Skip to content
Sign in

flagon-io/g1t

public
0
760 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1import type { AccessClient, BasePermission, RepoGrant } from "./access";
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API2import type { Acting, CreateRunCredentialInput, RunBinding } from "./audit";
Agents as a team: lifecycle, merge queue, billing and a new shell3import type { RepoPath } from "./repos";
Initial g1t: services, event bus, intents and attempts4import type { Result } from "./result";
Merge branch 'worktree-agent-ad7c6d88d93adc817'5import type { TeamCreation, TeamsClient } from "./teams";
Deploy keys: SSH keys that reach one repository6import type { DeployKeysClient } from "./deploy-keys";
Initial g1t: services, event bus, intents and attempts7
Email verification, password reset, and Git for AI scale positioning8export type User = {
9 id: string;
10 username: string;
11 /**
Agents as a team: lifecycle, merge queue, billing and a new shell12 * `workspace` when a workspace is acting through one of its own access
Git storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily13 * tokens: `id` is then the workspace's and `username` its slug. `system`
14 * is g1t itself doing platform work, such as a security update
15 * (`username` `g1t`). Absent means `user`.
Agents as a team: lifecycle, merge queue, billing and a new shell16 */
Git storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily17 kind?: "user" | "workspace" | "agent" | "system";
Agents as a team: lifecycle, merge queue, billing and a new shell18 /**
Email verification, password reset, and Git for AI scale positioning19 * Whether the account's email address is confirmed. Only set on users
20 * resolved from credentials; unverified accounts cannot change anything.
21 */
22 verified?: boolean;
Workspaces own repositories23 /**
24 * The workspaces this user belongs to. Set on users resolved from
25 * credentials, so any service can authorize from it.
26 */
27 workspaces?: Membership[];
Workspace names and icons, and a component kit for every control28 /**
29 * The person's uploaded avatar: the SHA-256 of its bytes, served at
30 * `/avatars/<avatar>`. Only set on the signed-in person; absent means
31 * the generated letter avatar.
32 */
33 avatar?: string;
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API34 /**
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent35 * Set on an agent resolved from its token: who it acts for ("g1t
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API36 * on behalf of syntaqx"), with which credential, and what it may do.
37 */
38 acting?: Acting;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look39 /**
40 * The repositories this user has a role on directly, whether or not they
41 * belong to its workspace. Set with `workspaces`; see `access.ts`.
42 */
43 grants?: RepoGrant[];
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step44 /**
45 * Set on a user resolved from an access token: its scopes (null for full
46 * access) and the workspaces or repositories it reaches. See scopes.ts.
47 */
48 token?: {
49 token_id: string;
50 scopes?: string[] | null;
51 legacy?: boolean;
Merge the AI Gateway: Anthropic's Messages API on a workspace's tokens52 /** The token's name, as its owner gave it. */
53 name?: string;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step54 };
Email verification, password reset, and Git for AI scale positioning55};
Initial g1t: services, event bus, intents and attempts56
Workspaces own repositories57/** What a member may do: an owner also manages the workspace's members. */
58export type Role = "owner" | "member";
59
Workspace names and icons, and a component kit for every control60export type Membership = {
61 /** The workspace's name in URLs: `g1t.sh/<slug>`. */
62 slug: string;
63 role: Role;
64 /** Its display name. Set on users resolved from credentials. */
65 name?: string;
66 /** Its uploaded icon, as `Workspace.avatar`. */
67 avatar?: string;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look68 /** The workspace's base permission: what members get on every repository. Absent means `write`. */
69 base_permission?: BasePermission;
Merge branch 'worktree-agent-ad7c6d88d93adc817'70 /** Who may create its teams. Absent means any member. */
71 team_creation?: TeamCreation;
Workspace names and icons, and a component kit for every control72};
Workspaces own repositories73
Agents and memory, checks and conflicts, profiles, slug renames, custom domains74/** How long an old workspace slug redirects, and stays reserved for it, after a rename. */
75export const SLUG_HOLD_DAYS = 90;
76
77/** How long a workspace must wait between renames. */
78export const RENAME_COOLDOWN_HOURS = 24;
79
Workspace names and icons, and a component kit for every control80/** The largest avatar that can be uploaded, in bytes. */
81export const MAX_AVATAR_BYTES = 1024 * 1024;
82
Workspaces own repositories83/**
Merge branch 'worktree-agent-a2013627e5ea4ab13'84 * Where a workspace keeps its repositories' git data: anywhere g1t stores
85 * it (the default), or in the EU only. It applies to repositories made
86 * after it is set.
87 */
88export type DataResidency = "anywhere" | "eu";
89
90/**
Workspaces own repositories91 * A workspace: the owner of repositories, and the first segment of their
92 * URLs. A person's own space and a team's are the same thing.
