@foss.global/gitmanager 0.6.0 → 1.0.0

package/changelog.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2026-07-20 - 1.0.0
+
+### Breaking Changes
+
+- enforce revision-fenced protected refs for receive-pack (smart-http)
+  - Add a TypeScript and IPC API to apply canonical protected-head rules with revision fencing, idempotency, stale detection, and SHA-256 rule digests.
+  - Run receive-pack through a managed pre-receive hook that rejects protected branch creates, deletes, and non-fast-forward updates unless explicitly allowed.
+  - Require each repository to have an explicit protected-ref policy snapshot before Smart HTTP pushes are admitted, including after restart.
+  - Add coverage for policy initialization, protected ref enforcement, self-test hardening, and restart replay.
+
+## 2026-07-20 - 0.7.0
+
+### Features
+
+- support trusted private reads through smart HTTP (smart-http)
+  - Add optional `privateRead` configuration with a constant-time trusted ingress token check.
+  - Preserve default-deny public visibility while allowing an authenticated loopback ingress to clone and fetch private repositories.
+  - Cover trusted and rejected private Git protocol v2 reads in the real transport integration test.
+
 ## 2026-07-20 - 0.6.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@foss.global/gitmanager',
-    version: '0.6.0',
+    version: '1.0.0',
     description: 'Headless Git manager for the foss.global Git platform, with a TypeScript API and Rust engine.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx5QkFBeUI7SUFDL0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLCtGQUErRjtDQUM3RyxDQUFBIn0=

package/dist_ts/classes.gitmanager.d.ts

@@ -1,5 +1,5 @@
 import * as plugins from './plugins.js';
-import type { IGitManagerCommitDetail, IGitManagerCommitRequest, IGitManagerCommitSummary, IGitManagerDiff, IGitManagerDiffRequest, IGitManagerFileContent, IGitManagerImportMirrorRequest, IGitManagerInitBareRepositoryRequest, IGitManagerListCommitsRequest, IGitManagerListTagsRequest, IGitManagerReadFileRequest, IGitManagerRef, IGitManagerRefRequest, IGitManagerRepositoryBundle, IGitManagerRepositoryInfo, IGitManagerRepositorySelector, IGitManagerRestoreBundleRequest, IGitManagerSmartHttpRepositoryAccess, IGitManagerSmartHttpRepositoryVisibility, IGitManagerStatus, IGitManagerTag, IGitManagerTagRequest, IGitManagerTreeEntry, IGitManagerTreeRequest, IGitManagerOptions } from './models.js';
+import type { IGitManagerCommitDetail, IGitManagerCommitRequest, IGitManagerCommitSummary, IGitManagerDiff, IGitManagerDiffRequest, IGitManagerFileContent, IGitManagerImportMirrorRequest, IGitManagerInitBareRepositoryRequest, IGitManagerListCommitsRequest, IGitManagerListTagsRequest, IGitManagerReadFileRequest, IGitManagerRef, IGitManagerRefRequest, IGitManagerProtectedRefsApplyResult, IGitManagerSmartHttpRepositoryProtectedRefs, IGitManagerRepositoryBundle, IGitManagerRepositoryInfo, IGitManagerRepositorySelector, IGitManagerRestoreBundleRequest, IGitManagerSmartHttpRepositoryAccess, IGitManagerSmartHttpRepositoryVisibility, IGitManagerStatus, IGitManagerTag, IGitManagerTagRequest, IGitManagerTreeEntry, IGitManagerTreeRequest, IGitManagerOptions } from './models.js';
 export declare class GitManager extends plugins.EventEmitter {
     private bridge;
     private started;
@@ -12,6 +12,7 @@ export declare class GitManager extends plugins.EventEmitter {
     getStatus(): Promise<IGitManagerStatus>;
     setSmartHttpRepositoryAccess(accessArg: IGitManagerSmartHttpRepositoryAccess): Promise<void>;
     setSmartHttpRepositoryVisibility(visibilityArg: IGitManagerSmartHttpRepositoryVisibility): Promise<void>;
+    setSmartHttpRepositoryProtectedRefs(protectedRefsArg: IGitManagerSmartHttpRepositoryProtectedRefs): Promise<IGitManagerProtectedRefsApplyResult>;
     get running(): boolean;
     initBareRepository(requestArg: IGitManagerInitBareRepositoryRequest): Promise<IGitManagerRepositoryInfo>;
     importMirror(requestArg: IGitManagerImportMirrorRequest): Promise<IGitManagerRepositoryInfo>;

