Skip to content
Sign up

flagon-io/g1t

public
0
921 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1import type { AccessClient, BasePermission, RepoGrant } from "./access";
Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules2import type { PermissionAccess, RepositorySelection } from "./fine-grained";
Merge main (membership, two-factor, GitHub repo roles) into tokens3import type { MemberPrivileges, OrgRole, PolicyHold } from "./members";
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API4import type { Acting, CreateRunCredentialInput, RunBinding } from "./audit";
Agents as a team: lifecycle, merge queue, billing and a new shell5import type { RepoPath } from "./repos";
Initial g1t: services, event bus, intents and attempts6import type { Result } from "./result";
Merge branch 'worktree-agent-ad7c6d88d93adc817'7import type { TeamCreation, TeamsClient } from "./teams";
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca8import type { DeployKeysClient } from "./deploy-keys";
Email confirmation gate: a code and a link, nothing else until confirmed9import type { EmailConfirmed } from "./accounts";
Initial g1t: services, event bus, intents and attempts10
Email verification, password reset, and Git for AI scale positioning11export type User = {
12 id: string;
13 username: string;
14 /**
Agents as a team: lifecycle, merge queue, billing and a new shell15 * `workspace` when a workspace is acting through one of its own access
Git storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily16 * tokens: `id` is then the workspace's and `username` its slug. `system`
17 * is g1t itself doing platform work, such as a security update
18 * (`username` `g1t`). Absent means `user`.
Agents as a team: lifecycle, merge queue, billing and a new shell19 */
Git storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily20 kind?: "user" | "workspace" | "agent" | "system";
Agents as a team: lifecycle, merge queue, billing and a new shell21 /**
Email verification, password reset, and Git for AI scale positioning22 * Whether the account's email address is confirmed. Only set on users
Email confirmation gate: a code and a link, nothing else until confirmed23 * resolved from credentials. An account that has not confirmed it can
24 * only confirm it: see `awaitsConfirmation`.
Email verification, password reset, and Git for AI scale positioning25 */
26 verified?: boolean;
Workspaces own repositories27 /**
28 * The workspaces this user belongs to. Set on users resolved from
29 * credentials, so any service can authorize from it.
30 */
31 workspaces?: Membership[];
Workspace names and icons, and a component kit for every control32 /**
33 * The person's uploaded avatar: the SHA-256 of its bytes, served at
34 * `/avatars/<avatar>`. Only set on the signed-in person; absent means
35 * the generated letter avatar.
36 */
37 avatar?: string;
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API38 /**
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent39 * Set on an agent resolved from its token: who it acts for ("g1t
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API40 * on behalf of syntaqx"), with which credential, and what it may do.
41 */
42 acting?: Acting;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look43 /**
44 * The repositories this user has a role on directly, whether or not they
45 * belong to its workspace. Set with `workspaces`; see `access.ts`.
46 */
47 grants?: RepoGrant[];
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step48 /**
49 * Set on a user resolved from an access token: its scopes (null for full
50 * access) and the workspaces or repositories it reaches. See scopes.ts.
51 */
52 token?: {
53 token_id: string;
54 scopes?: string[] | null;
55 legacy?: boolean;
Merge the AI Gateway: Anthropic's Messages API on a workspace's tokens56 /** The token's name, as its owner gave it. */
57 name?: string;
TS access mirrors the workspace token cap and fine-grained reach58 /** A fine-grained token's reach: its resource owner and repositories. */
59 fine_grained?: {
60 workspace?: string | null;
61 repositories?: "all" | "selected" | "public";
62 repo_ids?: string[];
63 };
64 /** A workspace's own token an owner gave Admin. */
65 admin?: boolean;
66 /** Set on what a deploy key resolves to. */
67 deploy_key?: string;
68 /** The one repository a job's token or a deploy key reaches. */
69 repo?: string;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step70 };
Merge main (membership, two-factor, GitHub repo roles) into tokens71 /**
72 * Workspaces the person belongs to but cannot use until they meet its
73 * policy, such as turning on two-factor authentication. Left out of
74 * `workspaces` and `grants` meanwhile.
75 */
76 held?: PolicyHold[];
Email verification, password reset, and Git for AI scale positioning77};
Initial g1t: services, event bus, intents and attempts78
Workspaces own repositories79/** What a member may do: an owner also manages the workspace's members. */
80export type Role = "owner" | "member";
81
Workspace names and icons, and a component kit for every control82export type Membership = {
83 /** The workspace's name in URLs: `g1t.sh/<slug>`. */
84 slug: string;
85 role: Role;
86 /** Its display name. Set on users resolved from credentials. */
87 name?: string;
88 /** Its uploaded icon, as `Workspace.avatar`. */
89 avatar?: string;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look90 /** The workspace's base permission: what members get on every repository. Absent means `write`. */
91 base_permission?: BasePermission;
Merge branch 'worktree-agent-ad7c6d88d93adc817'92 /** Who may create its teams. Absent means any member. */
93 team_creation?: TeamCreation;
Merge main (membership, two-factor, GitHub repo roles) into tokens94 /** The roles held besides owner or member. */
95 org_roles?: OrgRole[];
96 /** What the workspace lets its members do. Absent means the defaults. */
97 privileges?: MemberPrivileges;
Workspace names and icons, and a component kit for every control98};
Workspaces own repositories99
Agents and memory, checks and conflicts, profiles, slug renames, custom domains100/** How long an old workspace slug redirects, and stays reserved for it, after a rename. */
101export const SLUG_HOLD_DAYS = 90;
102
103/** How long a workspace must wait between renames. */
104export const RENAME_COOLDOWN_HOURS = 24;
105
Workspace names and icons, and a component kit for every control106/** The largest avatar that can be uploaded, in bytes. */
107export const MAX_AVATAR_BYTES = 1024 * 1024;
108
Workspaces own repositories109/**
Merge branch 'worktree-agent-a2013627e5ea4ab13'110 * Where a workspace keeps its repositories' git data: anywhere g1t stores
111 * it (the default), or in the EU only. It applies to repositories made
112 * after it is set.
