedGitError('MANAGED_SOURCE_UNAVAILABLE', 'Managed source control is not enabled in this Platform environment.');
+    }
+    if (code === 'SOURCE_RECORD_MISSING' || response.status === 409) {
+        throw new ManagedGitError('MANAGED_SOURCE_UNAVAILABLE', message ||
+            'Managed source record is missing or mismatched. Retry if this is a transient lookup, or request owner/developer access.');
+    }
+    if (response.status === 403 || code === 'ACCESS_DENIED') {
+        throw new ManagedGitError('MANAGED_SOURCE_UNAVAILABLE', message ||
+            'You do not have owner/developer access to this managed source. Request access from the App owner.');
+    }
+    if (response.status === 404 || code === 'APP_NOT_FOUND') {
+        throw new ManagedGitError('MANAGED_SOURCE_UNAVAILABLE', message || 'App not found for managed source.');
+    }
+    throw new ManagedGitError('MANAGED_SOURCE_UNAVAILABLE', message || fallback);
+}
+export function createPlatformSourceApi() {
+    return {
+        getStatus(appId) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a, _b;
+                const { response, body } = yield authorizedFetch(`/api/apps/${encodeURIComponent(appId)}/source`, {}, false);
+                const errorBody = body;
+                if (response.status === 503 || ((_a = errorBody === null || errorBody === void 0 ? void 0 : errorBody.error) === null || _a === void 0 ? void 0 : _a.code) === 'SOURCE_FEATURE_DISABLED') {
+                    return 'feature_disabled';
+                }
+                if (response.status === 404 || ((_b = errorBody === null || errorBody === void 0 ? void 0 : errorBody.error) === null || _b === void 0 ? void 0 : _b.code) === 'APP_NOT_FOUND') {
+                    return 'app_not_found';
+                }
+                if (!response.ok) {
+                    throwPlatformError(response, errorBody, 'Failed to load managed source status.');
+                }
+                const status = body;
+                if ((status === null || status === void 0 ? void 0 : status.mode) === 'managed' &&
+                    (typeof status.remote !== 'string' || status.remote.length === 0)) {
+                    throw new ManagedGitError('MANAGED_SOURCE_UNAVAILABLE', 'Managed source status did not include the registered remote.');
+                }
+                return status;
+            });
+        },
+        activate(appId, activationId) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                const { response, body } = yield authorizedFetch(`/api/apps/${encodeURIComponent(appId)}/source/activate`, {
+                    method: 'POST',
+                    body: JSON.stringify({ activationId }),
+                });
+                const errorBody = body;
+                if (!response.ok) {
+                    throwPlatformError(response, errorBody, 'Failed to activate managed source.');
+                }
+                const result = body;
+                if (!(result === null || result === void 0 ? void 0 : result.success) ||
+                    ((_a = result.source) === null || _a === void 0 ? void 0 : _a.appId) !== appId ||
+                    typeof result.source.remote !== 'string') {
+                    throw new ManagedGitError('MANAGED_SOURCE_UNAVAILABLE', 'Managed source activation response was invalid.');
+                }
+                return result;
+            });
+        },
+        issueCredential(appId, scope) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const { response, body } = yield authorizedFetch(`/api/apps/${encodeURIComponent(appId)}/source/credentials`, {
+                    method: 'POST',
+                    body: JSON.stringify({ scope }),
+                });
+                const errorBody = body;
+                if (!response.ok) {
+                    throwPlatformError(response, errorBody, 'Failed to issue managed source credentials.');
+                }
+                const credential = body;
+                if (!credential ||
+                    typeof credential.token !== 'string' ||
+                    typeof credential.remote !== 'string') {
+                    throw new ManagedGitError('MANAGED_SOURCE_UNAVAILABLE', 'Managed source credential response was invalid.');
+                }
+                return credential;
+            });
+        },
+    };
+}
+/**
+ * Ensures the platform client module remains the auth base for non-source routes.
+ * Source operations keep a small fetch wrapper for explicit no-store and token-redaction handling.
+ */
+export function getPlatformBaseUrl() {
+    createPlatformClient();
+    return PLATFORM_API_URL;
+}
+/**
+ * Strips provider query suffixes from repository tokens before handing them to Git.
+ * Never log the returned secret.
+ */
+export function stripRepositoryTokenSecret(token) {
+    const queryIndex = token.indexOf('?');
+    return queryIndex === -1 ? token : token.slice(0, queryIndex);
+}
+//# sourceMappingURL=platform-source.js.map

