gcb-host 0.0.0 → 0.0.2

package/lib/commands/authorize.js

@@ -0,0 +1,134 @@
+/**
+ * `authorize` — get a user token for this app, once, from whoever runs it.
+ *
+ * Run on the host, beside the configuration. It prints a code, waits for that person to type it at
+ * GitHub on whatever device has a browser, and stores the refresh token next to the configuration and
+ * its key — outside every mount, never in the repository. From then on the broker renews the token by
+ * itself and nothing here has to be run again.
+ *
+ * The token is what makes a pull request authored by a person rather than by the app. Only a person
+ * can be the author of one that reviewers will not skip, and only the device flow reaches a person
+ * whose host has no browser and no callback server.
+ *
+ * Exit codes: 0 stored, 1 refused.
+ */
+import { dirname, join, resolve as resolvePath } from 'node:path';
+import { USER_TOKEN_FILE, userTokenPath, loadConfig, resolveConfigPath } from '../config.js';
+import { collectUserToken, startDeviceFlow } from '../device-flow.js';
+import { fetcherFor, parseProxy } from '../http.js';
+import { fail, insideMountedPath, isInsideContainer, parseArgs, say, writeSecretFile } from 'gcb-core';
+/** Usage text for `authorize`. */
+export const AUTHORIZE_USAGE = `Usage: gcb authorize [options]
+
+Get a user token for this app, by authorizing it once from a browser somewhere else. Run it on the host,
+beside the configuration. It stores a refresh token and prints where; nothing else needs running after
+that, because the broker renews the token itself.
+
+  --config <path>   The configuration (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)
+  --host <host>     The host block to authorize for (default: github.com)
+  --to <path>       Where to write the refresh token (default: beside the configuration)
+  --proxy <url>     Use this proxy for this command
+  --no-proxy        Reach GitHub directly for this command
+  -h, --help        Show this help
+
+The app needs its client id configured (the App ID will not do), and "Enable Device Flow" selected in
+its settings. GitHub returns a refresh token only while "Expire user authorization tokens" is selected,
+which is its default and what this wants.
+`;
+/**
+ * Where this command writes the refresh token.
+ *
+ * Beside the configuration, because the configuration is the path this process was *given*: the paths
+ * inside it belong to whichever process runs the broker, and for a sidecar those are container paths
+ * that do not exist out here. In the usual sidecar layout the configuration and the key sit in one
+ * directory, so this lands in the same file the broker reads; where they differ, the difference is
+ * printed rather than discovered later.
+ *
+ * @param configPath - the resolved configuration path.
+ * @returns the path to write the refresh token to.
+ */
+export function refreshTokenPath(configPath) {
+    return join(dirname(resolvePath(configPath)), USER_TOKEN_FILE);
+}
+/**
+ * Where the broker will look for it, which is beside the key — from the key's own point of view.
+ *
+ * @param privateKeyPath - the path as the configuration records it.
+ * @returns the path the broker reads, or `undefined` when the key is not a file.
+ */
+export function brokerReadsPath(privateKeyPath) {
+    return privateKeyPath === undefined ? undefined : userTokenPath(privateKeyPath);
+}
+/**
+ * Run the `authorize` command.
+ *
+ * @param argv - arguments after the command name.
+ * @returns the process exit code: 0 stored, 1 refused.
+ */
+import { assertProxyEnabled } from '../proxy.js';
+export async function runAuthorize(argv) {
+    const args = parseArgs(argv, { booleans: ['help', 'no-proxy'] });
+    if (args.has('no-proxy') && args.value('proxy') !== undefined)
+        fail('--proxy and --no-proxy are mutually exclusive');
+    if (args.has('proxy') && args.value('proxy') === undefined)
+        fail('--proxy needs a value');
+    const proxy = args.has('no-proxy') ? null : args.value('proxy');
+    if (proxy !== undefined && parseProxy(proxy) === false)
+        fail('--proxy must be an http(s) URL');
+    if (args.has('help') || args.has('h')) {
+        say(AUTHORIZE_USAGE);
+        return 0;
+    }
+    if (proxy === undefined)
+        assertProxyEnabled();
+    const configPath = resolveConfigPath(args.value('config'));
+    const host = args.value('host') ?? 'github.com';
+    const config = loadConfig(configPath);
+    const block = config.hosts[host];
+    if (block === undefined)
+        fail(`no host ${host} in ${configPath}`);
+    if (block.provider !== 'github-app')
+        fail(`${host} is not a github-app host`);
+    if (block.clientId === undefined) {
+        fail(`${host} has no clientId — a device flow needs the app's client id, and the App ID will not do`);
+    }
+    const fetcher = fetcherFor(proxy);
+    const code = await startDeviceFlow(block.clientId, fetcher);
+    say(`Open ${code.verificationUri} and enter: ${code.userCode}`);
+    say(`Waiting up to ${Math.round(code.expiresIn / 60)} minutes for that to be authorized…`);
+    const token = await collectUserToken(block.clientId, code, fetcher, (ms) => new Promise((done) => setTimeout(done, ms)));
+    if (token.refreshToken === undefined) {
+        fail('GitHub returned no refresh token, so the token would expire in eight hours with no way to renew.\n' +
+            '  Select "Expire user authorization tokens" in the app settings and authorize again.');
+    }
+    const target = args.value('to') ?? refreshTokenPath(configPath);
+    // The same two checks init and stage apply, for the same reason: this is a credential of a person, and
+    // the container that pushes must not be able to read it. It is written outside every mount or not at all.
+    if (isInsideContainer()) {
+        fail('run this on the host, not inside the container: the token must not land anywhere the container can read');
+    }
+    const mounted = insideMountedPath(target);
+    if (mounted !== null) {
+        fail(`${target} is inside ${mounted}, which is mounted into the container; the refresh token must live\n` +
+            '  outside every mount — the deployment directory beside the configuration is the usual place');
+    }
+    writeSecretFile(target, `${token.refreshToken}\n`);
+    say(`stored the refresh token in ${target} (mode 600)`);
+    const readByBroker = brokerReadsPath(block.privateKeyPath);
+    if (readByBroker === undefined) {
+        // An inline privateKeyPem deployment: the broker has no directory to derive a path from, so it never
+        // looks for this file. Saying otherwise would be a promise the broker does not keep.
+        say('note: this host block keeps its key inline, so the broker has nowhere to look for this file:');
+        say('      pull requests will stay app-authored until the key is a file (privateKeyPath)');
+    }
+    else if (resolvePath(readByBroker) !== resolvePath(target)) {
+        say(`note: the broker will look in ${readByBroker} — make sure that is this file, and that it is`);
+        say('      writable, because GitHub rotates the token on every exchange');
+    }
+    else {
+        say('which is where the broker looks for it — keep it writable, since the token is rotated on every use');
+    }
+    say('the broker will use it for pull requests authored by that person; nothing else needs running');
+    return 0;
+}
+//# sourceMappingURL=authorize.js.map

