@amalgm/shell 0.1.164-preview.36072132286 → 0.1.164-preview.36809057014

package/dist/git-configuration.js

@@ -0,0 +1,217 @@
+/** One value-bearing configuration observation supplies both Card remotes and
+ * the machine-local certificate attached to its actual observed result. */
+import { createHash } from "node:crypto";
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { refusal } from "@amalgm/live";
+import { CaptureSourceChangedError } from "./content-cache-host.js";
+import { externalGitStorage, gitCommonDirectory, gitStorageDirectory } from "./git-binding.js";
+import { gitHost, runGit } from "./git-command.js";
+import { readThroughAddresses } from "./sync-address.js";
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const missing = (error) => ["ENOENT", "ENOTDIR"].includes(error.code ?? "");
+function configurationEntries(bytes) {
+    if (bytes.length === 0)
+        return [];
+    const text = bytes.toString("utf8");
+    if (bytes.at(-1) !== 0 || !Buffer.from(text).equals(bytes))
+        throw new Error("invalid native Git configuration framing");
+    const fields = text.split("\0");
+    fields.pop();
+    if (fields.length % 3 !== 0)
+        throw new Error("invalid native Git configuration framing");
+    const entries = [];
+    for (let i = 0; i < fields.length; i += 3) {
+        if (!fields[i] || !fields[i + 1])
+            throw new Error("invalid native Git configuration origin");
+        const entry = fields[i + 2], separator = entry.indexOf("\n");
+        const key = separator < 0 ? entry : entry.slice(0, separator);
+        if (!key)
+            throw new Error("invalid native Git configuration key");
+        entries.push({ origin: fields[i + 1], key, value: separator < 0 ? "" : entry.slice(separator + 1) });
+    }
+    return entries;
+}
+function remotesFromEntries(entries) {
+    return Object.freeze(entries.flatMap(({ key, value }) => {
+        const match = /^remote\.(.+)\.url$/.exec(key);
+        return match ? [Object.freeze({ name: match[1], url: value })] : [];
+    }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+export function configurationRemotes(bytes) {
+    return remotesFromEntries(configurationEntries(bytes));
+}
+/** Git opens configuration by lexical path, so beneath the host's fixed scope
+ * its answer is decided by the bytes at each path it consults, absence and
+ * emptiness included, and by where that path really lies: a relative
+ * `gitdir:` condition matches against its including file's real directory. */
+function sourceWitness(path) {
+    let stat, real;
+    try {
+        stat = statSync(path);
+        real = realpathSync(path);
+    }
+    catch (error) {
+        if (missing(error))
+            return "absent";
+        throw error;
+    }
+    if (!stat.isFile())
+        return JSON.stringify([real, `kind:${stat.mode & 0o170000}`]);
+    try {
+        return JSON.stringify([real, digest(readFileSync(path))]);
+    }
+    catch (error) {
+        if (missing(error) || error.code === "EISDIR") {
+            throw new CaptureSourceChangedError(`Git configuration source changed while read: ${path}`, { cause: error });
+        }
+        throw error;
+    }
+}
+/** A branch condition reads the checked-out branch's name: HEAD and each
+ * symbolic ref it follows, to Git's symref depth. A packed ref is never
+ * symbolic, so a missing or direct loose ref ends the chain; commits that
+ * move a branch leave its name, and this witness, unchanged. */
+const SYMREF_DEPTH = 5;
+const perWorktreeRef = (name) => name === "HEAD"
+    || ["refs/worktree/", "refs/bisect/", "refs/rewritten/"].some(prefix => name.startsWith(prefix));
+function branchChain(gitDir) {
+    const common = gitCommonDirectory(gitDir);
+    const names = [], paths = [];
+    for (let name = "HEAD", depth = 0; depth <= SYMREF_DEPTH; depth += 1) {
+        const path = join(perWorktreeRef(name) ? gitDir : common, name);
+        paths.push(path);
+        let text;
+        try {
+            text = readFileSync(path, "utf8");
+        }
+        catch (error) {
+            if (missing(error) || error.code === "EISDIR")
+                break;
+            throw error;
+        }
+        const target = /^ref:\s*(\S+)\s*$/.exec(text)?.[1];
+        if (!target)
+            break;
+        names.push(target);
+        name = target;
+    }
+    return { names, paths };
+}
+/** Sources Git consults whether or not they contribute: the storage route
+ * (marker and commondir) and the local and worktree defaults. */
+function defaultSources(repository) {
+    let gitDir;
+    try {
+        gitDir = gitStorageDirectory(repository).directory;
+    }
+    catch (error) {
+        if (missing(error))
+            throw new CaptureSourceChangedError("repository marker disappeared", { cause: error });
+        throw error;
+    }
+    return { gitDir, paths: [join(repository, ".git"), join(gitDir, "commondir"),
+            join(gitCommonDirectory(gitDir), "config"), join(gitDir, "config.worktree")] };
+}
+/** Git resolves a relative include against its including file's directory. */
+function includeTarget(including, value) {
+    if (value.startsWith("~/")) {
+        const home = gitHost().environment.HOME;
+        if (!home)
+            throw new Error(`Git configuration include needs HOME: ${value}`);
+        return resolve(home, value.slice(2));
+    }
+    // Git expands these against another user's home or its install prefix;
+    // Amalgm cannot witness that source, so it declines the repository.