package/lib/commands/apps/git/platform-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-source.js","sourceRoot":"","sources":["../../../../src/commands/apps/git/platform-source.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAC,+BAA+B,EAAC,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAC,mBAAmB,EAAC,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAC,oBAAoB,EAAC,MAAM,6BAA6B,CAAC;AACjE,OAAO,EACH,eAAe,GAIlB,MAAM,YAAY,CAAC;AAEpB,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;AAsBxF,SAAS,aAAa,CAAC,KAAa;IAChC,OAAO,KAAK;SACP,OAAO,CAAC,uBAAuB,EAAE,cAAc,CAAC;SAChD,OAAO,CACJ,+BAA+B,EAC/B,cAAc,CACjB;SACA,OAAO,CACJ,uBAAuB,EACvB,cAAc,CACjB,CAAC;AACV,CAAC;AAED,SAAS,cAAc,CAAC,IAAmC,EAAE,QAAgB;;IACzE,MAAM,OAAO,GAAG,MAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,0CAAE,OAAO,mCAAI,QAAQ,CAAC;IACjD,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,SAAe,eAAe;yDAC1B,IAAY,EACZ,OAAoB,EAAE,EACtB,qBAAqB,GAAG,IAAI;;QAE5B,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,qBAAqB,EAAE,CAAC;YAClC,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,+BAA+B,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,gBAAgB,GAAG,IAAI,EAAE,kCAClD,IAAI,KACP,OAAO,8DACA,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,aAAa,EAAE,UAAU,KAAK,EAAE,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KACpD,MAAM,EAAE,kBAAkB,KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,cAAc,EAAE,kBAAkB,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GACvD,CAAC,MAAA,IAAI,CAAC,OAAO,mCAAI,EAAE,CAAC,KAE7B,CAAC;QAEH,IAAI,IAAI,GAAY,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,WAAM,CAAC;gBACL,IAAI,GAAG,SAAS,CAAC;YACrB,CAAC;QACL,CAAC;QACD,OAAO,EAAC,QAAQ,EAAE,IAAI,EAAC,CAAC;IAC5B,CAAC;CAAA;AAED,SAAS,kBAAkB,CACvB,QAAkB,EAClB,IAAmC,EACnC,QAAgB;;IAEhB,MAAM,IAAI,GAAG,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,0CAAE,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE/C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAClF,MAAM,IAAI,eAAe,CACrB,yBAAyB,EACzB,GAAG,+BAA+B,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxE,CAAC;IACN,CAAC;IACD,IAAI,IAAI,KAAK,yBAAyB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChE,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,qEAAqE,CACxE,CAAC;IACN,CAAC;IACD,IAAI,IAAI,KAAK,uBAAuB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9D,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,OAAO;YACH,yHAAyH,CAChI,CAAC;IACN,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QACtD,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,OAAO;YACH,mGAAmG,CAC1G,CAAC;IACN,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QACtD,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,OAAO,IAAI,mCAAmC,CACjD,CAAC;IACN,CAAC;IAED,MAAM,IAAI,eAAe,CAAC,4BAA4B,EAAE,OAAO,IAAI,QAAQ,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,uBAAuB;IACnC,OAAO;QACG,SAAS,CAAC,KAAa;;;gBACzB,MAAM,EAAC,QAAQ,EAAE,IAAI,EAAC,GAAG,MAAM,eAAe,CAC1C,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAC/C,EAAE,EACF,KAAK,CACR,CAAC;gBACF,MAAM,SAAS,GAAG,IAAqC,CAAC;gBACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAA,MAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,KAAK,0CAAE,IAAI,MAAK,yBAAyB,EAAE,CAAC;oBAClF,OAAO,kBAAkB,CAAC;gBAC9B,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAA,MAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,KAAK,0CAAE,IAAI,MAAK,eAAe,EAAE,CAAC;oBACxE,OAAO,eAAe,CAAC;gBAC3B,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACf,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,uCAAuC,CAAC,CAAC;gBACrF,CAAC;gBACD,MAAM,MAAM,GAAG,IAAmC,CAAC;gBACnD,IACI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,MAAK,SAAS;oBAC1B,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,EACnE,CAAC;oBACC,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,8DAA8D,CACjE,CAAC;gBACN,CAAC;gBACD,OAAO,MAAM,CAAC;YAClB,CAAC;SAAA;QAEK,QAAQ,CAAC,KAAa,EAAE,YAAoB;;;gBAC9C,MAAM,EAAC,QAAQ,EAAE,IAAI,EAAC,GAAG,MAAM,eAAe,CAC1C,aAAa,kBAAkB,CAAC,KAAK,CAAC,kBAAkB,EACxD;oBACI,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAC,YAAY,EAAC,CAAC;iBACvC,CACJ,CAAC;gBACF,MAAM,SAAS,GAAG,IAAqC,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACf,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,oCAAoC,CAAC,CAAC;gBAClF,CAAC;gBACD,MAAM,MAAM,GAAG,IAAqC,CAAC;gBACrD,IACI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,CAAA;oBAChB,CAAA,MAAA,MAAM,CAAC,MAAM,0CAAE,KAAK,MAAK,KAAK;oBAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,EAC1C,CAAC;oBACC,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,iDAAiD,CACpD,CAAC;gBACN,CAAC;gBACD,OAAO,MAAM,CAAC;YAClB,CAAC;SAAA;QAEK,eAAe,CAAC,KAAa,EAAE,KAAuB;;gBACxD,MAAM,EAAC,QAAQ,EAAE,IAAI,EAAC,GAAG,MAAM,eAAe,CAC1C,aAAa,kBAAkB,CAAC,KAAK,CAAC,qBAAqB,EAC3D;oBACI,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAC,KAAK,EAAC,CAAC;iBAChC,CACJ,CAAC;gBACF,MAAM,SAAS,GAAG,IAAqC,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACf,kBAAkB,CACd,QAAQ,EACR,SAAS,EACT,6CAA6C,CAChD,CAAC;gBACN,CAAC;gBACD,MAAM,UAAU,GAAG,IAA+B,CAAC;gBACnD,IACI,CAAC,UAAU;oBACX,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;oBACpC,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,EACvC,CAAC;oBACC,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,iDAAiD,CACpD,CAAC;gBACN,CAAC;gBACD,OAAO,UAAU,CAAC;YACtB,CAAC;SAAA;KACJ,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAC9B,oBAAoB,EAAE,CAAC;IACvB,OAAO,gBAAgB,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACpD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC"}

