@foss.global/codefeed 2.1.0 → 3.1.0

package/ts/forgeinventory.transport.ts

@@ -9,11 +9,12 @@ export interface IForgeTransportResponse {
 }
 
 /**
- * Sends one credential-scoped GET and resolves once response headers arrive.
- * A redirect status rejects and is never followed; aborting `signal` discards
- * the connection, also while the body is still being read.
+ * Sends one credential-scoped GET, or a POST of `body` when one is given, and
+ * resolves once response headers arrive. A redirect status rejects and is
+ * never followed; aborting `signal` discards the connection, also while the
+ * body is still being read.
  */
-export type TForgeTransport = (url: URL, headers: Record<string, string>, signal: AbortSignal) => Promise<IForgeTransportResponse>;
+export type TForgeTransport = (url: URL, headers: Record<string, string>, signal: AbortSignal, body?: Uint8Array<ArrayBuffer>) => Promise<IForgeTransportResponse>;
 
 /** The fetch statuses whose redirect mode `error` turns them into a network error. */
 const redirectStatuses: ReadonlySet<number> = new Set([301, 302, 303, 307, 308]);
@@ -26,48 +27,130 @@ const redirectStatuses: ReadonlySet<number> = new Set([301, 302, 303, 307, 308])
 const idleSocketTimeoutMs = 4_000;
 
 /** Node's global `fetch` with the process-wide default trust store. */
-export const globalFetchTransport: TForgeTransport = async (url, headers, signal) => {
-  const response = await fetch(url, { method: 'GET', headers, redirect: 'error', credentials: 'omit', signal });
+export const globalFetchTransport: TForgeTransport = async (url, headers, signal, body) => {
+  const response = await fetch(url, { method: body ? 'POST' : 'GET', headers, body, redirect: 'error', credentials: 'omit', signal });
   return { status: response.status, headers: response.headers, body: response.body };
 };
 