113 */
114export type DataResidency = "anywhere" | "eu";
115
116/**
Workspaces own repositories117 * A workspace: the owner of repositories, and the first segment of their
118 * URLs. A person's own space and a team's are the same thing.
119 */
120export type Workspace = {
121 id: string;
122 slug: string;
123 name: string;
Agents as a team: lifecycle, merge queue, billing and a new shell124 /** One line saying what the workspace is for. */
125 description: string | null;
Workspaces own repositories126 /** RFC 3339. */
127 createdAt: string;
128 memberCount: number;
Workspace names and icons, and a component kit for every control129 /**
130 * The workspace's uploaded icon: the SHA-256 of its bytes, served at
131 * `/avatars/<avatar>`. Null means the generated letter avatar.
132 */
133 avatar: string | null;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look134 /** What every member gets on each repository; owners have Admin. */
135 basePermission?: BasePermission;
Merge branch 'worktree-agent-ad7c6d88d93adc817'136 /** Who may create its teams. Absent means any member. */
137 teamCreation?: TeamCreation;
Merge main (membership, two-factor, GitHub repo roles) into tokens138 /** Whether members and outside collaborators need two-factor authentication. */
139 twoFactorRequirementEnabled?: boolean;
140} & Partial<MemberPrivileges>;
Workspaces own repositories141
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look142export type Member = {
143 username: string;
144 role: Role;
Merge main (membership, two-factor, GitHub repo roles) into tokens145 /** The roles they hold besides `role`. */
146 org_roles?: OrgRole[];
147 /** Whether two-factor authentication is on; owners only, null for anyone else. */
148 two_factor?: boolean | null;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look149 /** Their display name, when they set one. */
150 name?: string | null;
151 /** Their uploaded avatar's hash, served at `/avatars/<avatar>`; null for the generated letter avatar. */
152 avatar?: string | null;
153};
Workspaces own repositories154
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace155/** An owner of a workspace, as staff see them. */
156export type AdminOwner = { username: string; email: string | null };
157
158/** A workspace as staff see it. Mirrors `AdminWorkspace` in `crates/contracts/src/identity.rs`. */
159export type AdminWorkspace = {
160 slug: string;
161 name: string;
162 /** RFC 3339. */
163 createdAt: string;
164 owners: AdminOwner[];
165 memberCount: number;
166};
167
168/** A member of a workspace, as staff see them. */
169export type AdminMember = { username: string; email: string | null; role: Role; /** RFC 3339. */ joined: string };
170
171export type AdminWorkspaceDetail = {
172 slug: string;
173 name: string;
174 description: string | null;
175 /** RFC 3339. */
176 createdAt: string;
177 /** Owners first, then by username. */
178 members: AdminMember[];
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member179 /** It can never be deleted, by anyone (identity's `PROTECTED_WORKSPACES`). */
180 protected: boolean;
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace181};
182
183/** The most workspaces one `workspaces` call returns. */
184export const ADMIN_WORKSPACES_LIMIT = 500;
185
186/**
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look187 * Whether anyone may make an account, or only someone with an invite.
188 * Identity's `REGISTRATION_MODE`; unset means `invite`.
189 */
190export type RegistrationMode = "invite" | "open";
191
192/** How many invites a person may have out at once, unless identity's `INVITES_PER_USER` says otherwise. */
193export const INVITES_PER_USER = 5;
194/** How long an invite works, unless identity's `INVITE_TTL_DAYS` says otherwise. */
195export const INVITE_TTL_DAYS = 30;
196
197/** Only a pending invite can be used or revoked. Revoked and expired ones never used give the invite back. */
Email confirmation gate: a code and a link, nothing else until confirmed198/**
199 * `awaiting_confirmation`: used to make an account that has not confirmed its
200 * email address yet; what it gives is joined when the address is confirmed,
201 * unless it is revoked first.
