@foss.global/gitmanager 2.1.0 → 2.3.0

package/native-notices/manifest.json

@@ -23,6 +23,7 @@
         "base64@0.22.1",
         "block-buffer@0.10.4",
         "bytes@1.12.0",
+        "cc@1.8.0",
         "cfg-if@1.0.4",
         "clap@4.6.1",
         "clap_builder@4.6.0",
@@ -34,6 +35,7 @@
         "crypto-common@0.1.7",
         "digest@0.10.7",
         "errno@0.3.14",
+        "find-msvc-tools@0.1.14",
         "flate2@1.1.9",
         "form_urlencoded@1.2.2",
         "futures-channel@0.3.33",
@@ -83,6 +85,7 @@
         "serde_urlencoded@0.7.1",
         "sha2@0.10.9",
         "sharded-slab@0.1.7",
+        "shlex@2.0.1",
         "signal-hook-registry@1.4.8",
         "simd-adler32@0.3.10",
         "slab@0.4.12",
@@ -92,6 +95,8 @@
         "syn@2.0.118",
         "sync_wrapper@1.0.2",
         "thread_local@1.1.9",
+        "tikv-jemalloc-sys@0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8",
+        "tikv-jemallocator@0.7.0",
         "tokio-macros@2.7.0",
         "tokio-stream@0.1.18",
         "tokio-util@0.7.18",
@@ -133,6 +138,7 @@
         "base64@0.22.1",
         "block-buffer@0.10.4",
         "bytes@1.12.0",
+        "cc@1.8.0",
         "cfg-if@1.0.4",
         "clap@4.6.1",
         "clap_builder@4.6.0",
@@ -144,6 +150,7 @@
         "crypto-common@0.1.7",
         "digest@0.10.7",
         "errno@0.3.14",
+        "find-msvc-tools@0.1.14",
         "flate2@1.1.9",
         "form_urlencoded@1.2.2",
         "futures-channel@0.3.33",
@@ -193,6 +200,7 @@
         "serde_urlencoded@0.7.1",
         "sha2@0.10.9",
         "sharded-slab@0.1.7",
+        "shlex@2.0.1",
         "signal-hook-registry@1.4.8",
         "simd-adler32@0.3.10",
         "slab@0.4.12",
@@ -202,6 +210,8 @@
         "syn@2.0.118",
         "sync_wrapper@1.0.2",
         "thread_local@1.1.9",
+        "tikv-jemalloc-sys@0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8",
+        "tikv-jemallocator@0.7.0",
         "tokio-macros@2.7.0",
         "tokio-stream@0.1.18",
         "tokio-util@0.7.18",
@@ -485,6 +495,26 @@
         }
       ]
     },
+    {
+      "name": "cc",
+      "version": "1.8.0",
+      "source": "registry+https://github.com/rust-lang/crates.io-index",
+      "license": "MIT OR Apache-2.0",
+      "files": [
+        {
+          "path": "crates/cc-1.8.0/license-apache",
+          "licenses": [
+            "Apache-2.0"
+          ]
+        },
+        {
+          "path": "crates/cc-1.8.0/license-mit",
+          "licenses": [
+            "MIT"
+          ]
+        }
+      ]
+    },
     {
       "name": "cfg-if",
       "version": "1.0.4",
@@ -705,6 +735,26 @@
         }
       ]
     },
+    {
+      "name": "find-msvc-tools",
+      "version": "0.1.14",
+      "source": "registry+https://github.com/rust-lang/crates.io-index",
+      "license": "MIT OR Apache-2.0",
+      "files": [
+        {
+          "path": "crates/find-msvc-tools-0.1.14/license-apache",
+          "licenses": [
+            "Apache-2.0"
+          ]
+        },
+        {
+          "path": "crates/find-msvc-tools-0.1.14/license-mit",
+          "licenses": [
+            "MIT"
+          ]
+        }
+      ]
+    },
     {
       "name": "flate2",
       "version": "1.1.9",
@@ -1647,6 +1697,24 @@
         }
       ]
     },
+    {
+      "name": "shlex",
+      "version": "2.0.1",
