@lobu/connector-sdk 7.2.0 → 9.0.0

package/dist/sources/git-file-source.js

@@ -0,0 +1,207 @@
+/**
+ * GitFileSource — shallow git clone backed by `isomorphic-git`.
+ *
+ *  - URI shape: `git+https://github.com/owner/repo.git[@<ref>]`. Ref may be
+ *    a branch name, tag, or full commit SHA. If omitted, defaults to `main`.
+ *  - Initial fetch: shallow clone (`depth: 1`, `singleBranch: true`).
+ *  - Subsequent fetch: `git.fetch` against the same single branch with
+ *    `depth: 1` — pulls only the new tip if upstream advanced.
+ *  - `ref` = `resolveRef('HEAD')` (full commit SHA).
+ *  - `diffSinceRef(prevRef)` walks two trees with `git.walk` and classifies
+ *    each path by OID equality (`added`/`modified`/`removed`).
+ *
+ * Caveats called out in JSDoc rather than hidden:
+ *
+ *  - With `depth: 1`, history before the current tip is NOT in the local
+ *    repo. `git.walk` requires both trees to be reachable; if the caller
+ *    passes a `prevRef` we no longer have on disk we throw a clear error.
+ *  - Snapshot reads point at the working tree inside the cache. Git itself
+ *    is not exposed.
+ */
+import { mkdir, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import * as git from 'isomorphic-git';
+// `fs` is passed as a plain Node fs module — isomorphic-git accepts it.
+// We import the callback-style module so isomorphic-git's promisified
+// adapter works out of the box (it auto-detects promises if present).
+import nodeFs from 'node:fs';
+import { cachePathsFor, readAndVerifyMeta, requireMeta, withSourceLock, writeMeta, } from './cache.js';
+import { GitSnapshot } from './git-snapshot.js';
+// Custom https-only http client — rejects plaintext redirects that the
+// stock `isomorphic-git/http/node` (simple-get under the hood) would
+// silently follow.
+import { gitHttpsOnlyClient as http } from './git-http.js';
+const DEFAULT_BRANCH = 'main';
+export function parseGitUri(uri) {
+    if (uri.startsWith('git+http://')) {
+        throw new Error('GitFileSource: plaintext HTTP rejected, use git+https://');
+    }
+    if (!uri.startsWith('git+https://')) {
+        throw new Error(`GitFileSource: expected git+https:// URI, got ${uri}`);
+    }
+    const stripped = uri.slice('git+'.length); // → https://...
+    // Split on the LAST `@` that follows the host's `/`, not the user@host form.
+    const slashIdx = stripped.indexOf('/', stripped.indexOf('://') + 3);
+    const atIdx = slashIdx === -1 ? -1 : stripped.lastIndexOf('@');
+    if (atIdx > slashIdx) {
+        return {
+            url: stripped.slice(0, atIdx),
+            ref: stripped.slice(atIdx + 1) || DEFAULT_BRANCH,
+        };
+    }
+    return { url: stripped, ref: DEFAULT_BRANCH };
+}
+export class GitFileSource {
+    #uri;
+    #parsed;
+    #paths;
+    constructor(uri) {
+        this.#uri = uri;
+        this.#parsed = parseGitUri(uri);
+        this.#paths = cachePathsFor(uri);
+    }
+    fetch() {
+        return withSourceLock(this.#uri, () => this.#fetchLocked());
+    }
+    async #fetchLocked() {
+        await mkdir(this.#paths.root, { recursive: true });
+        await readAndVerifyMeta(this.#paths.metaPath, this.#uri);
+        const dir = this.#paths.snapshotDir;
+        // Detect whether we already have a clone.
+        const alreadyCloned = await pathExists(join(dir, '.git'));
+        if (!alreadyCloned) {
+            await mkdir(dir, { recursive: true });
+            await git.clone({
+                fs: nodeFs,
+                http,
+                dir,
+                url: this.#parsed.url,
+                ref: this.#parsed.ref,
+                singleBranch: true,
+                depth: 1,
+            });
+        }
+        else {
+            // Existing repo — fetch the same branch shallow.
+            await git.fetch({
+                fs: nodeFs,
+                http,
+                dir,
+                ref: this.#parsed.ref,
+                singleBranch: true,
+                depth: 1,
+                tags: false,
+            });
+            // Move HEAD/working tree to the fetched tip.
+            await git.checkout({
+                fs: nodeFs,
+                dir,
+                ref: this.#parsed.ref,