93 */
94export type Workspace = {
95 id: string;
96 slug: string;
97 name: string;
Agents as a team: lifecycle, merge queue, billing and a new shell98 /** One line saying what the workspace is for. */
99 description: string | null;
Workspaces own repositories100 /** RFC 3339. */
101 createdAt: string;
102 memberCount: number;
Workspace names and icons, and a component kit for every control103 /**
104 * The workspace's uploaded icon: the SHA-256 of its bytes, served at
105 * `/avatars/<avatar>`. Null means the generated letter avatar.
106 */
107 avatar: string | null;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look108 /** What every member gets on each repository; owners have Admin. */
109 basePermission?: BasePermission;
Merge branch 'worktree-agent-ad7c6d88d93adc817'110 /** Who may create its teams. Absent means any member. */
111 teamCreation?: TeamCreation;
Workspaces own repositories112};
113
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look114export type Member = {
115 username: string;
116 role: Role;
117 /** Their display name, when they set one. */
118 name?: string | null;
119 /** Their uploaded avatar's hash, served at `/avatars/<avatar>`; null for the generated letter avatar. */
120 avatar?: string | null;
121};
Workspaces own repositories122
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace123/** An owner of a workspace, as staff see them. */
124export type AdminOwner = { username: string; email: string | null };
125
126/** A workspace as staff see it. Mirrors `AdminWorkspace` in `crates/contracts/src/identity.rs`. */
127export type AdminWorkspace = {
128 slug: string;
129 name: string;
130 /** RFC 3339. */
131 createdAt: string;
132 owners: AdminOwner[];
133 memberCount: number;
134};
135
136/** A member of a workspace, as staff see them. */
137export type AdminMember = { username: string; email: string | null; role: Role; /** RFC 3339. */ joined: string };
138
139export type AdminWorkspaceDetail = {
140 slug: string;
141 name: string;
142 description: string | null;
143 /** RFC 3339. */
144 createdAt: string;
145 /** Owners first, then by username. */
146 members: AdminMember[];
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member147 /** It can never be deleted, by anyone (identity's `PROTECTED_WORKSPACES`). */
148 protected: boolean;
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace149};
150
151/** The most workspaces one `workspaces` call returns. */
152export const ADMIN_WORKSPACES_LIMIT = 500;
153
154/**
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look155 * Whether anyone may make an account, or only someone with an invite.
156 * Identity's `REGISTRATION_MODE`; unset means `invite`.
157 */
158export type RegistrationMode = "invite" | "open";
159
160/** How many invites a person may have out at once, unless identity's `INVITES_PER_USER` says otherwise. */
161export const INVITES_PER_USER = 5;
162/** How long an invite works, unless identity's `INVITE_TTL_DAYS` says otherwise. */
163export const INVITE_TTL_DAYS = 30;
164
165/** Only a pending invite can be used or revoked. Revoked and expired ones never used give the invite back. */
166export type InviteStatus = "pending" | "redeemed" | "expired" | "revoked";
167
168/** One invite. Mirrors `Invite` in `crates/contracts/src/identity.rs`. */
169export type Invite = {
170 id: string;
171 /** `g1t-k7m2-…`: returned when it is made, and to its maker while pending. */
172 code: string | null;
173 /** The code's first group, such as `g1t-k7m2`. */
174 hint: string;
175 /** Only this address can use it. */
176 email: string | null;
177 /** `account` makes an account; `workspace` joins an existing one to `workspace`. */
178 kind: "account" | "workspace";
179 /** The workspace using it joins. */
180 workspace: string | null;
181 status: InviteStatus;
182 /** Whose allowance it used. */
183 chargedTo: "user" | "workspace" | "none";
184 /** Its maker's username; null when g1t staff made it. */
185 invitedBy: string | null;
186 /** The account that used it. */
187 redeemedBy: string | null;
188 /** RFC 3339. */
189 createdAt: string;
190 /** RFC 3339. */
191 expiresAt: string;
192 redeemedAt: string | null;
193 revokedAt: string | null;
194 /** The staff member who minted it; only in staff views. */
195 staff?: string | null;
196};
197
198/** How many invites someone may have out. `limit` and `remaining` are null for no limit. */
199export type Allowance = { limit: number | null; used: number; remaining: number | null };
200
201export type InvitesOverview = {
202 mode: RegistrationMode;
203 allowance: Allowance;
204 /** Workspaces the person owns that were granted invites to share. */
205 workspaces: { slug: string; allowance: Allowance }[];
206 invites: Invite[];
207};
208
209/** What a valid code is for, before it is used. */
210export type InvitePreview = {
211 kind: "account" | "workspace";
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas212 /** Pending, unless `anyStatus` asked about a code that is spent. */
213 status: InviteStatus;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look214 /** Null when g1t staff sent it. */
215 invitedBy: { username: string; name: string | null; avatar: string | null } | null;