+    if (value.startsWith("~") || value.startsWith("%(prefix)/")) {
+        throw refusal(`unsupported Git configuration include path: ${value}`);
+    }
+    return resolve(dirname(including), value);
+}
+/** Sources a read names: every contributing file and every include target,
+ * missing ones included. A conditional include's branch input is the
+ * separate branch-chain witness. */
+function namedSources(repository, entries) {
+    const paths = [];
+    for (const { origin, key, value } of entries) {
+        if (origin === "command line:")
+            continue; // the host's fixed scope
+        if (!origin.startsWith("file:"))
+            throw new Error(`unexpected Git configuration origin: ${origin}`);
+        const file = resolve(repository, origin.slice("file:".length));
+        paths.push(file);
+        if (key === "include.path" || /^includeif\..*\.path$/.test(key))
+            paths.push(includeTarget(file, value));
+    }
+    return paths;
+}
+/** Conditions whose inputs these witnesses close: the storage route (held by
+ * the binding's association) and the branch chain. `hasconfig:` looks ahead
+ * through every include, so its answer is never reused from witnesses. */
+const witnessedCondition = (key) => !key.startsWith("includeif.")
+    || /^includeif\.(gitdir|gitdir\/i|onbranch):/.test(key);
+const sourcesUnchanged = ({ sources, branch }) => sources.every(([path, before]) => sourceWitness(path) === before)
+    && (branch === null || JSON.stringify(branchChain(branch.gitDir).names) === branch.names);
+export function judgeGitConfiguration(witness) {
+    if (!sourcesUnchanged(witness)) {
+        throw new CaptureSourceChangedError("repository Git configuration source changed after observation");
+    }
+}
+export async function observeGitConfiguration(repository) {
+    const read = (closing) => runGit(repository, ["config", "--null", "--list", "--includes", "--show-origin", "--show-scope"], { purpose: "configuration", closing });
+    const { gitDir, paths } = defaultSources(repository);
+    const sources = new Map();
+    const remember = (candidates) => {
+        for (const path of candidates)
+            if (!sources.has(path))
+                sources.set(path, sourceWitness(path));
+    };
+    // Every witness precedes the read that depends on it; the branch chain is
+    // compared only once a conditional include makes it an input.
+    const branch = branchChain(gitDir), branchNames = JSON.stringify(branch.names);
+    let conditional = false;
+    const witnessed = () => ({ sources: [...sources],
+        branch: conditional ? { gitDir, names: branchNames } : null });
+    const unchanged = () => sourcesUnchanged(witnessed());
+    remember(paths);
+    // One read names every source it followed; a second read covers sources the
+    // first discovered. Discovery after that means the sources moved while read.
