| 1 | /** |
| 2 | * Contract between the Diffinery control plane (Worker) and the runner agent's |
| 3 | * import mode, which copies a repository's Git data (and Git LFS objects) from |
| 4 | * GitHub into Diffinery inside a Cloudflare Container. |
| 5 | * |
| 6 | * The agent calls `${apiUrl}/api/v3/diffinery/imports/:id/agent/...` with |
| 7 | * `Authorization: Bearer <push token>`: a short-lived Diffinery token scoped to |
| 8 | * the target repository, which the Worker revokes when the transfer ends. |
| 9 | */ |
| 10 | |
| 11 | export interface ImportSpec { |
| 12 | importId: string; |
| 13 | /** GitHub side. `cloneUrl` is checked by the Worker to be on the GitHub host being imported from. */ |
| 14 | source: { fullName: string; cloneUrl: string; defaultBranch: string }; |
| 15 | /** Read token for GitHub (private repositories, LFS); null for public repositories. */ |
| 16 | githubToken: string | null; |
| 17 | /** Diffinery side: the repository's git URL, e.g. https://diffinery.com/acme/app.git */ |
| 18 | target: { fullName: string; pushUrl: string }; |
| 19 | /** The short-lived push token (same as the bearer token used for these calls). */ |
| 20 | pushToken: string; |
| 21 | /** Git LFS objects are copied too. */ |
| 22 | lfs: boolean; |
| 23 | /** Push protection findings in old history: push with an audited admin bypass, or stop. */ |
| 24 | secrets: "bypass" | "stop"; |
| 25 | /** Reason sent with `-o allow-secrets=` when `secrets` is "bypass". */ |
| 26 | bypassReason: string; |
| 27 | /** Upper bound for one push request body; the agent splits history to stay under it. */ |
| 28 | chunkBytes: number; |
| 29 | } |
| 30 | |
| 31 | export type ImportPhase = "clone" | "lfs-fetch" | "push" | "refs" | "lfs-push" | "cleanup" | "done"; |
| 32 | |
| 33 | export interface ImportProgress { |
| 34 | phase: ImportPhase; |
| 35 | message: string; |
| 36 | /** Pushed history chunks so far, and the bytes they carried. */ |
| 37 | chunks?: number; |
| 38 | bytes?: number; |
| 39 | } |
| 40 | |
| 41 | export interface ImportSecretFinding { |
| 42 | kind: string; |
| 43 | /** Blob id, or its abbreviation as the server reported it. */ |
| 44 | blob: string; |
| 45 | /** A path where the blob appears in history, when the agent could find one. */ |
| 46 | path?: string; |
| 47 | } |
| 48 | |
| 49 | export interface ImportGitResult { |
| 50 | ok: boolean; |
| 51 | error?: string; |
| 52 | branches: number; |
| 53 | tags: number; |
| 54 | pullRefs: number; |
| 55 | chunks: number; |
| 56 | bytes: number; |
| 57 | lfsObjects: number; |
| 58 | lfsBytes: number; |
| 59 | /** The GitHub default branch exists in the import. */ |
| 60 | defaultBranch: string | null; |
| 61 | secretFindings: ImportSecretFinding[]; |
| 62 | warnings: string[]; |
| 63 | } |