package/lib/commands/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/commands/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAgB,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEvG,kCAAkC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;CAgB9B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,cAAkC;IAChE,OAAO,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAuB;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,IAAI,CAAC,+CAA+C,CAAC,CAAC;IACrH,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,eAAe,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,KAAK,KAAK,SAAS;QAAE,kBAAkB,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,IAAI,OAAO,UAAU,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,IAAI,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,IAAI,wFAAwF,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,OAAO,GAAY,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,GAAG,CAAC,QAAQ,IAAI,CAAC,eAAe,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChE,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAC;IAE3F,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,KAAK,CAAC,QAAQ,EACd,IAAI,EACJ,OAAO,EACP,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACpD,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CACF,oGAAoG;YAClG,sFAAsF,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAChE,uGAAuG;IACvG,0GAA0G;IAC1G,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC,yGAAyG,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,CACF,GAAG,MAAM,cAAc,OAAO,sEAAsE;YAClG,8FAA8F,CACjG,CAAC;IACJ,CAAC;IACD,eAAe,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;IACnD,GAAG,CAAC,+BAA+B,MAAM,aAAa,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,qGAAqG;QACrG,qFAAqF;QACrF,GAAG,CAAC,8FAA8F,CAAC,CAAC;QACpG,GAAG,CAAC,qFAAqF,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,WAAW,CAAC,YAAY,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,iCAAiC,YAAY,gDAAgD,CAAC,CAAC;QACnG,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,oGAAoG,CAAC,CAAC;IAC5G,CAAC;IACD,GAAG,CAAC,8FAA8F,CAAC,CAAC;IACpG,OAAO,CAAC,CAAC;AACX,CAAC"}