package/dist_ts/classes.gitmanager.js

@@ -31,6 +31,12 @@ export class GitManager extends plugins.EventEmitter {
                     processTimeoutMs: smartHttpOptions.processTimeoutMs ?? 30 * 60 * 1000,
                     idleTimeoutSeconds: smartHttpOptions.idleTimeoutSeconds ?? 300,
                     gracefulShutdownMs: smartHttpOptions.gracefulShutdownMs ?? 10_000,
+                    privateRead: smartHttpOptions.privateRead
+                        && smartHttpOptions.privateRead.enabled !== false
+                        ? {
+                            trustedIngressToken: smartHttpOptions.privateRead.trustedIngressToken,
+                        }
+                        : undefined,
                     receivePack: smartHttpOptions.receivePack
                         && smartHttpOptions.receivePack.enabled !== false
                         ? {
@@ -112,6 +118,20 @@ export class GitManager extends plugins.EventEmitter {
             revision: visibilityArg.revision,
         });
     }
+    async setSmartHttpRepositoryProtectedRefs(protectedRefsArg) {
+        this.assertRunning();
+        return this.bridge.setSmartHttpRepositoryProtectedRefs({
+            org: protectedRefsArg.org,
+            repo: protectedRefsArg.repo,
+            revision: protectedRefsArg.revision,
+            rules: protectedRefsArg.rules.map((rule) => ({
+                refName: rule.refName,
+                allowCreates: rule.allowCreates,
+                allowDeletes: rule.allowDeletes,
+                allowForcePushes: rule.allowForcePushes,
+            })),
+        });
+    }
     get running() {
         return this.started && this.bridge.running;
     }
@@ -210,4 +230,4 @@ export class GitManager extends plugins.EventEmitter {
         }
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5naXRtYW5hZ2VyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5naXRtYW5hZ2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBNkJ4QyxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUVuRSxNQUFNLE9BQU8sVUFBVyxTQUFRLE9BQU8sQ0FBQyxZQUFZO0lBT2xELFlBQVksYUFBaUMsRUFBRTtRQUM3QyxLQUFLLEVBQUUsQ0FBQztRQVBGLFdBQU0sR0FBRyxJQUFJLG9CQUFvQixFQUFFLENBQUM7UUFDcEMsWUFBTyxHQUFHLEtBQUssQ0FBQztRQUNoQixpQkFBWSxHQUF5QixJQUFJLENBQUM7UUFDMUMsa0JBQWEsR0FBRyxLQUFLLENBQUM7UUFLNUIsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLE9BQU87ZUFDN0IsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxFQUFFLFFBQVEsRUFBRSxZQUFZLENBQUMsQ0FBQztRQUNqRSxNQUFNLGdCQUFnQixHQUFHLFVBQVUsQ0FBQyxTQUFTLENBQUM7UUFDOUMsSUFBSSxDQUFDLE1BQU0sR0FBRztZQUNaLE9BQU87WUFDUCxXQUFXLEVBQUUsVUFBVSxDQUFDLFdBQVcsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsV0FBVyxDQUFDO1lBQzlFLGNBQWMsRUFBRSxVQUFVLENBQUMsY0FBYyxJQUFJLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSSxHQUFHLElBQUk7WUFDbkUsU0FBUyxFQUFFLGdCQUFnQixJQUFJLGdCQUFnQixDQUFDLE9BQU8sS0FBSyxLQUFLO2dCQUMvRCxDQUFDLENBQUM7b0JBQ0UsV0FBVyxFQUFFLGdCQUFnQixDQUFDLFdBQVcsSUFBSSxXQUFXO29CQUN4RCxJQUFJLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxJQUFJLENBQUM7b0JBQ2hDLHNCQUFzQixFQUFFLGdCQUFnQixDQUFDLHNCQUFzQixJQUFJLEtBQUs7b0JBQ3hFLG9CQUFvQixFQUFFLGdCQUFnQixDQUFDLG9CQUFvQixJQUFJLEtBQUs7b0JBQ3BFLG1CQUFtQixFQUFFLGdCQUFnQixDQUFDLG1CQUFtQixFQUFFLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQzt3QkFDOUUsR0FBRyxFQUFFLFVBQVUsQ0FBQyxHQUFHO3dCQUNuQixJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUk7cUJBQ3RCLENBQUMsQ0FBQyxJQUFJLEVBQUU7b0JBQ1Qsc0JBQXNCLEVBQUUsZ0JBQWdCLENBQUMsc0JBQXNCLElBQUksRUFBRTtvQkFDckUsbUJBQW1CLEVBQUUsZ0JBQWdCLENBQUMsbUJBQW1CLElBQUksRUFBRSxHQUFHLElBQUksR0FBRyxJQUFJO29CQUM3RSxxQkFBcUIsRUFBRSxnQkFBZ0IsQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUk7b0JBQ2hGLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLGdCQUFnQixJQUFJLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSSxHQUFHLElBQUk7b0JBQzdFLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLGdCQUFnQixJQUFJLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSTtvQkFDckUsa0JBQWtCLEVBQUUsZ0JBQWdCLENBQUMsa0JBQWtCLElBQUksR0FBRztvQkFDOUQsa0JBQWtCLEVBQUUsZ0JBQWdCLENBQUMsa0JBQWtCLElBQUksTUFBTTtvQkFDakUsV0FBVyxFQUFFLGdCQUFnQixDQUFDLFdBQVc7MkJBQ3BDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxPQUFPLEtBQUssS0FBSzt3QkFDakQsQ0FBQyxDQUFDOzRCQUNFLG1CQUFtQixFQUNqQixnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsbUJBQW1COzRCQUNsRCxtQkFBbUIsRUFDakIsZ0JBQWdCLENBQUMsV0FBVyxDQUFDLG1CQUFtQjttQ0FDN0MsQ0FBQyxHQUFHLElBQUksR0FBRyxJQUFJLEdBQUcsSUFBSTt5QkFDNUI7d0JBQ0gsQ0FBQyxDQUFDLFNBQVM7aUJBQ2Q7Z0JBQ0gsQ0FBQyxDQUFDLFNBQVM7U0FDZCxDQUFDO1FBQ0YsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBbUIsRUFBRSxNQUFxQixFQUFFLEVBQUU7WUFDcEUsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7WUFDckIsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ2xDLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBWSxFQUFFLEVBQUU7WUFDeEMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDNUIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLEtBQUs7UUFDaEIsSUFBSSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDakIsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBQ25ELENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7UUFDcEQsQ0FBQztRQUVELElBQUksQ0FBQyxhQUFhLEdBQUcsS0FBSyxDQUFDO1FBQzNCLElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3pDLElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQztRQUMxQixDQUFDO2dCQUFTLENBQUM7WUFDVCxJQUFJLENBQUMsWUFBWSxHQUFHLElBQUksQ0FBQztRQUMzQixDQUFDO0lBQ0gsQ0FBQztJQUVNLEtBQUssQ0FBQyxJQUFJO1FBQ2YsSUFBSSxDQUFDLGFBQWEsR0FBRyxJQUFJLENBQUM7UUFDMUIsSUFBSSxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDdEIsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNqRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDekIsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7WUFDckIsT0FBTztRQUNULENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDckMsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNuQixJQUFJLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQztRQUN2QixDQUFDO0lBQ0gsQ0FBQztJQUVNLEtBQUssQ0FBQyxTQUFTO1FBQ3BCLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3pCLE9BQU87Z0JBQ0wsT0FBTyxFQUFFLEtBQUs7Z0JBQ2QsT0FBTyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTztnQkFDNUIsUUFBUSxFQUFFLENBQUM7YUFDWixDQUFDO1FBQ0osQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUNqQyxDQUFDO0lBRU0sS0FBSyxDQUFDLDRCQUE0QixDQUN2QyxTQUErQztRQUUvQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLDRCQUE0QixDQUFDO1lBQzlDLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxvQkFBb0I7WUFDcEQsbUJBQW1CLEVBQUUsU0FBUyxDQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDdEUsR0FBRyxFQUFFLFVBQVUsQ0FBQyxHQUFHO2dCQUNuQixJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUk7YUFDdEIsQ0FBQyxDQUFDO1NBQ0osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FDM0MsYUFBdUQ7UUFFdkQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxnQ0FBZ0MsQ0FBQztZQUNsRCxHQUFHLEVBQUUsYUFBYSxDQUFDLEdBQUc7WUFDdEIsSUFBSSxFQUFFLGFBQWEsQ0FBQyxJQUFJO1lBQ3hCLE1BQU0sRUFBRSxhQUFhLENBQUMsTUFBTTtZQUM1QixRQUFRLEVBQUUsYUFBYSxDQUFDLFFBQVE7U0FDakMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxPQUFPLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxVQUFnRDtRQUM5RSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFFTSxLQUFLLENBQUMsWUFBWSxDQUFDLFVBQTBDO1FBQ2xFLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFFTSxLQUFLLENBQUMsYUFBYSxDQUFDLFVBQXlDO1FBQ2xFLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQy9DLENBQUM7SUFFTSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsVUFBeUM7UUFDckUsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBRU0sS0FBSyxDQUFDLHNCQUFzQixDQUNqQyxVQUF5QztRQUV6QyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLHNCQUFzQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFFTSxLQUFLLENBQUMsdUJBQXVCLENBQ2xDLFVBQTJDO1FBRTNDLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsdUJBQXVCLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVNLEtBQUssQ0FBQyxnQkFBZ0I7UUFDM0IsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO0lBQ3hDLENBQUM7SUFFTSxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQWlDO1FBQ3JELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzFDLENBQUM7SUFFTSxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQWtDO1FBQ3RELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzFDLENBQUM7SUFFTSxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQXNDO1FBQzFELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzFDLENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVyxDQUFDLFVBQXlDO1FBQ2hFLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzdDLENBQUM7SUFFTSxLQUFLLENBQUMsU0FBUyxDQUFDLFVBQW9DO1FBQ3pELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzNDLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQWtDO1FBQ3JELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3pDLENBQUM7SUFFTSxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQXNDO1FBQzFELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzFDLENBQUM7SUFFTSxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQWlDO1FBQ25ELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFTyxLQUFLLENBQUMsYUFBYTtRQUN6QixNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDMUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2IsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUN2QixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ25CLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztRQUNwRCxDQUFDO1FBRUQsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDL0MsSUFBSSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQ3ZCLElBQUksQ0FBQztvQkFDSCxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7Z0JBQ3JDLENBQUM7d0JBQVMsQ0FBQztvQkFDVCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO29CQUNuQixJQUFJLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQztnQkFDdkIsQ0FBQztnQkFDRCxNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7WUFDcEQsQ0FBQztZQUNELElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1FBQ3RCLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNuQixJQUFJLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQztZQUNyQixNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRU8sYUFBYTtRQUNuQixJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2xCLE1BQU0sSUFBSSxLQUFLLENBQUMsMkJBQTJCLENBQUMsQ0FBQztRQUMvQyxDQUFDO0lBQ0gsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5naXRtYW5hZ2VyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5naXRtYW5hZ2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBK0J4QyxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUVuRSxNQUFNLE9BQU8sVUFBVyxTQUFRLE9BQU8sQ0FBQyxZQUFZO0lBT2xELFlBQVksYUFBaUMsRUFBRTtRQUM3QyxLQUFLLEVBQUUsQ0FBQztRQVBGLFdBQU0sR0FBRyxJQUFJLG9CQUFvQixFQUFFLENBQUM7UUFDcEMsWUFBTyxHQUFHLEtBQUssQ0FBQztRQUNoQixpQkFBWSxHQUF5QixJQUFJLENBQUM7UUFDMUMsa0JBQWEsR0FBRyxLQUFLLENBQUM7UUFLNUIsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLE9BQU87ZUFDN0IsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxFQUFFLFFBQVEsRUFBRSxZQUFZLENBQUMsQ0FBQztRQUNqRSxNQUFNLGdCQUFnQixHQUFHLFVBQVUsQ0FBQyxTQUFTLENBQUM7UUFDOUMsSUFBSSxDQUFDLE1BQU0sR0FBRztZQUNaLE9BQU87WUFDUCxXQUFXLEVBQUUsVUFBVSxDQUFDLFdBQVcsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsV0FBVyxDQUFDO1lBQzlFLGNBQWMsRUFBRSxVQUFVLENBQUMsY0FBYyxJQUFJLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSSxHQUFHLElBQUk7WUFDbkUsU0FBUyxFQUFFLGdCQUFnQixJQUFJLGdCQUFnQixDQUFDLE9BQU8sS0FBSyxLQUFLO2dCQUMvRCxDQUFDLENBQUM7b0JBQ0UsV0FBVyxFQUFFLGdCQUFnQixDQUFDLFdBQVcsSUFBSSxXQUFXO29CQUN4RCxJQUFJLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxJQUFJLENBQUM7b0JBQ2hDLHNCQUFzQixFQUFFLGdCQUFnQixDQUFDLHNCQUFzQixJQUFJLEtBQUs7b0JBQ3hFLG9CQUFvQixFQUFFLGdCQUFnQixDQUFDLG9CQUFvQixJQUFJLEtBQUs7b0JBQ3BFLG1CQUFtQixFQUFFLGdCQUFnQixDQUFDLG1CQUFtQixFQUFFLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQzt3QkFDOUUsR0FBRyxFQUFFLFVBQVUsQ0FBQyxHQUFHO3dCQUNuQixJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUk7cUJBQ3RCLENBQUMsQ0FBQyxJQUFJLEVBQUU7b0JBQ1Qsc0JBQXNCLEVBQUUsZ0JBQWdCLENBQUMsc0JBQXNCLElBQUksRUFBRTtvQkFDckUsbUJBQW1CLEVBQUUsZ0JBQWdCLENBQUMsbUJBQW1CLElBQUksRUFBRSxHQUFHLElBQUksR0FBRyxJQUFJO29CQUM3RSxxQkFBcUIsRUFBRSxnQkFBZ0IsQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUk7b0JBQ2hGLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLGdCQUFnQixJQUFJLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSSxHQUFHLElBQUk7b0JBQzdFLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLGdCQUFnQixJQUFJLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSTtvQkFDckUsa0JBQWtCLEVBQUUsZ0JBQWdCLENBQUMsa0JBQWtCLElBQUksR0FBRztvQkFDOUQsa0JBQWtCLEVBQUUsZ0JBQWdCLENBQUMsa0JBQWtCLElBQUksTUFBTTtvQkFDakUsV0FBVyxFQUFFLGdCQUFnQixDQUFDLFdBQVc7MkJBQ3BDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxPQUFPLEtBQUssS0FBSzt3QkFDakQsQ0FBQyxDQUFDOzRCQUNFLG1CQUFtQixFQUNqQixnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsbUJBQW1CO3lCQUNuRDt3QkFDSCxDQUFDLENBQUMsU0FBUztvQkFDYixXQUFXLEVBQUUsZ0JBQWdCLENBQUMsV0FBVzsyQkFDcEMsZ0JBQWdCLENBQUMsV0FBVyxDQUFDLE9BQU8sS0FBSyxLQUFLO3dCQUNqRCxDQUFDLENBQUM7NEJBQ0UsbUJBQW1CLEVBQ2pCLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxtQkFBbUI7NEJBQ2xELG1CQUFtQixFQUNqQixnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsbUJBQW1CO21DQUM3QyxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUksR0FBRyxJQUFJO3lCQUM1Qjt3QkFDSCxDQUFDLENBQUMsU0FBUztpQkFDZDtnQkFDSCxDQUFDLENBQUMsU0FBUztTQUNkLENBQUM7UUFDRixJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFtQixFQUFFLE1BQXFCLEVBQUUsRUFBRTtZQUNwRSxJQUFJLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQztZQUNyQixJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDbEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFZLEVBQUUsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTSxLQUFLLENBQUMsS0FBSztRQUNoQixJQUFJLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNqQixNQUFNLElBQUksS0FBSyxDQUFDLCtCQUErQixDQUFDLENBQUM7UUFDbkQsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztRQUNwRCxDQUFDO1FBRUQsSUFBSSxDQUFDLGFBQWEsR0FBRyxLQUFLLENBQUM7UUFDM0IsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDekMsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDO1FBQzFCLENBQUM7Z0JBQVMsQ0FBQztZQUNULElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxDQUFDO1FBQzNCLENBQUM7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUk7UUFDZixJQUFJLENBQUMsYUFBYSxHQUFHLElBQUksQ0FBQztRQUMxQixJQUFJLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2pELENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN6QixJQUFJLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQztZQUNyQixPQUFPO1FBQ1QsQ0FBQztRQUNELElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNyQyxDQUFDO2dCQUFTLENBQUM7WUFDVCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ25CLElBQUksQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDO1FBQ3ZCLENBQUM7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLFNBQVM7UUFDcEIsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDekIsT0FBTztnQkFDTCxPQUFPLEVBQUUsS0FBSztnQkFDZCxPQUFPLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPO2dCQUM1QixRQUFRLEVBQUUsQ0FBQzthQUNaLENBQUM7UUFDSixDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO0lBQ2pDLENBQUM7SUFFTSxLQUFLLENBQUMsNEJBQTRCLENBQ3ZDLFNBQStDO1FBRS9DLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsNEJBQTRCLENBQUM7WUFDOUMsb0JBQW9CLEVBQUUsU0FBUyxDQUFDLG9CQUFvQjtZQUNwRCxtQkFBbUIsRUFBRSxTQUFTLENBQUMsbUJBQW1CLENBQUMsR0FBRyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxDQUFDO2dCQUN0RSxHQUFHLEVBQUUsVUFBVSxDQUFDLEdBQUc7Z0JBQ25CLElBQUksRUFBRSxVQUFVLENBQUMsSUFBSTthQUN0QixDQUFDLENBQUM7U0FDSixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLGdDQUFnQyxDQUMzQyxhQUF1RDtRQUV2RCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGdDQUFnQyxDQUFDO1lBQ2xELEdBQUcsRUFBRSxhQUFhLENBQUMsR0FBRztZQUN0QixJQUFJLEVBQUUsYUFBYSxDQUFDLElBQUk7WUFDeEIsTUFBTSxFQUFFLGFBQWEsQ0FBQyxNQUFNO1lBQzVCLFFBQVEsRUFBRSxhQUFhLENBQUMsUUFBUTtTQUNqQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLG1DQUFtQyxDQUM5QyxnQkFBNkQ7UUFFN0QsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxtQ0FBbUMsQ0FBQztZQUNyRCxHQUFHLEVBQUUsZ0JBQWdCLENBQUMsR0FBRztZQUN6QixJQUFJLEVBQUUsZ0JBQWdCLENBQUMsSUFBSTtZQUMzQixRQUFRLEVBQUUsZ0JBQWdCLENBQUMsUUFBUTtZQUNuQyxLQUFLLEVBQUUsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDM0MsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPO2dCQUNyQixZQUFZLEVBQUUsSUFBSSxDQUFDLFlBQVk7Z0JBQy9CLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtnQkFDL0IsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLGdCQUFnQjthQUN4QyxDQUFDLENBQUM7U0FDSixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE9BQU8sSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztJQUM3QyxDQUFDO0lBRU0sS0FBSyxDQUFDLGtCQUFrQixDQUFDLFVBQWdEO1FBQzlFLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsa0JBQWtCLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDcEQsQ0FBQztJQUVNLEtBQUssQ0FBQyxZQUFZLENBQUMsVUFBMEM7UUFDbEUsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxhQUFhLENBQUMsVUFBeUM7UUFDbEUsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxVQUF5QztRQUNyRSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFFTSxLQUFLLENBQUMsc0JBQXNCLENBQ2pDLFVBQXlDO1FBRXpDLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsc0JBQXNCLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUVNLEtBQUssQ0FBQyx1QkFBdUIsQ0FDbEMsVUFBMkM7UUFFM0MsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyx1QkFBdUIsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN6RCxDQUFDO0lBRU0sS0FBSyxDQUFDLGdCQUFnQjtRQUMzQixJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGdCQUFnQixFQUFFLENBQUM7SUFDeEMsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBaUM7UUFDckQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBa0M7UUFDdEQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBc0M7UUFDMUQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxXQUFXLENBQUMsVUFBeUM7UUFDaEUsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDN0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxTQUFTLENBQUMsVUFBb0M7UUFDekQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDM0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBa0M7UUFDckQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBc0M7UUFDMUQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxNQUFNLENBQUMsVUFBaUM7UUFDbkQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUVPLEtBQUssQ0FBQyxhQUFhO1FBQ3pCLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUMxQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ3ZCLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDbkIsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFFRCxJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUMvQyxJQUFJLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztnQkFDdkIsSUFBSSxDQUFDO29CQUNILE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztnQkFDckMsQ0FBQzt3QkFBUyxDQUFDO29CQUNULElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7b0JBQ25CLElBQUksQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDO2dCQUN2QixDQUFDO2dCQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztZQUNwRCxDQUFDO1lBQ0QsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7UUFDdEIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ25CLElBQUksQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDO1lBQ3JCLE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztJQUNILENBQUM7SUFFTyxhQUFhO1FBQ25CLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDbEIsTUFBTSxJQUFJLEtBQUssQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO1FBQy9DLENBQUM7SUFDSCxDQUFDO0NBQ0YifQ==