+/** The agents a node request may use; a URL whose protocol has no agent is refused. */
+export interface INodeRequestAgents {
+  http?: InstanceType<typeof plugins.http.Agent>;
+  https?: InstanceType<typeof plugins.https.Agent>;
+}
+
+export interface INodeRequest {
+  method: string;
+  headers: Record<string, string>;
+  /** Sent in full, or streamed with backpressure; a streamed body needs its own `content-length` header. */
+  body?: Uint8Array | AsyncIterable<Uint8Array>;
+  signal: AbortSignal;
+  agents: INodeRequestAgents;
+}
+
+export interface INodeResponse extends IForgeTransportResponse {
+  /**
+   * Settles once the request body has been sent, or rejects with the error
+   * that ended it, such as the body source's own error. Always handled.
+   */
+  sent: Promise<void>;
+}
+
+/**
+ * Idle keep-alive agents that unreference their pooled sockets, so pooled
+ * connections never keep the process alive.
+ */
+export const createNodeAgents = (caCertificatesArg?: string[], allowHttpArg = false): INodeRequestAgents => ({
+  https: new plugins.https.Agent({ ...(caCertificatesArg ? { ca: caCertificatesArg } : {}), keepAlive: true, timeout: idleSocketTimeoutMs }),
+  ...(allowHttpArg ? { http: new plugins.http.Agent({ keepAlive: true, timeout: idleSocketTimeoutMs }) } : {}),
+});
+
+/** Waits until the request can take more body bytes; rejects once it has closed. */
+const drained = (requestArg: InstanceType<typeof plugins.http.ClientRequest>): Promise<void> => new Promise((resolve, reject) => {
+  const done = () => { requestArg.off('drain', done); requestArg.off('close', closed); resolve(); };
+  const closed = () => { requestArg.off('drain', done); requestArg.off('close', closed); reject(new Error('Request closed.')); };
+  requestArg.on('drain', done);
+  requestArg.on('close', closed);
+});
+
+/**
+ * Sends one request through `node:http` or `node:https` and resolves once
+ * response headers arrive. A redirect status rejects and is never followed;
+ * aborting `signal` discards the connection, also while a body is still being
+ * sent or read. A streamed body that fails destroys the request and rejects.
+ */
+export const sendNodeRequest = (url: URL, requestArg: INodeRequest): Promise<INodeResponse> => new Promise<INodeResponse>((resolve, reject) => {
+  const { signal } = requestArg;
+  if (signal.aborted) return reject(signal.reason);
+  const agent = url.protocol === 'https:' ? requestArg.agents.https : url.protocol === 'http:' ? requestArg.agents.http : undefined;
+  if (!agent) return reject(new Error('Refused protocol.'));
+  const module = url.protocol === 'https:' ? plugins.https : plugins.http;
+  // Bodies are read as sent, so ask for them without a content coding.
+  const request = module.request(url, { method: requestArg.method, headers: { ...requestArg.headers, 'accept-encoding': 'identity' }, agent });
+  let settled = false;
+  const fail = (errorArg: unknown) => {
+    if (!settled) {
+      settled = true;
+      reject(errorArg);
+    }
+  };
+  // Stays attached for the request's lifetime, so a connection failure while
+  // the body is read never becomes an unhandled 'error' event.
+  request.on('error', fail);
+  // Destroyed without an error on purpose: an error would be re-emitted on the
+  // socket, which no longer has a listener once a keep-alive response completed.
+  const abort = () => {
+    fail(signal.reason);
+    request.destroy();
+  };
+  signal.addEventListener('abort', abort, { once: true });
+  request.once('close', () => signal.removeEventListener('abort', abort));
+  const sent = (async () => {
+    const { body } = requestArg;
+    if (body === undefined || body instanceof Uint8Array) {
+      request.end(body);
+      return;
+    }
+    try {
+      for await (const chunk of body) {
+        if (request.destroyed) throw new Error('Request closed.');
+        if (!request.write(chunk)) await drained(request);
+      }
+      request.end();
+    } catch (error) {
+      fail(error);
+      request.destroy();
+      throw error;
+    }
+  })();
+  sent.catch(() => undefined);
+  request.on('response', (response) => {
+    try {
+      const status = response.statusCode ?? 0;
+      if (redirectStatuses.has(status)) throw new Error('Refused redirect.');
+      // Same combination rules as fetch: repeated fields join with ", ".
+      const responseHeaders = new Headers();
+      for (let index = 0; index < response.rawHeaders.length; index += 2) {
+        responseHeaders.append(response.rawHeaders[index], response.rawHeaders[index + 1]);
+      }
+      if (settled) return void request.destroy();
+      settled = true;
+      resolve({ status, headers: responseHeaders, body: response, sent });
+    } catch (error) {
+      fail(error);
+      request.destroy();
+    }
+  });
+});
+
 /**
  * `node:https` with an owned keep-alive agent whose `ca` list replaces the
  * default trust store for these connections only. The agent unreferences idle
  * sockets, so pooled connections never keep the process alive.
  */
 export const createHttpsTransport = (caCertificates: string[]): TForgeTransport => {
-  const agent = new plugins.https.Agent({ ca: caCertificates, keepAlive: true, timeout: idleSocketTimeoutMs });
-  return (url, headers, signal) => new Promise<IForgeTransportResponse>((resolve, reject) => {
-    if (signal.aborted) return reject(signal.reason);
-    // Bodies are read as sent, so ask for them without a content coding.
-    const request = plugins.https.request(url, { method: 'GET', headers: { ...headers, 'accept-encoding': 'identity' }, agent });
-    // Stays attached for the request's lifetime, so a connection failure while
-    // the body is read never becomes an unhandled 'error' event.
-    request.on('error', reject);
-    // Destroyed without an error on purpose: an error would be re-emitted on the
-    // socket, which no longer has a listener once a keep-alive response completed.
-    const abort = () => {
-      reject(signal.reason);
-      request.destroy();
-    };
-    signal.addEventListener('abort', abort, { once: true });
-    request.once('close', () => signal.removeEventListener('abort', abort));
-    request.on('response', (response) => {
-      try {
-        const status = response.statusCode ?? 0;
-        if (redirectStatuses.has(status)) throw new Error('Refused redirect.');
-        // Same combination rules as fetch: repeated fields join with ", ".
-        const responseHeaders = new Headers();
-        for (let index = 0; index < response.rawHeaders.length; index += 2) {
-          responseHeaders.append(response.rawHeaders[index], response.rawHeaders[index + 1]);
-        }
-        resolve({ status, headers: responseHeaders, body: response });
-      } catch (error) {
-        reject(error);
-        request.destroy();
-      }
-    });
-    request.end();
-  });
+  const agents = createNodeAgents(caCertificates);
+  return async (url, headers, signal, body) => {
+    const { sent: _sent, ...response } = await sendNodeRequest(url, { method: body ? 'POST' : 'GET', headers, body, signal, agents });
+    return response;
+  };
 };