package/lib/commands/compose.d.ts

@@ -0,0 +1,42 @@
+/** Everything `compose` needs, resolved. */
+export interface ComposeInput {
+    /** Host directory holding broker.config.yml, app.pem and log/. */
+    readonly dir: string;
+    /** Host configuration file; defaults to `${dir}/broker.config.yml`. */
+    readonly configPath?: string;
+    /** Host directory the pushing container already mounts, where the socket will appear. */
+    readonly socketDir: string;
+    /** `uid:gid` the sidecar runs as; must match the container that needs the socket. */
+    readonly user: string;
+    /** Base image. */
+    readonly image: string;
+    /** npm spec to run, e.g. `gcb@0.0.0`. */
+    readonly packageSpec: string;
+    /** Compose service and container name. */
+    readonly name: string;
+    /**
+     * Host directory holding the broker's code, as `stage` exports it. When given, the sidecar runs
+     * that code with the image's Node instead of fetching the package at start: no registry access
+     * at boot, and the commit that runs is the one you reviewed.
+     */
+    readonly code?: string;
+}
+/** Where a code-mounted sidecar expects the broker. */
+export declare const CODE_DIR = "/opt/gcb";
+/**
+ * Render the compose file.
+ *
+ * @param input - the resolved options.
+ * @returns the YAML, newline-terminated.
+ */
+export declare function renderCompose(input: ComposeInput): string;
+/** Usage text for `compose`. */
+export declare const COMPOSE_USAGE = "Usage: gcb compose [options]\n\nPrint a Docker sidecar definition for the broker (to stdout). Pair it with a config written by\n`init --mode sidecar`, whose paths this file fixes.\n\n  --dir <path>        Host directory holding broker.config.yml, app.pem and log/ (default: the config's directory)\n  --config <path>     The sidecar's config, checked before anything is printed\n                      (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)\n  --socket-dir <path> Host directory the pushing container already mounts\n  --code <path>       Run code mounted from this host directory instead of fetching the package\n                      at start (as `stage` exports it); nothing is fetched or built at boot\n  --user <uid:gid>    UID the sidecar runs as (default: this user)\n  --image <name>      Base image (default: node:24-slim)\n  --package <spec>    npm spec to run (default: gcb-host@<version>)\n  --name <name>       Service and container name (default: gcb)\n  -h, --help          Show this help\n";
+/**
+ * Run the `compose` command.
+ *
+ * @param argv - arguments after the command name.
+ * @returns the process exit code.
+ */
+export declare function runCompose(argv: readonly string[]): number;
+//# sourceMappingURL=compose.d.ts.map

package/lib/commands/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/commands/compose.ts"],"names":[],"mappings":"AAmBA,4CAA4C;AAC5C,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kBAAkB;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,uDAAuD;AACvD,eAAO,MAAM,QAAQ,aAAa,CAAC;AAEnC;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAgHzD;AAED,gCAAgC;AAChC,eAAO,MAAM,aAAa,kgCAgBzB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA0D1D"}