+                force: true,
+            });
+        }
+        const ref = await git.resolveRef({ fs: nodeFs, dir, ref: 'HEAD' });
+        await writeMeta(this.#paths.metaPath, { uri: this.#uri, kind: 'git' });
+        // Read from the captured commit's tree/blobs — immutable view even if a
+        // later fetch() moves HEAD or rewrites the working tree on disk.
+        return new GitSnapshot(dir, ref, nodeFs, { exclude: isGitInternalPath });
+    }
+    diffSinceRef(prevRef) {
+        return withSourceLock(this.#uri, () => this.#diffLocked(prevRef));
+    }
+    async #diffLocked(prevRef) {
+        await requireMeta(this.#paths.metaPath, this.#uri);
+        const dir = this.#paths.snapshotDir;
+        const currentRef = await git.resolveRef({ fs: nodeFs, dir, ref: 'HEAD' });
+        if (currentRef === prevRef)
+            return { added: [], modified: [], removed: [] };
+        // If `prevRef` isn't reachable in the local (shallow) repo, return a
+        // full-reingest delta — every current file as `added`. Matches the
+        // tarball and local-source contract: an unknown prevRef yields a
+        // re-ingest, never a thrown error.
+        let prevReachable = true;
+        try {
+            await git.readCommit({ fs: nodeFs, dir, oid: prevRef });
+        }
+        catch {
+            prevReachable = false;
+        }
+        if (!prevReachable) {
+            const allFiles = await listCurrentFiles(dir, currentRef);
+            return { added: allFiles, modified: [], removed: [] };
+        }
+        const added = [];
+        const modified = [];
+        const removed = [];
+        await git.walk({
+            fs: nodeFs,
+            dir,
+            trees: [git.TREE({ ref: prevRef }), git.TREE({ ref: currentRef })],
+            map: async (filepath, entries) => {
+                // The root entry has filepath '.'. Don't classify it but DO let the
+                // walk descend (returning null prunes the subtree).
+                if (filepath === '.')
+                    return undefined;
+                if (!entries)
+                    return undefined;
+                const [a, b] = entries;
+                // Skip directories — they're emitted as their own map() calls; we
+                // only classify file (blob) entries.
+                const aType = a ? await a.type() : null;
+                const bType = b ? await b.type() : null;
+                if (aType === 'tree' || bType === 'tree')
+                    return undefined;
+                const aOid = aType ? await a.oid() : null;
+                const bOid = bType ? await b.oid() : null;
+                if (aOid === null && bOid !== null)
+                    added.push(filepath);
+                else if (aOid !== null && bOid === null)
+                    removed.push(filepath);
+                else if (aOid !== null && bOid !== null && aOid !== bOid)
+                    modified.push(filepath);
+                return undefined;
+            },
+        });
+        return { added, modified, removed };
+    }
+}
+/** Walk a commit's tree and return every blob path (POSIX-separated). */
+async function listCurrentFiles(dir, ref) {
+    const collected = [];
+    await git.walk({
+        fs: nodeFs,
+        dir,
+        trees: [git.TREE({ ref })],
+        map: async (filepath, entries) => {
+            if (filepath === '.')
+                return undefined;
+            if (!entries)
+                return undefined;
+            const [entry] = entries;
+            if (!entry)
+                return undefined;
+            const type = await entry.type();
+            if (type === 'blob')
+                collected.push(filepath);
+            return undefined;
+        },
+    });
+    return collected;
+}
+/** Filter for git internals — matches `.git` itself and anything under it. */
+function isGitInternalPath(rel) {
+    return rel === '.git' || rel.startsWith('.git/');
+}
+async function pathExists(p) {
+    try {
+        await readFile(p).catch(async () => {
+            const { stat } = await import('node:fs/promises');
+            await stat(p);
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=git-file-source.js.map