package/ts/giteasourceinventory.git.ts

@@ -0,0 +1,343 @@
+import * as plugins from './plugins.js';
+import * as validation from './forgeinventory.validation.js';
+import type { ForgeRequestClient } from './forgeinventory.client.js';
+
+type TMeasure = plugins.fossInterfaces.data.TForgeSourceMeasure;
+type IGitCounts = Omit<plugins.fossInterfaces.data.IForgeSourceGitCounts, 'reportedSizeKiB'>;
+type ILfsCounts = plugins.fossInterfaces.data.IForgeSourceLfsCounts;
+
+export interface IGiteaMirrorSource {
+  /** Instance root without a trailing slash. */
+  baseUrl: string;
+  owner: string;
+  name: string;
+  /** The reader's login and token; Gitea accepts a token as the Basic password for Git and LFS. */
+  username: string;
+  token: string;
+  caCertificates?: string[];
+  /** Private directory that holds the temporary mirror. */
+  workDir: string;
+  /** The repository size Gitea reports, which sizes the mirror's scratch reservation. */
+  reportedSizeKiB: bigint;
+  /** Wall-clock limit of the mirror clone. */
+  timeoutMs: number;
+  /** Sends LFS batch reads with the reader's Basic credentials. */
+  lfsClient: ForgeRequestClient;
+  signal?: AbortSignal;
+}
+
+/** Objects per LFS batch request. */
+const lfsBatchSize = 100;
+const lfsMediaType = 'application/vnd.git-lfs+json';
+
+/**
+ * Scratch space reserved for one mirror: twice the size Gitea reports, because
+ * a clone holds received and indexed packs, plus fixed headroom for refs, the
+ * index and a size Gitea has not updated yet.
+ */
+export const mirrorScratchBytes = (reportedSizeKiBArg: bigint): bigint => reportedSizeKiBArg * 1024n * 2n + 64n * 1024n * 1024n;
+
+/** Bytes an unprivileged process may still write to the file system holding `directoryArg`. */
+const statfsFreeBytes = async (directoryArg: string): Promise<bigint> => {
+  const stats = await plugins.fs.statfs(directoryArg, { bigint: true });
+  return stats.bavail * stats.bsize;
+};
+
+/**
+ * Admits mirror clones on one file system in arrival order while the scratch
+ * they reserve fits its free space. A clone's reservation counts in full until
+ * it is released, although part of it is already written, so the check never
+ * admits more than fits. A clone that does not fit waits until the clones in
+ * flight release their reservations; one that does not fit even alone is
+ * refused.
+ */
+export class GitScratchBudget {
+  readonly #freeBytes: (directoryArg: string) => Promise<bigint>;
+  #reserved = 0n;
+  /** Settles when the clones ahead of the next arrival have been admitted or refused. */
+  #queue: Promise<void> = Promise.resolve();
+  readonly #releaseListeners = new Set<() => void>();
+
+  constructor(freeBytesArg: (directoryArg: string) => Promise<bigint> = statfsFreeBytes) {
+    this.#freeBytes = freeBytesArg;
+  }
+
+  /**
+   * Reserves `bytesArg` in `directoryArg` and resolves with the function that
+   * releases them, or with null when they exceed the free space with no other
+   * clone in flight. Rejects when the free space cannot be read or `signalArg`
+   * aborts.
+   */
+  async reserve(directoryArg: string, bytesArg: bigint, signalArg?: AbortSignal): Promise<(() => void) | null> {
+    const ahead = this.#queue;
+    let admitted!: () => void;
+    const turn = new Promise<void>((resolve) => { admitted = resolve; });
+    // Followers wait for this turn and every turn ahead of it, even when this one ends early.
+    this.#queue = ahead.then(() => turn);
+    try {
+      await this.#until(ahead, signalArg);
+      for (;;) {
+        // Listens before reading the free space, so a release while it is read is not missed.
+        let listener!: () => void;
+        const released = new Promise<void>((resolve) => { listener = resolve; });
+        this.#releaseListeners.add(listener);
+        try {
+          const free = await this.#freeBytes(directoryArg);
+          if (this.#reserved + bytesArg <= free) {
+            this.#reserved += bytesArg;
+            return this.#releaser(bytesArg);
+          }
+          if (this.#reserved === 0n) return null;
+          await this.#until(released, signalArg);
+        } finally {
+          this.#releaseListeners.delete(listener);
+        }
+      }
+    } finally {
+      admitted();
+    }
+  }
+
+  /**
+   * The process-wide budget of the file system that holds `directoryArg`,
+   * keyed by its device; every mirror clone and every scratch GitManager in
+   * the process reserves through it.
+   */
+  static async forDirectory(directoryArg: string): Promise<GitScratchBudget> {
+    const device = (await plugins.fs.stat(directoryArg, { bigint: true })).dev;
+    let budget = scratchBudgets.get(device);
+    if (!budget) {
+      budget = new GitScratchBudget();
+      scratchBudgets.set(device, budget);
+    }
+    return budget;
+  }
+
+  #releaser(bytesArg: bigint): () => void {
+    let held = true;
+    return () => {
+      if (!held) return;
+      held = false;
+      this.#reserved -= bytesArg;
+      for (const listener of this.#releaseListeners) listener();
+    };
+  }
+
+  async #until(promiseArg: Promise<void>, signalArg?: AbortSignal): Promise<void> {
+    signalArg?.throwIfAborted();
+    if (!signalArg) return promiseArg;
+    let abort!: () => void;