216 workspace: ProfileWorkspace | null;
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas217 /** The repository it accepts an invitation to, such as `{ name: "flagon-io/g1t", role: "write" }`. */
218 repository: { name: string; role: string } | null;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look219 /** Partly hidden, such as `a•••@example.com`. */
220 email: string | null;
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas221 /** The bound address in full, while the invite is pending: it fills in and locks the sign-up form. */
222 address: string | null;
223 /** Whether the bound address has a g1t account already: sign in to accept. */
224 hasAccount: boolean;
225 /** With a viewer: whether it is theirs (for one of their confirmed addresses, or used by them). */
226 forViewer: boolean | null;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look227 expiresAt: string;
228};
229
230export type WaitlistStatus = "waiting" | "invited" | "dismissed";
231
232export type WaitlistEntry = {
233 id: string;
234 email: string;
235 about: string | null;
236 status: WaitlistStatus;
237 inviteId: string | null;
238 decidedBy: string | null;
239 decidedAt: string | null;
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas240 /** What staff wrote when approving; it went in the invite email. */
241 note: string | null;
242 /** The account made with the invite, once it was used. */
243 joinedAs: string | null;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look244 /** When they first asked. */
245 createdAt: string;
246 /** When they last asked. */
247 updatedAt: string;
248};
249
250export type InviteGrant = { amount: number; note: string | null; grantedBy: string; createdAt: string };
251export type InviteTreeNode = { username: string; joinedAt: string; invited: InviteTreeNode[] };
252
253/** Where a person came from and whom they brought. For a workspace, `username` is its slug. */
254export type InviteTree = {
255 username: string;
256 /** Who invited them, then who invited that person, and so on. */
257 invitedBy: string[];
258 /** The staff member who minted their invite, when staff did. */
259 staff: string | null;
260 allowance: Allowance;
261 grants: InviteGrant[];
262 invites: Invite[];
263 /** Whom they invited, three levels down. */
264 invited: InviteTreeNode[];
265};
266
267/** The most rows one staff listing of invites or the waitlist returns. */
268export const ADMIN_INVITES_LIMIT = 500;
269
270/**
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace271 * Staff-only identity, for sudo.g1t.sh. It takes no viewer and checks no
272 * membership: only sudo calls it, over its service binding, once Cloudflare
273 * Access and its staff list have let someone in. Never call it on behalf of
274 * a customer.
275 */
276export interface IdentityAdminApi {
277 /** Every workspace, newest first, at most 500; `query` matches slug, name, or an owner's username or email. */
278 workspaces(query?: string): Promise<AdminWorkspace[]>;
279 /** One workspace with all its members, or null. */
280 workspace(slug: string): Promise<AdminWorkspaceDetail | null>;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look281
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas282 /** The waitlist, newest first; `query` matches the address or what they said. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look283 waitlist(query?: string | null, status?: WaitlistStatus | null): Promise<WaitlistEntry[]>;
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas284 /** How many requests are waiting, for the navigation's badge. */
285 waitlistPending(): Promise<number>;
286 /**
287 * Approving mints an invite bound to the address and emails it, with
288 * `note` (up to 500 characters) if given; dismissing only marks it.
289 */
290 decideWaitlist(id: string, approve: boolean, staff: string, note?: string | null): Promise<Result<WaitlistEntry>>;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look291 /** Invites, newest first; `query` is a code's start, or part of an email, inviter or redeemer. */
292 invites(query?: string | null): Promise<Invite[]>;
293 revokeInvite(id: string, staff: string): Promise<Result<Invite>>;
294 /** An invite that uses nobody's allowance, optionally bound to (and emailed to) `email`. */
295 mintInvite(email: string | null, staff: string): Promise<Result<Invite>>;
296 /** More invites (or fewer, with a negative amount) for a person or a workspace. */
297 grantInvites(
298 target: "user" | "workspace",
299 name: string,
300 amount: number,
301 note: string,
302 staff: string,
303 ): Promise<Result<Allowance>>;
304 /** Where a person came from and whom they brought, or null. */
305 inviteTree(username: string): Promise<InviteTree | null>;
306 /** A workspace's granted invites and the invites made for it, or null. */
307 workspaceInvites(slug: string): Promise<InviteTree | null>;
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member308
309 /** Workspaces owners deleted that are not purged yet, newest first. */
310 deletedWorkspaces(): Promise<DeletedWorkspace[]>;
311 /**
312 * Brings a deleted workspace back, with its members, tokens and what went
313 * with it, while it is still restorable. Publishes `workspace.restored`.