package/dist/sources/git-file-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-file-source.js","sourceRoot":"","sources":["../../src/sources/git-file-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAC;AACtC,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,OAAO,MAAM,MAAM,SAAS,CAAC;AAG7B,OAAO,EAEL,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,uEAAuE;AACvE,qEAAqE;AACrE,mBAAmB;AACnB,OAAO,EAAE,kBAAkB,IAAI,IAAI,EAAE,MAAM,eAAe,CAAC;AAE3D,MAAM,cAAc,GAAG,MAAM,CAAC;AAO9B,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;IAC3D,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACrB,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;YAC7B,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,cAAc;SACjD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,OAAO,aAAa;IACf,IAAI,CAAS;IACb,OAAO,CAAe;IACtB,MAAM,CAAa;IAE5B,YAAY,GAAW;QACrB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,KAAK;QACH,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAEpC,0CAA0C;QAC1C,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAE1D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,MAAM,GAAG,CAAC,KAAK,CAAC;gBACd,EAAE,EAAE,MAAM;gBACV,IAAI;gBACJ,GAAG;gBACH,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;gBACrB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;gBACrB,YAAY,EAAE,IAAI;gBAClB,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,iDAAiD;YACjD,MAAM,GAAG,CAAC,KAAK,CAAC;gBACd,EAAE,EAAE,MAAM;gBACV,IAAI;gBACJ,GAAG;gBACH,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;gBACrB,YAAY,EAAE,IAAI;gBAClB,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,6CAA6C;YAC7C,MAAM,GAAG,CAAC,QAAQ,CAAC;gBACjB,EAAE,EAAE,MAAM;gBACV,GAAG;gBACH,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;gBACrB,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvE,wEAAwE;QACxE,iEAAiE;QACjE,OAAO,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,YAAY,CAAC,OAAe;QAC1B,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,IAAI,UAAU,KAAK,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAE5E,qEAAqE;QACrE,mEAAmE;QACnE,iEAAiE;QACjE,mCAAmC;QACnC,IAAI,aAAa,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,MAAM,GAAG,CAAC,IAAI,CAAC;YACb,EAAE,EAAE,MAAM;YACV,GAAG;YACH,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YAClE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;gBAC/B,oEAAoE;gBACpE,oDAAoD;gBACpD,IAAI,QAAQ,KAAK,GAAG;oBAAE,OAAO,SAAS,CAAC;gBACvC,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAC/B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC;gBAEvB,kEAAkE;gBAClE,qCAAqC;gBACrC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACxC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACxC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAC;gBAE3D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE3C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;qBACpD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;oBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;qBAC3D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAElF,OAAO,SAAS,CAAC;YACnB,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;CACF;AAED,yEAAyE;AACzE,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW;IACtD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,GAAG,CAAC,IAAI,CAAC;QACb,EAAE,EAAE,MAAM;QACV,GAAG;QACH,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1B,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;YAC/B,IAAI,QAAQ,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAC;YACvC,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;YACxB,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,IAAI,KAAK,MAAM;gBAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/sources/git-http.d.ts