package/dist_ts/models.d.ts

@@ -13,8 +13,13 @@ export interface IGitManagerSmartHttpOptions {
     processTimeoutMs?: number;
     idleTimeoutSeconds?: number;
     gracefulShutdownMs?: number;
+    privateRead?: IGitManagerSmartHttpPrivateReadOptions;
     receivePack?: IGitManagerSmartHttpReceivePackOptions;
 }
+export interface IGitManagerSmartHttpPrivateReadOptions {
+    enabled?: boolean;
+    trustedIngressToken: string;
+}
 export interface IGitManagerSmartHttpReceivePackOptions {
     enabled?: boolean;
     trustedIngressToken: string;
@@ -28,6 +33,22 @@ export interface IGitManagerSmartHttpRepositoryVisibility extends IGitManagerRep
     public: boolean;
     revision: number;
 }
+export interface IGitManagerProtectedRefRule {
+    refName: string;
+    allowCreates: boolean;
+    allowDeletes: boolean;
+    allowForcePushes: boolean;
+}
+export interface IGitManagerSmartHttpRepositoryProtectedRefs extends IGitManagerRepositorySelector {
+    revision: number;
+    rules: IGitManagerProtectedRefRule[];
+}
+export type TGitManagerProtectedRefsApplyStatus = 'applied' | 'idempotent' | 'stale';
+export interface IGitManagerProtectedRefsApplyResult {
+    status: TGitManagerProtectedRefsApplyStatus;
+    effectiveRevision: number;
+    rulesDigest: string;
+}
 export interface IGitManagerRepositoryBundle extends IGitManagerRepositorySelector {
     bundlePath: string;
     sizeBytes: number;
@@ -55,8 +76,12 @@ export interface IRustGitManagerSmartHttpConfig {
     processTimeoutMs: number;
     idleTimeoutSeconds: number;
     gracefulShutdownMs: number;
+    privateRead?: IRustGitManagerSmartHttpPrivateReadConfig;
     receivePack?: IRustGitManagerSmartHttpReceivePackConfig;
 }
+export interface IRustGitManagerSmartHttpPrivateReadConfig {
+    trustedIngressToken: string;
+}
 export interface IRustGitManagerSmartHttpReceivePackConfig {
     trustedIngressToken: string;
     maxRequestBodyBytes: number;

package/dist_ts/rust-gitmanager-bridge.d.ts

@@ -1,5 +1,5 @@
 import * as plugins from './plugins.js';
-import type { IGitManagerCommitDetail, IGitManagerCommitRequest, IGitManagerCommitSummary, IGitManagerDiff, IGitManagerDiffRequest, IGitManagerFileContent, IGitManagerImportMirrorRequest, IGitManagerInitBareRepositoryRequest, IGitManagerListCommitsRequest, IGitManagerListTagsRequest, IGitManagerReadFileRequest, IGitManagerRef, IGitManagerRefRequest, IGitManagerRepositoryBundle, IGitManagerRepositoryInfo, IGitManagerRepositorySelector, IGitManagerRestoreBundleRequest, IGitManagerSmartHttpRepositoryAccess, IGitManagerSmartHttpRepositoryVisibility, IGitManagerStatus, IGitManagerTag, IGitManagerTagRequest, IGitManagerTreeEntry, IGitManagerTreeRequest, IRustGitManagerConfig } from './models.js';
+import type { IGitManagerCommitDetail, IGitManagerCommitRequest, IGitManagerCommitSummary, IGitManagerDiff, IGitManagerDiffRequest, IGitManagerFileContent, IGitManagerImportMirrorRequest, IGitManagerInitBareRepositoryRequest, IGitManagerListCommitsRequest, IGitManagerListTagsRequest, IGitManagerReadFileRequest, IGitManagerRef, IGitManagerRefRequest, IGitManagerProtectedRefsApplyResult, IGitManagerSmartHttpRepositoryProtectedRefs, IGitManagerRepositoryBundle, IGitManagerRepositoryInfo, IGitManagerRepositorySelector, IGitManagerRestoreBundleRequest, IGitManagerSmartHttpRepositoryAccess, IGitManagerSmartHttpRepositoryVisibility, IGitManagerStatus, IGitManagerTag, IGitManagerTagRequest, IGitManagerTreeEntry, IGitManagerTreeRequest, IRustGitManagerConfig } from './models.js';
 export declare class RustGitManagerBridge extends plugins.EventEmitter {
     private bridge;
     constructor();
@@ -11,6 +11,7 @@ export declare class RustGitManagerBridge extends plugins.EventEmitter {
     getStatus(): Promise<IGitManagerStatus>;
     setSmartHttpRepositoryAccess(accessArg: IGitManagerSmartHttpRepositoryAccess): Promise<void>;
     setSmartHttpRepositoryVisibility(visibilityArg: IGitManagerSmartHttpRepositoryVisibility): Promise<void>;
+    setSmartHttpRepositoryProtectedRefs(protectedRefsArg: IGitManagerSmartHttpRepositoryProtectedRefs): Promise<IGitManagerProtectedRefsApplyResult>;
     initBareRepository(requestArg: IGitManagerInitBareRepositoryRequest): Promise<IGitManagerRepositoryInfo>;
     importMirror(requestArg: IGitManagerImportMirrorRequest): Promise<IGitManagerRepositoryInfo>;
     refreshMirror(requestArg: IGitManagerRepositorySelector): Promise<IGitManagerRepositoryInfo>;