package/lib/commands/apps/git/preflight.d.ts

@@ -0,0 +1,21 @@
+import { type GitRunner } from './run-git.js';
+import { type GitRepositoryInfo, type WorkingTreeStatus } from './types.js';
+export interface ManagedGitPreflightOptions {
+    requireMainBranch?: boolean;
+    expectedOriginRemote?: string;
+    appDir?: string;
+    runner?: GitRunner;
+}
+export interface ManagedGitPreflightResult {
+    repo: GitRepositoryInfo;
+    branch: string;
+    head: string;
+    tree: WorkingTreeStatus;
+}
+/**
+ * Validates the local Git state required for managed source operations.
+ * Never mutates the repository.
+ */
+export declare function requireManagedGitPreflight(options?: ManagedGitPreflightOptions): Promise<ManagedGitPreflightResult>;
+export declare function requireManagedOrigin(repo: GitRepositoryInfo, expectedRemote: string): void;
+//# sourceMappingURL=preflight.d.ts.map

package/lib/commands/apps/git/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../../../src/commands/apps/git/preflight.ts"],"names":[],"mappings":"AAOA,OAAO,EAAS,KAAK,SAAS,EAAC,MAAM,cAAc,CAAC;AACpD,OAAO,EAGH,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACzB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,0BAA0B;IACvC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACtC,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;CAC3B;AAeD;;;GAGG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,GAAE,0BAA+B,GACzC,OAAO,CAAC,yBAAyB,CAAC,CAoGpC;AAED,wBAAgB,oBAAoB,CAChC,IAAI,EAAE,iBAAiB,EACvB,cAAc,EAAE,MAAM,GACvB,IAAI,CAsCN"}