@@ -0,0 +1,48 @@
+/**
+ * HttpClient for isomorphic-git that:
+ *
+ *  - Talks https only — refuses to issue any request whose URL is not
+ *    `https://...`.
+ *  - Follows redirects manually (max 5 hops). Every `Location` is re-validated
+ *    https before the next request — closes the https-to-http downgrade hole
+ *    that an https endpoint replying with `Location: http://...` would
+ *    otherwise open against the default `isomorphic-git/http/node` impl
+ *    (which uses `simple-get`'s built-in redirect follower and does NOT
+ *    enforce a scheme on the next hop).
+ *
+ * Implemented on top of Node's `https.request` so the SDK doesn't pull in
+ * an extra HTTP client. The body-as-async-iterator contract matches
+ * isomorphic-git's `GitHttpRequest` / `GitHttpResponse` types.
+ */
+interface GitHttpRequest {
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: AsyncIterable<Uint8Array> | Uint8Array | Buffer;
+}
+interface GitHttpResponse {
+    url: string;
+    method: string;
+    statusCode: number;
+    statusMessage: string;
+    headers: Record<string, string>;
+    body: AsyncIterableIterator<Uint8Array>;
+}
+/**
+ * Send `req`, manually following 3xx redirects up to MAX_REDIRECTS. Every
+ * hop validates the next URL is https. On a 30x→non-https Location, throws.
+ *
+ * Per RFC 7231 §6.4: 301/302/303 turn POST into GET and drop the request
+ * body; 307/308 preserve the method and body. isomorphic-git's traffic is
+ * GET (info/refs) and POST (upload-pack / receive-pack). For a POST that
+ * gets redirected with a method-changing status we drop the body — git
+ * smart servers don't typically issue method-changing redirects mid-flow,
+ * but if they did, the resulting GET would surface as a server-side error
+ * rather than silently completing.
+ */
+export declare function gitHttpRequest(req: GitHttpRequest): Promise<GitHttpResponse>;
+export declare const gitHttpsOnlyClient: {
+    request: typeof gitHttpRequest;
+};
+export {};
+//# sourceMappingURL=git-http.d.ts.map

package/dist/sources/git-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-http.d.ts","sourceRoot":"","sources":["../../src/sources/git-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,MAAM,CAAC;CACxD;AAED,UAAU,eAAe;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC;CACzC;AAgGD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAkElF;AAED,eAAO,MAAM,kBAAkB;;CAA8B,CAAC"}