314 */
315 restoreWorkspace(workspaceId: string, staff: string): Promise<Result<boolean>>;
316 /**
317 * Purges a deleted workspace now rather than at `purgeAfter`. `confirm` is
318 * its slug, typed out. Refused for a protected workspace. Publishes
319 * `workspace.deleted`.
320 */
321 purgeWorkspace(workspaceId: string, staff: string, confirm: string): Promise<Result<boolean>>;
Merge branch 'worktree-agent-a8385d293d42c913a'322
323 /** Every workspace alias, by name. */
324 aliases(): Promise<WorkspaceAlias[]>;
325 /**
326 * Points `alias` at the workspace whose slug is `workspace`. Refused for
327 * one of the site's routes, anyone's username, a workspace's slug (deleted
328 * or held after a rename) and an existing alias. `note` says why.
329 */
330 setAlias(alias: string, workspace: string, note: string, staff: string): Promise<Result<WorkspaceAlias>>;
331 /** Removes an alias; `reason` goes in sudo's audit log. */
332 removeAlias(alias: string, reason: string, staff: string): Promise<Result<boolean>>;
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace333}
334
Merge branch 'worktree-agent-a8385d293d42c913a'335/**
336 * A name g1t's staff point at a workspace, so its addresses lead there under
337 * the workspace's own name: `g1t`, the product, leads to `flagon-io`, Flagon,
338 * Inc. Staff-managed only; it follows the workspace through renames.
339 */
340export type WorkspaceAlias = {
341 alias: string;
342 workspaceId: string;
343 /** The workspace's slug and name now. */
344 workspace: string;
345 workspaceName: string;
346 /** Why it exists. */
347 note: string;
348 /** The staff member who set it, or `migration`. */
349 createdBy: string;
350 /** RFC 3339. */
351 createdAt: string;
352};
353
Initial g1t: services, event bus, intents and attempts354/** Who is asking. Every read and write in every service takes one. */
355export type Viewer = User | null;
356
357export type SshKey = {
358 id: string;
359 title: string;
360 fingerprint: string;
RFC 3339 timestamps in identity and repos361 /** RFC 3339. */
362 createdAt: string;
Deploy keys: SSH keys that reach one repository363 /** When it last signed in over SSH, RFC 3339, to within 5 minutes; null when it never has. */
364 lastUsedAt: string | null;
Initial g1t: services, event bus, intents and attempts365};
366
Agents as a team: lifecycle, merge queue, billing and a new shell367export type AccessToken = {
368 id: string;
369 name: string;
370 /** RFC 3339. */
371 createdAt: string;
372 /** RFC 3339, to within a few minutes. Null until it is first used. */
373 lastUsedAt: string | null;
374 /**
375 * For a workspace's token, the username of the member who made it. Null
376 * once that account is gone, and on personal tokens.
377 */
378 createdBy: string | null;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step379 /** Its scopes, as `resource:level`. Null: full access. */
380 scopes: string[] | null;
381 /** Made before tokens had scopes: full access until someone narrows it. */
382 legacy: boolean;
383 /** RFC 3339. Null: it does not expire. */
384 expiresAt: string | null;
385};
386
387/** What a new or changed token may do. */
388export type TokenGrant = {
389 /** Null: full access. */
390 scopes: string[] | null;
Agents as a team: lifecycle, merge queue, billing and a new shell391};
Initial g1t: services, event bus, intents and attempts392
Device sign-in replaces registering and minting tokens over the API393export type DeviceStart = {
394 /** Secret held by the tool and exchanged for a token once approved. */
395 deviceCode: string;
396 /** Short code shown to the person, e.g. `WDJB-MJHT`. */
397 userCode: string;
398 /** Seconds until both codes stop working. */
399 expiresIn: number;
400 /** Seconds the tool should wait between polls. */
401 interval: number;
402};
403
404export type DeviceRequest = { userCode: string; clientName: string };
405
406export type DeviceClaim =
407 | { status: "pending" | "denied" | "expired" }
408 | { status: "approved"; token: string; user: User };
409
OAuth 2.1 sign-in for MCP clients and other applications410/** What the site passes on once a person has approved an application. */
411export type OAuthApproval = {
412 clientId: string;
413 /** Shown wherever the application's access is listed. */
414 clientName: string;
415 redirectUri: string;
416 /** PKCE challenge, method S256. */
417 codeChallenge: string;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step418 /** What the person granted. Null: full access. */
419 scopes: string[] | null;
OAuth 2.1 sign-in for MCP clients and other applications420};
421
422export type OAuthTokens = {
423 accessToken: string;
424 /** Works once; using it returns the next one. */
425 refreshToken: string;
426 /** Seconds until the access token stops working. */
427 expiresIn: number;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step428 /** The scopes granted, space-separated, or `*` for full access. */
429 scope?: string | null;
OAuth 2.1 sign-in for MCP clients and other applications430};
431
432/** An application a person has signed in to. */
433export type OAuthGrant = {
434 id: string;
435 clientName: string;
436 /** RFC 3339. */
437 createdAt: string;
438 /** RFC 3339. */
439 lastUsedAt: string;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step440 /** What the person granted. Null: full access. */
441 scopes: string[] | null;
442 /** Signed in before applications had scopes: full access until narrowed. */
443 legacy: boolean;
OAuth 2.1 sign-in for MCP clients and other applications444};
445
Initial g1t: services, event bus, intents and attempts446/** Accounts, credentials and sessions. */
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member447/**
448 * What deleting a workspace takes with it, and what stands in the way:
449 * nothing does while `billing` is null and it is not `protected`.