202 */
203export type InviteStatus = "pending" | "awaiting_confirmation" | "redeemed" | "expired" | "revoked";
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look204
205/** One invite. Mirrors `Invite` in `crates/contracts/src/identity.rs`. */
206export type Invite = {
207 id: string;
208 /** `g1t-k7m2-…`: returned when it is made, and to its maker while pending. */
209 code: string | null;
210 /** The code's first group, such as `g1t-k7m2`. */
211 hint: string;
212 /** Only this address can use it. */
213 email: string | null;
214 /** `account` makes an account; `workspace` joins an existing one to `workspace`. */
215 kind: "account" | "workspace";
216 /** The workspace using it joins. */
217 workspace: string | null;
218 status: InviteStatus;
219 /** Whose allowance it used. */
220 chargedTo: "user" | "workspace" | "none";
221 /** Its maker's username; null when g1t staff made it. */
222 invitedBy: string | null;
223 /** The account that used it. */
224 redeemedBy: string | null;
225 /** RFC 3339. */
226 createdAt: string;
227 /** RFC 3339. */
228 expiresAt: string;
229 redeemedAt: string | null;
230 revokedAt: string | null;
231 /** The staff member who minted it; only in staff views. */
232 staff?: string | null;
233};
234
235/** How many invites someone may have out. `limit` and `remaining` are null for no limit. */
236export type Allowance = { limit: number | null; used: number; remaining: number | null };
237
238export type InvitesOverview = {
239 mode: RegistrationMode;
240 allowance: Allowance;
241 /** Workspaces the person owns that were granted invites to share. */
242 workspaces: { slug: string; allowance: Allowance }[];
243 invites: Invite[];
244};
245
246/** What a valid code is for, before it is used. */
247export type InvitePreview = {
248 kind: "account" | "workspace";
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas249 /** Pending, unless `anyStatus` asked about a code that is spent. */
250 status: InviteStatus;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look251 /** Null when g1t staff sent it. */
252 invitedBy: { username: string; name: string | null; avatar: string | null } | null;
253 workspace: ProfileWorkspace | null;
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas254 /** The repository it accepts an invitation to, such as `{ name: "flagon-io/g1t", role: "write" }`. */
255 repository: { name: string; role: string } | null;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look256 /** Partly hidden, such as `a•••@example.com`. */
257 email: string | null;
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas258 /** The bound address in full, while the invite is pending: it fills in and locks the sign-up form. */
259 address: string | null;
260 /** Whether the bound address has a g1t account already: sign in to accept. */
261 hasAccount: boolean;
262 /** With a viewer: whether it is theirs (for one of their confirmed addresses, or used by them). */
263 forViewer: boolean | null;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look264 expiresAt: string;
265};
266
267export type WaitlistStatus = "waiting" | "invited" | "dismissed";
268
269export type WaitlistEntry = {
270 id: string;
271 email: string;
272 about: string | null;
273 status: WaitlistStatus;
274 inviteId: string | null;
275 decidedBy: string | null;
276 decidedAt: string | null;
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas277 /** What staff wrote when approving; it went in the invite email. */
278 note: string | null;
279 /** The account made with the invite, once it was used. */
280 joinedAs: string | null;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look281 /** When they first asked. */
282 createdAt: string;
283 /** When they last asked. */
284 updatedAt: string;
285};
286
287export type InviteGrant = { amount: number; note: string | null; grantedBy: string; createdAt: string };
288export type InviteTreeNode = { username: string; joinedAt: string; invited: InviteTreeNode[] };
289
290/** Where a person came from and whom they brought. For a workspace, `username` is its slug. */
291export type InviteTree = {
292 username: string;
293 /** Who invited them, then who invited that person, and so on. */
294 invitedBy: string[];
295 /** The staff member who minted their invite, when staff did. */
296 staff: string | null;
297 allowance: Allowance;
298 grants: InviteGrant[];
299 invites: Invite[];
300 /** Whom they invited, three levels down. */
301 invited: InviteTreeNode[];
302};
303
304/** The most rows one staff listing of invites or the waitlist returns. */
305export const ADMIN_INVITES_LIMIT = 500;
306
307/**
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace308 * Staff-only identity, for sudo.g1t.sh. It takes no viewer and checks no
309 * membership: only sudo calls it, over its service binding, once Cloudflare
310 * Access and its staff list have let someone in. Never call it on behalf of
311 * a customer.
312 */
313export interface IdentityAdminApi {
314 /** Every workspace, newest first, at most 500; `query` matches slug, name, or an owner's username or email. */
315 workspaces(query?: string): Promise<AdminWorkspace[]>;
316 /** One workspace with all its members, or null. */
317 workspace(slug: string): Promise<AdminWorkspaceDetail | null>;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look318
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas319 /** The waitlist, newest first; `query` matches the address or what they said. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look320 waitlist(query?: string | null, status?: WaitlistStatus | null): Promise<WaitlistEntry[]>;
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas321 /** How many requests are waiting, for the navigation's badge. */
322 waitlistPending(): Promise<number>;
323 /**
324 * Approving mints an invite bound to the address and emails it, with
325 * `note` (up to 500 characters) if given; dismissing only marks it.
326 */
327 decideWaitlist(id: string, approve: boolean, staff: string, note?: string | null): Promise<Result<WaitlistEntry>>;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look328 /** Invites, newest first; `query` is a code's start, or part of an email, inviter or redeemer. */
329 invites(query?: string | null): Promise<Invite[]>;
330 revokeInvite(id: string, staff: string): Promise<Result<Invite>>;
331 /** An invite that uses nobody's allowance, optionally bound to (and emailed to) `email`. */
332 mintInvite(email: string | null, staff: string): Promise<Result<Invite>>;
333 /** More invites (or fewer, with a negative amount) for a person or a workspace. */
334 grantInvites(
335 target: "user" | "workspace",
336 name: string,
337 amount: number,
338 note: string,
339 staff: string,
340 ): Promise<Result<Allowance>>;
341 /** Where a person came from and whom they brought, or null. */
342 inviteTree(username: string): Promise<InviteTree | null>;
343 /** A workspace's granted invites and the invites made for it, or null. */
344 workspaceInvites(slug: string): Promise<InviteTree | null>;
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member345
346 /** Workspaces owners deleted that are not purged yet, newest first. */
347 deletedWorkspaces(): Promise<DeletedWorkspace[]>;
348 /**
349 * Brings a deleted workspace back, with its members, tokens and what went
350 * with it, while it is still restorable. Publishes `workspace.restored`.
351 */
352 restoreWorkspace(workspaceId: string, staff: string): Promise<Result<boolean>>;
353 /**
354 * Purges a deleted workspace now rather than at `purgeAfter`. `confirm` is
355 * its slug, typed out. Refused for a protected workspace. Publishes
356 * `workspace.deleted`.
357 */
358 purgeWorkspace(workspaceId: string, staff: string, confirm: string): Promise<Result<boolean>>;
Merge branch 'worktree-agent-a8385d293d42c913a'359
360 /** Every workspace alias, by name. */
361 aliases(): Promise<WorkspaceAlias[]>;
362 /**
363 * Points `alias` at the workspace whose slug is `workspace`. Refused for
364 * one of the site's routes, anyone's username, a workspace's slug (deleted
365 * or held after a rename) and an existing alias. `note` says why.