package/dist/sources/git-http.js

@@ -0,0 +1,179 @@
+/**
+ * HttpClient for isomorphic-git that:
+ *
+ *  - Talks https only — refuses to issue any request whose URL is not
+ *    `https://...`.
+ *  - Follows redirects manually (max 5 hops). Every `Location` is re-validated
+ *    https before the next request — closes the https-to-http downgrade hole
+ *    that an https endpoint replying with `Location: http://...` would
+ *    otherwise open against the default `isomorphic-git/http/node` impl
+ *    (which uses `simple-get`'s built-in redirect follower and does NOT
+ *    enforce a scheme on the next hop).
+ *
+ * Implemented on top of Node's `https.request` so the SDK doesn't pull in
+ * an extra HTTP client. The body-as-async-iterator contract matches
+ * isomorphic-git's `GitHttpRequest` / `GitHttpResponse` types.
+ */
+import { request as httpsRequest } from 'node:https';
+import { Readable } from 'node:stream';
+const MAX_REDIRECTS = 5;
+async function bodyToBuffer(body) {
+    if (!body)
+        return undefined;
+    if (Buffer.isBuffer(body))
+        return body;
+    if (body instanceof Uint8Array)
+        return Buffer.from(body);
+    const chunks = [];
+    for await (const chunk of body) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks);
+}
+function flattenHeaders(raw) {
+    const out = {};
+    for (const [k, v] of Object.entries(raw)) {
+        if (v === undefined)
+            continue;
+        out[k] = Array.isArray(v) ? v.join(', ') : v;
+    }
+    return out;
+}
+function nodeStreamToAsyncIterableIterator(stream) {
+    // IncomingMessage is already AsyncIterable<Buffer>. Wrap it as an
+    // AsyncIterableIterator since that's what isomorphic-git's type
+    // demands (it has a `next()` method).
+    const iter = stream[Symbol.asyncIterator]();
+    return {
+        next: () => iter.next(),
+        return: iter.return ? (v) => iter.return(v) : undefined,
+        throw: iter.throw ? (e) => iter.throw(e) : undefined,
+        [Symbol.asyncIterator]() {
+            return this;
+        },
+    };
+}
+async function singleRequest(req) {
+    if (!req.url.startsWith('https://')) {
+        throw new Error(`GitFileSource: refusing non-https request: ${req.url}`);
+    }
+    const parsed = new URL(req.url);
+    const bodyBuf = await bodyToBuffer(req.body);
+    const method = (req.method ?? 'GET').toUpperCase();
+    const headers = { ...(req.headers ?? {}) };
+    if (bodyBuf) {
+        headers['content-length'] = bodyBuf.length;
+    }
+    return new Promise((resolve, reject) => {
+        const r = httpsRequest({
+            protocol: parsed.protocol,
+            hostname: parsed.hostname,
+            port: parsed.port || undefined,
+            path: `${parsed.pathname}${parsed.search}`,
+            method,
+            headers,
+        }, (res) => {
+            resolve({
+                statusCode: res.statusCode ?? 0,
+                statusMessage: res.statusMessage ?? '',
+                headers: flattenHeaders(res.headers),
+                bodyStream: res,
+                url: req.url,
+            });
+        });
+        r.on('error', reject);
+        if (bodyBuf)
+            r.write(bodyBuf);
+        r.end();
+    });
+}
+async function drain(stream) {
+    return new Promise((resolve) => {
+        stream.on('data', () => undefined);
+        stream.on('end', () => resolve());
+        stream.on('error', () => resolve());
+        stream.resume();
+    });
+}
+/**
+ * Send `req`, manually following 3xx redirects up to MAX_REDIRECTS. Every
+ * hop validates the next URL is https. On a 30x→non-https Location, throws.
+ *
+ * Per RFC 7231 §6.4: 301/302/303 turn POST into GET and drop the request
+ * body; 307/308 preserve the method and body. isomorphic-git's traffic is
+ * GET (info/refs) and POST (upload-pack / receive-pack). For a POST that
+ * gets redirected with a method-changing status we drop the body — git
+ * smart servers don't typically issue method-changing redirects mid-flow,
+ * but if they did, the resulting GET would surface as a server-side error
+ * rather than silently completing.
+ */
+export async function gitHttpRequest(req) {
+    let cur = req;
+    let lastBuffered;
+    for (let i = 0; i <= MAX_REDIRECTS; i++) {
+        if (cur.body && !Buffer.isBuffer(cur.body) && !(cur.body instanceof Uint8Array)) {
+            // Eagerly buffer the body so a redirect can replay it without
+            // re-consuming an already-iterated source.
+            lastBuffered = await bodyToBuffer(cur.body);
+            cur = { ...cur, body: lastBuffered };
+        }
+        const res = await singleRequest(cur);
+        const status = res.statusCode;
+        const isRedirect = status >= 300 && status < 400 && res.headers['location'];
+        if (!isRedirect) {
+            return {
+                url: res.url,
+                method: cur.method ?? 'GET',
+                statusCode: status,
+                statusMessage: res.statusMessage,
+                headers: res.headers,
+                body: nodeStreamToAsyncIterableIterator(res.bodyStream),
+            };
+        }
+        const locHeader = res.headers['location'];
+        if (!locHeader) {
+            return {
+                url: res.url,
+                method: cur.method ?? 'GET',
+                statusCode: status,
+                statusMessage: res.statusMessage,
+                headers: res.headers,
+                body: nodeStreamToAsyncIterableIterator(res.bodyStream),
+            };
+        }
+        let nextUrl;
+        try {
+            nextUrl = new URL(locHeader, cur.url).toString();
+        }
+        catch {
+            throw new Error(`GitFileSource: invalid redirect location: ${locHeader}`);
+        }
+        if (!nextUrl.startsWith('https://')) {
+            throw new Error(`GitFileSource: redirect to plaintext URL rejected: ${nextUrl}`);
+        }
+        // Drain the redirect's body so the socket can be reused.
+        await drain(res.bodyStream);
+        // RFC 7231 §6.4.2/6.4.3: 301/302/303 strip the body and change the
+        // method to GET. 307/308 preserve method + body.
+        let nextMethod = cur.method ?? 'GET';
+        let nextBody = lastBuffered;
+        if (status === 301 || status === 302 || status === 303) {
+            if (nextMethod !== 'GET' && nextMethod !== 'HEAD') {
+                nextMethod = 'GET';
+                nextBody = undefined;
+            }
+        }
+        cur = {
+            url: nextUrl,
+            method: nextMethod,
+            headers: { ...(cur.headers ?? {}) },
+            body: nextBody,
+        };
+    }
+    throw new Error(`GitFileSource: too many redirects (>${MAX_REDIRECTS}) for ${req.url}`);
+}
+export const gitHttpsOnlyClient = { request: gitHttpRequest };
+// Force Readable import to be retained (avoids unused-import elision and
+// keeps the contract explicit for future stream-conversion changes).
+void Readable;
+//# sourceMappingURL=git-http.js.map