+      "source": "registry+https://github.com/rust-lang/crates.io-index",
+      "license": "MIT OR Apache-2.0",
+      "files": [
+        {
+          "path": "crates/shlex-2.0.1/license-apache",
+          "licenses": []
+        },
+        {
+          "path": "crates/shlex-2.0.1/license-mit",
+          "licenses": [
+            "MIT"
+          ]
+        }
+      ]
+    },
     {
       "name": "signal-hook-registry",
       "version": "1.4.8",
@@ -1803,6 +1871,61 @@
         }
       ]
     },
+    {
+      "name": "tikv-jemalloc-sys",
+      "version": "0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8",
+      "source": "registry+https://github.com/rust-lang/crates.io-index",
+      "license": "MIT/Apache-2.0",
+      "files": [
+        {
+          "path": "crates/tikv-jemalloc-sys-0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8/license-apache",
+          "licenses": [
+            "Apache-2.0"
+          ]
+        },
+        {
+          "path": "crates/tikv-jemalloc-sys-0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8/license-mit",
+          "licenses": [
+            "MIT"
+          ]
+        }
+      ],
+      "native": [
+        {
+          "name": "jemalloc",
+          "version": "5.3.1",
+          "license": "BSD-2-Clause",
+          "files": [
+            {
+              "path": "native/tikv-jemalloc-sys-0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8/jemalloc-5.3.1/jemalloc-copying",
+              "licenses": [
+                "BSD-2-Clause"
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "tikv-jemallocator",
+      "version": "0.7.0",
+      "source": "registry+https://github.com/rust-lang/crates.io-index",
+      "license": "MIT/Apache-2.0",
+      "files": [
+        {
+          "path": "crates/tikv-jemallocator-0.7.0/license-apache",
+          "licenses": [
+            "Apache-2.0"
+          ]
+        },
+        {
+          "path": "crates/tikv-jemallocator-0.7.0/license-mit",
+          "licenses": [
+            "MIT"
+          ]
+        }
+      ]
+    },
     {
       "name": "tokio-macros",
       "version": "2.7.0",
@@ -2270,6 +2393,8 @@
     "crates/block-buffer-0.10.4/license-apache": "a9040321c3712d8fd0b09cf52b17445de04a23a10165049ae187cd39e5c86be5",
     "crates/block-buffer-0.10.4/license-mit": "d5c22aa3118d240e877ad41c5d9fa232f9c77d757d4aac0c2f943afc0a95e0ef",
     "crates/bytes-1.12.0/license": "45f522cacecb1023856e46df79ca625dfc550c94910078bd8aec6e02880b3d42",
+    "crates/cc-1.8.0/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
+    "crates/cc-1.8.0/license-mit": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
     "crates/cfg-if-1.0.4/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
     "crates/cfg-if-1.0.4/license-mit": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
     "crates/clap-4.6.1/license-apache": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08",
@@ -2292,6 +2417,8 @@
     "crates/digest-0.10.7/license-mit": "9e0dfd2dd4173a530e238cb6adb37aa78c34c6bc7444e0e10c1ab5d8881f63ba",
     "crates/errno-0.3.14/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
     "crates/errno-0.3.14/license-mit": "8764a597675778ddfd4e25f81b08a05dbcf089ac05662df7613fe67f150e3aa2",
+    "crates/find-msvc-tools-0.1.14/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
+    "crates/find-msvc-tools-0.1.14/license-mit": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
     "crates/flate2-1.1.9/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
     "crates/flate2-1.1.9/license-mit": "025436edff4cfcdde17a5811fdea78892d8482efd1abdec5a17872d07a4f2112",
     "crates/form_urlencoded-1.2.2/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
@@ -2384,6 +2511,8 @@
     "crates/sha2-0.10.9/license-apache": "a9040321c3712d8fd0b09cf52b17445de04a23a10165049ae187cd39e5c86be5",
     "crates/sha2-0.10.9/license-mit": "b4eb00df6e2a4d22518fcaa6a2b4646f249b3a3c9814509b22bd2091f1392ff1",
     "crates/sharded-slab-0.1.7/license": "eafbfa606bc005ed7fd2f623d65af17ffe4ef7c017221ac14405bf4140771ea9",
+    "crates/shlex-2.0.1/license-apache": "553fffcd9b1cb158bc3e9edc35da85ca5c3b3d7d2e61c883ebcfa8a65814b583",
+    "crates/shlex-2.0.1/license-mit": "4455bf75a91154108304cb283e0fea9948c14f13e20d60887cf2552449dea3b1",
     "crates/signal-hook-registry-1.4.8/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
     "crates/signal-hook-registry-1.4.8/license-mit": "503558bfefe66ca15e4e3f7955b3cb0ec87fd52f29bf24b336af7bd00e946d5c",
     "crates/simd-adler32-0.3.10/license.md": "42a35170233e83e18856792e748de4c1ce4a63b2afce9a370c89ef3fe23f9f2d",
@@ -2398,6 +2527,10 @@
     "crates/sync_wrapper-1.0.2/license": "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594",
     "crates/thread_local-1.1.9/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
     "crates/thread_local-1.1.9/license-mit": "c9a75f18b9ab2927829a208fc6aa2cf4e63b8420887ba29cdb265d6619ae82d5",
+    "crates/tikv-jemalloc-sys-0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
+    "crates/tikv-jemalloc-sys-0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8/license-mit": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
+    "crates/tikv-jemallocator-0.7.0/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
+    "crates/tikv-jemallocator-0.7.0/license-mit": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
     "crates/tokio-1.52.3/license": "253cd04c6714889df2d32f3f64d669179a1c95c76ac43c40882c52eb06bc3552",
     "crates/tokio-macros-2.7.0/license": "0b83dc40cba89b9922bb84b0a9c7d2768ce37c1d7e138b7424fd4549915778c9",
     "crates/tokio-stream-0.1.18/license": "253cd04c6714889df2d32f3f64d669179a1c95c76ac43c40882c52eb06bc3552",
@@ -2421,7 +2554,8 @@
     "crates/version_check-0.9.5/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
     "crates/version_check-0.9.5/license-mit": "b7e650f3fce5c53249d1cdc608b54df156a97edd636cf9d23498d0cfe7aec63e",
     "crates/zmij-1.0.21/license-mit": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
-    "readme.md": "04809ae136a7ad00a51d3c6bf1f89d187f30b29215a331dfc303ab94ebfba0e0",
+    "native/tikv-jemalloc-sys-0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8/jemalloc-5.3.1/jemalloc-copying": "94aa2caa98c25d942f58b956c71dba6a99ff98fc3a31cbc669fe2a4cd0268b53",
+    "readme.md": "81effb0ac33ff0b14d70a6d2deca504acbd941d13aa962744af7890ba6887fb5",
     "runtime/gcc/gpl-3.0.txt": "8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903",
     "runtime/gcc/runtime-library-exception-3.1.txt": "9d6b43ce4d8de0c878bf16b54d8e7a10d9bd42b75178153e3af6a815bdc90f74",
     "runtime/glibc/lgpl-2.1.txt": "dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551",