package/lib/commands/compose.js

@@ -0,0 +1,208 @@
+/**
+ * `compose` — print a Docker sidecar definition for the broker.
+ *
+ * The broker runs in its own container with the private key mounted read-only, no published
+ * ports, no capabilities and a read-only root filesystem; the only surface it shares with
+ * anything else is the socket directory. The container fetches the published package, so there
+ * is no checkout to copy and nothing to build on the host.
+ *
+ * The mount targets are constants from `deployment.ts`, shared with `init --mode sidecar`, so
+ * the paths recorded in `broker.config.yml` and the paths this file mounts cannot drift apart.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { inferMode, loadConfig, resolveConfigPath, deploymentDir, SIDECAR } from '../config.js';
+import { PACKAGE_VERSION } from 'gcb-core';
+import { fail, parseArgs, say, warn } from 'gcb-core';
+import { USER_TOKEN_FILE } from '../config.js';
+/** Where a code-mounted sidecar expects the broker. */
+export const CODE_DIR = '/opt/gcb';
+/**
+ * Render the compose file.
+ *
+ * @param input - the resolved options.
+ * @returns the YAML, newline-terminated.
+ */
+export function renderCompose(input) {
+    const socketDir = input.socketDir.replace(/\/+$/, '');
+    const configPath = input.configPath ?? `${input.dir}/broker.config.yml`;
+    const fromCode = input.code !== undefined;
+    const origin = fromCode
+        ? `# It runs the code mounted read-only from ${input.code}, which is whatever \`stage\` put there —
+# see the STAGED.json beside it for the commit. stage does not install dependencies or build:
+# run \`corepack yarn install\` in that directory first, then the source entry point runs here.`
+        : `# The image fetches the published package at start:
+#
+#   npx --yes --package '${input.packageSpec}' gcb daemon
+#
+# To avoid depending on the registry at boot, either render this file with --code <directory> to
+# run staged code from a mount, or point --image at an image of your own that already has the
+# package installed, and change \`command\` to the binary in it:
+#   ["gcb", "daemon", "--config", "${SIDECAR.configPath}"]`;
+    // The egress lines belong to both renders: a --code deployment is a sidecar too, and without them it
+    // would carry no proxy variables at all, so the daemon would go direct and hang rather than refuse.
+    const egress = `
+      # Egress. The socket needs no proxy; the broker's calls to api.github.com and github.com do.
+      - http_proxy=\${http_proxy:-\${HTTP_PROXY:-}}
+      - https_proxy=\${https_proxy:-\${HTTPS_PROXY:-}}
+      - no_proxy=\${no_proxy:-\${NO_PROXY:-}}
+      # The daemon refuses to start with a proxy variable and without this one.
+      - NODE_USE_ENV_PROXY=1
+      # Runtime override: a URL pins a proxy, an empty value goes direct, unset keeps the above.
+      - GCB_PROXY=\${GCB_PROXY-default}`;
+    const environment = fromCode
+        ? `
+    environment:${egress}`
+        : `
+    environment:
+      # npx needs somewhere writable for its cache; /tmp is a tmpfs above.
+      - npm_config_cache=/tmp/npm-cache${egress}`;
+    // A bind mount for a path that does not exist becomes a directory, and the broker would then read a
+    // directory instead of a token — for every action, not only the personal ones. Emit it once `authorize`
+    // has written the file, and say what to run until then.
+    const userRefreshMount = fs.existsSync(`${input.dir}/${USER_TOKEN_FILE}`)
+        ? `\n      # The authorized person's refresh token: the only secret mounted writable, because GitHub\n      # rotates it on every exchange.\n      - ${input.dir}/${USER_TOKEN_FILE}:${SIDECAR.userTokenPath}:rw`
+        : '\n      # No user.refresh yet: run `gcb authorize` and render this again. A mount' +
+            '\n      # for a path that does not exist would become a directory, and the broker would read that.';
+    const start = fromCode
+        ? `exec node --conditions=development ${CODE_DIR}/packages/host/bin/gcb.js daemon --config ${SIDECAR.configPath}`
+        : `exec npx --yes --package '${input.packageSpec}' gcb daemon --config ${SIDECAR.configPath}`;
+    const command = `      - sh
+      - -c
+      - |
+        case "\$\${GCB_PROXY-default}" in
+          default) ;;
+          "") unset http_proxy https_proxy all_proxy no_proxy HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY NODE_USE_ENV_PROXY ;;
+          *) export http_proxy="\$\$GCB_PROXY" https_proxy="\$\$GCB_PROXY" no_proxy=localhost,127.0.0.1 NODE_USE_ENV_PROXY=1 ;;
+        esac
+        ${start}`;
+    const codeMount = fromCode
+        ? `
+      # The code, read-only, from the commit you reviewed and staged.
+      - ${input.code}:${CODE_DIR}:ro`
+        : '';
+    return `# Docker sidecar for gcb-host@${PACKAGE_VERSION}
+#
+# The broker holds the only long-lived secret, so it runs isolated: the key is mounted
+# read-only, there are no published ports, no capabilities, and the root filesystem is