package/dist/sources/git-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-http.js","sourceRoot":"","sources":["../../src/sources/git-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAkBvC,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,KAAK,UAAU,YAAY,CACzB,IAAiE;IAEjE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,IAAI,YAAY,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,GAAmC;IACzD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iCAAiC,CACxC,MAAuB;IAEvB,kEAAkE;IAClE,gEAAgE;IAChE,sCAAsC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAA+B,CAAC;IACzE,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACxD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,CAAC,MAAM,CAAC,aAAa,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAmB;IAO9C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8CAA8C,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,MAAM,OAAO,GAAoC,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7C,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,YAAY,CACpB;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;YAC9B,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,MAAM;YACN,OAAO;SACR,EACD,CAAC,GAAG,EAAE,EAAE;YACN,OAAO,CAAC;gBACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;gBAC/B,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE;gBACtC,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,UAAU,EAAE,GAAG;gBACf,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtB,IAAI,OAAO;YAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,EAAE,CAAC;IACV,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,MAAuB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAmB;IACtD,IAAI,GAAG,GAAmB,GAAG,CAAC;IAC9B,IAAI,YAAgC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;YAChF,8DAA8D;YAC9D,2CAA2C;YAC3C,YAAY,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;gBAC3B,UAAU,EAAE,MAAM;gBAClB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,iCAAiC,CAAC,GAAG,CAAC,UAAU,CAAC;aACxD,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;gBAC3B,UAAU,EAAE,MAAM;gBAClB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,iCAAiC,CAAC,GAAG,CAAC,UAAU,CAAC;aACxD,CAAC;QACJ,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,sDAAsD,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,yDAAyD;QACzD,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE5B,mEAAmE;QACnE,iDAAiD;QACjD,IAAI,UAAU,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QACrC,IAAI,QAAQ,GAAuB,YAAY,CAAC;QAChD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBAClD,UAAU,GAAG,KAAK,CAAC;gBACnB,QAAQ,GAAG,SAAS,CAAC;YACvB,CAAC;QACH,CAAC;QACD,GAAG,GAAG;YACJ,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;YACnC,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,aAAa,SAAS,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAE9D,yEAAyE;AACzE,qEAAqE;AACrE,KAAK,QAAQ,CAAC"}

package/dist/sources/git-snapshot.d.ts

@@ -0,0 +1,14 @@
+import type nodeFsType from 'node:fs';
+import type { Snapshot } from '../file-source.js';
+export interface GitSnapshotOptions {
+    exclude?: (relativePath: string) => boolean;
+}
+export declare class GitSnapshot implements Snapshot {
+    #private;
+    readonly ref: string;
+    constructor(dir: string, ref: string, fs: typeof nodeFsType, options?: GitSnapshotOptions);
+    walkFiles(glob: string): AsyncIterable<string>;
+    readFile(relativePath: string): Promise<Buffer>;
+    readText(relativePath: string): Promise<string>;
+}
+//# sourceMappingURL=git-snapshot.d.ts.map