366 */
367 setAlias(alias: string, workspace: string, note: string, staff: string): Promise<Result<WorkspaceAlias>>;
368 /** Removes an alias; `reason` goes in sudo's audit log. */
369 removeAlias(alias: string, reason: string, staff: string): Promise<Result<boolean>>;
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace370}
371
Merge branch 'worktree-agent-a8385d293d42c913a'372/**
373 * A name g1t's staff point at a workspace, so its addresses lead there under
374 * the workspace's own name: `g1t`, the product, leads to `flagon-io`, Flagon,
375 * Inc. Staff-managed only; it follows the workspace through renames.
376 */
377export type WorkspaceAlias = {
378 alias: string;
379 workspaceId: string;
380 /** The workspace's slug and name now. */
381 workspace: string;
382 workspaceName: string;
383 /** Why it exists. */
384 note: string;
385 /** The staff member who set it, or `migration`. */
386 createdBy: string;
387 /** RFC 3339. */
388 createdAt: string;
389};
390
Initial g1t: services, event bus, intents and attempts391/** Who is asking. Every read and write in every service takes one. */
392export type Viewer = User | null;
393
Email confirmation gate: a code and a link, nothing else until confirmed394/**
395 * Whether this is a person whose account has not confirmed its email
396 * address. Such an account can only confirm it, change it, or sign out.
397 */
398export function awaitsConfirmation(user: Pick<User, "kind" | "verified"> | null | undefined): boolean {
399 return !!user && (user.kind ?? "user") === "user" && !user.verified;
400}
401
Initial g1t: services, event bus, intents and attempts402export type SshKey = {
403 id: string;
404 title: string;
405 fingerprint: string;
RFC 3339 timestamps in identity and repos406 /** RFC 3339. */
407 createdAt: string;
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca408 /** When it last signed in over SSH, RFC 3339, to within 5 minutes; null when it never has. */
409 lastUsedAt: string | null;
Initial g1t: services, event bus, intents and attempts410};
411
Agents as a team: lifecycle, merge queue, billing and a new shell412export type AccessToken = {
413 id: string;
414 name: string;
415 /** RFC 3339. */
416 createdAt: string;
417 /** RFC 3339, to within a few minutes. Null until it is first used. */
418 lastUsedAt: string | null;
419 /**
420 * For a workspace's token, the username of the member who made it. Null
421 * once that account is gone, and on personal tokens.
422 */
423 createdBy: string | null;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step424 /** Its scopes, as `resource:level`. Null: full access. */
425 scopes: string[] | null;
426 /** Made before tokens had scopes: full access until someone narrows it. */
427 legacy: boolean;
428 /** RFC 3339. Null: it does not expire. */
429 expiresAt: string | null;
Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules430 /** Classic, fine-grained, or a workspace's own. */
431 kind?: TokenKind;
432 /** What it is for, as its owner wrote it. */
433 description?: string | null;
434 /** A fine-grained token's resource owner, repositories, permissions and status. */
435 fineGrained?: FineGrainedDetails | null;
436 /** A workspace's own token an owner gave Admin when making it. */
437 admin?: boolean;
438};
439
440export type TokenKind = "classic" | "fine_grained" | "workspace";
441
442/** Whether a fine-grained token may be used on its resource owner. */
443export type TokenStatus = "active" | "pending" | "denied" | "revoked";
444
445export type FineGrainedDetails = {
446 /** The resource owner's slug; null for your own account. */
447 workspace: string | null;
448 repositorySelection: RepositorySelection;
449 /** With `selected`: the repositories, as `owner/name`, that you can see. */
450 repositories: string[];
451 permissions: Partial<Record<string, PermissionAccess>>;
452 status: TokenStatus;
453 /** Why an owner denied or revoked it. */
454 reviewReason?: string | null;
455};
456
457/** What a new fine-grained token is. */
458export type FineGrainedTokenInput = {
459 name: string;
460 description?: string | null;
461 /** Between 1 and 366 days, and no more than the workspace allows. */
462 ttlSeconds: number;
463 /** The resource owner: a workspace's slug, or null for your own account. */
464 workspace: string | null;
465 repositorySelection: RepositorySelection;
466 /** With `selected`: `owner/name` or names in the workspace. */
467 repositories: string[];
468 /** Each permission's level by name; names left out are none. */
469 permissions: Record<string, PermissionAccess>;
470};
471
472/** A workspace's rules for personal access tokens. */
473export type TokenPolicy = {
474 allowClassic: boolean;
475 allowFineGrained: boolean;
476 requireApproval: boolean;
477 /** Null: no limit. */
478 maxLifetimeDays: number | null;
479 forbidNoExpiry: boolean;
480 updatedBy?: string | null;
481 updatedAt?: string | null;
482};
483
484/** A member's personal token that reaches a workspace, as its owners see it. */
485export type MemberToken = {
486 owner: string;
487 token: AccessToken;
488 /** Whether it reaches the workspace now. */
489 reaches: boolean;
490 /** Why not: pending approval, denied, revoked, classic tokens not allowed, lasts too long, never expires. */
491 blockedBy?: string | null;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step492};
493
494/** What a new or changed token may do. */
495export type TokenGrant = {
496 /** Null: full access. */
497 scopes: string[] | null;
Agents as a team: lifecycle, merge queue, billing and a new shell498};
Initial g1t: services, event bus, intents and attempts499
Device sign-in replaces registering and minting tokens over the API500export type DeviceStart = {
501 /** Secret held by the tool and exchanged for a token once approved. */
502 deviceCode: string;
503 /** Short code shown to the person, e.g. `WDJB-MJHT`. */
504 userCode: string;
505 /** Seconds until both codes stop working. */
506 expiresIn: number;
507 /** Seconds the tool should wait between polls. */
508 interval: number;
509};
510
511export type DeviceRequest = { userCode: string; clientName: string };
512
513export type DeviceClaim =
514 | { status: "pending" | "denied" | "expired" }
515 | { status: "approved"; token: string; user: User };
516
OAuth 2.1 sign-in for MCP clients and other applications517/** What the site passes on once a person has approved an application. */
518export type OAuthApproval = {
519 clientId: string;
520 /** Shown wherever the application's access is listed. */
521 clientName: string;
522 redirectUri: string;
523 /** PKCE challenge, method S256. */
524 codeChallenge: string;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step525 /** What the person granted. Null: full access. */
526 scopes: string[] | null;
OAuth 2.1 sign-in for MCP clients and other applications527};
528
529export type OAuthTokens = {
530 accessToken: string;
531 /** Works once; using it returns the next one. */
532 refreshToken: string;
533 /** Seconds until the access token stops working. */
534 expiresIn: number;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step535 /** The scopes granted, space-separated, or `*` for full access. */
536 scope?: string | null;
OAuth 2.1 sign-in for MCP clients and other applications537};
538
539/** An application a person has signed in to. */
540export type OAuthGrant = {
541 id: string;
542 clientName: string;
543 /** RFC 3339. */
544 createdAt: string;
545 /** RFC 3339. */
546 lastUsedAt: string;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step547 /** What the person granted. Null: full access. */
548 scopes: string[] | null;
549 /** Signed in before applications had scopes: full access until narrowed. */
550 legacy: boolean;
OAuth 2.1 sign-in for MCP clients and other applications551};
552
Initial g1t: services, event bus, intents and attempts553/** Accounts, credentials and sessions. */
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member554/**
555 * What deleting a workspace takes with it, and what stands in the way:
556 * nothing does while `billing` is null and it is not `protected`.