+    let bytes, entries;
+    for (let reads = 1;; reads += 1) {
+        bytes = await read(false);
+        entries = configurationEntries(bytes);
+        conditional = entries.some(entry => entry.key.startsWith("includeif."));
+        if (!unchanged())
+            throw new CaptureSourceChangedError("repository Git configuration changed during observation");
+        const known = sources.size;
+        remember(namedSources(repository, entries));
+        if (sources.size === known)
+            break;
+        if (reads === 2)
+            throw new CaptureSourceChangedError("repository Git configuration sources changed during observation");
+    }
+    const configuration = digest(bytes), size = bytes.length, remotes = remotesFromEntries(entries);
+    const keys = new Set(entries.map(entry => entry.key));
+    const fingerprint = digest(JSON.stringify(["amalgm.git-configuration@2", gitHost().key, size, configuration]));
+    const semantic = async () => {
+        if (digest(await read(true)) !== configuration) {
+            throw new CaptureSourceChangedError("repository Git configuration changed after observation");
+        }
+    };
+    const witness = Object.freeze({ kind: "git-configuration", ...witnessed() });
+    return Object.freeze({ remotes, semantic, witnesses: Object.freeze([witness]), fingerprint,
+        sources: Object.freeze([...sources.keys(), ...(conditional ? branch.paths : [])]),
+        reusable: [...keys].every(witnessedCondition),
+        has: (key) => keys.has(key),
+        stamp: (uuid, payloadVersion, binding) => digest(JSON.stringify(["amalgm.git-configuration-observation@1", uuid, payloadVersion, binding, fingerprint])),
+    });
+}
+/** Ground a repository reader depends on beyond its checkout: external Git
+ * storage and every configuration source, include targets included, each at
+ * its synchronization address (a source read through a link depends on the
+ * link and its target). A collection requires all of it in its lease before
+ * admitting what it read; sources inside the checkout are already covered. */
+export function repositoryFootprint(binding, configuration) {
+    return [...new Set([...externalGitStorage(binding), ...configuration.sources.flatMap(readThroughAddresses)])];
+}
+//# sourceMappingURL=git-configuration.js.map

package/dist/git-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-configuration.js","sourceRoot":"","sources":["../src/git-configuration.ts"],"names":[],"mappings":"AAAA;2EAC2E;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,EAAmB,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAA2B,MAAM,kBAAkB,CAAC;AACxH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxG,MAAM,OAAO,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AAKzH,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACxH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACzF,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,SAAS,kBAAkB,CAAC,OAAsC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,kBAAkB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;8EAG8E;AAC9E,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,EAAE,IAAI,CAAC;IACf,IAAI,CAAC;QAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACzD,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAClE,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,KAAK,CAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzE,MAAM,IAAI,yBAAyB,CAAC,gDAAgD,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;gEAGgE;AAChE,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,MAAM;OAC5D,CAAC,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACnG,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAa,EAAE,EAAE,KAAK,GAAa,EAAE,CAAC;IACjD,KAAK,IAAI,IAAI,GAAG,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAC1C,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,OAAO,CAAC,KAAK,CAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM;YAChF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,MAAM;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;iEACiE;AACjE,SAAS,cAAc,CAAC,UAAkB;IACxC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC;IAAC,CAAC;IAC3D,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3G,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;YAC1E,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,SAAiB,EAAE,KAAa;IACrD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,MAAM,OAAO,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;oCAEoC;AACpC,SAAS,YAAY,CAAC,UAAkB,EAAE,OAAsC;IAC9E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QAC7C,IAAI,MAAM,KAAK,eAAe;YAAE,SAAS,CAAC,yBAAyB;QACnE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,GAAG,KAAK,cAAc,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;0EAE0E;AAC1E,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;OAC7E,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAU1D,MAAM,gBAAgB,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAyC,EAAW,EAAE,CAC/F,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;OAC9D,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;AAE5F,MAAM,UAAU,qBAAqB,CAAC,OAAgC;IACpE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,yBAAyB,CAAC,+DAA+D,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAqBD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IAC9D,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAmB,EAAE,CAAC,MAAM,CAAC,UAAU,EACnE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;IACxH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