package/lib/commands/apps/git/preflight.js

@@ -0,0 +1,130 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { getOriginRemote, getWorkingTreeStatus, inspectGitRepository, remoteUrlsEqual, requireGitRepository, } from './inspect.js';
+import { runGit } from './run-git.js';
+import { DEFAULT_MANAGED_BRANCH, ManagedGitError, } from './types.js';
+function formatFileList(files, limit = 10) {
+    if (files.length === 0) {
+        return '';
+    }
+    const shown = files.slice(0, limit);
+    const remaining = files.length - shown.length;
+    const lines = shown.map(file => `  - ${file}`);
+    if (remaining > 0) {
+        lines.push(`  - ...and ${remaining} more`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Validates the local Git state required for managed source operations.
+ * Never mutates the repository.
+ */
+export function requireManagedGitPreflight() {
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        var _a, _b, _c;
+        const runner = (_a = options.runner) !== null && _a !== void 0 ? _a : runGit;
+        const appDir = (_b = options.appDir) !== null && _b !== void 0 ? _b : process.cwd();
+        const repo = yield inspectGitRepository(appDir, runner);
+        requireGitRepository(repo);
+        if (repo.isNestedApp) {
+            throw new ManagedGitError('BKPER_YAML_NOT_AT_GIT_ROOT', [
+                'Managed source requires bkper.yaml at the Git repository root.',
+                `Git root: ${repo.root}`,
+                `App config: ${(_c = repo.bkperYamlPath) !== null && _c !== void 0 ? _c : appDir}`,
+                'Nested monorepo Apps keep external source mode and are not migrated automatically.',
+            ].join('\n'));
+        }
+        if (!repo.hasCommits || !repo.head) {
+            throw new ManagedGitError('NO_COMMITS', [
+                'Managed source requires a committed HEAD.',
+                'Create an initial commit, then retry:',
+                '  git add .',
+                '  git commit -m "Initial app"',
+            ].join('\n'));
+        }
+        if (repo.detached || !repo.branch) {
+            throw new ManagedGitError('DETACHED_HEAD', [
+                'Managed source requires an attached branch (detached HEAD is not allowed).',
+                'Create or switch to a branch first, for example:',
+                '  git switch -c main',
+                'or:',
+                '  git switch -c rollback/<name> <commit>',
+            ].join('\n'));
+        }
+        if (options.requireMainBranch && repo.branch !== DEFAULT_MANAGED_BRANCH) {
+            throw new ManagedGitError('FIRST_ACTIVATION_NOT_MAIN', [
+                `First managed-source activation requires branch '${DEFAULT_MANAGED_BRANCH}'.`,
+                `Current branch: ${repo.branch}`,
+                'Switch to main without rewriting history, for example:',
+                '  git switch main',
+            ].join('\n'));
+        }
+        const tree = yield getWorkingTreeStatus(repo.root, runner);
+        if (tree.staged.length > 0) {
+            throw new ManagedGitError('STAGED_CHANGES', [
+                'Managed source requires a clean working tree (no staged changes).',
+                'Review and commit or unstage these files:',
+                formatFileList(tree.staged),
+            ].join('\n'), tree.staged);
+        }
+        if (tree.modified.length > 0) {
+            throw new ManagedGitError('MODIFIED_TRACKED_FILES', [
+                'Managed source requires a clean working tree (no modified tracked files).',
+                'Review and commit or restore these files:',
+                formatFileList(tree.modified),
+            ].join('\n'), tree.modified);
+        }
+        if (tree.untracked.length > 0) {
+            throw new ManagedGitError('UNTRACKED_FILES', [
+                'Managed source requires a clean working tree (no non-ignored untracked files).',
+                'Review, commit, or ignore these files:',
+                formatFileList(tree.untracked),
+            ].join('\n'), tree.untracked);
+        }
+        if (options.expectedOriginRemote) {
+            requireManagedOrigin(repo, options.expectedOriginRemote);
+        }
+        return {
+            repo,
+            branch: repo.branch,
+            head: repo.head,
+            tree,
+        };
+    });
+}
+export function requireManagedOrigin(repo, expectedRemote) {
+    const origin = getOriginRemote(repo.remotes);
+    if (!origin) {
+        throw new ManagedGitError('MISSING_MANAGED_ORIGIN', [
+            'Managed source requires the Artifacts repository configured as `origin`.',
+            'Repair local Git config with:',
+            `  git remote add origin ${expectedRemote}`,
+            'Then install the Bkper credential helper and retry.',
+        ].join('\n'));
+    }
+    if (!origin.isArtifacts) {
+        throw new ManagedGitError('EXTERNAL_ORIGIN_PRESENT', [
+            'Managed source keeps Artifacts as `origin` and never rewrites an external remote.',
+            `Current origin: ${origin.url}`,
+            'Rename or remove the external origin yourself only if you intend to use managed source on this clone, for example:',
+            '  git remote rename origin upstream',
+            `  git remote add origin ${expectedRemote}`,
+        ].join('\n'));
+    }
+    if (!remoteUrlsEqual(origin.url, expectedRemote)) {
+        throw new ManagedGitError('INCORRECT_MANAGED_ORIGIN', [
+            'The configured `origin` does not match the Platform-registered Artifacts remote.',
+            `Expected: ${expectedRemote}`,
+            `Actual:   ${origin.url}`,
+            'Repair the origin URL only when you are sure this clone belongs to that managed App.',
+        ].join('\n'));
+    }
+}
+//# sourceMappingURL=preflight.js.map