+    const aborted = new Promise<never>((_resolve, reject) => {
+      abort = () => reject(signalArg.reason);
+      signalArg.addEventListener('abort', abort, { once: true });
+    });
+    try {
+      await Promise.race([promiseArg, aborted]);
+    } finally {
+      signalArg.removeEventListener('abort', abort);
+    }
+  }
+}
+
+/** One budget per file system, shared by every reader in the process. */
+const scratchBudgets = new Map<bigint, GitScratchBudget>();
+
+/**
+ * Reserves the scratch of one mirror clone into `directoryArg` in the
+ * process-wide budget of its file system and resolves with the function that
+ * releases it. Rejects with `git-workdir-too-small` when the clone does not
+ * fit even alone, `git-workdir-failed` when the directory or its free space
+ * cannot be read and `request-aborted` when `signalArg` aborts first.
+ */
+export const reserveMirrorScratch = async (directoryArg: string, reportedSizeKiBArg: bigint, signalArg?: AbortSignal): Promise<() => void> => {
+  let release: (() => void) | null;
+  try {
+    release = await (await GitScratchBudget.forDirectory(directoryArg)).reserve(directoryArg, mirrorScratchBytes(reportedSizeKiBArg), signalArg);
+  } catch {
+    throw new validation.ForgeInventoryError(signalArg?.aborted ? 'request-aborted' : 'git-workdir-failed');
+  }
+  if (release === null) throw new validation.ForgeInventoryError('git-workdir-too-small');
+  return release;
+};
+
+/** The HTTPS Git URL of a Gitea repository; it never carries credentials. */
+export const giteaCloneUrl = (baseUrlArg: string, ownerArg: string, nameArg: string): string =>
+  `${baseUrlArg}/${encodeURIComponent(ownerArg)}/${encodeURIComponent(nameArg)}.git`;
+
+const complete = (valueArg: bigint | number): TMeasure => ({ status: 'complete', value: BigInt(valueArg).toString() });
+const partial = (observedArg: bigint | number, reasonArg: string): TMeasure => ({ status: 'partial', observedValue: BigInt(observedArg).toString(), reason: reasonArg });
+
+const failedGit = (reasonArg: string): IGitCounts => {
+  const failed = partial(0, reasonArg);
+  return { branches: failed, tags: failed, pullRequestRefs: failed, otherRefs: failed, objects: failed, objectBytes: failed };
+};
+const failedLfs = (reasonArg: string): ILfsCounts => {
+  const failed = partial(0, reasonArg);
+  return { objects: failed, bytes: failed, missingObjects: failed };
+};
+
+/**
+ * Fixed reason for a failed step. GitManager errors are never passed on: they
+ * are redacted, but still remote text.
+ */
+const stepFailure = (errorArg: unknown, stepArg: string, signalArg?: AbortSignal): string =>
+  signalArg?.aborted ? 'request-aborted' : errorArg instanceof validation.ForgeInventoryError ? errorArg.code : stepArg;
+
+/**
+ * Measures one repository at the Git level: clones every ref Gitea advertises
+ * into a temporary mirror, counts its refs and objects, finds the LFS pointers
+ * of every reachable revision and checks through the LFS batch API which of
+ * their objects Gitea holds. The mirror is removed afterwards. The clone starts
+ * only once its scratch reservation fits the work directory's free space; a
+ * repository too large for it fails with `git-workdir-too-small`.
+ */
+export const measureGiteaMirror = async (sourceArg: IGiteaMirrorSource): Promise<{ git: IGitCounts; lfs: ILfsCounts }> => {
+  const { signal } = sourceArg;
+  if (signal?.aborted) throw new validation.ForgeInventoryError('request-aborted');
+  let release: () => void;
+  try {
+    release = await reserveMirrorScratch(sourceArg.workDir, sourceArg.reportedSizeKiB, signal);
+  } catch (error) {
+    const failure = stepFailure(error, 'git-workdir-failed', signal);
+    return { git: failedGit(failure), lfs: failedLfs(failure) };
+  }
+  try {
+    return await measureReservedMirror(sourceArg);
+  } finally {
+    release();
+  }
+};
+
+const measureReservedMirror = async (sourceArg: IGiteaMirrorSource): Promise<{ git: IGitCounts; lfs: ILfsCounts }> => {
+  const { signal } = sourceArg;
+  const { GitManager } = await plugins.getGitManager();
+  let directory: string;
+  try {
+    directory = await plugins.fs.mkdtemp(plugins.path.join(sourceArg.workDir, 'mirror-'));
+  } catch {
+    return { git: failedGit('git-workdir-failed'), lfs: failedLfs('git-workdir-failed') };
+  }
+  const manager = new GitManager({ dataDir: directory });
+  // The engine serves this measurement alone; stopping it ends the ref, object
+  // and LFS scans in flight, which take no signal. The clone takes the signal.
+  const abort = () => { void manager.stop().catch(() => undefined); };
+  signal?.addEventListener('abort', abort, { once: true });
+  const selector = { org: 'source', repo: 'mirror' };
+  try {
+    try {
+      // An abort while the engine module loaded or the directory was created reached no listener.
+      signal?.throwIfAborted();
+      await manager.start();
+      await manager.importMirror({
+        ...selector,
+        remoteUrl: giteaCloneUrl(sourceArg.baseUrl, sourceArg.owner, sourceArg.name),
+        credential: { kind: 'basic', username: sourceArg.username, password: sourceArg.token },
+        caCertificates: sourceArg.caCertificates,
+        timeoutMs: sourceArg.timeoutMs,
+      }, { signal });