,UAA6B,EAAQ,EAAE;QACvD,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC;IACF,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,MAAM,SAAS,GAAG,GAA0C,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;QACrF,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,GAAY,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChB,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,KAAa,EAAE,OAAsC,CAAC;IAC1D,KAAK,IAAI,KAAK,GAAG,CAAC,GAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACjC,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,EAAE;YAAE,MAAM,IAAI,yBAAyB,CAAC,yDAAyD,CAAC,CAAC;QACjH,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3B,QAAQ,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;YAAE,MAAM;QAClC,IAAI,KAAK,KAAK,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,iEAAiE,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,4BAA4B,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;QACzC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;YAC/C,MAAM,IAAI,yBAAyB,CAAC,wDAAwD,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,GAA4B,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,SAAS,EAAE,EAAE,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW;QACxF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjF,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC7C,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnC,KAAK,EAAE,CAAC,IAAY,EAAE,cAAsB,EAAE,OAA2B,EAAE,EAAE,CAC3E,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,wCAAwC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;KACjH,CAAC,CAAC;AACL,CAAC;AAED;;;;8EAI8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,OAA2B,EAAE,aAA0C;IACzG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;AAChH,CAAC"}

package/dist/git-evidence.d.ts

@@ -0,0 +1,61 @@
+import { type CaptureFailure } from "./content-failure.js";
+import type { NativeIndexBinding } from "./git-binding.js";
+import type { GitCapture } from "./git-capture.js";
+import type { GitConfigurationObservation } from "./git-configuration.js";
+import { type SourceProof } from "./source-proof.js";
+import type { SourceWitness } from "./source-witness.js";
+export interface GitEvidenceObservation {
+    readonly fingerprint: string;
+    readonly configuration: GitConfigurationObservation;
+    readonly binding: NativeIndexBinding;
+    /** The capture whose shared answers this digest names. */
+    readonly capture: GitCapture;
+    /** Unclosed: the shared answers and the native witnesses together. */
+    readonly proof: SourceProof;
+    /** Only the native files and namespaces this collection read. */
+    readonly witnesses: SourceProof;
+    /** Physical keys of the native Git files this collection opened and read. */
+    readonly physical: readonly string[];
+}
+/** Why a repository's Git state cannot certify reuse. Every refusal means the
+ * full reader observes; the reason is evidence, never a different answer. */
+export type GitSealRefusalReason = "marker" | "storage-layout" | "worktree" | "unsupported-storage" | "config-include" | "operation" | "reveal" | "result-mismatch" | "changed" | "unreadable";
+export interface GitSealRefusal {
+    readonly refused: GitSealRefusalReason;
+    readonly detail?: string;
+}
+export type GitEvidence = GitEvidenceObservation | GitSealRefusal;
+export declare const sealRefused: (evidence: GitEvidence) => evidence is GitSealRefusal;
+export declare function reportSeal(repository: string, outcome: "unreached" | "reuse" | "miss" | "reuse-selected" | "write" | "write-refused", reason: string | null): void;
+/**
+ * A digest of the Git state a capture proves: the checkout's binding (the
+ * effective worktree, a gitfile's bytes and its route included), the Git host,
+ * effective configuration, HEAD, every loose ref, packed-refs content, config,
+ * the shallow boundary, an unfinished merge's heads, message, mode and
+ * AUTO_MERGE, and the index's meaning (git-native-index.ts). Config
+ * and shallow matter because the Card carries remotes and the shallow
+ * boundary; the merge files because the Checkpoint carries the merge.
+ * AUTO_MERGE is not reproduced; it only invalidates. Equal digests mean Git's
+ * own records are unchanged since the digest was taken, so a sealed capture
+ * bound to it still holds. Absent members are digested as absent, so their
+ * later appearance breaks the seal. The supported profile is one private
+ * storage directory (a `.git` directory or a gitfile naming it) whose
+ * effective worktree is the enrolled root. Anything else — split or linked
+ * storage, reftable, config includes, an operation the Checkpoint does not
+ * carry, unreadable metadata — is a typed refusal and the caller captures in
+ * full. Git evaluates effective configuration itself so global, system and
+ * conditional sources cannot escape this digest. The configuration, stash
+ * and binding are the capture's shared answers, so the digest and the result
+ * it certifies name the same answers. The evidence is unclosed: reuse retains
+ * its proof in the enclosing admission, and a seal is written only with the
+ * capture it certifies (closeRepositorySeal).
+ */
+export declare function collectGitEvidence(capture: GitCapture): Promise<GitEvidence>;
+/** A seal names one capture's result. Its shared answers close at the
+ * admission that installs the seal, together with that result's proof; here
+ * the digest's own native witnesses must still hold after the capture.
