| 1 | // Package tinygit coordinates signed Nostr repository events with native |
| 2 | // Git object storage and smart HTTP. Signed events establish repository refs, |
| 3 | // metadata and maintainer authority. |
| 4 | // |
| 5 | // GitRelay stores bare repositories under Config.Root. Journal files under |
| 6 | // .tinyrelay/journal make event-to-ref transitions recoverable, while pending |
| 7 | // state files keep a signed ref announcement out of the visible repository |
| 8 | // until every advertised tip object is present. New creates the root, |
| 9 | // recovers journals and reloads repository metadata from the event store. |
| 10 | // Synchronization runs through Service.Tick or transport callbacks invoked by |
| 11 | // the caller. |
| 12 | // |
| 13 | // ParseMetadata checks repository announcement and state shape without a store, |
| 14 | // signature check or host policy. Its Metadata result contains claims, not |
| 15 | // resolved repository authority. Use protocol/nostr.Validate for the separate |
| 16 | // wire, event ID and signature check. Neither check establishes maintainer |
| 17 | // authority, hosting permission or Git object availability, and the metadata |
| 18 | // parser does not claim full NIP or GRASP compliance. |
| 19 | // |
| 20 | // Validate and ValidateImported check signatures and metadata shape before |
| 21 | // resolving repository authority and applying host admission. A valid shape may |
| 22 | // still be denied by Config.Authorize or lack a current announcement. After the |
| 23 | // caller durably stores an admitted event, CommitAfterStore stages its Git transition. |
| 24 | // CommitAfterStoreNoNotify serves callers already holding the host publication |
| 25 | // fence. PromotePending completes a receive-pack repair and invokes OnPromote |
| 26 | // after state becomes visible. |
| 27 | // |
| 28 | // ServeHTTP exposes Git smart HTTP for public and private repositories. |
| 29 | // Private requests pass through AuthorizeHTTP. GRASP-08 private peer traffic |
| 30 | // is limited to Config.PrivatePeers and is signed by HTTPAuth. GitSync and |
| 31 | // EventSync supply synchronization transports; the daemon supplies the relay |
| 32 | // client and WebSocket lifecycle. |
| 33 | // |
| 34 | // For a standalone public host, OpenServer owns event persistence and exposes |
| 35 | // POST /events plus Git smart HTTP. It requires an owner public key, admits |
| 36 | // only that owner's public repositories and their announced maintainers, and |
| 37 | // rejects private announcements. Publish signed kind 30617 metadata first, |
| 38 | // then signed kind 30618 refs before pushing their objects. Receive-pack |
| 39 | // promotes pending refs; unsigned ref updates are rejected by the same native |
| 40 | // hook used by the embedded engine. GET /healthz reports process readiness. |
| 41 | // |
| 42 | // New is the lower-level integration boundary. Supply an absolute Config.Root |
| 43 | // and an OpenStore result, or provide a Store implementation for an embedded |
| 44 | // host. Policy, Event and Store are public contracts; the standard SQLite |
| 45 | // adapter and the host's richer policy remain behind those contracts. Neither |
| 46 | // constructor starts the daemon, relay protocol, UI or replication workers. |
| 47 | // Native Git and a POSIX shell are required for smart HTTP and receive hooks. |
| 48 | package tinygit |