557 */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look558export type WorkspaceDeletion = {
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member559 /** Its live repositories, deleted with it. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look560 repositories: number;
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member561 /** Its projects, hidden with it. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look562 projects: number;
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member563 members: number;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look564 /** Why billing cannot close it yet, in words for its owner. */
565 billing: string | null;
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member566 /** It can never be deleted, by anyone. */
567 protected: boolean;
568};
569
570/** How long a deleted workspace is kept, for g1t's staff to restore, before it is purged. */
571export const WORKSPACE_RESTORE_DAYS = 30;
572
573/**
574 * Workspaces nobody can delete, whatever identity's `PROTECTED_WORKSPACES`
575 * says: Flagon's, which runs g1t. Services that act on `workspace.deleting`
576 * check it too, so one published for it by mistake changes nothing.
577 */
578export const ALWAYS_PROTECTED_WORKSPACES: readonly string[] = ["flagon-io"];
579
580/** Whether `slug` is one of `ALWAYS_PROTECTED_WORKSPACES`, in any case. */
581export function isProtectedWorkspace(slug: string): boolean {
582 return ALWAYS_PROTECTED_WORKSPACES.includes(slug.trim().toLowerCase());
583}
584
585/** A workspace an owner deleted, kept until `purgeAfter` for staff to restore. */
586export type DeletedWorkspace = {
587 workspaceId: string;
588 slug: string;
589 name: string;
590 /** RFC 3339. */
591 deletedAt: string;
592 /** The username of the owner who deleted it. */
593 deletedBy: string;
594 /** RFC 3339: when it is purged unless restored first. */
595 purgeAfter: string;
596 /** What went with it, counted when it was deleted. */
597 went: WorkspaceDeletion;
598 /** Whether staff can still restore it. */
599 restorable: boolean;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look600};
601
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca602export interface IdentityApi extends AccessClient, TeamsClient, DeployKeysClient {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look603 /**
604 * Creates an account and signs it in. While registration is invite-only,
605 * `inviteCode` must be an unused, unexpired invite (and, when it names an
606 * email, that address); it is ignored while registration is open.
607 */
608 register(
609 username: string,
610 email: string,
611 password: string,
612 inviteCode?: string | null,
613 /** Who is asking, such as the visitor's IP address, for rate limits. */
614 client?: string | null,
615 ): Promise<Result<{ user: User; sessionToken: string }>>;
Initial g1t: services, event bus, intents and attempts616 /** Verifies a username and password for website sign-in. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look617 /**
618 * Verifies a username, or any confirmed address of the account, and its
619 * password. Wrong passwords are counted against the account and `client`
620 * (the visitor's IP address); past a limit nothing is checked for a while.
621 */
Merge main (membership, two-factor, GitHub repo roles) into tokens622 signIn(
623 username: string,
624 password: string,
625 client?: string | null,
626 ): Promise<Result<{ user: User; sessionToken: string; twoFactorChallenge?: string | null }>>;
627 /**
628 * The second step of signing in, for an account with two-factor
629 * authentication: the challenge `signIn` returned, and a code from the
630 * app or a recovery code.
631 */
632 twoFactorSignIn(challenge: string, code: string, client?: string | null): Promise<Result<{ user: User; sessionToken: string }>>;
Initial g1t: services, event bus, intents and attempts633 signOut(sessionToken: string): Promise<void>;
Email verification, password reset, and Git for AI scale positioning634
Email confirmation gate: a code and a link, nothing else until confirmed635 /**
636 * Sends a new confirmation code and link to the primary of an account
637 * that has not confirmed it, at most once a minute.
638 */
Email verification, password reset, and Git for AI scale positioning639 resendVerification(user: User): Promise<Result<boolean>>;
Email confirmation gate: a code and a link, nothing else until confirmed640 /** Confirms the address the emailed link was sent to, signed in or not; ends the code sent with it. */
641 verifyEmail(token: string): Promise<Result<EmailConfirmed>>;
Email verification, password reset, and Git for AI scale positioning642 /** Emails a reset link if the address has an account. Always resolves. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look643 /**
644 * Any confirmed address of an account works; the link goes to it, and the
645 * primary and backup are told. A few an hour per address and per `client`.