package/lib/commands/apps/git/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../../../src/commands/apps/git/preflight.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACH,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAC,MAAM,EAAiB,MAAM,cAAc,CAAC;AACpD,OAAO,EACH,sBAAsB,EACtB,eAAe,GAGlB,MAAM,YAAY,CAAC;AAgBpB,SAAS,cAAc,CAAC,KAAe,EAAE,KAAK,GAAG,EAAE;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,cAAc,SAAS,OAAO,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAgB,0BAA0B;yDAC5C,UAAsC,EAAE;;QAExC,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,MAAM,CAAC;QACxC,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxD,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAE3B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B;gBACI,gEAAgE;gBAChE,aAAa,IAAI,CAAC,IAAI,EAAE;gBACxB,eAAe,MAAA,IAAI,CAAC,aAAa,mCAAI,MAAM,EAAE;gBAC7C,oFAAoF;aACvF,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;QACN,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,eAAe,CACrB,YAAY,EACZ;gBACI,2CAA2C;gBAC3C,uCAAuC;gBACvC,aAAa;gBACb,+BAA+B;aAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;QACN,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,eAAe,CACrB,eAAe,EACf;gBACI,4EAA4E;gBAC5E,kDAAkD;gBAClD,sBAAsB;gBACtB,KAAK;gBACL,0CAA0C;aAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;QACN,CAAC;QAED,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;YACtE,MAAM,IAAI,eAAe,CACrB,2BAA2B,EAC3B;gBACI,oDAAoD,sBAAsB,IAAI;gBAC9E,mBAAmB,IAAI,CAAC,MAAM,EAAE;gBAChC,wDAAwD;gBACxD,mBAAmB;aACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;QACN,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACrB,gBAAgB,EAChB;gBACI,mEAAmE;gBACnE,2CAA2C;gBAC3C,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;aAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,IAAI,CAAC,MAAM,CACd,CAAC;QACN,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,eAAe,CACrB,wBAAwB,EACxB;gBACI,2EAA2E;gBAC3E,2CAA2C;gBAC3C,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;aAChC,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,IAAI,CAAC,QAAQ,CAChB,CAAC;QACN,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CACrB,iBAAiB,EACjB;gBACI,gFAAgF;gBAChF,wCAAwC;gBACxC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;aACjC,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,IAAI,CAAC,SAAS,CACjB,CAAC;QACN,CAAC;QAED,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC/B,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;YACH,IAAI;YACJ,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI;SACP,CAAC;IACN,CAAC;CAAA;AAED,MAAM,UAAU,oBAAoB,CAChC,IAAuB,EACvB,cAAsB;IAEtB,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CACrB,wBAAwB,EACxB;YACI,0EAA0E;YAC1E,+BAA+B;YAC/B,2BAA2B,cAAc,EAAE;YAC3C,qDAAqD;SACxD,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;IACN,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CACrB,yBAAyB,EACzB;YACI,mFAAmF;YACnF,mBAAmB,MAAM,CAAC,GAAG,EAAE;YAC/B,oHAAoH;YACpH,qCAAqC;YACrC,2BAA2B,cAAc,EAAE;SAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;IACN,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,eAAe,CACrB,0BAA0B,EAC1B;YACI,kFAAkF;YAClF,aAAa,cAAc,EAAE;YAC7B,aAAa,MAAM,CAAC,GAAG,EAAE;YACzB,sFAAsF;SACzF,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;IACN,CAAC;AACL,CAAC"}

package/lib/commands/apps/git/push.d.ts

@@ -0,0 +1,22 @@
+import { type GitRunner } from './run-git.js';
+export interface SafePushOptions {
+    appDir?: string;
+    expectedOriginRemote?: string;
+    requireMainBranch?: boolean;
+    runner?: GitRunner;
+}
+export interface SafePushResult {
+    branch: string;
+    head: string;
+    action: 'pushed' | 'already_up_to_date' | 'created_remote_branch';
+}
+/**
+ * Fetches the remote branch and allows only missing, equal, or ancestor remote tips.
+ */
+export declare function assertFastForwardPush(repoRoot: string, branch: string, head: string, runner?: GitRunner): Promise<'missing' | 'same' | 'ahead'>;
+/**
+ * Safe current-branch push with upstream setup.
+ * Never commits, merges, rebases, force-pushes, or discards local changes.
+ */
+export declare function pushCurrentBranchSafe(options?: SafePushOptions): Promise<SafePushResult>;
+//# sourceMappingURL=push.d.ts.map

package/lib/commands/apps/git/push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../../../src/commands/apps/git/push.ts"],"names":[],"mappings":"AAEA,OAAO,EAAS,KAAK,SAAS,EAAC,MAAM,cAAc,CAAC;AAGpD,MAAM,WAAW,eAAe;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,MAAM,CAAC,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;CACrE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,SAAkB,GAC3B,OAAO,CAAC,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,CA2CvC;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACvC,OAAO,GAAE,eAAoB,GAC9B,OAAO,CAAC,cAAc,CAAC,CA+DzB"}