+    } catch (error) {
+      const failure = stepFailure(error, 'git-mirror-failed', signal);
+      return { git: failedGit(failure), lfs: failedLfs(failure) };
+    }
+    const git = await measureRefsAndObjects(manager, selector, signal);
+    let pointers: Array<{ oid: string; sizeBytes: number }>;
+    try {
+      pointers = await manager.listRepositoryLfsPointers(selector);
+    } catch (error) {
+      return { git, lfs: failedLfs(stepFailure(error, 'lfs-pointer-scan-failed', signal)) };
+    }
+    return { git, lfs: await giteaLfsPresence(sourceArg, pointers) };
+  } finally {
+    signal?.removeEventListener('abort', abort);
+    await manager.stop().catch(() => undefined);
+    await plugins.fs.rm(directory, { recursive: true, force: true });
+  }
+};
+
+const measureRefsAndObjects = async (
+  managerArg: plugins.TGitManager,
+  selectorArg: { org: string; repo: string },
+  signalArg?: AbortSignal,
+): Promise<IGitCounts> => {
+  const counts = { branches: 0, tags: 0, pullRequestRefs: 0, otherRefs: 0 };
+  let refsFailure: string | null = null;
+  try {
+    let cursor: string | undefined;
+    do {
+      const page = await managerArg.listRefs({ ...selectorArg, cursor });
+      // Nothing writes to the private mirror, so a changed inventory is a failure.
+      if (page.status === 'stale') throw new validation.ForgeInventoryError('git-refs-changed');
+      for (const ref of page.refs) {
+        if (ref.name.startsWith('refs/heads/')) counts.branches++;
+        else if (ref.name.startsWith('refs/tags/')) counts.tags++;
+        else if (ref.name.startsWith('refs/pull/')) counts.pullRequestRefs++;
+        else counts.otherRefs++;
+      }
+      cursor = page.pagination.status === 'more' ? page.pagination.cursor : undefined;
+    } while (cursor !== undefined);
+  } catch (error) {
+    refsFailure = stepFailure(error, 'git-refs-failed', signalArg);
+  }
+  const refs = (valueArg: number) => refsFailure === null ? complete(valueArg) : partial(0, refsFailure);
+  let objects: TMeasure;
+  let objectBytes: TMeasure;
+  try {
+    const size = await managerArg.getRepositorySize(selectorArg);
+    objects = complete(size.objectCount);
+    objectBytes = complete(size.objectBytes);
+  } catch (error) {
+    objects = objectBytes = partial(0, stepFailure(error, 'git-size-failed', signalArg));
+  }
+  return {
+    branches: refs(counts.branches), tags: refs(counts.tags), pullRequestRefs: refs(counts.pullRequestRefs), otherRefs: refs(counts.otherRefs),
+    objects, objectBytes,
+  };
+};
+
+/**
+ * Asks Gitea's LFS batch API, as a `download`, which referenced objects it
+ * holds: a held object answers with a download action, a missing one with
+ * error 404. Actions, their URLs and headers are never retained.
+ */
+export const giteaLfsPresence = async (
+  sourceArg: Pick<IGiteaMirrorSource, 'baseUrl' | 'owner' | 'name' | 'lfsClient' | 'signal'>,
+  pointersArg: Array<{ oid: string; sizeBytes: number }>,
+): Promise<ILfsCounts> => {
+  const url = new URL(`${sourceArg.baseUrl}/${encodeURIComponent(sourceArg.owner)}/${encodeURIComponent(sourceArg.name)}.git/info/lfs/objects/batch`);
+  let held = 0n;
+  let heldBytes = 0n;
+  let missing = 0n;
+  for (let index = 0; index < pointersArg.length; index += lfsBatchSize) {
+    const chunk = pointersArg.slice(index, index + lfsBatchSize);
+    try {
+      const response = await sourceArg.lfsClient.request(url, {
+        signal: sourceArg.signal,
+        mediaType: lfsMediaType,
+        json: { operation: 'download', transfers: ['basic'], objects: chunk.map((pointerArg) => ({ oid: pointerArg.oid, size: pointerArg.sizeBytes })) },
+      });
+      const objects = validation.record(response.body).objects;
+      if (!Array.isArray(objects) || objects.length !== chunk.length) throw new validation.ForgeInventoryError('invalid-lfs-batch');
+      const requested = new Map(chunk.map((pointerArg) => [pointerArg.oid, pointerArg.sizeBytes]));
+      for (const objectArg of objects) {
+        const object = validation.record(objectArg);
+        const size = typeof object.oid === 'string' ? requested.get(object.oid) : undefined;
+        if (size === undefined || object.size !== size) throw new validation.ForgeInventoryError('invalid-lfs-batch');
+        requested.delete(object.oid as string);
+        const download = object.actions === undefined || object.actions === null ? undefined : validation.record(object.actions).download;
+        if (download !== undefined && download !== null && object.error === undefined) {
+          held++;
+          heldBytes += BigInt(size);
+        } else if (object.error !== undefined && validation.record(object.error).code === 404) {
+          missing++;
+        } else {
+          // A size that disagrees with the stored object answers 422.
+          throw new validation.ForgeInventoryError('lfs-object-unavailable');
+        }
+      }
+    } catch (error) {
+      const failure = stepFailure(error, 'lfs-batch-failed', sourceArg.signal);
+      return { objects: partial(held, failure), bytes: partial(heldBytes, failure), missingObjects: partial(missing, failure) };
+    }
+  }
+  return { objects: complete(held), bytes: complete(heldBytes), missingObjects: complete(missing) };
+};