646 */
647 requestPasswordReset(email: string, client?: string | null): Promise<boolean>;
Email verification, password reset, and Git for AI scale positioning648 /** Sets a new password from an emailed token and ends every session. */
649 resetPassword(token: string, password: string): Promise<Result<User>>;
650
Device sign-in replaces registering and minting tokens over the API651 /**
652 * Device sign-in (RFC 8628). A tool starts a request, a person approves
653 * its short code in a browser, and the tool claims an access token.
654 */
655 deviceStart(clientName: string): Promise<DeviceStart>;
656 /** What a user code is asking for, or null if it is not valid. */
657 deviceLookup(userCode: string): Promise<DeviceRequest | null>;
658 deviceResolve(userCode: string, user: User, approve: boolean): Promise<Result<boolean>>;
659 deviceClaim(deviceCode: string): Promise<DeviceClaim>;
660
OAuth 2.1 sign-in for MCP clients and other applications661 /**
662 * OAuth 2.1 for applications that sign a person in through the browser.
663 * The caller has checked the client and its redirect address; this
664 * returns the one-time code the application exchanges for tokens.
665 */
666 oauthAuthorize(user: User, approval: OAuthApproval): Promise<{ code: string }>;
667 /** Redeems a code. It works once, for that client, with the PKCE verifier. */
668 oauthExchange(code: string, codeVerifier: string, clientId: string, redirectUri: string): Promise<Result<OAuthTokens>>;
669 /** Trades a refresh token for new tokens; the old ones stop working. */
670 oauthRefresh(refreshToken: string, clientId: string): Promise<Result<OAuthTokens>>;
671 /** Applications the user has signed in to, most recently used first. */
672 listOAuthGrants(user: User): Promise<OAuthGrant[]>;
673 /** Signs an application out. */
674 revokeOAuthGrant(user: User, id: string): Promise<void>;
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step675 /** Changes what an application may do, at once and when it refreshes. */
676 updateOAuthGrant(user: User, id: string, grant: TokenGrant): Promise<Result<OAuthGrant>>;
OAuth 2.1 sign-in for MCP clients and other applications677
Workspaces own repositories678 createWorkspace(user: User, slug: string, name: string): Promise<Result<Workspace>>;
679 /** Public details of a workspace, or null. */
680 getWorkspace(slug: string): Promise<Workspace | null>;
Merge branch 'worktree-agent-a2013627e5ea4ab13'681 /** Where a workspace keeps its repositories' git data; null when there is no such workspace. */
682 workspaceResidency(slug: string): Promise<DataResidency | null>;
683 /**
684 * Owners only. Applies to repositories made from then on. Offer `eu`
685 * only when the repos service's `storageOptions()` says it is available.
686 */
687 setWorkspaceResidency(actor: User, slug: string, residency: DataResidency): Promise<Result<DataResidency>>;
Workspaces own repositories688 /** Members only. */
689 listMembers(slug: string, viewer: Viewer): Promise<Result<Member[]>>;
690 /** Owners only. */
691 addMember(actor: User, slug: string, username: string): Promise<Result<boolean>>;
Merge main (membership, two-factor, GitHub repo roles) into tokens692 /** Owners only; your own username is leaving. Never the last owner. */
Workspaces own repositories693 removeMember(actor: User, slug: string, username: string): Promise<Result<boolean>>;
Merge main (membership, two-factor, GitHub repo roles) into tokens694 /** Owners only: owner or member, and the roles held besides it. Never leaves no owner. */
695 updateMember(actor: User, slug: string, username: string, change: { role?: Role; org_roles?: OrgRole[] }): Promise<Result<Member>>;
696 /** Owners only: `username` becomes an owner, and you a member. */
697 transferOwnership(actor: User, slug: string, username: string): Promise<Result<boolean>>;
698 /** You leave the workspace. Never the last owner. */
699 leaveWorkspace(user: User, slug: string): Promise<Result<boolean>>;
700 /** Owners only: change some member privileges; returns all of them. */
701 setMemberPrivileges(actor: User, slug: string, change: Partial<MemberPrivileges>): Promise<Result<MemberPrivileges>>;
702 /** Owners only, with two-factor on themselves: require it of everyone. */
703 setTwoFactorRequirement(actor: User, slug: string, required: boolean): Promise<Result<boolean>>;
Agents as a team: lifecycle, merge queue, billing and a new shell704 /** Owners only. An empty name falls back to the slug. */
705 updateWorkspace(actor: User, slug: string, details: { name: string; description: string }): Promise<Result<Workspace>>;
Workspace names and icons, and a component kit for every control706 /**
Agents and memory, checks and conflicts, profiles, slug renames, custom domains707 * Owners only. Changes the slug, the first segment of the workspace's
708 * URLs; the display name is untouched. The old slug redirects to the new
709 * one, and stays reserved for this workspace, for `SLUG_HOLD_DAYS`.
710 * Publishes `workspace.renamed`.
711 */
712 renameWorkspace(actor: User, slug: string, newSlug: string): Promise<Result<Workspace>>;
713 /** Whether `renameWorkspace` would be allowed, changing nothing. */
714 checkWorkspaceRename(actor: User, slug: string, newSlug: string): Promise<Result<boolean>>;
715 /**
716 * The workspace's current slug when `slug` is one it was renamed from
Merge branch 'worktree-agent-a8385d293d42c913a'717 * within `SLUG_HOLD_DAYS`, or when `slug` is an alias staff set for it
718 * (`WorkspaceAlias`); null otherwise, including for a slug in use.
Agents and memory, checks and conflicts, profiles, slug renames, custom domains719 */
720 resolveSlug(slug: string): Promise<string | null>;
721 /**
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look722 * Owners only, a person only. `confirm` is the slug, typed out. Refused
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member723 * for a protected workspace, and while billing cannot settle it. Its
724 * repositories, projects and apps go with it; it is kept for
725 * `WORKSPACE_RESTORE_DAYS`, when g1t's staff can restore it, then purged.