package/lib/commands/apps/git/push.js

@@ -0,0 +1,107 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { getOriginRemote, listRemotes, remoteUrlsEqual } from './inspect.js';
+import { requireManagedGitPreflight } from './preflight.js';
+import { runGit } from './run-git.js';
+import { ManagedGitError } from './types.js';
+/**
+ * Fetches the remote branch and allows only missing, equal, or ancestor remote tips.
+ */
+export function assertFastForwardPush(repoRoot_1, branch_1, head_1) {
+    return __awaiter(this, arguments, void 0, function* (repoRoot, branch, head, runner = runGit) {
+        yield runner(['fetch', 'origin', branch], {
+            cwd: repoRoot,
+            allowFailure: true,
+        });
+        const remoteRef = yield runner(['rev-parse', '--verify', `refs/remotes/origin/${branch}`], {
+            cwd: repoRoot,
+            allowFailure: true,
+        });
+        if (remoteRef.exitCode !== 0) {
+            return 'missing';
+        }
+        const remoteSha = remoteRef.stdout.trim();
+        if (!remoteSha) {
+            return 'missing';
+        }
+        if (remoteSha === head) {
+            return 'same';
+        }
+        const ancestor = yield runner(['merge-base', '--is-ancestor', remoteSha, head], {
+            cwd: repoRoot,
+            allowFailure: true,
+        });
+        if (ancestor.exitCode === 0) {
+            return 'ahead';
+        }
+        throw new ManagedGitError('REMOTE_AHEAD_OR_DIVERGED', [
+            `Remote branch 'origin/${branch}' is ahead of or diverged from local HEAD.`,
+            'The CLI never force-pushes, merges, or rebases.',
+            'Fetch and reconcile intentionally, then retry:',
+            `  git fetch origin ${branch}`,
+            '  git log --oneline --left-right HEAD...origin/' + branch,
+            '  # merge or rebase by your choice, then:',
+            '  git push',
+        ].join('\n'));
+    });
+}
+/**
+ * Safe current-branch push with upstream setup.
+ * Never commits, merges, rebases, force-pushes, or discards local changes.
+ */
+export function pushCurrentBranchSafe() {
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        var _a;
+        const runner = (_a = options.runner) !== null && _a !== void 0 ? _a : runGit;
+        const preflight = yield requireManagedGitPreflight({
+            appDir: options.appDir,
+            expectedOriginRemote: options.expectedOriginRemote,
+            requireMainBranch: options.requireMainBranch,
+            runner,
+        });
+        const remotes = yield listRemotes(preflight.repo.root, runner);
+        const origin = getOriginRemote(remotes);
+        if (!origin) {
+            throw new ManagedGitError('MISSING_MANAGED_ORIGIN', 'Managed source requires `origin` before push.');
+        }
+        if (options.expectedOriginRemote && !remoteUrlsEqual(origin.url, options.expectedOriginRemote)) {
+            throw new ManagedGitError('INCORRECT_MANAGED_ORIGIN', 'origin does not match the expected managed remote.');
+        }
+        const relation = yield assertFastForwardPush(preflight.repo.root, preflight.branch, preflight.head, runner);
+        if (relation === 'same') {
+            return {
+                branch: preflight.branch,
+                head: preflight.head,
+                action: 'already_up_to_date',
+            };
+        }
+        const upstream = yield runner(['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}'], {
+            cwd: preflight.repo.root,
+            allowFailure: true,
+        });
+        const hasUpstream = upstream.exitCode === 0 && upstream.stdout.trim().length > 0;
+        if (hasUpstream) {
+            yield runner(['push', 'origin', `HEAD:${preflight.branch}`], {
+                cwd: preflight.repo.root,
+            });
+        }
+        else {
+            yield runner(['push', '-u', 'origin', `HEAD:${preflight.branch}`], {
+                cwd: preflight.repo.root,
+            });
+        }
+        return {
+            branch: preflight.branch,
+            head: preflight.head,
+            action: relation === 'missing' ? 'created_remote_branch' : 'pushed',
+        };
+    });
+}
+//# sourceMappingURL=push.js.map

package/lib/commands/apps/git/push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../../../src/commands/apps/git/push.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAC,eAAe,EAAE,WAAW,EAAE,eAAe,EAAC,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAC,0BAA0B,EAAC,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAC,MAAM,EAAiB,MAAM,cAAc,CAAC;AACpD,OAAO,EAAC,eAAe,EAAC,MAAM,YAAY,CAAC;AAe3C;;GAEG;AACH,MAAM,UAAgB,qBAAqB;yDACvC,QAAgB,EAChB,MAAc,EACd,IAAY,EACZ,SAAoB,MAAM;QAE1B,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;YACtC,GAAG,EAAE,QAAQ;YACb,YAAY,EAAE,IAAI;SACrB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,uBAAuB,MAAM,EAAE,CAAC,EAAE;YACvF,GAAG,EAAE,QAAQ;YACb,YAAY,EAAE,IAAI;SACrB,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;YAC5E,GAAG,EAAE,QAAQ;YACb,YAAY,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,eAAe,CACrB,0BAA0B,EAC1B;YACI,yBAAyB,MAAM,4CAA4C;YAC3E,iDAAiD;YACjD,gDAAgD;YAChD,sBAAsB,MAAM,EAAE;YAC9B,iDAAiD,GAAG,MAAM;YAC1D,2CAA2C;YAC3C,YAAY;SACf,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;IACN,CAAC;CAAA;AAED;;;GAGG;AACH,MAAM,UAAgB,qBAAqB;yDACvC,UAA2B,EAAE;;QAE7B,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,MAAM,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;YAC/C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;YAClD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,MAAM;SACT,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,eAAe,CACrB,wBAAwB,EACxB,+CAA+C,CAClD,CAAC;QACN,CAAC;QACD,IAAI,OAAO,CAAC,oBAAoB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,eAAe,CACrB,0BAA0B,EAC1B,oDAAoD,CACvD,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CACxC,SAAS,CAAC,IAAI,CAAC,IAAI,EACnB,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,IAAI,EACd,MAAM,CACT,CAAC;QAEF,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO;gBACH,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,MAAM,EAAE,oBAAoB;aAC/B,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CACzB,CAAC,WAAW,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAC7D;YACI,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI;YACxB,YAAY,EAAE,IAAI;SACrB,CACJ,CAAC;QACF,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAEjF,IAAI,WAAW,EAAE,CAAC;YACd,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE;gBACzD,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI;aAC3B,CAAC,CAAC;QACP,CAAC;aAAM,CAAC;YACJ,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE;gBAC/D,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI;aAC3B,CAAC,CAAC;QACP,CAAC;QAED,OAAO;YACH,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,QAAQ;SACtE,CAAC;IACN,CAAC;CAAA"}