+ * They carry no admission, so `judge` samples them again wherever the
+ * caller reads ground: on a content thread, never the admitting one. */
+export declare function closeRepositorySeal(evidence: GitEvidence, captured: {
+    readonly capture: GitCapture;
+}, judge: (witnesses: readonly SourceWitness[]) => Promise<CaptureFailure | null>): Promise<string | GitSealRefusal>;

package/dist/git-evidence.js

@@ -0,0 +1,181 @@
+/** Git evidence: the digest of every Git record a repository capture proves,
+ * with the native witnesses that hold it. Equal digests certify that a sealed
+ * capture still describes the repository. */
+import { createHash } from "node:crypto";
+import { channel } from "node:diagnostics_channel";
+import { lstatSync } from "node:fs";
+import { join } from "node:path";
+import { CaptureSourceChangedError } from "./content-cache-host.js";
+import { restoreFailure } from "./content-failure.js";
+import { gitHost } from "./git-command.js";
+import { observeNativeGitFile } from "./git-native-file.js";
+import { REVEAL_MARKER, UNSUPPORTED_GIT_OPERATIONS, unsupportedGitOperation } from "./git-operation-host.js";
+import { observeNamespace } from "./physical-path-witness.js";
+import { sourceProofs, witnessProof } from "./source-proof.js";
+export const sealRefused = (evidence) => "refused" in evidence;
+const refuse = (refused, detail) => Object.freeze(detail === undefined ? { refused } : { refused, detail });
+const failureRefusal = (error) => error instanceof CaptureSourceChangedError
+    || ["ENOENT", "ENOTDIR"].includes(error.code ?? "")
+    ? refuse("changed", error.message) : refuse("unreadable", error.message);
+/** How one repository's seal served a Detect: `unreached` (no Watch name
+ * reached it, so its seal stood without asking Git), `reuse`, `miss`, then
+ * after a fresh observation `reuse-selected` (sharing already held the
+ * selected result), `write` or `write-refused`, with its literal reason.
+ * Published only while someone listens; evidence only, never an input to a
+ * decision. */
+const sealOutcomes = channel("amalgm:git-seal");
+export function reportSeal(repository, outcome, reason) {
+    if (sealOutcomes.hasSubscribers)
+        sealOutcomes.publish({ repository, outcome, reason });
+}
+/**
+ * A digest of the Git state a capture proves: the checkout's binding (the
+ * effective worktree, a gitfile's bytes and its route included), the Git host,
+ * effective configuration, HEAD, every loose ref, packed-refs content, config,
+ * the shallow boundary, an unfinished merge's heads, message, mode and
+ * AUTO_MERGE, and the index's meaning (git-native-index.ts). Config
+ * and shallow matter because the Card carries remotes and the shallow
+ * boundary; the merge files because the Checkpoint carries the merge.
+ * AUTO_MERGE is not reproduced; it only invalidates. Equal digests mean Git's
+ * own records are unchanged since the digest was taken, so a sealed capture
+ * bound to it still holds. Absent members are digested as absent, so their
+ * later appearance breaks the seal. The supported profile is one private
+ * storage directory (a `.git` directory or a gitfile naming it) whose
+ * effective worktree is the enrolled root. Anything else — split or linked
+ * storage, reftable, config includes, an operation the Checkpoint does not
+ * carry, unreadable metadata — is a typed refusal and the caller captures in
+ * full. Git evaluates effective configuration itself so global, system and
+ * conditional sources cannot escape this digest. The configuration, stash
+ * and binding are the capture's shared answers, so the digest and the result
+ * it certifies name the same answers. The evidence is unclosed: reuse retains
+ * its proof in the enclosing admission, and a seal is written only with the
+ * capture it certifies (closeRepositorySeal).
+ */
+export async function collectGitEvidence(capture) {
+    const marker = join(capture.repository, ".git");
+    try {
+        const markerKind = lstatSync(marker);
+        if (!markerKind.isDirectory() && !markerKind.isFile())
+            return refuse("marker");
+        const configuration = await capture.configuration();
+        const stashFact = await capture.stash();
+        const stash = JSON.stringify(stashFact.value);
+        if (configuration.has("extensions.refstorage"))
+            return refuse("unsupported-storage", "extensions.refstorage");
+        const files = [];
+        const bindingProof = await capture.binding();
+        const binding = bindingProof.binding;
+        // One private storage directory: a directory marker is that storage; a
+        // gitfile names it, and the binding retains its route. Git's effective
+        // worktree (core.worktree included) must be the enrolled root.
+        if (binding.common !== binding.gitDir || binding.index !== join(binding.gitDir, "index")
+            || (markerKind.isDirectory() && binding.gitDir !== join(binding.repository, ".git")))
+            return refuse("storage-layout");
+        if (binding.worktree !== binding.repository)
+            return refuse("worktree");
+        const gitDir = binding.gitDir;
+        const operation = unsupportedGitOperation(gitDir);
+        if (operation)
+            return refuse("operation", operation);
+        const markerFile = markerKind.isFile() ? observeNativeGitFile(marker) : null;
+        if (markerFile)
+            files.push(markerFile);
+        const namespaces = [];
+        const directory = (path) => {
+            const namespace = observeNamespace(path);
+            namespaces.push(namespace);
+            return namespace.names;
+        };
+        const read = (name) => {
+            const observed = observeNativeGitFile(join(gitDir, name));
+            files.push(observed);
+            return observed;
+        };
+        // Negative witnesses: each absent marker's later appearance breaks the seal.