package/dist/sources/git-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-snapshot.d.ts","sourceRoot":"","sources":["../../src/sources/git-snapshot.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,UAAU,MAAM,SAAS,CAAC;AAEtC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlD,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAED,qBAAa,WAAY,YAAW,QAAQ;;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAMnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,OAAO,UAAU,EACrB,OAAO,GAAE,kBAAuB;IAQ3B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;IAsB/C,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAW/C,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAuBtD"}

package/dist/sources/git-snapshot.js

@@ -0,0 +1,96 @@
+/**
+ * GitSnapshot — Snapshot backed by an immutable git commit OID.
+ *
+ * Unlike `DirectorySnapshot`, this snapshot reads file contents via
+ * `git.readBlob({oid, filepath})` against the captured commit, NOT from
+ * the on-disk working tree. That gives us true immutability: a later
+ * `fetch()` may move HEAD or rewrite the working tree, but blob OIDs for
+ * the captured commit stay reachable in the shallow clone's object DB.
+ *
+ * Caveats:
+ *  - `walkFiles` walks the captured commit's tree (`git.walk` with a single
+ *    `TREE({ref})`). Result: files-as-they-existed-at-the-commit, not
+ *    files-as-they-are-on-disk-right-now.
+ *  - `readFile` / `readText` extract blob bytes from the object DB.
+ *  - Path-security primitives mirror `DirectorySnapshot` lexically (absolute
+ *    paths rejected, `..` escapes rejected, exclude predicate enforced).
+ *  - No realpath/symlink defense — git's object model has no symlinks-as-
+ *    filesystem-pointers. A blob with mode 120000 IS the link contents, not
+ *    a follow-able pointer.
+ */
+import * as git from 'isomorphic-git';
+import { isAbsolute, join, normalize, relative, sep } from 'node:path';
+import { matchesGlob } from './glob.js';
+export class GitSnapshot {
+    ref;
+    #dir;
+    #fs;
+    #exclude;
+    constructor(dir, ref, fs, options = {}) {
+        this.#dir = dir;
+        this.ref = ref;
+        this.#fs = fs;
+        this.#exclude = options.exclude ?? (() => false);
+    }
+    async *walkFiles(glob) {
+        const collected = [];
+        await git.walk({
+            fs: this.#fs,
+            dir: this.#dir,
+            trees: [git.TREE({ ref: this.ref })],
+            map: async (filepath, entries) => {
+                if (filepath === '.')
+                    return undefined;
+                if (!entries)
+                    return undefined;
+                const [entry] = entries;
+                if (!entry)
+                    return undefined;
+                const type = await entry.type();
+                if (type !== 'blob')
+                    return undefined;
+                const posix = filepath.split(sep).join('/');
+                if (this.#exclude(posix))
+                    return undefined;
+                if (matchesGlob(posix, glob))
+                    collected.push(posix);
+                return undefined;
+            },
+        });
+        for (const p of collected)
+            yield p;
+    }
+    async readFile(relativePath) {
+        const posix = this.#validateRel(relativePath);
+        const { blob } = await git.readBlob({
+            fs: this.#fs,
+            dir: this.#dir,
+            oid: this.ref,
+            filepath: posix,
+        });
+        return Buffer.from(blob);
+    }
+    async readText(relativePath) {
+        const buf = await this.readFile(relativePath);
+        return buf.toString('utf8');
+    }
+    #validateRel(relativePath) {
+        if (isAbsolute(relativePath)) {
+            throw new Error(`Snapshot.readFile: absolute paths are not allowed (${relativePath})`);
+        }
+        // Use a virtual root so `normalize`/`relative` behave consistently across
+        // platforms without touching the real fs.
+        const virtualRoot = '/__snap__';
+        const joined = normalize(join(virtualRoot, relativePath));
+        const rel = relative(virtualRoot, joined);
+        if (rel.startsWith('..') || isAbsolute(rel) || rel.split(sep).includes('..')) {
+            throw new Error(`Snapshot.readFile: path escapes snapshot root (${relativePath})`);
+        }
+        const posix = sep === '/' ? rel : rel.split(sep).join('/');
+        if (this.#exclude(posix)) {
+            throw new Error(`Snapshot.readFile: path is excluded from the snapshot (${relativePath})`);
+        }
+        return posix;
+    }
+}
+//# sourceMappingURL=git-snapshot.js.map