+# read-only. The socket directory is the only thing shared with the container that pushes.
+#
+#   docker compose -f <this file> up -d
+#
+${origin}
+#
+# IMPORTANT: this file fixes where the sidecar sees things, so broker.config.yml must have been
+# written for it. Create it with:
+#
+#   gcb init --mode sidecar --cert <key.pem> --allow <owner/repo> \\
+#     --client-id <id> --app-id <id> --dir ${input.dir}
+#
+# which records exactly these paths (both commands read them from one definition):
+#
+#   socketPath     ${SIDECAR.socketPath}
+#   privateKeyPath ${SIDECAR.keyPath}
+#   auditPath      ${SIDECAR.auditPath}
+#
+# A config written with --mode host records host paths and the sidecar will not start.
+services:
+  ${input.name}:
+    image: ${input.image}
+    container_name: ${input.name}
+    restart: unless-stopped
+    user: "${input.user}"
+    read_only: true
+    tmpfs:
+      - /tmp
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true${environment}
+    command:
+${command}
+    volumes:${codeMount}
+      - ${configPath}:${SIDECAR.configPath}:ro
+      - ${input.dir}/app.pem:${SIDECAR.keyPath}:ro
+${userRefreshMount}
+      - ${input.dir}/log:${SIDECAR.auditDir}
+      - ${socketDir}:${SIDECAR.socketDir}
+# The socket appears at ${socketDir}${SIDECAR.socketPath.slice(SIDECAR.socketDir.length)} on the host. Point the pushing
+# environment at the same socket with:
+#   gcb setup --socket <that path as the pusher sees it>
+`;
+}
+/** Usage text for `compose`. */
+export const COMPOSE_USAGE = `Usage: gcb compose [options]
+
+Print a Docker sidecar definition for the broker (to stdout). Pair it with a config written by
+\`init --mode sidecar\`, whose paths this file fixes.
+
+  --dir <path>        Host directory holding broker.config.yml, app.pem and log/ (default: the config's directory)
+  --config <path>     The sidecar's config, checked before anything is printed
+                      (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)
+  --socket-dir <path> Host directory the pushing container already mounts
+  --code <path>       Run code mounted from this host directory instead of fetching the package
+                      at start (as \`stage\` exports it); nothing is fetched or built at boot
+  --user <uid:gid>    UID the sidecar runs as (default: this user)
+  --image <name>      Base image (default: node:24-slim)
+  --package <spec>    npm spec to run (default: gcb-host@<version>)
+  --name <name>       Service and container name (default: gcb)
+  -h, --help          Show this help
+`;
+/**
+ * Run the `compose` command.
+ *
+ * @param argv - arguments after the command name.
+ * @returns the process exit code.
+ */
+export function runCompose(argv) {
+    const args = parseArgs(argv, { booleans: ['help'] });
+    if (args.has('help') || args.has('h')) {
+        say(COMPOSE_USAGE);
+        return 0;
+    }
+    const explicitConfig = args.value('config');
+    const dirArg = args.value('dir');
+    const configPath = path.resolve(explicitConfig !== undefined
+        ? resolveConfigPath(explicitConfig)
+        : dirArg !== undefined
+            ? path.join(dirArg, 'broker.config.yml')
+            : resolveConfigPath());
+    const dir = path.resolve(dirArg ?? deploymentDir(configPath));
+    const socketDir = args.value('socket-dir');
+    if (!socketDir) {
+        fail('--socket-dir is required (a host directory the pushing container already mounts)');
+    }
+    // Check before emitting. A config written for the other deployment produces a sidecar that
+    // starts and then cannot find its own private key, which is a confusing way to find out.
+    if (fs.existsSync(configPath)) {
+        const mode = inferMode(loadConfig(configPath));
+        if (mode !== 'sidecar') {
+            fail(`${configPath} was written with --mode host; re-run ` +
+                '`gcb init --mode sidecar ...` before using compose');
+        }
+    }
+    else {
+        warn(`no configuration at ${configPath} yet; create it with \`init --mode sidecar\` first`);
+    }
+    // POSIX only, and guaranteed to exist by the refusal above: the file this prints binds host paths
+    // and a socket directory, neither of which works from a Windows host. Asserting it here rather
+    // than defaulting to a made-up uid — a wrong `user:` line is a silent misconfiguration.
+    const uid = process.getuid?.();
+    const gid = process.getgid?.();
+    if (uid === undefined || gid === undefined) {
+        fail('compose needs a POSIX uid and gid');
+    }
+    const user = args.value('user') ?? `${uid}:${gid}`;
+    say(renderCompose({
+        dir,
+        configPath,
+        socketDir,
+        user,
+        image: args.value('image') ?? 'node:24-slim',
+        packageSpec: args.value('package') ?? `gcb-host@${PACKAGE_VERSION}`,
+        name: args.value('name') ?? 'gcb',
+        code: args.value('code'),
+    }));
+    return 0;
+}
+//# sourceMappingURL=compose.js.map