+        for (const refused of ["commondir", "config.worktree", "reftable"]) {
+            if (read(refused).bytes !== null)
+                return refuse("unsupported-storage", refused);
+        }
+        for (const [refused, name] of UNSUPPORTED_GIT_OPERATIONS) {
+            if (read(refused).bytes !== null)
+                return refuse("operation", name);
+        }
+        if (read(REVEAL_MARKER).bytes !== null)
+            return refuse("reveal");
+        const digest = createHash("sha256");
+        digest.update("literal-worktree-v7-card4-native-index-v6-seal4\0");
+        digest.update(gitHost().key + "\0");
+        // Seal reuse also preserves O's configuration/result pairing. Equal settings
+        // at another checkout or replaced Git directory cannot inherit that proof.
+        digest.update(JSON.stringify(binding) + "\0");
+        digest.update(configuration.fingerprint + "\0");
+        digest.update(stash + "\0");
+        const file = (name) => {
+            const observed = read(name);
+            // Presence and length are explicit. Present bytes spelling "absent"
+            // cannot impersonate a missing metadata file.
+            digest.update(JSON.stringify([name, observed.bytes !== null, observed.bytes?.length ?? 0]) + "\0");
+            if (observed.bytes)
+                digest.update(observed.bytes);
+            return observed.bytes;
+        };
+        if (markerFile) {
+            digest.update(JSON.stringify([".git", true, markerFile.bytes.length]) + "\0");
+            digest.update(markerFile.bytes);
+        }
+        file("HEAD");
+        file("packed-refs");
+        file("MERGE_HEAD");
+        file("MERGE_MSG");
+        file("MERGE_MODE");
+        file("AUTO_MERGE");
+        const config = file("config");
+        if (config !== null && /^\s*\[include/im.test(config.toString("utf8")))
+            return refuse("config-include");
+        file("shallow");
+        const walkRefs = (relative) => {
+            for (const name of directory(join(gitDir, relative))) {
+                const child = `${relative}/${name}`;
+                if (lstatSync(join(gitDir, child)).isDirectory())
+                    walkRefs(child);
+                else
+                    file(child);
+            }
+        };
+        walkRefs("refs");
+        file("logs/refs/stash");
+        const index = await capture.index();
+        digest.update(JSON.stringify(["index", index.witness.meaning]) + "\0");
+        // Only original witnesses survive: never a worktree view or cargo.
+        const witnesses = witnessProof([...files.map(observed => observed.witness), ...namespaces, index.witness]);
+        return Object.freeze({ fingerprint: digest.digest("hex"), configuration, binding, capture, witnesses,
+            proof: sourceProofs([configuration, stashFact.proof, bindingProof, witnesses]),
+            physical: Object.freeze([...files.flatMap(observed => observed.physical ?? []), ...index.physical]) });
+    }
+    catch (error) {
+        // Missing ancestors, changed proof or unreadable metadata mean this fast
+        // path cannot certify reuse. The full reader must observe.
+        return failureRefusal(error);
+    }
+}
+/** A seal names one capture's result. Its shared answers close at the
+ * admission that installs the seal, together with that result's proof; here
+ * the digest's own native witnesses must still hold after the capture.
+ * They carry no admission, so `judge` samples them again wherever the
+ * caller reads ground: on a content thread, never the admitting one. */
+export async function closeRepositorySeal(evidence, captured, judge) {
+    if (sealRefused(evidence))
+        return evidence;
+    if (evidence.capture !== captured.capture)
+        return refuse("result-mismatch");
+    // Optional reuse evidence never weakens full capture.