450 */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look451export type WorkspaceDeletion = {
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member452 /** Its live repositories, deleted with it. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look453 repositories: number;
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member454 /** Its projects, hidden with it. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look455 projects: number;
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member456 members: number;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look457 /** Why billing cannot close it yet, in words for its owner. */
458 billing: string | null;
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member459 /** It can never be deleted, by anyone. */
460 protected: boolean;
461};
462
463/** How long a deleted workspace is kept, for g1t's staff to restore, before it is purged. */
464export const WORKSPACE_RESTORE_DAYS = 30;
465
466/**
467 * Workspaces nobody can delete, whatever identity's `PROTECTED_WORKSPACES`
468 * says: Flagon's, which runs g1t. Services that act on `workspace.deleting`
469 * check it too, so one published for it by mistake changes nothing.
470 */
471export const ALWAYS_PROTECTED_WORKSPACES: readonly string[] = ["flagon-io"];
472
473/** Whether `slug` is one of `ALWAYS_PROTECTED_WORKSPACES`, in any case. */
474export function isProtectedWorkspace(slug: string): boolean {
475 return ALWAYS_PROTECTED_WORKSPACES.includes(slug.trim().toLowerCase());
476}
477
478/** A workspace an owner deleted, kept until `purgeAfter` for staff to restore. */
479export type DeletedWorkspace = {
480 workspaceId: string;
481 slug: string;
482 name: string;
483 /** RFC 3339. */
484 deletedAt: string;
485 /** The username of the owner who deleted it. */
486 deletedBy: string;
487 /** RFC 3339: when it is purged unless restored first. */
488 purgeAfter: string;
489 /** What went with it, counted when it was deleted. */
490 went: WorkspaceDeletion;
491 /** Whether staff can still restore it. */
492 restorable: boolean;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look493};
494
Deploy keys: SSH keys that reach one repository495export interface IdentityApi extends AccessClient, TeamsClient, DeployKeysClient {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look496 /**
497 * Creates an account and signs it in. While registration is invite-only,
498 * `inviteCode` must be an unused, unexpired invite (and, when it names an
499 * email, that address); it is ignored while registration is open.
500 */
501 register(
502 username: string,
503 email: string,
504 password: string,
505 inviteCode?: string | null,
506 /** Who is asking, such as the visitor's IP address, for rate limits. */
507 client?: string | null,
508 ): Promise<Result<{ user: User; sessionToken: string }>>;
Initial g1t: services, event bus, intents and attempts509 /** Verifies a username and password for website sign-in. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look510 /**
511 * Verifies a username, or any confirmed address of the account, and its
512 * password. Wrong passwords are counted against the account and `client`
513 * (the visitor's IP address); past a limit nothing is checked for a while.
514 */
515 signIn(username: string, password: string, client?: string | null): Promise<Result<{ user: User; sessionToken: string }>>;
Initial g1t: services, event bus, intents and attempts516 signOut(sessionToken: string): Promise<void>;
Email verification, password reset, and Git for AI scale positioning517
518 /** Sends the confirmation email again. */
519 resendVerification(user: User): Promise<Result<boolean>>;
520 /** Confirms the address the emailed token was sent to. */
521 verifyEmail(token: string): Promise<Result<User>>;
522 /** Emails a reset link if the address has an account. Always resolves. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look523 /**
524 * Any confirmed address of an account works; the link goes to it, and the
525 * primary and backup are told. A few an hour per address and per `client`.
526 */
527 requestPasswordReset(email: string, client?: string | null): Promise<boolean>;
Email verification, password reset, and Git for AI scale positioning528 /** Sets a new password from an emailed token and ends every session. */
529 resetPassword(token: string, password: string): Promise<Result<User>>;
530
Device sign-in replaces registering and minting tokens over the API531 /**
532 * Device sign-in (RFC 8628). A tool starts a request, a person approves
533 * its short code in a browser, and the tool claims an access token.