package/native-notices/native/tikv-jemalloc-sys-0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8/jemalloc-5.3.1/jemalloc-copying

@@ -0,0 +1,27 @@
+Unless otherwise specified, files in the jemalloc source distribution are
+subject to the following license:
+--------------------------------------------------------------------------------
+Copyright (C) 2002-present Jason Evans <jasone@canonware.com>.
+All rights reserved.
+Copyright (C) 2007-2012 Mozilla Foundation.  All rights reserved.
+Copyright (C) 2009-present Facebook, Inc.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+1. Redistributions of source code must retain the above copyright notice(s),
+   this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice(s),
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER(S) ``AS IS'' AND ANY EXPRESS
+OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO
+EVENT SHALL THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+--------------------------------------------------------------------------------

package/native-notices/readme.md

@@ -12,15 +12,17 @@ package's own code is covered by its own license.
 
 | Target | Rust target | Linkage | Cargo packages |
 | --- | --- | --- | --- |
-| linux_amd64 | x86_64-unknown-linux-gnu | dynamic glibc | 99 |
-| linux_arm64 | aarch64-unknown-linux-gnu | dynamic glibc | 99 |
+| linux_amd64 | x86_64-unknown-linux-gnu | dynamic glibc | 104 |
+| linux_arm64 | aarch64-unknown-linux-gnu | dynamic glibc | 104 |
 
 ## Contents
 
-- `crates/`: the license and notice files of the 99 third-party Cargo packages compiled
+- `crates/`: the license and notice files of the 104 third-party Cargo packages compiled
   for these targets (normal and build dependencies, including procedural macros;
   development dependencies are excluded), copied verbatim. `manifest.json` records each
   package's license expression, the texts that cover it, and the targets it is built for.
+- `native/`: the license files of C and C++ libraries that Cargo packages compile into
+  the executables.
 - `rust/`: the Rust standard library copyright inventory and license texts from the
   toolchain, and compiler-builtins' license.
   `rust/crates/` holds the license files of 5 standard-library dependencies the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foss.global/gitmanager",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "private": false,
   "description": "Headless Git manager for the foss.global Git platform, with a TypeScript API and Rust engine.",
   "exports": {
@@ -10,17 +10,17 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "dependencies": {
-    "@foss.global/interfaces": "^1.0.0",
+    "@foss.global/interfaces": "^2.0.0",
     "@push.rocks/smartrust": "^1.7.0"
   },
   "devDependencies": {
     "@foss.global/ci-spec": "1.1.1",
-    "@git.zone/tsbuild": "^5.0.0",
-    "@git.zone/tsdoc": "^2.2.2",
-    "@git.zone/tsrun": "^3.0.1",
-    "@git.zone/tsrust": "^1.15.1",
-    "@git.zone/tstest": "^6.3.2",
-    "@types/node": "^26.6.2"
+    "@git.zone/tsbuild": "^6.0.2",
+    "@git.zone/tsdoc": "^3.0.2",
+    "@git.zone/tsrun": "^3.0.3",
+    "@git.zone/tsrust": "^4.5.1",
+    "@git.zone/tstest": "^7.2.1",
+    "@types/node": "^26.6.4"
   },
   "files": [
     "ts/**/*",
@@ -61,6 +61,7 @@
     "test": "tstest test/ --verbose --logfile --timeout 60",
     "test:rust": "(cd rust && cargo test)",
     "build": "(tsbuild tsfolders) && (tsrust)",
+    "build:release": "(tsbuild tsfolders) && (tsrust --configured-targets) && (tsrust verify)",
     "buildDocs": "tsdoc"
   }
 }

package/readme.md

@@ -104,6 +104,33 @@ const main = await gitManager.listRefs({
   0.9 s for the complete inventory with packed refs and about 9.5 s with loose
   refs.
 