726 * Its slug is never given to anyone else; the person whose username it is
727 * may make it again once it is purged. Publishes `workspace.deleting`.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look728 */
729 deleteWorkspace(actor: User, slug: string, confirm: string): Promise<Result<boolean>>;
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member730 /** What `deleteWorkspace` would take with it, and what stands in its way, changing nothing. */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look731 checkWorkspaceDeletion(actor: User, slug: string): Promise<Result<WorkspaceDeletion>>;
732 /**
Workspace names and icons, and a component kit for every control733 * Owners only. `image` is the file in base64: PNG, JPEG, WebP or GIF, at
734 * most `MAX_AVATAR_BYTES`, checked by its bytes. Null removes the icon.
735 */
736 setWorkspaceAvatar(actor: User, slug: string, image: string | null): Promise<Result<Workspace>>;
737 /** A person's own avatar, as `setWorkspaceAvatar`: the new one, or null. */
738 setUserAvatar(user: User, image: string | null): Promise<Result<string | null>>;
Workspaces own repositories739
Agents as a team: lifecycle, merge queue, billing and a new shell740 /**
741 * A workspace's own access tokens. They belong to the workspace, act as
742 * it, and keep working when the member who made one leaves. Members only.
743 */
744 listWorkspaceTokens(slug: string, viewer: Viewer): Promise<Result<AccessToken[]>>;
745 /** Owners only. The plaintext token is returned once and never stored. */
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step746 createWorkspaceToken(
747 actor: User,
748 slug: string,
749 name: string,
Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules750 grant?: TokenGrant & { ttlSeconds?: number; admin?: boolean },
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step751 ): Promise<Result<{ token: string; info: AccessToken }>>;
Agents as a team: lifecycle, merge queue, billing and a new shell752 /** Owners only. */
753 removeWorkspaceToken(actor: User, slug: string, id: string): Promise<Result<boolean>>;
754
Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules755 /**
756 * A fine-grained personal access token: one resource owner, some of its
757 * repositories, a level for each permission. People only. It starts
758 * pending when its workspace asks for approval and you are not an owner.
759 */
760 createFineGrainedToken(user: User, input: FineGrainedTokenInput): Promise<Result<{ token: string; info: AccessToken }>>;
761 /** Its owner changes it; what is left out stays. Widening it asks for approval again. */
762 updateFineGrainedToken(
763 user: User,
764 id: string,
765 change: Partial<Omit<FineGrainedTokenInput, "ttlSeconds" | "workspace">>,
766 ): Promise<Result<AccessToken>>;
767 /** A workspace's rules for personal access tokens. Members only. */
768 getTokenPolicy(slug: string, viewer: Viewer): Promise<Result<TokenPolicy>>;
769 /** Owners only, as people. `maxLifetimeDays` of 0 removes the limit. */
770 setTokenPolicy(
771 actor: User,
772 slug: string,
773 change: Partial<Omit<TokenPolicy, "updatedBy" | "updatedAt">>,
774 ): Promise<Result<TokenPolicy>>;
775 /** The members' tokens that can reach a workspace. Owners only. */
776 listMemberTokens(
777 actor: User,
778 slug: string,
779 filter?: { status?: TokenStatus; kind?: TokenKind },
780 ): Promise<Result<MemberToken[]>>;
781 /** Approve or deny a fine-grained token waiting for approval. Owners only. */
782 reviewTokenRequest(actor: User, slug: string, id: string, approve: boolean, reason?: string | null): Promise<Result<MemberToken>>;
783 /** Take a member's token out of the workspace. Owners only. */
784 revokeMemberToken(actor: User, slug: string, id: string, reason?: string | null): Promise<Result<boolean>>;
785
Initial g1t: services, event bus, intents and attempts786 userForSession(sessionToken: string): Promise<Viewer>;
787
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look788 /** Whether registration is invite-only. */
789 registration(): Promise<RegistrationMode>;
790 /** A person's invites and what they have left. */
791 listInvites(user: User): Promise<InvitesOverview>;
792 /**
793 * A person makes an invite, optionally for one address (emailed to it),
794 * using one of theirs or, with `workspace`, one the workspace was granted.
795 * People only: never an agent or a workspace's token.
796 */
797 createInvite(user: User, options?: { email?: string | null; workspace?: string | null }): Promise<Result<Invite>>;
798 /** Its maker, or an owner of its workspace, revokes a pending invite; the invite comes back. */
799 revokeInvite(user: User, id: string): Promise<Result<Invite>>;
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas800 /**
801 * What a code is for. Unknown, used, revoked and expired codes all get the
802 * same answer, unless `anyStatus`: then a real code that is spent is
803 * described, with its `status`. `viewer` sets `forViewer`.
804 */
805 checkInvite(
806 code: string,
807 client?: string | null,
808 options?: { viewer?: User | null; anyStatus?: boolean },
809 ): Promise<Result<InvitePreview>>;
810 /**
811 * A signed-in person uses a workspace invite sent to their address, or one
812 * sent with a repository invitation; returns the workspace's slug, or
813 * `workspace/repo`.