534 */
535 deviceStart(clientName: string): Promise<DeviceStart>;
536 /** What a user code is asking for, or null if it is not valid. */
537 deviceLookup(userCode: string): Promise<DeviceRequest | null>;
538 deviceResolve(userCode: string, user: User, approve: boolean): Promise<Result<boolean>>;
539 deviceClaim(deviceCode: string): Promise<DeviceClaim>;
540
OAuth 2.1 sign-in for MCP clients and other applications541 /**
542 * OAuth 2.1 for applications that sign a person in through the browser.
543 * The caller has checked the client and its redirect address; this
544 * returns the one-time code the application exchanges for tokens.
545 */
546 oauthAuthorize(user: User, approval: OAuthApproval): Promise<{ code: string }>;
547 /** Redeems a code. It works once, for that client, with the PKCE verifier. */
548 oauthExchange(code: string, codeVerifier: string, clientId: string, redirectUri: string): Promise<Result<OAuthTokens>>;
549 /** Trades a refresh token for new tokens; the old ones stop working. */
550 oauthRefresh(refreshToken: string, clientId: string): Promise<Result<OAuthTokens>>;
551 /** Applications the user has signed in to, most recently used first. */
552 listOAuthGrants(user: User): Promise<OAuthGrant[]>;
553 /** Signs an application out. */
554 revokeOAuthGrant(user: User, id: string): Promise<void>;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step555 /** Changes what an application may do, at once and when it refreshes. */
556 updateOAuthGrant(user: User, id: string, grant: TokenGrant): Promise<Result<OAuthGrant>>;
OAuth 2.1 sign-in for MCP clients and other applications557
Workspaces own repositories558 createWorkspace(user: User, slug: string, name: string): Promise<Result<Workspace>>;
559 /** Public details of a workspace, or null. */
560 getWorkspace(slug: string): Promise<Workspace | null>;
Merge branch 'worktree-agent-a2013627e5ea4ab13'561 /** Where a workspace keeps its repositories' git data; null when there is no such workspace. */
562 workspaceResidency(slug: string): Promise<DataResidency | null>;
563 /**
564 * Owners only. Applies to repositories made from then on. Offer `eu`
565 * only when the repos service's `storageOptions()` says it is available.
566 */
567 setWorkspaceResidency(actor: User, slug: string, residency: DataResidency): Promise<Result<DataResidency>>;
Workspaces own repositories568 /** Members only. */
569 listMembers(slug: string, viewer: Viewer): Promise<Result<Member[]>>;
570 /** Owners only. */
571 addMember(actor: User, slug: string, username: string): Promise<Result<boolean>>;
572 /** Owners only. */
573 removeMember(actor: User, slug: string, username: string): Promise<Result<boolean>>;
Agents as a team: lifecycle, merge queue, billing and a new shell574 /** Owners only. An empty name falls back to the slug. */
575 updateWorkspace(actor: User, slug: string, details: { name: string; description: string }): Promise<Result<Workspace>>;
Workspace names and icons, and a component kit for every control576 /**
Agents and memory, checks and conflicts, profiles, slug renames, custom domains577 * Owners only. Changes the slug, the first segment of the workspace's
578 * URLs; the display name is untouched. The old slug redirects to the new
579 * one, and stays reserved for this workspace, for `SLUG_HOLD_DAYS`.
580 * Publishes `workspace.renamed`.
581 */
582 renameWorkspace(actor: User, slug: string, newSlug: string): Promise<Result<Workspace>>;
583 /** Whether `renameWorkspace` would be allowed, changing nothing. */
584 checkWorkspaceRename(actor: User, slug: string, newSlug: string): Promise<Result<boolean>>;
585 /**
586 * The workspace's current slug when `slug` is one it was renamed from
Merge branch 'worktree-agent-a8385d293d42c913a'587 * within `SLUG_HOLD_DAYS`, or when `slug` is an alias staff set for it
588 * (`WorkspaceAlias`); null otherwise, including for a slug in use.
Agents and memory, checks and conflicts, profiles, slug renames, custom domains589 */
590 resolveSlug(slug: string): Promise<string | null>;
591 /**
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look592 * Owners only, a person only. `confirm` is the slug, typed out. Refused
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member593 * for a protected workspace, and while billing cannot settle it. Its
594 * repositories, projects and apps go with it; it is kept for
595 * `WORKSPACE_RESTORE_DAYS`, when g1t's staff can restore it, then purged.