package/dist/sources/git-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-snapshot.js","sourceRoot":"","sources":["../../src/sources/git-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAMxC,MAAM,OAAO,WAAW;IACb,GAAG,CAAS;IACZ,IAAI,CAAS;IACb,GAAG,CAAoB;IACvB,QAAQ,CAAoC;IAErD,YACE,GAAW,EACX,GAAW,EACX,EAAqB,EACrB,UAA8B,EAAE;QAEhC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,CAAC,SAAS,CAAC,IAAY;QAC3B,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,GAAG,CAAC,IAAI,CAAC;YACb,EAAE,EAAE,IAAI,CAAC,GAAG;YACZ,GAAG,EAAE,IAAI,CAAC,IAAI;YACd,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACpC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;gBAC/B,IAAI,QAAQ,KAAK,GAAG;oBAAE,OAAO,SAAS,CAAC;gBACvC,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;gBACxB,IAAI,CAAC,KAAK;oBAAE,OAAO,SAAS,CAAC;gBAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChC,IAAI,IAAI,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAC;gBACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAC;gBAC3C,IAAI,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC;oBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpD,OAAO,SAAS,CAAC;YACnB,CAAC;SACF,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC;YAClC,EAAE,EAAE,IAAI,CAAC,GAAG;YACZ,GAAG,EAAE,IAAI,CAAC,IAAI;YACd,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC9C,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,YAAY,CAAC,YAAoB;QAC/B,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sDAAsD,YAAY,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAM,WAAW,GAAG,WAAW,CAAC;QAChC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,YAAY,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0DAA0D,YAAY,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/sources/glob.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Minimal glob matcher + recursive directory walk.
+ *
+ * Supports the subset of glob syntax connectors actually need:
+ *   - `*`   matches any run of characters except `/`
+ *   - `**`  matches any run of characters including `/`
+ *   - `?`   matches exactly one character except `/`
+ *   - Literal `.` `/` `_` `-` segments
+ *
+ * No brace-expansion, no `!` negation, no `[ ]` character classes. If a
+ * connector needs more, it can iterate `walkFiles("**\/*")` and filter in
+ * its own code — keeping the SDK surface small.
+ */
+/**
+ * Recursive walk yielding POSIX-style relative paths (forward-slash).
+ * Skips dot-directories of the cache itself (`.lobu-cache`) but otherwise
+ * includes hidden files — git's `.git/` is excluded by callers that need
+ * to (git source uses a separate snapshot dir without `.git`).
+ */
+export declare function walkDirectoryRelative(root: string): AsyncIterable<string>;
+/**
+ * Compile a glob to a RegExp. Anchored on both ends.
+ *
+ * Implementation note: we walk the glob char-by-char rather than splitting on
+ * `*` so we can distinguish `*` from `**` without ambiguity, and so literal
+ * regex metacharacters get escaped exactly once.
+ */
+export declare function globToRegExp(glob: string): RegExp;
+/** Test a POSIX-style relative path against `glob`. */
+export declare function matchesGlob(relativePath: string, glob: string): boolean;
+//# sourceMappingURL=glob.d.ts.map

package/dist/sources/glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../../src/sources/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH;;;;;GAKG;AACH,wBAAuB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAwBhF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkDjD;AAYD,uDAAuD;AACvD,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKvE"}