814 */
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look815 acceptInvite(user: User, code: string): Promise<Result<string>>;
816 /** Owners only. Invites an address into a workspace, always with an invite bound to it. */
817 inviteMember(actor: User, slug: string, email: string): Promise<Result<Invite>>;
818 /** Owners only: the workspace's invites, newest first. */
819 workspaceInvites(slug: string, viewer: Viewer): Promise<Result<Invite[]>>;
820 /** Owners only. */
821 revokeWorkspaceInvite(actor: User, slug: string, id: string): Promise<Result<Invite>>;
822 /** Someone without an invite asks for one. Always the same answer for a valid address. */
823 requestAccess(email: string, about: string, client?: string | null): Promise<Result<boolean>>;
824
Initial g1t: services, event bus, intents and attempts825 /** Verifies git credentials: the account password or an access token. */
826 userForGitCredentials(username: string, secret: string): Promise<Viewer>;
API and MCP server, Rust identity service, registration, site redesign827 /** Resolves a `g1t_…` access token, as sent to the API and MCP server. */
828 userForAccessToken(token: string): Promise<Viewer>;
Initial g1t: services, event bus, intents and attempts829 userForSshKey(fingerprint: string): Promise<Viewer>;
830 userByUsername(username: string): Promise<Viewer>;
What happened across an outcome, as a feed beside its graph831 /** The names behind account and workspace ids; unknown ids are left out. */
832 usernames(ids: string[]): Promise<Record<string, string>>;
Initial g1t: services, event bus, intents and attempts833
Agents and memory, checks and conflicts, profiles, slug renames, custom domains834 /** A person's public profile, or null if there is no such account. Never an email address. */
835 profile(username: string): Promise<Profile | null>;
836 /** A person changes their own profile. Every field is replaced; an empty one is cleared. */
837 updateProfile(actor: User, fields: ProfileFields): Promise<Result<Profile>>;
838 /**
839 * The workspaces a profile shows `viewer`: those the viewer belongs to
840 * as well, and those of `publicIn` (where the person made a public
841 * project) that the person really belongs to. Nothing else.
842 */
843 profileWorkspaces(username: string, viewer: Viewer, publicIn: string[]): Promise<ProfileWorkspace[]>;
844
Initial g1t: services, event bus, intents and attempts845 listSshKeys(user: User): Promise<SshKey[]>;
846 /** Takes one line in OpenSSH public key format. */
847 addSshKey(user: User, title: string, publicKey: string): Promise<Result<SshKey>>;
848 removeSshKey(user: User, id: string): Promise<void>;
849
850 listAccessTokens(user: User): Promise<AccessToken[]>;
Account dropdown, llms.txt onboarding, hosted agent runner (not yet deployed)851 /**
Agents as a team: lifecycle, merge queue, billing and a new shell852 * The plaintext token is returned once and never stored. With
853 * `ttlSeconds` the token expires and is left out of token lists; that
854 * form is used for hosted agents. A token made for a workspace acting
855 * through a token of its own belongs to that workspace too.
Account dropdown, llms.txt onboarding, hosted agent runner (not yet deployed)856 */
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step857 createAccessToken(
858 user: User,
859 name: string,
860 ttlSeconds?: number,
861 grant?: TokenGrant & { listed?: boolean },
862 ): Promise<{ token: string; info: AccessToken }>;
863 /** Changes what one of a person's tokens may do; the token is unchanged. */
864 updateAccessToken(user: User, id: string, grant: TokenGrant): Promise<Result<AccessToken>>;
Agents as a team: lifecycle, merge queue, billing and a new shell865 /**
866 * A token for a g1t agent working for `onBehalfOf`: it acts as
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent867 * `g1t`, in `scope.repo` only, and only for `scope.operations`.
Agents as a team: lifecycle, merge queue, billing and a new shell868 */
869 createAgentToken(
870 onBehalfOf: User,
871 scope: AgentScope,
872 ttlSeconds: number,
873 ): Promise<{ token: string; info: AccessToken }>;
Initial g1t: services, event bus, intents and attempts874 removeAccessToken(user: User, id: string): Promise<void>;
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API875 /**
876 * A token for one sandbox run: it acts as the agent on behalf of
877 * `onBehalfOf`, can do only what the run's kind needs in `repo`, and
878 * expires after `ttlSeconds`. See `audit.ts`.
879 */
880 createRunCredential(input: CreateRunCredentialInput): Promise<{ token: string; info: AccessToken }>;
881 /** Ties tokens, by the SHA-256 of their text in hex, to the agent run their sandbox recorded. */
882 bindRunCredentials(tokenHashes: string[], runId: string): Promise<boolean>;
883 /** Ends a sandbox's run credentials, by hash or by run. Never touches another token. */
884 revokeRunCredentials(target: { tokenHashes?: string[]; runId?: string | null }): Promise<boolean>;
Initial g1t: services, event bus, intents and attempts885}
Agents as a team: lifecycle, merge queue, billing and a new shell886
887
888/** What an agent's token may do: these operations, in this repository. */
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API889export type AgentScope = { repo: RepoPath; operations: string[]; run?: RunBinding };
Agents and memory, checks and conflicts, profiles, slug renames, custom domains890
891/** The most characters each profile field takes. Mirrors `crates/contracts/src/identity.rs`. */
892export const PROFILE_LIMITS = { name: 80, bio: 160, location: 80, website: 200, pronouns: 40 } as const;
893
894/** What anyone may see about a person, at `g1t.sh/u/<username>`. */
895export type Profile = {
896 username: string;
897 /** The name they go by, if they gave one. */
898 name: string | null;
899 bio: string | null;
900 location: string | null;
901 /** Always an `https://` address. */
902 website: string | null;
903 pronouns: string | null;
904 /** The uploaded avatar's hash, served at `/avatars/<avatar>`. */
905 avatar: string | null;
906 /** When the account was made. RFC 3339. */
907 createdAt: string;
908};
909
910/** What a person may change on their profile. Empty clears a field. */
911export type ProfileFields = {
912 name: string;
913 bio: string;
914 location: string;
915 /** `https://…`; a bare `example.com` is taken as `https://example.com`. */
916 website: string;
917 pronouns: string;
918};
919
920/** A workspace on a person's profile. */
921export type ProfileWorkspace = { slug: string; name: string; avatar: string | null };

This file's history is long; its oldest lines are credited to the oldest commit read.