package/lib/commands/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../src/commands/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AA0B/C,uDAAuD;AACvD,MAAM,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,GAAG,KAAK,CAAC,GAAG,oBAAoB,CAAC;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;IAE1C,MAAM,MAAM,GAAG,QAAQ;QACrB,CAAC,CAAC,6CAA6C,KAAK,CAAC,IAAI;;gGAEmC;QAC5F,CAAC,CAAC;;2BAEqB,KAAK,CAAC,WAAW;;;;;qCAKP,OAAO,CAAC,UAAU,IAAI,CAAC;IAE1D,qGAAqG;IACrG,oGAAoG;IACpG,MAAM,MAAM,GAAG;;;;;;;;wCAQuB,CAAC;IAEvC,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC;kBACY,MAAM,EAAE;QACtB,CAAC,CAAC;;;yCAGmC,MAAM,EAAE,CAAC;IAEhD,oGAAoG;IACpG,wGAAwG;IACxG,wDAAwD;IACxD,MAAM,gBAAgB,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QACvE,CAAC,CAAC,qJAAqJ,KAAK,CAAC,GAAG,IAAI,eAAe,IAAI,OAAO,CAAC,aAAa,KAAK;QACjN,CAAC,CAAC,mFAAmF;YACnF,oGAAoG,CAAC;IACzG,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC,sCAAsC,QAAQ,6CAA6C,OAAO,CAAC,UAAU,EAAE;QACjH,CAAC,CAAC,6BAA6B,KAAK,CAAC,WAAW,yBAAyB,OAAO,CAAC,UAAU,EAAE,CAAC;IAChG,MAAM,OAAO,GAAG;;;;;;;;UAQR,KAAK,EAAE,CAAC;IAEhB,MAAM,SAAS,GAAG,QAAQ;QACxB,CAAC,CAAC;;UAEI,KAAK,CAAC,IAAI,IAAI,QAAQ,KAAK;QACjC,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,iCAAiC,eAAe;;;;;;;;EAQvD,MAAM;;;;;;6CAMqC,KAAK,CAAC,GAAG;;;;qBAIjC,OAAO,CAAC,UAAU;qBAClB,OAAO,CAAC,OAAO;qBACf,OAAO,CAAC,SAAS;;;;IAIlC,KAAK,CAAC,IAAI;aACD,KAAK,CAAC,KAAK;sBACF,KAAK,CAAC,IAAI;;aAEnB,KAAK,CAAC,IAAI;;;;;;;gCAOS,WAAW;;EAEzC,OAAO;cACK,SAAS;UACb,UAAU,IAAI,OAAO,CAAC,UAAU;UAChC,KAAK,CAAC,GAAG,YAAY,OAAO,CAAC,OAAO;EAC5C,gBAAgB;UACR,KAAK,CAAC,GAAG,QAAQ,OAAO,CAAC,QAAQ;UACjC,SAAS,IAAI,OAAO,CAAC,SAAS;0BACd,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;;;CAGvF,CAAC;AACF,CAAC;AAED,gCAAgC;AAChC,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;CAgB5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,aAAa,CAAC,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAC7B,cAAc,KAAK,SAAS;QAC1B,CAAC,CAAC,iBAAiB,CAAC,cAAc,CAAC;QACnC,CAAC,CAAC,MAAM,KAAK,SAAS;YACpB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC;YACxC,CAAC,CAAC,iBAAiB,EAAE,CAC1B,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC3F,CAAC;IAED,2FAA2F;IAC3F,yFAAyF;IACzF,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CACF,GAAG,UAAU,wCAAwC;gBACnD,oDAAoD,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,uBAAuB,UAAU,oDAAoD,CAAC,CAAC;IAC9F,CAAC;IAED,kGAAkG;IAClG,+FAA+F;IAC/F,wFAAwF;IACxF,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;IAEnD,GAAG,CACD,aAAa,CAAC;QACZ,GAAG;QACH,UAAU;QACV,SAAS;QACT,IAAI;QACJ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,cAAc;QAC5C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,YAAY,eAAe,EAAE;QACnE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK;QACjC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;KACzB,CAAC,CACH,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/lib/commands/deployment.d.ts