package/ts/index.ts

@@ -488,3 +488,6 @@ export class CodeFeed {
 export * from './classes.forgeinventory.js';
 export * from './classes.forgeinventoryscanner.js';
 export * from './classes.giteasourceinventory.js';
+export * from './classes.giteasourcetransfer.js';
+export * from './classes.lfsbatchclient.js';
+export { GitScratchBudget, mirrorScratchBytes } from './giteasourceinventory.git.js';

package/ts/plugins.ts

@@ -1,8 +1,13 @@
 import type * as fossInterfaces from '@foss.global/interfaces';
 
 import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as http from 'node:http';
 import * as https from 'node:https';
-export { crypto, https };
+import * as net from 'node:net';
+import * as path from 'node:path';
+import * as stream from 'node:stream';
+export { crypto, fs, http, https, net, path, stream };
 
 // module
 import * as interfaces from './interfaces/index.js';
@@ -25,6 +30,7 @@ export type TGitManagerTag = import('@foss.global/gitmanager').IGitManagerTag;
 export type TGitManagerDiff = import('@foss.global/gitmanager').IGitManagerDiff;
 
 export const getSmartnpm = async () => import('@push.rocks/smartnpm');
+export const getGitManager = async () => import('@foss.global/gitmanager');
 
 export {
   smarttime,