package/lib/commands/apps/git/remote.d.ts

@@ -0,0 +1,7 @@
+import { type GitRunner } from './run-git.js';
+/**
+ * Configures Artifacts as `origin` only after managed activation.
+ * Never modifies an existing external remote.
+ */
+export declare function configureManagedOrigin(repoRoot: string, remote: string, appId: string, runner?: GitRunner): Promise<void>;
+//# sourceMappingURL=remote.d.ts.map

package/lib/commands/apps/git/remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../../src/commands/apps/git/remote.ts"],"names":[],"mappings":"AAOA,OAAO,EAAS,KAAK,SAAS,EAAC,MAAM,cAAc,CAAC;AAGpD;;;GAGG;AACH,wBAAsB,sBAAsB,CACxC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,SAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAqCf"}

package/lib/commands/apps/git/remote.js

@@ -0,0 +1,48 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { getOriginRemote, isArtifactsRemoteUrl, listRemotes, remoteUrlsEqual, } from './inspect.js';
+import { configureManagedCredentialHelper } from './credentials.js';
+import { runGit } from './run-git.js';
+import { ManagedGitError } from './types.js';
+/**
+ * Configures Artifacts as `origin` only after managed activation.
+ * Never modifies an existing external remote.
+ */
+export function configureManagedOrigin(repoRoot_1, remote_1, appId_1) {
+    return __awaiter(this, arguments, void 0, function* (repoRoot, remote, appId, runner = runGit) {
+        if (!isArtifactsRemoteUrl(remote)) {
+            throw new ManagedGitError('INVALID_CREDENTIAL_REQUEST', 'Managed origin must be an Artifacts HTTPS remote.');
+        }
+        const remotes = yield listRemotes(repoRoot, runner);
+        const origin = getOriginRemote(remotes);
+        if (!origin) {
+            yield runner(['remote', 'add', 'origin', remote], { cwd: repoRoot });
+        }
+        else if (!origin.isArtifacts) {
+            throw new ManagedGitError('EXTERNAL_ORIGIN_PRESENT', [
+                'Refusing to rewrite an external `origin` remote.',
+                `Current origin: ${origin.url}`,
+                'Rename the external remote yourself if this clone should use managed source:',
+                '  git remote rename origin upstream',
+                `  git remote add origin ${remote}`,
+            ].join('\n'));
+        }
+        else if (!remoteUrlsEqual(origin.url, remote)) {
+            throw new ManagedGitError('INCORRECT_MANAGED_ORIGIN', [
+                'An Artifacts `origin` already exists but does not match the registered remote.',
+                `Expected: ${remote}`,
+                `Actual:   ${origin.url}`,
+                'Resolve the mismatch manually. The CLI never rewrites remotes automatically.',
+            ].join('\n'));
+        }
+        yield configureManagedCredentialHelper(repoRoot, remote, appId, runner);
+    });
+}
+//# sourceMappingURL=remote.js.map

package/lib/commands/apps/git/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../../src/commands/apps/git/remote.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACH,eAAe,EACf,oBAAoB,EACpB,WAAW,EACX,eAAe,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAC,gCAAgC,EAAC,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAC,MAAM,EAAiB,MAAM,cAAc,CAAC;AACpD,OAAO,EAAC,eAAe,EAAC,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,UAAgB,sBAAsB;yDACxC,QAAgB,EAChB,MAAc,EACd,KAAa,EACb,SAAoB,MAAM;QAE1B,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,eAAe,CACrB,4BAA4B,EAC5B,mDAAmD,CACtD,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAExC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAC,GAAG,EAAE,QAAQ,EAAC,CAAC,CAAC;QACvE,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CACrB,yBAAyB,EACzB;gBACI,kDAAkD;gBAClD,mBAAmB,MAAM,CAAC,GAAG,EAAE;gBAC/B,8EAA8E;gBAC9E,qCAAqC;gBACrC,2BAA2B,MAAM,EAAE;aACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;QACN,CAAC;aAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,eAAe,CACrB,0BAA0B,EAC1B;gBACI,gFAAgF;gBAChF,aAAa,MAAM,EAAE;gBACrB,aAAa,MAAM,CAAC,GAAG,EAAE;gBACzB,8EAA8E;aACjF,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC;QACN,CAAC;QAED,MAAM,gCAAgC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;CAAA"}