596 * Its slug is never given to anyone else; the person whose username it is
597 * may make it again once it is purged. Publishes `workspace.deleting`.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look598 */
599 deleteWorkspace(actor: User, slug: string, confirm: string): Promise<Result<boolean>>;
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member600 /** What `deleteWorkspace` would take with it, and what stands in its way, changing nothing. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look601 checkWorkspaceDeletion(actor: User, slug: string): Promise<Result<WorkspaceDeletion>>;
602 /**
Workspace names and icons, and a component kit for every control603 * Owners only. `image` is the file in base64: PNG, JPEG, WebP or GIF, at
604 * most `MAX_AVATAR_BYTES`, checked by its bytes. Null removes the icon.
605 */
606 setWorkspaceAvatar(actor: User, slug: string, image: string | null): Promise<Result<Workspace>>;
607 /** A person's own avatar, as `setWorkspaceAvatar`: the new one, or null. */
608 setUserAvatar(user: User, image: string | null): Promise<Result<string | null>>;
Workspaces own repositories609
Agents as a team: lifecycle, merge queue, billing and a new shell610 /**
611 * A workspace's own access tokens. They belong to the workspace, act as
612 * it, and keep working when the member who made one leaves. Members only.
613 */
614 listWorkspaceTokens(slug: string, viewer: Viewer): Promise<Result<AccessToken[]>>;
615 /** Owners only. The plaintext token is returned once and never stored. */
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step616 createWorkspaceToken(
617 actor: User,
618 slug: string,
619 name: string,
620 grant?: TokenGrant & { ttlSeconds?: number },
621 ): Promise<Result<{ token: string; info: AccessToken }>>;
Agents as a team: lifecycle, merge queue, billing and a new shell622 /** Owners only. */
623 removeWorkspaceToken(actor: User, slug: string, id: string): Promise<Result<boolean>>;
624
Initial g1t: services, event bus, intents and attempts625 userForSession(sessionToken: string): Promise<Viewer>;
626
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look627 /** Whether registration is invite-only. */
628 registration(): Promise<RegistrationMode>;
629 /** A person's invites and what they have left. */
630 listInvites(user: User): Promise<InvitesOverview>;
631 /**
632 * A person makes an invite, optionally for one address (emailed to it),
633 * using one of theirs or, with `workspace`, one the workspace was granted.
634 * People only: never an agent or a workspace's token.
635 */
636 createInvite(user: User, options?: { email?: string | null; workspace?: string | null }): Promise<Result<Invite>>;
637 /** Its maker, or an owner of its workspace, revokes a pending invite; the invite comes back. */
638 revokeInvite(user: User, id: string): Promise<Result<Invite>>;
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas639 /**
640 * What a code is for. Unknown, used, revoked and expired codes all get the
641 * same answer, unless `anyStatus`: then a real code that is spent is
642 * described, with its `status`. `viewer` sets `forViewer`.
643 */
644 checkInvite(
645 code: string,
646 client?: string | null,
647 options?: { viewer?: User | null; anyStatus?: boolean },
648 ): Promise<Result<InvitePreview>>;
649 /**
650 * A signed-in person uses a workspace invite sent to their address, or one
651 * sent with a repository invitation; returns the workspace's slug, or
652 * `workspace/repo`.
653 */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look654 acceptInvite(user: User, code: string): Promise<Result<string>>;
655 /** Owners only. Invites an address into a workspace, always with an invite bound to it. */
656 inviteMember(actor: User, slug: string, email: string): Promise<Result<Invite>>;
657 /** Owners only: the workspace's invites, newest first. */
658 workspaceInvites(slug: string, viewer: Viewer): Promise<Result<Invite[]>>;
659 /** Owners only. */
660 revokeWorkspaceInvite(actor: User, slug: string, id: string): Promise<Result<Invite>>;
661 /** Someone without an invite asks for one. Always the same answer for a valid address. */
662 requestAccess(email: string, about: string, client?: string | null): Promise<Result<boolean>>;
663
Initial g1t: services, event bus, intents and attempts664 /** Verifies git credentials: the account password or an access token. */
665 userForGitCredentials(username: string, secret: string): Promise<Viewer>;
API and MCP server, Rust identity service, registration, site redesign666 /** Resolves a `g1t_…` access token, as sent to the API and MCP server. */
667 userForAccessToken(token: string): Promise<Viewer>;
Initial g1t: services, event bus, intents and attempts668 userForSshKey(fingerprint: string): Promise<Viewer>;
669 userByUsername(username: string): Promise<Viewer>;
What happened across an outcome, as a feed beside its graph670 /** The names behind account and workspace ids; unknown ids are left out. */
671 usernames(ids: string[]): Promise<Record<string, string>>;
Initial g1t: services, event bus, intents and attempts672
Agents and memory, checks and conflicts, profiles, slug renames, custom domains673 /** A person's public profile, or null if there is no such account. Never an email address. */
674 profile(username: string): Promise<Profile | null>;
675 /** A person changes their own profile. Every field is replaced; an empty one is cleared. */
676 updateProfile(actor: User, fields: ProfileFields): Promise<Result<Profile>>;
677 /**
678 * The workspaces a profile shows `viewer`: those the viewer belongs to
679 * as well, and those of `publicIn` (where the person made a public
680 * project) that the person really belongs to. Nothing else.