+## Credentialed mirrors and repository size
+
+`importMirror()` and `refreshMirror()` take the transfer options of `IGitManagerRemoteTransferOptions`:
+
+```ts
+const credential = { kind: 'basic' as const, username: 'mirror-reader', password: accessToken };
+await gitManager.importMirror({
+  org: 'mirror.org',
+  repo: 'interfaces',
+  remoteUrl: 'https://forge.example/foss.global/interfaces.git',
+  credential,
+  caCertificates: [privateCaPem],
+  timeoutMs: 30 * 60 * 1000,
+});
+await gitManager.refreshMirror({ org: 'mirror.org', repo: 'interfaces', credential, caCertificates: [privateCaPem] });
+
+const size = await gitManager.getRepositorySize({ org: 'mirror.org', repo: 'interfaces' });
+// { org, repo, objectCount, objectBytes, storageBytes }
+```
+
+- The credential reaches Git only through the child process environment (`GIT_CONFIG_COUNT` entries) as an `Authorization: Basic` header. It never appears in the remote URL, on a command line, in the repository's Git config or in an error: error text replaces the remote URL with `<mirror-source>` and every form of the credential with `<redacted>`.
+- A credential requires an `https://` remote URL without user information. While it carries one, Git does not follow redirects and reads no global or system Git config, so `insteadOf` rewrites and credential helpers there cannot take effect.
+- `caCertificates` replaces Git's CA bundle for this transfer. The PEMs are written to a private file in `transferDir` that is removed when the transfer ends.
+- `timeoutMs` is the transfer's wall-clock limit: 120000 by default, at most 21600000 (six hours). The Git process group is killed when it runs out.
+- Both transfers run without credential helpers or hooks, refuse the `ext::` transport and check incoming objects.
+- `getRepositorySize()` counts the distinct objects of the repository's own object database (`objectCount`) and the sum of their uncompressed sizes (`objectBytes`), which does not depend on packing. `storageBytes` is the size of every file below `objects/`. A repository with alternate object stores is refused. Measuring runs for at most 30 minutes.
+
 ## Durable repository bundles
 
 GitManager can export a repository as a full Git bundle and atomically restore it under a new managed repository identity. Bundle bytes never pass through JSON IPC: Rust writes or reads a temporary file inside the dedicated `transferDir`, and the caller streams that file to or from durable object storage.
@@ -329,6 +356,8 @@ The metadata is recomputed from the bytes, so compare it with what the sender de
 - `GitManager.initBareRepository()`: creates an empty local bare repository.
 - `GitManager.importMirror()`: imports a remote repository with `git clone --mirror`. Supported remote forms are `https://`, `http://`, `ssh://`, `git://`, `file://`, and SCP-like `git@host:org/repo.git` URLs.
 - `GitManager.refreshMirror()`: atomically fetches and verifies the configured mirror source.
+- `GitManager.importMirror()` and `GitManager.refreshMirror()` accept a `credential`, `caCertificates` and `timeoutMs`; see [Credentialed mirrors and repository size](#credentialed-mirrors-and-repository-size).
+- `GitManager.getRepositorySize()`: returns the exact object count, uncompressed object bytes and on-disk object storage bytes of a repository.
 - `GitManager.verifyRepository()`: runs a strict full integrity check.
 - `GitManager.createRepositoryBundle()`: writes a bounded full Git bundle into `transferDir` and returns its temporary path and size.
 - `GitManager.createRepositoryArchive(request, { signal? })`: writes a bounded deterministic exact-commit `tar.gz` archive into `transferDir` and returns its digest, compressed size, extracted regular-file size, entry count, and temporary path; cancellation settles after Rust process and staging cleanup.

package/thirdparty.md

@@ -2,6 +2,8 @@
 
 This package bundles Rust binaries in `dist_rust/`. Those binaries are built from the Rust crates listed below. Each dependency remains licensed by its respective authors under the stated license expression.
 