@@ -0,0 +1,49 @@
+import type { DeploymentMode } from '../config.ts';
+/** The modes, for validation and help text. */
+export declare const DEPLOYMENT_MODES: readonly DeploymentMode[];
+/** Paths recorded in the configuration, as the broker process will resolve them. */
+export interface BrokerPaths {
+    readonly socketPath: string;
+    readonly privateKeyPath: string;
+    readonly auditPath: string;
+}
+/** Files `init` writes on the host. The same in both modes; only the recorded paths differ. */
+export interface HostArtifacts {
+    readonly keyPath: string;
+    /** Where authorize leaves the refresh token, beside the key. */
+    readonly userTokenPath: string;
+    readonly configPath: string;
+    readonly auditDir: string;
+}
+/** The socket path a host-process deployment uses unless told otherwise. */
+export declare const HOST_SOCKET_PATH_DEFAULT = "/run/git-cred-broker/broker.sock";
+/**
+ * The host-side files a deployment needs, regardless of mode.
+ *
+ * @param dir - the host directory holding the deployment.
+ * @returns the paths on the host.
+ */
+export declare function hostArtifacts(dir: string): HostArtifacts;
+/**
+ * The paths to record in the configuration for one deployment.
+ *
+ * @param mode - which deployment the broker will run as.
+ * @param dir - the host directory holding the deployment.
+ * @param hostSocketPath - the socket path a host process should use; ignored in sidecar mode.
+ * @returns the paths as the broker will resolve them.
+ */
+export declare function brokerPaths(mode: DeploymentMode, dir: string, hostSocketPath?: string): BrokerPaths;
+/**
+ * Reject an override that cannot apply in sidecar mode.
+ *
+ * The compose file fixes these locations, so silently ignoring a different value would produce a
+ * broker that starts and then cannot find its own key. Failing loudly is the only kind option.
+ *
+ * @param flag - the flag name, for the message.
+ * @param given - the value the user supplied, if any.
+ * @param fixed - the value the deployment requires.
+ * @param mode - the chosen deployment.
+ * @throws {Error} when sidecar mode was chosen and a conflicting value was supplied.
+ */
+export declare function requireFixedInSidecar(flag: string, given: string | undefined, fixed: string, mode: DeploymentMode): void;
+//# sourceMappingURL=deployment.d.ts.map