681 */
682 profileWorkspaces(username: string, viewer: Viewer, publicIn: string[]): Promise<ProfileWorkspace[]>;
683
Initial g1t: services, event bus, intents and attempts684 listSshKeys(user: User): Promise<SshKey[]>;
685 /** Takes one line in OpenSSH public key format. */
686 addSshKey(user: User, title: string, publicKey: string): Promise<Result<SshKey>>;
687 removeSshKey(user: User, id: string): Promise<void>;
688
689 listAccessTokens(user: User): Promise<AccessToken[]>;
Account dropdown, llms.txt onboarding, hosted agent runner (not yet deployed)690 /**
Agents as a team: lifecycle, merge queue, billing and a new shell691 * The plaintext token is returned once and never stored. With
692 * `ttlSeconds` the token expires and is left out of token lists; that
693 * form is used for hosted agents. A token made for a workspace acting
694 * through a token of its own belongs to that workspace too.
Account dropdown, llms.txt onboarding, hosted agent runner (not yet deployed)695 */
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step696 createAccessToken(
697 user: User,
698 name: string,
699 ttlSeconds?: number,
700 grant?: TokenGrant & { listed?: boolean },
701 ): Promise<{ token: string; info: AccessToken }>;
702 /** Changes what one of a person's tokens may do; the token is unchanged. */
703 updateAccessToken(user: User, id: string, grant: TokenGrant): Promise<Result<AccessToken>>;
Agents as a team: lifecycle, merge queue, billing and a new shell704 /**
705 * A token for a g1t agent working for `onBehalfOf`: it acts as
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent706 * `g1t`, in `scope.repo` only, and only for `scope.operations`.
Agents as a team: lifecycle, merge queue, billing and a new shell707 */
708 createAgentToken(
709 onBehalfOf: User,
710 scope: AgentScope,
711 ttlSeconds: number,
712 ): Promise<{ token: string; info: AccessToken }>;
Initial g1t: services, event bus, intents and attempts713 removeAccessToken(user: User, id: string): Promise<void>;
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API714 /**
715 * A token for one sandbox run: it acts as the agent on behalf of
716 * `onBehalfOf`, can do only what the run's kind needs in `repo`, and
717 * expires after `ttlSeconds`. See `audit.ts`.
718 */
719 createRunCredential(input: CreateRunCredentialInput): Promise<{ token: string; info: AccessToken }>;
720 /** Ties tokens, by the SHA-256 of their text in hex, to the agent run their sandbox recorded. */
721 bindRunCredentials(tokenHashes: string[], runId: string): Promise<boolean>;
722 /** Ends a sandbox's run credentials, by hash or by run. Never touches another token. */
723 revokeRunCredentials(target: { tokenHashes?: string[]; runId?: string | null }): Promise<boolean>;
Initial g1t: services, event bus, intents and attempts724}
Agents as a team: lifecycle, merge queue, billing and a new shell725
726
727/** What an agent's token may do: these operations, in this repository. */
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API728export type AgentScope = { repo: RepoPath; operations: string[]; run?: RunBinding };
Agents and memory, checks and conflicts, profiles, slug renames, custom domains729
730/** The most characters each profile field takes. Mirrors `crates/contracts/src/identity.rs`. */
731export const PROFILE_LIMITS = { name: 80, bio: 160, location: 80, website: 200, pronouns: 40 } as const;
732
733/** What anyone may see about a person, at `g1t.sh/u/<username>`. */
734export type Profile = {
735 username: string;
736 /** The name they go by, if they gave one. */
737 name: string | null;
738 bio: string | null;
739 location: string | null;
740 /** Always an `https://` address. */
741 website: string | null;
742 pronouns: string | null;
743 /** The uploaded avatar's hash, served at `/avatars/<avatar>`. */
744 avatar: string | null;
745 /** When the account was made. RFC 3339. */
746 createdAt: string;
747};
748
749/** What a person may change on their profile. Empty clears a field. */
750export type ProfileFields = {
751 name: string;
752 bio: string;
753 location: string;
754 /** `https://…`; a bare `example.com` is taken as `https://example.com`. */
755 website: string;
756 pronouns: string;
757};
758
759/** A workspace on a person's profile. */
760export type ProfileWorkspace = { slug: string; name: string; avatar: string | null };

This file's history is long; its oldest lines are credited to the oldest commit read.