package/dist_ts/rust-gitmanager-bridge.js

@@ -64,6 +64,9 @@ export class RustGitManagerBridge extends plugins.EventEmitter {
     async setSmartHttpRepositoryVisibility(visibilityArg) {
         await this.bridge.sendCommand('setSmartHttpRepositoryVisibility', visibilityArg);
     }
+    async setSmartHttpRepositoryProtectedRefs(protectedRefsArg) {
+        return this.bridge.sendCommand('setSmartHttpRepositoryProtectedRefs', protectedRefsArg);
+    }
     async initBareRepository(requestArg) {
         return this.bridge.sendCommand('initBareRepository', requestArg);
     }
@@ -110,4 +113,4 @@ export class RustGitManagerBridge extends plugins.EventEmitter {
         return this.bridge.sendCommand('getTag', requestArg);
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVzdC1naXRtYW5hZ2VyLWJyaWRnZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1c3QtZ2l0bWFuYWdlci1icmlkZ2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFvRHhDLFNBQVMsY0FBYztJQUNyQixNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDakYsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDN0MsQ0FBQztBQUVELFNBQVMsdUJBQXVCO0lBQzlCLE1BQU0sT0FBTyxHQUEyQixFQUFFLEdBQUcsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ3pFLE1BQU0sS0FBSyxHQUEyQixFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxDQUFDO0lBQzFFLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbkMsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNuQyxPQUFPLEVBQUUsSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxJQUFJLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7QUFDN0MsQ0FBQztBQUVELFNBQVMsZUFBZTtJQUN0QixNQUFNLFdBQVcsR0FBRyxjQUFjLEVBQUUsQ0FBQztJQUNyQyxNQUFNLE1BQU0sR0FBRyx1QkFBdUIsRUFBRSxDQUFDO0lBQ3pDLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztJQUUzQixJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQ1gsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsV0FBVyxFQUFFLGtCQUFrQixNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLFdBQVcsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7SUFDMUUsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0lBQy9GLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLGdCQUFnQixDQUFDLENBQUMsQ0FBQztJQUU3RixPQUFPLEtBQUssQ0FBQztBQUNmLENBQUM7QUFFRCxNQUFNLE9BQU8sb0JBQXFCLFNBQVEsT0FBTyxDQUFDLFlBQVk7SUFHNUQ7UUFDRSxLQUFLLEVBQUUsQ0FBQztRQUNSLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBc0I7WUFDbEUsVUFBVSxFQUFFLGdCQUFnQjtZQUM1QixVQUFVLEVBQUUsd0JBQXdCO1lBQ3BDLHFCQUFxQixFQUFFLHlCQUF5QjtZQUNoRCxVQUFVLEVBQUUsZUFBZSxFQUFFO1lBQzdCLGdCQUFnQixFQUFFLE1BQU07WUFDeEIsY0FBYyxFQUFFLEtBQUs7U0FDdEIsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBbUIsRUFBRSxNQUFxQixFQUFFLEVBQUU7WUFDcEUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ2xDLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBWSxFQUFFLEVBQUU7WUFDeEMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDNUIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLEtBQUs7UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQzdCLENBQUM7SUFFTSxJQUFJO1FBQ1QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNyQixDQUFDO0lBRUQsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztJQUVNLEtBQUssQ0FBQyxlQUFlLENBQUMsU0FBZ0M7UUFDM0QsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBRU0sS0FBSyxDQUFDLGNBQWM7UUFDekIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxTQUFTO1FBQ3BCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFFTSxLQUFLLENBQUMsNEJBQTRCLENBQUMsU0FBK0M7UUFDdkYsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyw4QkFBOEIsRUFBRSxTQUFTLENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBRU0sS0FBSyxDQUFDLGdDQUFnQyxDQUMzQyxhQUF1RDtRQUV2RCxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGtDQUFrQyxFQUFFLGFBQWEsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFFTSxLQUFLLENBQUMsa0JBQWtCLENBQUMsVUFBZ0Q7UUFDOUUsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBRU0sS0FBSyxDQUFDLFlBQVksQ0FBQyxVQUEwQztRQUNsRSxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGNBQWMsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBRU0sS0FBSyxDQUFDLGFBQWEsQ0FBQyxVQUF5QztRQUNsRSxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGVBQWUsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBRU0sS0FBSyxDQUFDLGdCQUFnQixDQUFDLFVBQXlDO1FBQ3JFLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsa0JBQWtCLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUVNLEtBQUssQ0FBQyxzQkFBc0IsQ0FDakMsVUFBeUM7UUFFekMsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyx3QkFBd0IsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBRU0sS0FBSyxDQUFDLHVCQUF1QixDQUNsQyxVQUEyQztRQUUzQyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLHlCQUF5QixFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFFTSxLQUFLLENBQUMsZ0JBQWdCO1FBQzNCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsa0JBQWtCLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBaUM7UUFDckQsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBa0M7UUFDdEQsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBc0M7UUFDMUQsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVNLEtBQUssQ0FBQyxXQUFXLENBQUMsVUFBeUM7UUFDaEUsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxhQUFhLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDNUQsQ0FBQztJQUVNLEtBQUssQ0FBQyxTQUFTLENBQUMsVUFBb0M7UUFDekQsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDMUQsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBa0M7UUFDckQsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxTQUFTLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBc0M7UUFDMUQsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVNLEtBQUssQ0FBQyxNQUFNLENBQUMsVUFBaUM7UUFDbkQsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDdkQsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVzdC1naXRtYW5hZ2VyLWJyaWRnZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1c3QtZ2l0bWFuYWdlci1icmlkZ2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUF1RHhDLFNBQVMsY0FBYztJQUNyQixNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDakYsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDN0MsQ0FBQztBQUVELFNBQVMsdUJBQXVCO0lBQzlCLE1BQU0sT0FBTyxHQUEyQixFQUFFLEdBQUcsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ3pFLE1BQU0sS0FBSyxHQUEyQixFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxDQUFDO0lBQzFFLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbkMsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNuQyxPQUFPLEVBQUUsSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxJQUFJLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7QUFDN0MsQ0FBQztBQUVELFNBQVMsZUFBZTtJQUN0QixNQUFNLFdBQVcsR0FBRyxjQUFjLEVBQUUsQ0FBQztJQUNyQyxNQUFNLE1BQU0sR0FBRyx1QkFBdUIsRUFBRSxDQUFDO0lBQ3pDLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztJQUUzQixJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQ1gsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsV0FBVyxFQUFFLGtCQUFrQixNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLFdBQVcsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7SUFDMUUsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0lBQy9GLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLGdCQUFnQixDQUFDLENBQUMsQ0FBQztJQUU3RixPQUFPLEtBQUssQ0FBQztBQUNmLENBQUM7QUFFRCxNQUFNLE9BQU8sb0JBQXFCLFNBQVEsT0FBTyxDQUFDLFlBQVk7SUFHNUQ7UUFDRSxLQUFLLEVBQUUsQ0FBQztRQUNSLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBc0I7WUFDbEUsVUFBVSxFQUFFLGdCQUFnQjtZQUM1QixVQUFVLEVBQUUsd0JBQXdCO1lBQ3BDLHFCQUFxQixFQUFFLHlCQUF5QjtZQUNoRCxVQUFVLEVBQUUsZUFBZSxFQUFFO1lBQzdCLGdCQUFnQixFQUFFLE1BQU07WUFDeEIsY0FBYyxFQUFFLEtBQUs7U0FDdEIsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBbUIsRUFBRSxNQUFxQixFQUFFLEVBQUU7WUFDcEUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ2xDLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBWSxFQUFFLEVBQUU7WUFDeEMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDNUIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLEtBQUs7UUFDaEIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQzdCLENBQUM7SUFFTSxJQUFJO1FBQ1QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNyQixDQUFDO0lBRUQsSUFBVyxPQUFPO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0IsQ0FBQztJQUVNLEtBQUssQ0FBQyxlQUFlLENBQUMsU0FBZ0M7UUFDM0QsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBRU0sS0FBSyxDQUFDLGNBQWM7UUFDekIsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxTQUFTO1FBQ3BCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFFTSxLQUFLLENBQUMsNEJBQTRCLENBQUMsU0FBK0M7UUFDdkYsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyw4QkFBOEIsRUFBRSxTQUFTLENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBRU0sS0FBSyxDQUFDLGdDQUFnQyxDQUMzQyxhQUF1RDtRQUV2RCxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGtDQUFrQyxFQUFFLGFBQWEsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFFTSxLQUFLLENBQUMsbUNBQW1DLENBQzlDLGdCQUE2RDtRQUU3RCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUM1QixxQ0FBcUMsRUFDckMsZ0JBQWdCLENBQ2pCLENBQUM7SUFDSixDQUFDO0lBRU0sS0FBSyxDQUFDLGtCQUFrQixDQUFDLFVBQWdEO1FBQzlFLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDbkUsQ0FBQztJQUVNLEtBQUssQ0FBQyxZQUFZLENBQUMsVUFBMEM7UUFDbEUsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxjQUFjLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUVNLEtBQUssQ0FBQyxhQUFhLENBQUMsVUFBeUM7UUFDbEUsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxlQUFlLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUVNLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxVQUF5QztRQUNyRSxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGtCQUFrQixFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFFTSxLQUFLLENBQUMsc0JBQXNCLENBQ2pDLFVBQXlDO1FBRXpDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsd0JBQXdCLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUVNLEtBQUssQ0FBQyx1QkFBdUIsQ0FDbEMsVUFBMkM7UUFFM0MsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyx5QkFBeUIsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBRU0sS0FBSyxDQUFDLGdCQUFnQjtRQUMzQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGtCQUFrQixFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFFTSxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQWlDO1FBQ3JELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFFTSxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQWtDO1FBQ3RELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFFTSxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQXNDO1FBQzFELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVyxDQUFDLFVBQXlDO1FBQ2hFLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQzVELENBQUM7SUFFTSxLQUFLLENBQUMsU0FBUyxDQUFDLFVBQW9DO1FBQ3pELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsV0FBVyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQWtDO1FBQ3JELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFFTSxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQXNDO1FBQzFELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFFTSxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQWlDO1FBQ25ELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7Q0FDRiJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foss.global/gitmanager",
-  "version": "0.6.0",
+  "version": "1.0.0",
   "private": false,
   "description": "Headless Git manager for the foss.global Git platform, with a TypeScript API and Rust engine.",
   "exports": {