package/lib/commands/deployment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAwB,CAAC;AAE/E,oFAAoF;AACpF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,qCAAqC,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAOxD;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EACX,cAAc,GAAE,MAAiC,GAChD,WAAW,CAab;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,cAAc,GACnB,IAAI,CAKN"}

package/lib/commands/deployment.js

@@ -0,0 +1,72 @@
+/**
+ * Where each deployment expects its files, from the **broker's** point of view.
+ *
+ * This module exists because of one easily-missed fact: the paths inside `broker.config.yml` are
+ * resolved by whichever process reads the file. A broker running as a host process sees the
+ * host's filesystem, and a broker running as a sidecar sees only what its `volumes:` mount.
+ * The same file therefore means two different things, and one config cannot serve both.
+ *
+ * Both `init --mode` and `compose` derive from here, so the two halves cannot drift apart —
+ * which they did once: `init` recorded host paths while `compose` mounted the files at container
+ * paths, producing a sidecar that could not read its own key.
+ */
+import path from 'node:path';
+import { USER_TOKEN_FILE, SIDECAR } from '../config.js';
+/** The modes, for validation and help text. */
+export const DEPLOYMENT_MODES = ['host', 'sidecar'];
+/** The socket path a host-process deployment uses unless told otherwise. */
+export const HOST_SOCKET_PATH_DEFAULT = '/run/git-cred-broker/broker.sock';
+/**
+ * The host-side files a deployment needs, regardless of mode.
+ *
+ * @param dir - the host directory holding the deployment.
+ * @returns the paths on the host.
+ */
+export function hostArtifacts(dir) {
+    return {
+        keyPath: path.join(dir, 'app.pem'),
+        userTokenPath: path.join(dir, USER_TOKEN_FILE),
+        configPath: path.join(dir, 'broker.config.yml'),
+        auditDir: path.join(dir, 'log'),
+    };
+}
+/**
+ * The paths to record in the configuration for one deployment.
+ *
+ * @param mode - which deployment the broker will run as.
+ * @param dir - the host directory holding the deployment.
+ * @param hostSocketPath - the socket path a host process should use; ignored in sidecar mode.
+ * @returns the paths as the broker will resolve them.
+ */
+export function brokerPaths(mode, dir, hostSocketPath = HOST_SOCKET_PATH_DEFAULT) {
+    if (mode === 'sidecar') {
+        return {
+            socketPath: SIDECAR.socketPath,
+            privateKeyPath: SIDECAR.keyPath,
+            auditPath: SIDECAR.auditPath,
+        };
+    }
+    return {
+        socketPath: hostSocketPath,
+        privateKeyPath: path.join(dir, 'app.pem'),
+        auditPath: path.join(dir, 'log', 'audit.jsonl'),
+    };
+}
+/**
+ * Reject an override that cannot apply in sidecar mode.
+ *
+ * The compose file fixes these locations, so silently ignoring a different value would produce a
+ * broker that starts and then cannot find its own key. Failing loudly is the only kind option.
+ *
+ * @param flag - the flag name, for the message.
+ * @param given - the value the user supplied, if any.
+ * @param fixed - the value the deployment requires.
+ * @param mode - the chosen deployment.
+ * @throws {Error} when sidecar mode was chosen and a conflicting value was supplied.
+ */
+export function requireFixedInSidecar(flag, given, fixed, mode) {
+    if (mode !== 'sidecar' || given === undefined || given === fixed)
+        return;
+    throw new Error(`${flag} must be ${fixed} with --mode sidecar, because the compose file mounts it there; got ${given}`);
+}
+//# sourceMappingURL=deployment.js.map

package/lib/commands/deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGxD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAA8B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAkB/E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,kCAAkC,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;QAClC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;QAC9C,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC;QAC/C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,IAAoB,EACpB,GAAW,EACX,cAAc,GAAW,wBAAwB;IAEjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,OAAO;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU,EAAE,cAAc;QAC1B,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC;KAChD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,KAAyB,EACzB,KAAa,EACb,IAAoB;IAEpB,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO;IACzE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,YAAY,KAAK,uEAAuE,KAAK,EAAE,CACvG,CAAC;AACJ,CAAC"}

package/lib/commands/diagnose.d.ts

@@ -0,0 +1,4 @@
+/** Usage text for `diagnose`. */
+export declare const DIAGNOSE_USAGE = "Usage: gcb diagnose [options]\n\nAsk GitHub what this app can actually see: identity, permissions, installations and the\nrepositories each installation can reach. Never prints a key or a token.\n\n  --config <path>  The broker configuration to inspect (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)\n  --host <host>    Which host block to inspect (default: the first github-app one)\n  --proxy <url>    Use this proxy for this command\n  --no-proxy       Reach GitHub directly for this command\n  -h, --help       Show this help\n";
+export declare function runDiagnose(argv: readonly string[]): Promise<number>;
+//# sourceMappingURL=diagnose.d.ts.map

package/lib/commands/diagnose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnose.d.ts","sourceRoot":"","sources":["../../src/commands/diagnose.ts"],"names":[],"mappings":"AAqCA,iCAAiC;AACjC,eAAO,MAAM,cAAc,iiBAU1B,CAAC;AAUF,wBAAsB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwL1E"}