+The generated `native-notices/` directory ships the complete license texts, including jemalloc 5.3.1's BSD-2-Clause COPYING bundled by `tikv-jemalloc-sys`, the Rust runtime and platform runtime notices.
+
 | Crate | Version | License |
 | --- | --- | --- |
 | adler2 | 2.0.1 | 0BSD OR MIT OR Apache-2.0 |
@@ -19,6 +21,7 @@ This package bundles Rust binaries in `dist_rust/`. Those binaries are built fro
 | bitflags | 2.13.0 | Apache-2.0 OR MIT |
 | block-buffer | 0.10.4 | MIT OR Apache-2.0 |
 | bytes | 1.12.0 | MIT |
+| cc | 1.8.0 | MIT OR Apache-2.0 |
 | cfg-if | 1.0.4 | Apache-2.0 OR MIT |
 | clap | 4.6.1 | Apache-2.0 OR MIT |
 | clap_builder | 4.6.0 | Apache-2.0 OR MIT |
@@ -30,6 +33,7 @@ This package bundles Rust binaries in `dist_rust/`. Those binaries are built fro
 | crypto-common | 0.1.7 | MIT OR Apache-2.0 |
 | digest | 0.10.7 | MIT OR Apache-2.0 |
 | errno | 0.3.14 | Apache-2.0 OR MIT |
+| find-msvc-tools | 0.1.14 | MIT OR Apache-2.0 |
 | flate2 | 1.1.9 | MIT OR Apache-2.0 |
 | form_urlencoded | 1.2.2 | Apache-2.0 OR MIT |
 | futures-channel | 0.3.33 | Apache-2.0 OR MIT |
@@ -81,6 +85,7 @@ This package bundles Rust binaries in `dist_rust/`. Those binaries are built fro
 | serde_urlencoded | 0.7.1 | Apache-2.0 OR MIT |
 | sha2 | 0.10.9 | MIT OR Apache-2.0 |
 | sharded-slab | 0.1.7 | MIT |
+| shlex | 2.0.1 | MIT OR Apache-2.0 |
 | signal-hook-registry | 1.4.8 | Apache-2.0 OR MIT |
 | simd-adler32 | 0.3.10 | MIT |
 | slab | 0.4.12 | MIT |
@@ -90,6 +95,8 @@ This package bundles Rust binaries in `dist_rust/`. Those binaries are built fro
 | syn | 2.0.118 | Apache-2.0 OR MIT |
 | sync_wrapper | 1.0.2 | Apache-2.0 |
 | thread_local | 1.1.9 | Apache-2.0 OR MIT |
+| tikv-jemalloc-sys | 0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8 | MIT OR Apache-2.0 |
+| tikv-jemallocator | 0.7.0 | MIT OR Apache-2.0 |
 | tokio | 1.52.3 | MIT |
 | tokio-macros | 2.7.0 | MIT |
 | tokio-stream | 0.1.18 | MIT |

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@foss.global/gitmanager',
-  version: '2.1.0',
+  version: '2.3.0',
   description: 'Headless Git manager for the foss.global Git platform, with a TypeScript API and Rust engine.'
 }

package/ts/classes.gitmanager.ts

@@ -18,6 +18,8 @@ import type {
   IGitManagerMergeResult,
   IGitManagerReadFileRequest,
   IGitManagerRefRequest,
+  IGitManagerRefreshMirrorRequest,
+  IGitManagerRemoteTransferOptions,
   IGitManagerProtectedRefsApplyResult,
   IGitManagerSmartHttpRepositoryProtectedRefs,
   IGitManagerRepositoryBundle,
@@ -28,6 +30,7 @@ import type {
   IGitManagerRepositoryServiceRequest,
   IGitManagerRepositoryInfo,
   IGitManagerRepositorySelector,
+  IGitManagerRepositorySize,
   IGitManagerRestoreBundleRequest,
   IGitManagerSmartHttpRepositoryAccess,
   IGitManagerSmartHttpRepositoryVisibility,
@@ -49,6 +52,40 @@ import { runArchiveInspection } from './classes.archiveinspection.js';
 