package/readme.md

@@ -4,7 +4,7 @@ Headless Git manager for the foss.global Git platform.
 
 This package follows the push.rocks Rust-backed package pattern: TypeScript owns the public package API and lifecycle, while Rust owns the Git/storage/protocol engine. TypeScript controls the Rust binary through `@push.rocks/smartrust`, and builds use `@git.zone/tsrust`.
 
-The current implementation provides lifecycle IPC, local bare repository and mirror management, bounded read APIs, durable repository bundle transfer, public clone/fetch, and trusted-ingress receive-pack. User identity, permissions, TLS, and durable post-push storage remain the embedding service's responsibility.
+The current implementation provides lifecycle IPC, local bare repository and mirror management, bounded read APIs, durable repository bundle transfer, public and trusted-ingress private clone/fetch, trusted-ingress receive-pack, and revision-fenced protection for exact branch refs. User identity, permissions, TLS, durable protected-ref policy storage, and durable post-push repository storage remain the embedding service's responsibility.
 
 ## Issue Reporting and Security
 
@@ -87,6 +87,9 @@ const gitManager = new GitManager({
     allowedRepositories: [
       { org: 'foss.global', repo: 'interfaces' },
     ],
+    privateRead: {
+      trustedIngressToken: process.env.GITMANAGER_INGRESS_TOKEN!,
+    },
     receivePack: {
       trustedIngressToken: process.env.GITMANAGER_INGRESS_TOKEN!,
     },
@@ -98,9 +101,9 @@ const status = await gitManager.getStatus();
 console.log(status.smartHttp?.baseUrl);
 ```
 
-The server implements `git-upload-pack` for clone and fetch with Git protocol versions 0, 1, and 2. Missing and inaccessible read repositories both return the same not-found response. Receive-pack is disabled unless a loopback trusted ingress is configured.
+The server implements `git-upload-pack` for clone and fetch with Git protocol versions 0, 1, and 2. Missing and inaccessible read repositories both return the same not-found response. Configuring `privateRead` lets an authenticated loopback ingress grant repository-scoped access by injecting the exact `X-GitManager-Ingress-Token` value after removing any client-supplied copy. Direct private requests still receive the same not-found response.
 
-Configuring `receivePack` enables streamed push only for requests carrying the exact `X-GitManager-Ingress-Token` value. Receive-pack requires a loopback bind even when `allowUnsafeNonLoopback` is set. The trusted ingress must remove client-supplied internal token headers, authorize the user and repository, serialize writes, persist the updated repository, and withhold success if persistence fails.
+Configuring `receivePack` enables streamed push only for requests carrying the trusted ingress token. Private reads and receive-pack require a loopback bind even when `allowUnsafeNonLoopback` is set. The trusted ingress must authorize the user and repository; for pushes it must also serialize writes, persist the updated repository, and withhold success if persistence fails.
 
 The transport does not terminate TLS or implement user identity. Keep it behind a bounded ingress. Read-only binding to a non-loopback IP is rejected unless `allowUnsafeNonLoopback: true` is set explicitly.
 
@@ -121,6 +124,7 @@ All numeric options must be integers.
 - `processTimeoutMs`: 1,800,000; accepted range 1,000–86,400,000.
 - `idleTimeoutSeconds`: `300`; accepted range 1–3,600.
 - `gracefulShutdownMs`: `10,000`; accepted range 100–60,000.
+- `privateRead.trustedIngressToken`: required when trusted private reads are enabled; 32–512 non-whitespace characters.
 - `receivePack.trustedIngressToken`: required when receive-pack is enabled; 32–512 non-whitespace characters.
 - `receivePack.maxRequestBodyBytes`: 4 GiB; accepted range 1 KiB–16 TiB. Request bodies are streamed and counted.
 
@@ -149,6 +153,40 @@ await gitManager.setSmartHttpRepositoryVisibility({
 
 Use monotonic, non-negative safe integers for `revision`. Stale revisions are ignored, equal revisions are idempotent when their visibility matches, conflicting equal revisions fail, and newer revisions replace the previous visibility state.
 
+## Protected refs
+
+Protected refs are configured per repository as one complete, revisioned rule set:
+
+```ts
+const result = await gitManager.setSmartHttpRepositoryProtectedRefs({
+  org: 'foss.global',
+  repo: 'gitmanager',
+  revision: 1,
+  rules: [
+    {
+      refName: 'refs/heads/main',
+      allowCreates: false,
+      allowDeletes: false,
+      allowForcePushes: false,
+    },
+  ],
+});
+
+console.log(result.status, result.effectiveRevision, result.rulesDigest);
+```
+
+Rules accept canonical, exact `refs/heads/...` names only; patterns, tags, roles, and bypass identities are not supported. All three permission booleans are required. Unlisted refs are unaffected. GitManager accepts at most 64 unique rules and canonicalizes their order.
+
+Protected creates, deletes, and updates require valid commit objects. When `allowForcePushes` is `false`, an existing protected branch can move only through a fast-forward update.
+
+Every start begins with no admitted policy for any repository, so receive-pack fails closed until the embedding service explicitly initializes that repository. Revision `0` is reserved for the empty policy and must use `rules: []`; the first non-empty policy must use revision `1` or higher. Clearing protection requires a newer revision with `rules: []`.
+
+The first explicit policy after a start and every higher revision return `applied`. An equal revision with identical canonical rules returns `idempotent`. A lower revision returns `stale` with the effective revision and digest, while conflicting rules at an equal revision fail. Every successful result includes the effective revision and SHA-256 digest of the canonical rules.
+
+Protected-ref state is process-local by design. The embedding service must persist the desired revision and rules, replay them after every `start()`, verify that the returned effective revision and digest match the desired policy, and admit no pushes before that verification succeeds. Policy mutation and receive-pack admission for the same repository must be serialized. Each receive-pack invocation is bound to one immutable policy snapshot.
+
+Receive-pack uses only GitManager's private, process-specific hook directory; repository-configured hooks are not executed. The managed pre-receive hook rejects the complete push when policy bootstrap, decoding, schema validation, repository selection, object-format validation, commit or ancestry checks, or timeout handling fails.
+
 When enabled, `getStatus().smartHttp` reports `{ running, bindAddress, port, baseUrl }`. The server also exposes `GET /healthz` for a local ingress health check.
 
 ## Public API
@@ -159,6 +197,7 @@ When enabled, `getStatus().smartHttp` reports `{ running, bindAddress, port, bas
 - `GitManager.getStatus()`: returns `{ running, dataDir, uptimeMs, smartHttp? }`.
 - `GitManager.setSmartHttpRepositoryAccess()`: atomically replaces the running Smart HTTP allow-all/allowlist state.
 - `GitManager.setSmartHttpRepositoryVisibility()`: applies one revision-ordered repository visibility update.
+- `GitManager.setSmartHttpRepositoryProtectedRefs()`: applies a complete revision-fenced set of exact protected-head rules and returns its effective revision and digest.
 - `GitManager.initBareRepository()`: creates an empty local bare repository.
 - `GitManager.importMirror()`: imports a remote repository with `git clone --mirror`. Supported remote forms are `https://`, `http://`, `ssh://`, `git://`, `file://`, and SCP-like `git@host:org/repo.git` URLs.
 - `GitManager.refreshMirror()`: atomically fetches and verifies the configured mirror source.
@@ -176,13 +215,13 @@ When enabled, `getStatus().smartHttp` reports `{ running, bindAddress, port, bas
 - `GitManager.getTag()`: reads one tag by exact name.
 - `GitManager.running`: local facade running state.
 - `RustGitManagerBridge`: lower-level typed bridge around `@push.rocks/smartrust`.
-- `IGitManagerOptions`, `IGitManagerStatus`, `IRustGitManagerConfig`: exported option/status contracts.
+- `IGitManagerOptions`, `IGitManagerStatus`, `IRustGitManagerConfig`, `IGitManagerProtectedRefRule`, `IGitManagerSmartHttpRepositoryProtectedRefs`, `TGitManagerProtectedRefsApplyStatus`, and `IGitManagerProtectedRefsApplyResult`: exported option, status, and protected-ref contracts.
 
 Repository/read DTO contracts are re-exported from the published `@foss.global/interfaces` package.
 
 Read/list APIs go through JSON IPC. Git packfile streaming is served directly by the Rust engine through controlled `git upload-pack` and `git receive-pack` subprocesses; packfiles do not pass through JSON IPC.
 
-Read APIs and Smart HTTP use the system `git` CLI with explicit arguments, non-interactive environment variables, command timeouts, ref-to-object-id resolution, path validation, bounded stdout/stderr capture, ref/tree result caps, and a 1 MiB file read cap. Receive-pack streams bounded requests, disables repository hooks, and enables incoming object fsck.
+Read APIs and Smart HTTP use the system `git` CLI with explicit arguments, non-interactive environment variables, command timeouts, ref-to-object-id resolution, path validation, bounded stdout/stderr capture, ref/tree result caps, and a 1 MiB file read cap. Receive-pack streams bounded requests, replaces repository-configured hooks with GitManager's verified managed pre-receive hook, enables incoming object fsck, and rejects the complete push when policy evaluation cannot complete safely.
 
 ## Rust Build
 
@@ -203,7 +242,7 @@ pnpm run test:rust
 pnpm run build
 ```
 
-`pnpm test` runs the `pretest` hook first, which builds the Rust binaries with `tsrust`, and then runs lifecycle, local mirror/read API, clone/fetch denial, trusted receive-pack denial, and real push tests through `smartrust`.
+`pnpm test` runs the `pretest` hook first, which builds the Rust binaries with `tsrust`, and then runs lifecycle, local mirror/read API, clone/fetch denial, trusted receive-pack denial, explicit policy initialization, protected create/delete/non-fast-forward enforcement, inherited self-test hardening, restart replay, and real push tests through `smartrust`.
 
 ## License and Legal Information
 

package/thirdparty.md

@@ -16,6 +16,7 @@ This package bundles Rust binaries in `dist_rust/`. Those binaries are built fro
 | axum-core | 0.5.6 | MIT |
 | base64 | 0.22.1 | Apache-2.0 OR MIT |
 | bitflags | 2.13.0 | Apache-2.0 OR MIT |
+| block-buffer | 0.10.4 | MIT OR Apache-2.0 |
 | bytes | 1.12.0 | MIT |
 | cfg-if | 1.0.4 | Apache-2.0 OR MIT |
 | clap | 4.6.1 | Apache-2.0 OR MIT |
@@ -23,6 +24,9 @@ This package bundles Rust binaries in `dist_rust/`. Those binaries are built fro
 | clap_derive | 4.6.1 | Apache-2.0 OR MIT |
 | clap_lex | 1.1.0 | Apache-2.0 OR MIT |
 | colorchoice | 1.0.5 | Apache-2.0 OR MIT |
+| cpufeatures | 0.2.17 | MIT OR Apache-2.0 |
+| crypto-common | 0.1.7 | MIT OR Apache-2.0 |
+| digest | 0.10.7 | MIT OR Apache-2.0 |
 | errno | 0.3.14 | Apache-2.0 OR MIT |
 | form_urlencoded | 1.2.2 | Apache-2.0 OR MIT |
 | futures-channel | 0.3.33 | Apache-2.0 OR MIT |
@@ -31,6 +35,7 @@ This package bundles Rust binaries in `dist_rust/`. Those binaries are built fro
 | futures-sink | 0.3.33 | Apache-2.0 OR MIT |
 | futures-task | 0.3.33 | Apache-2.0 OR MIT |
 | futures-util | 0.3.33 | Apache-2.0 OR MIT |
+| generic-array | 0.14.7 | MIT |
 | heck | 0.5.0 | Apache-2.0 OR MIT |
 | http | 1.4.2 | Apache-2.0 OR MIT |
 | http-body | 1.1.0 | MIT |
@@ -70,6 +75,7 @@ This package bundles Rust binaries in `dist_rust/`. Those binaries are built fro
 | serde_json | 1.0.150 | Apache-2.0 OR MIT |
 | serde_path_to_error | 0.1.20 | Apache-2.0 OR MIT |
 | serde_urlencoded | 0.7.1 | Apache-2.0 OR MIT |
+| sha2 | 0.10.9 | MIT OR Apache-2.0 |
 | sharded-slab | 0.1.7 | MIT |
 | signal-hook-registry | 1.4.8 | Apache-2.0 OR MIT |
 | slab | 0.4.12 | MIT |
@@ -91,9 +97,11 @@ This package bundles Rust binaries in `dist_rust/`. Those binaries are built fro
 | tracing-core | 0.1.36 | MIT |
 | tracing-log | 0.2.0 | MIT |
 | tracing-subscriber | 0.3.23 | MIT |
+| typenum | 1.20.1 | MIT OR Apache-2.0 |
 | unicode-ident | 1.0.24 | (Apache-2.0 OR MIT) AND Unicode-3.0 |
 | utf8parse | 0.2.2 | Apache-2.0 OR MIT |
 | valuable | 0.1.1 | MIT |
+| version_check | 0.9.5 | MIT OR Apache-2.0 |
 | wasi | 0.11.1+wasi-snapshot-preview1 | Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT |
 | windows-link | 0.2.1 | Apache-2.0 OR MIT |
 | windows-sys | 0.61.2 | Apache-2.0 OR MIT |