package/lib/commands/apps/git/run-git.d.ts

@@ -0,0 +1,17 @@
+export interface GitCommandResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+export interface GitRunOptions {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    allowFailure?: boolean;
+    input?: string;
+}
+export type GitRunner = (args: string[], options?: GitRunOptions) => Promise<GitCommandResult>;
+/**
+ * Runs a git subprocess. Never logs secrets from env or stdout.
+ */
+export declare function runGit(args: string[], options?: GitRunOptions): Promise<GitCommandResult>;
+//# sourceMappingURL=run-git.d.ts.map

package/lib/commands/apps/git/run-git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-git.d.ts","sourceRoot":"","sources":["../../../../src/commands/apps/git/run-git.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,SAAS,GAAG,CACpB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,aAAa,KACtB,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE/B;;GAEG;AACH,wBAAsB,MAAM,CACxB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,aAAkB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAmD3B"}

package/lib/commands/apps/git/run-git.js

@@ -0,0 +1,61 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { spawn } from 'child_process';
+import { ManagedGitError } from './types.js';
+/**
+ * Runs a git subprocess. Never logs secrets from env or stdout.
+ */
+export function runGit(args_1) {
+    return __awaiter(this, arguments, void 0, function* (args, options = {}) {
+        return new Promise((resolve, reject) => {
+            const child = spawn('git', args, {
+                cwd: options.cwd,
+                env: Object.assign(Object.assign(Object.assign({}, process.env), options.env), { GIT_TERMINAL_PROMPT: '0' }),
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            let stdout = '';
+            let stderr = '';
+            child.stdout.on('data', (chunk) => {
+                stdout += chunk.toString();
+            });
+            child.stderr.on('data', (chunk) => {
+                stderr += chunk.toString();
+            });
+            if (options.input !== undefined) {
+                child.stdin.write(options.input);
+            }
+            child.stdin.end();
+            child.on('error', error => {
+                var _a;
+                reject(new ManagedGitError('GIT_COMMAND_FAILED', `Failed to run git ${(_a = args[0]) !== null && _a !== void 0 ? _a : ''}: ${error.message}`));
+            });
+            child.on('close', code => {
+                const exitCode = code !== null && code !== void 0 ? code : 1;
+                const result = { stdout: stdout.trimEnd(), stderr: stderr.trimEnd(), exitCode };
+                if (exitCode !== 0 && !options.allowFailure) {
+                    reject(new ManagedGitError('GIT_COMMAND_FAILED', formatGitFailure(args, result)));
+                    return;
+                }
+                resolve(result);
+            });
+        });
+    });
+}
+function formatGitFailure(args, result) {
+    const detail = result.stderr || result.stdout || `exit ${result.exitCode}`;
+    // Never include credential helper password protocol output in errors.
+    const redacted = detail
+        .split('\n')
+        .filter(line => !/^(username|password)=/i.test(line.trim()))
+        .join('\n')
+        .trim();
+    return `git ${args.join(' ')} failed: ${redacted || `exit ${result.exitCode}`}`;
+}
+//# sourceMappingURL=run-git.js.map

package/lib/commands/apps/git/run-git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-git.js","sourceRoot":"","sources":["../../../../src/commands/apps/git/run-git.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAC,KAAK,EAAC,MAAM,eAAe,CAAC;AACpC,OAAO,EAAC,eAAe,EAAC,MAAM,YAAY,CAAC;AAoB3C;;GAEG;AACH,MAAM,UAAgB,MAAM;yDACxB,IAAc,EACd,UAAyB,EAAE;QAE3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,gDACI,OAAO,CAAC,GAAG,GACX,OAAO,CAAC,GAAG,KACd,mBAAmB,EAAE,GAAG,GAC3B;gBACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;gBAC/C,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;gBAC/C,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC/B,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAElB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;;gBACtB,MAAM,CACF,IAAI,eAAe,CACf,oBAAoB,EACpB,qBAAqB,MAAA,IAAI,CAAC,CAAC,CAAC,mCAAI,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CACzD,CACJ,CAAC;YACN,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;gBACrB,MAAM,QAAQ,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,CAAC,CAAC;gBAC3B,MAAM,MAAM,GAAG,EAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAC,CAAC;gBAC9E,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;oBAC1C,MAAM,CACF,IAAI,eAAe,CACf,oBAAoB,EACpB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CACjC,CACJ,CAAC;oBACF,OAAO;gBACX,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CAAA;AAED,SAAS,gBAAgB,CAAC,IAAc,EAAE,MAAwB;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;SAC3D,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;IACZ,OAAO,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,QAAQ,IAAI,QAAQ,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACpF,CAAC"}