 const readinessDefaultTimeoutMs = 2_000;
 const readinessMaximumTimeoutMs = 30_000;
+const remoteTransferMaximumTimeoutMs = 21_600_000;
+
+/**
+ * Checks transfer options before they reach the engine, which answers a
+ * malformed credential-bearing request with fixed text only. Messages never
+ * quote a credential value.
+ */
+const assertRemoteTransferOptions = (optionsArg: IGitManagerRemoteTransferOptions): void => {
+  const { credential, caCertificates, timeoutMs } = optionsArg;
+  if (credential !== undefined) {
+    if (
+      credential === null
+      || typeof credential !== 'object'
+      || credential.kind !== 'basic'
+      || typeof credential.username !== 'string'
+      || typeof credential.password !== 'string'
+      || Object.keys(credential).some((key) => !['kind', 'username', 'password'].includes(key))
+    ) {
+      throw new TypeError('credential must be { kind: "basic", username: string, password: string }');
+    }
+  }
+  if (
+    caCertificates !== undefined
+    && (!Array.isArray(caCertificates) || caCertificates.some((certificate) => typeof certificate !== 'string'))
+  ) {
+    throw new TypeError('caCertificates must be an array of PEM strings');
+  }
+  if (
+    timeoutMs !== undefined
+    && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > remoteTransferMaximumTimeoutMs)
+  ) {
+    throw new RangeError(`timeoutMs must be an integer between 1 and ${remoteTransferMaximumTimeoutMs}`);
+  }
+};
 
 type TGitManagerReadinessAbortSource = 'caller' | 'deadline';
 type TGitManagerReadinessProbeOutcome = 'ready' | 'aborted' | 'unavailable';
@@ -339,16 +376,30 @@ export class GitManager extends plugins.EventEmitter {
     return this.bridge.initBareRepository(requestArg);
   }
 
+  /**
+   * Clones every ref of `remoteUrl` into a new mirror repository. Pass a
+   * credential as `credential`, never inside the URL: the engine hands it to
+   * Git only through the process environment and removes it from errors.
+   */
   public async importMirror(requestArg: IGitManagerImportMirrorRequest): Promise<IGitManagerRepositoryInfo> {
     this.assertRunning();
+    assertRemoteTransferOptions(requestArg);
     return this.bridge.importMirror(requestArg);
   }
 
-  public async refreshMirror(requestArg: IGitManagerRepositorySelector): Promise<IGitManagerRepositoryInfo> {
+  /** Fetches every ref of an imported mirror's remote again, with the same transfer options as `importMirror`. */
+  public async refreshMirror(requestArg: IGitManagerRefreshMirrorRequest): Promise<IGitManagerRepositoryInfo> {
     this.assertRunning();
+    assertRemoteTransferOptions(requestArg);
     return this.bridge.refreshMirror(requestArg);
   }
 
+  /** Counts the repository's objects and their exact Git bytes. */
+  public async getRepositorySize(requestArg: IGitManagerRepositorySelector): Promise<IGitManagerRepositorySize> {
+    this.assertRunning();
+    return this.bridge.getRepositorySize(requestArg);
+  }
+
   public async verifyRepository(requestArg: IGitManagerRepositorySelector): Promise<IGitManagerRepositoryInfo> {
     this.assertRunning();
     return this.bridge.verifyRepository(requestArg);

package/ts/models.ts

@@ -317,8 +317,12 @@ export type {
   IGitManagerRefInventoryPage,
   IGitManagerRefInventoryStale,
   IGitManagerRefRequest,
+  IGitManagerRefreshMirrorRequest,
+  IGitManagerRemoteBasicCredential,
+  IGitManagerRemoteTransferOptions,
   IGitManagerRepositoryInfo,
   IGitManagerRepositorySelector,
+  IGitManagerRepositorySize,
   IGitManagerTag,
   IGitManagerTagRequest,
   IGitManagerTreeEntry,
@@ -330,5 +334,6 @@ export type {
   TGitManagerObjectType,
   TGitManagerRefInventoryPagination,
   TGitManagerRefInventoryResult,
+  TGitManagerRemoteCredential,
   TGitManagerTreeEntryType,
 } from '@foss.global/interfaces';