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@foss.global/gitmanager',
-  version: '0.6.0',
+  version: '1.0.0',
   description: 'Headless Git manager for the foss.global Git platform, with a TypeScript API and Rust engine.'
 }

package/ts/classes.gitmanager.ts

@@ -13,6 +13,8 @@ import type {
   IGitManagerReadFileRequest,
   IGitManagerRef,
   IGitManagerRefRequest,
+  IGitManagerProtectedRefsApplyResult,
+  IGitManagerSmartHttpRepositoryProtectedRefs,
   IGitManagerRepositoryBundle,
   IGitManagerRepositoryInfo,
   IGitManagerRepositorySelector,
@@ -62,6 +64,13 @@ export class GitManager extends plugins.EventEmitter {
             processTimeoutMs: smartHttpOptions.processTimeoutMs ?? 30 * 60 * 1000,
             idleTimeoutSeconds: smartHttpOptions.idleTimeoutSeconds ?? 300,
             gracefulShutdownMs: smartHttpOptions.gracefulShutdownMs ?? 10_000,
+            privateRead: smartHttpOptions.privateRead
+              && smartHttpOptions.privateRead.enabled !== false
+              ? {
+                  trustedIngressToken:
+                    smartHttpOptions.privateRead.trustedIngressToken,
+                }
+              : undefined,
             receivePack: smartHttpOptions.receivePack
               && smartHttpOptions.receivePack.enabled !== false
               ? {
@@ -154,6 +163,23 @@ export class GitManager extends plugins.EventEmitter {
     });
   }
 
+  public async setSmartHttpRepositoryProtectedRefs(
+    protectedRefsArg: IGitManagerSmartHttpRepositoryProtectedRefs,
+  ): Promise<IGitManagerProtectedRefsApplyResult> {
+    this.assertRunning();
+    return this.bridge.setSmartHttpRepositoryProtectedRefs({
+      org: protectedRefsArg.org,
+      repo: protectedRefsArg.repo,
+      revision: protectedRefsArg.revision,
+      rules: protectedRefsArg.rules.map((rule) => ({
+        refName: rule.refName,
+        allowCreates: rule.allowCreates,
+        allowDeletes: rule.allowDeletes,
+        allowForcePushes: rule.allowForcePushes,
+      })),
+    });
+  }
+
   public get running(): boolean {
     return this.started && this.bridge.running;
   }

package/ts/models.ts

@@ -14,9 +14,15 @@ export interface IGitManagerSmartHttpOptions {
   processTimeoutMs?: number;
   idleTimeoutSeconds?: number;
   gracefulShutdownMs?: number;
+  privateRead?: IGitManagerSmartHttpPrivateReadOptions;
   receivePack?: IGitManagerSmartHttpReceivePackOptions;
 }
 
+export interface IGitManagerSmartHttpPrivateReadOptions {
+  enabled?: boolean;
+  trustedIngressToken: string;
+}
+
 export interface IGitManagerSmartHttpReceivePackOptions {
   enabled?: boolean;
   trustedIngressToken: string;
@@ -34,6 +40,30 @@ export interface IGitManagerSmartHttpRepositoryVisibility
   revision: number;
 }
 
+export interface IGitManagerProtectedRefRule {
+  refName: string;
+  allowCreates: boolean;
+  allowDeletes: boolean;
+  allowForcePushes: boolean;
+}
+
+export interface IGitManagerSmartHttpRepositoryProtectedRefs
+  extends IGitManagerRepositorySelector {
+  revision: number;
+  rules: IGitManagerProtectedRefRule[];
+}
+
+export type TGitManagerProtectedRefsApplyStatus =
+  | 'applied'
+  | 'idempotent'
+  | 'stale';
+
+export interface IGitManagerProtectedRefsApplyResult {
+  status: TGitManagerProtectedRefsApplyStatus;
+  effectiveRevision: number;
+  rulesDigest: string;
+}
+
 export interface IGitManagerRepositoryBundle
   extends IGitManagerRepositorySelector {
   bundlePath: string;
@@ -66,9 +96,14 @@ export interface IRustGitManagerSmartHttpConfig {
   processTimeoutMs: number;
   idleTimeoutSeconds: number;
   gracefulShutdownMs: number;
+  privateRead?: IRustGitManagerSmartHttpPrivateReadConfig;
   receivePack?: IRustGitManagerSmartHttpReceivePackConfig;
 }
 
+export interface IRustGitManagerSmartHttpPrivateReadConfig {
+  trustedIngressToken: string;
+}
+
 export interface IRustGitManagerSmartHttpReceivePackConfig {
   trustedIngressToken: string;
   maxRequestBodyBytes: number;

package/ts/rust-gitmanager-bridge.ts

@@ -13,6 +13,8 @@ import type {
   IGitManagerReadFileRequest,
   IGitManagerRef,
   IGitManagerRefRequest,
+  IGitManagerProtectedRefsApplyResult,
+  IGitManagerSmartHttpRepositoryProtectedRefs,
   IGitManagerRepositoryBundle,
   IGitManagerRepositoryInfo,
   IGitManagerRepositorySelector,
@@ -33,6 +35,7 @@ type TGitManagerCommands = {
   getStatus: { params: Record<string, never>; result: IGitManagerStatus };
   setSmartHttpRepositoryAccess: { params: IGitManagerSmartHttpRepositoryAccess; result: Record<string, never> };
   setSmartHttpRepositoryVisibility: { params: IGitManagerSmartHttpRepositoryVisibility; result: Record<string, never> };
+  setSmartHttpRepositoryProtectedRefs: { params: IGitManagerSmartHttpRepositoryProtectedRefs; result: IGitManagerProtectedRefsApplyResult };
   initBareRepository: { params: IGitManagerInitBareRepositoryRequest; result: IGitManagerRepositoryInfo };
   importMirror: { params: IGitManagerImportMirrorRequest; result: IGitManagerRepositoryInfo };
   refreshMirror: { params: IGitManagerRepositorySelector; result: IGitManagerRepositoryInfo };
@@ -134,6 +137,15 @@ export class RustGitManagerBridge extends plugins.EventEmitter {
     await this.bridge.sendCommand('setSmartHttpRepositoryVisibility', visibilityArg);
   }
 
+  public async setSmartHttpRepositoryProtectedRefs(
+    protectedRefsArg: IGitManagerSmartHttpRepositoryProtectedRefs,
+  ): Promise<IGitManagerProtectedRefsApplyResult> {
+    return this.bridge.sendCommand(
+      'setSmartHttpRepositoryProtectedRefs',
+      protectedRefsArg,
+    );
+  }
+
   public async initBareRepository(requestArg: IGitManagerInitBareRepositoryRequest): Promise<IGitManagerRepositoryInfo> {
     return this.bridge.sendCommand('initBareRepository', requestArg);
   }