+    let failure;
+    try {
+        failure = await judge(evidence.witnesses.witnesses);
+    }
+    catch (error) {
+        return failureRefusal(error);
+    }
+    return failure ? failureRefusal(restoreFailure(failure)) : evidence.fingerprint;
+}
+//# sourceMappingURL=git-evidence.js.map

package/dist/git-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-evidence.js","sourceRoot":"","sources":["../src/git-evidence.ts"],"names":[],"mappings":"AAAA;;6CAE6C;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAuB,MAAM,sBAAsB,CAAC;AAG3E,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAsB,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EAAE,gBAAgB,EAAyB,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAoB,MAAM,mBAAmB,CAAC;AAwBjF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAqB,EAA8B,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;AACxG,MAAM,MAAM,GAAG,CAAC,OAA6B,EAAE,MAAe,EAAkB,EAAE,CAChF,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1E,MAAM,cAAc,GAAG,CAAC,KAAc,EAAkB,EAAE,CAAC,KAAK,YAAY,yBAAyB;OAChG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9E,CAAC,CAAC,MAAM,CAAC,SAAS,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;AAEjG;;;;;eAKe;AACf,MAAM,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAChD,MAAM,UAAU,UAAU,CAAC,UAAkB,EAC3C,OAAsF,EACtF,MAAqB;IACrB,IAAI,YAAY,CAAC,cAAc;QAAE,YAAY,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAmB;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/E,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC;YAAE,OAAO,MAAM,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;QAC9G,MAAM,KAAK,GAAoB,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QACrC,uEAAuE;QACvE,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;eACnF,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACxH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,UAAU;YAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,SAAS;YAAE,OAAO,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,IAAI,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,UAAU,GAAuB,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,CAAC,IAAY,EAAqB,EAAE;YACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACzC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3B,OAAO,SAAS,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC3C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAC,OAAO,QAAQ,CAAC;QACxC,CAAC,CAAC;QACF,6EAA6E;QAC7E,KAAK,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,UAAU,CAAC,EAAE,CAAC;YACnE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,0BAA0B,EAAE,CAAC;YACzD,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACpC,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,oEAAoE;YACpE,8CAA8C;YAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,KAAK,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnG,IAAI,QAAQ,CAAC,KAAK;gBAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClD,OAAO,QAAQ,CAAC,KAAK,CAAC;QACxB,CAAC,CAAC;QACF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,KAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/E,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAM,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClC,IAAI,CAAC,YAAY,CAAC,CAAC;QAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACxG,IAAI,CAAC,SAAS,CAAC,CAAC;QAChB,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAQ,EAAE;YAC1C,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACrD,MAAM,KAAK,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACpC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE;oBAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;;oBAC7D,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;QACF,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACvE,mEAAmE;QACnE,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3G,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS;YAClG,KAAK,EAAE,YAAY,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC9E,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,2DAA2D;QAC3D,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;wEAIwE;AACxE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAqB,EAAE,QAA0C,EACjE,KAA8E;IAE9E,IAAI,WAAW,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5E,sDAAsD;IACtD,IAAI,OAA8B,CAAC;IACnC,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAC5G,OAAO,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;AAClF,CAAC"}

package/dist/git-index-entries.d.ts

@@ -0,0 +1,15 @@
+export interface GitIndexEntry {
+    readonly path: string;
+    readonly mode: string;
+    readonly objectId: string;
+    readonly stage: 0 | 1 | 2 | 3;
+}
+export declare const withinGitBoundary: (path: string, boundaries: readonly string[]) => boolean;
+export declare const isGitControlPath: (path: string) => boolean;
+export declare function assertGitPath(path: string): void;
+/** `ls-files --stage -z` entries, parsed in bounded slices over a private
+ * copy: each entry decodes from its own byte range (NUL never occurs inside
+ * a UTF-8 sequence, so this equals splitting the whole decoded text), and the
+ * parse yields at the dispatcher's turn boundary, so a large index never
+ * holds the thread in one long step. */
+export declare function parseGitIndex(bytes: Uint8Array): Promise<GitIndexEntry[]>;

package/dist/git-index-entries.js

@@ -0,0 +1,44 @@
+/** Validated, literal Git index entries shared by capture and replay. */
+import { ITEMS_PER_BOUNDARY } from "@amalgm/live";