package/ts/rust-gitmanager-bridge.ts

@@ -16,6 +16,7 @@ import type {
   IGitManagerMergeResult,
   IGitManagerReadFileRequest,
   IGitManagerRefRequest,
+  IGitManagerRefreshMirrorRequest,
   IGitManagerProtectedRefsApplyResult,
   IGitManagerSmartHttpRepositoryProtectedRefs,
   IGitManagerRepositoryBundle,
@@ -26,6 +27,7 @@ import type {
   IGitManagerRepositoryServiceRequest,
   IGitManagerRepositoryInfo,
   IGitManagerRepositorySelector,
+  IGitManagerRepositorySize,
   IGitManagerRestoreBundleRequest,
   IGitManagerSmartHttpRepositoryAccess,
   IGitManagerSmartHttpRepositoryVisibility,
@@ -63,8 +65,9 @@ type TGitManagerCommands = {
   setSmartHttpRepositoryProtectedRefs: { params: IGitManagerSmartHttpRepositoryProtectedRefs; result: IGitManagerProtectedRefsApplyResult };
   initBareRepository: { params: IGitManagerInitBareRepositoryRequest; result: IGitManagerRepositoryInfo };
   importMirror: { params: IGitManagerImportMirrorRequest; result: IGitManagerRepositoryInfo };
-  refreshMirror: { params: IGitManagerRepositorySelector; result: IGitManagerRepositoryInfo };
+  refreshMirror: { params: IGitManagerRefreshMirrorRequest; result: IGitManagerRepositoryInfo };
   verifyRepository: { params: IGitManagerRepositorySelector; result: IGitManagerRepositoryInfo };
+  getRepositorySize: { params: IGitManagerRepositorySelector; result: IGitManagerRepositorySize };
   createRepositoryBundle: { params: IGitManagerRepositorySelector; result: IGitManagerRepositoryBundle };
   createRepositoryArchive: { params: IRepositoryArchiveOperationRequest; result: IGitManagerRepositoryArchive };
   cancelRepositoryArchive: { params: IRepositoryArchiveCancelRequest; result: { status: TRepositoryArchiveCancelStatus } };
@@ -84,6 +87,16 @@ type TGitManagerCommands = {
   getTag: { params: IGitManagerTagRequest; result: IGitManagerTag };
 };
 
+/** Engine default for a remote transfer without `timeoutMs`. */
+const defaultRemoteTransferTimeoutMs = 120_000;
+
+/**
+ * The bridge waits past the engine's own transfer limit, so the engine reports
+ * a timeout and cleans up before the request is abandoned.
+ */
+const remoteTransferResponseTimeoutMs = (timeoutMsArg: number | undefined): number =>
+  (timeoutMsArg ?? defaultRemoteTransferTimeoutMs) + 30_000;
+
 function getPackageRoot(): string {
   const thisDir = plugins.path.dirname(plugins.url.fileURLToPath(import.meta.url));
   return plugins.path.resolve(thisDir, '..');
@@ -218,11 +231,22 @@ export class RustGitManagerBridge extends plugins.EventEmitter {
   }
 
   public async importMirror(requestArg: IGitManagerImportMirrorRequest): Promise<IGitManagerRepositoryInfo> {
-    return this.bridge.sendCommand('importMirror', requestArg);
+    return this.bridge.sendCommand('importMirror', requestArg, {
+      timeoutMs: remoteTransferResponseTimeoutMs(requestArg.timeoutMs),
+    });
   }
 
-  public async refreshMirror(requestArg: IGitManagerRepositorySelector): Promise<IGitManagerRepositoryInfo> {
-    return this.bridge.sendCommand('refreshMirror', requestArg);
+  public async refreshMirror(requestArg: IGitManagerRefreshMirrorRequest): Promise<IGitManagerRepositoryInfo> {
+    return this.bridge.sendCommand('refreshMirror', requestArg, {
+      timeoutMs: remoteTransferResponseTimeoutMs(requestArg.timeoutMs),
+    });
+  }
+
+  public async getRepositorySize(requestArg: IGitManagerRepositorySelector): Promise<IGitManagerRepositorySize> {
+    // The engine measures for up to 30 minutes.
+    return this.bridge.sendCommand('getRepositorySize', requestArg, {
+      timeoutMs: 31 * 60 * 1000,
+    });
   }
 
   public async verifyRepository(requestArg: IGitManagerRepositorySelector): Promise<IGitManagerRepositoryInfo> {