+import { turnBoundary } from "./turns.js";
+export const withinGitBoundary = (path, boundaries) => boundaries.some(boundary => path === boundary || path.startsWith(`${boundary}/`));
+export const isGitControlPath = (path) => path.split("/").some(part => part.toLowerCase() === ".amalgm");
+export function assertGitPath(path) {
+    if (!path || path.startsWith("/") || path.includes("\0")
+        || path.split("/").some(part => !part || part === "." || part === ".." || part.toLowerCase() === ".git")) {
+        throw new Error(`unsafe repository path: ${path}`);
+    }
+}
+const MODES = new Set(["100644", "100755", "120000", "160000"]);
+const OBJECT_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+function parseEntry(field) {
+    const separator = field.indexOf("\t");
+    const [mode, objectId, rawStage] = field.slice(0, separator).split(" ");
+    const path = field.slice(separator + 1);
+    const stage = Number(rawStage);
+    assertGitPath(path);
+    if (separator < 0 || !MODES.has(mode ?? "") || !OBJECT_ID.test(objectId ?? "")
+        || ![0, 1, 2, 3].includes(stage))
+        throw new Error("invalid Git index entry");
+    return { path, mode: mode, objectId: objectId, stage: stage };
+}
+/** `ls-files --stage -z` entries, parsed in bounded slices over a private
+ * copy: each entry decodes from its own byte range (NUL never occurs inside
+ * a UTF-8 sequence, so this equals splitting the whole decoded text), and the
+ * parse yields at the dispatcher's turn boundary, so a large index never
+ * holds the thread in one long step. */
+export async function parseGitIndex(bytes) {
+    const buffer = Buffer.from(bytes);
+    const entries = [];
+    for (let start = 0, fields = 0; start < buffer.length; fields += 1) {
+        const found = buffer.indexOf(0, start);
+        const end = found < 0 ? buffer.length : found;
+        if (end > start)
+            entries.push(parseEntry(buffer.toString("utf8", start, end)));
+        start = end + 1;
+        if (fields % ITEMS_PER_BOUNDARY === ITEMS_PER_BOUNDARY - 1)
+            await turnBoundary();
+    }
+    return entries;
+}
+//# sourceMappingURL=git-index-entries.js.map

package/dist/git-index-entries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-index-entries.js","sourceRoot":"","sources":["../src/git-index-entries.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAS1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,UAA6B,EAAW,EAAE,CACxF,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC;AAEpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAW,EAAE,CACxD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,CAAC;AAEjE,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;WACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrF,MAAM,SAAS,GAAG,iCAAiC,CAAC;AAEpD,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,aAAa,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;WACzE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAK,EAAE,QAAQ,EAAE,QAAS,EAAE,KAAK,EAAE,KAA+B,EAAE,CAAC;AAC5F,CAAC;AAED;;;;wCAIwC;AACxC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAiB;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9C,IAAI,GAAG,GAAG,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/E,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;QAChB,IAAI,MAAM,GAAG,kBAAkB,KAAK,kBAAkB,GAAG,CAAC;YAAE,MAAM,YAAY,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/git-index-format.d.ts

@@ -0,0 +1,35 @@
+/** Git's index file, read as Git reads it (read-cache.c, split-index.c)
+ * without a Git process. To capture an index means its stage listing: every
+ * entry's mode, object, stage and path in the order Git holds them, written
+ * as `git ls-files --stage -z` writes them. Capture asks nothing else of an
+ * index: its private view is built from the listing, and Git lists
+ * untracked names over copied bytes. The rest of an index file — the stat
+ * data each refresh re-stamps, entry flags and optional extensions — caches
+ * that meaning, serves Git's speed, or steers commands capture never runs
+ * over the index, so equal listings give capture equal answers whatever
+ * their bytes. A capture that came to read a flag would make it meaning.
+ *
+ * Every form Git writes is read: versions 2 to 4, extended flags,
+ * prefix-compressed paths, and a split index over its shared base. A form
+ * Git never writes is refused rather than guessed, as is a required
+ * extension Git would not understand. A split index resolves as Git's own
+ * merge does, which assumes its shared base and its additions each hold
+ * Git's order, so both must. Paths stay Git's to name: capture refuses any
+ * path Git itself would refuse (git-index-entries.ts). */
+import { type Steps } from "@amalgm/live";
+export declare class GitIndexFormatError extends Error {
+}
+declare const WIDTH: {
+    readonly sha1: 20;
+    readonly sha256: 32;
+};
+export type GitObjectFormat = keyof typeof WIDTH;
+/** An index's stage listing, and the shared base it was read over. */
+export interface StageListing {
+    readonly listing: Buffer;
+    readonly base: string | null;
+}
+/** The stage listing of an index file's bytes. A split index reads its
+ * shared base, by name, through `shared`. */
+export declare function stageListing(bytes: Buffer, format: GitObjectFormat, shared: (name: string) => Buffer): Steps<StageListing>;
+export {};