@scolladon/tsgit 0.9.0

package/dist/types/chunks/context-Ku1aP8Ie.d.cts

@@ -0,0 +1,354 @@
+import { H as HttpTransport } from './http-transport--_NdQOiw.cjs';
+
+interface InflateStreamResult {
+    /** The fully-inflated output bytes. */
+    readonly output: Uint8Array;
+    /** The number of input bytes consumed, counted from `offset`. */
+    readonly bytesConsumed: number;
+}
+interface Compressor {
+    /** Deflate (compress) data using zlib deflate format (RFC 1950). */
+    readonly deflate: (data: Uint8Array) => Promise<Uint8Array>;
+    /** Inflate (decompress) zlib-compressed data. */
+    readonly inflate: (data: Uint8Array) => Promise<Uint8Array>;
+    /**
+     * Inflate one zlib stream starting at `offset` in `bytes`, stopping at the
+     * zlib terminator. Used by the pack-file resolver, where each entry is a
+     * separate zlib stream concatenated with other entries; the resolver does
+     * not know the compressed length of a single entry a priori.
+     *
+     * Returns the inflated output and the number of input bytes consumed
+     * (measured from `offset`). Throws DECOMPRESS_FAILED when the input at
+     * `offset` is not a valid zlib stream.
+     */
+    readonly streamInflate: (bytes: Uint8Array, offset: number) => Promise<InflateStreamResult>;
+    /**
+     * Create a streaming inflate transform.
+     * Returns a TransformStream that inflates chunks incrementally.
+     * Used for large packfile entries to avoid buffering entire objects.
+     */
+    readonly createInflateStream: () => TransformStream<Uint8Array, Uint8Array>;
+}
+
+/** Metadata returned by stat operations. */
+interface FileStat {
+    readonly ctimeMs: number;
+    readonly mtimeMs: number;
+    readonly dev: number;
+    readonly ino: number;
+    readonly mode: number;
+    readonly uid: number;
+    readonly gid: number;
+    readonly size: number;
+    readonly isFile: boolean;
+    readonly isDirectory: boolean;
+    readonly isSymbolicLink: boolean;
+    /** Nanosecond-precision ctime. Populated by Node adapter (fs.stat({ bigint: true })). Undefined on platforms without ns support. */
+    readonly ctimeNs?: bigint;
+    /** Nanosecond-precision mtime. Populated by Node adapter. Undefined on platforms without ns support. */
+    readonly mtimeNs?: bigint;
+}
+/** A single entry from a directory listing. */
+interface DirEntry {
+    readonly name: string;
+    readonly isFile: boolean;
+    readonly isDirectory: boolean;
+    readonly isSymbolicLink: boolean;
+}
+/**
+ * Minimal subset of Node's `fs/promises` FileHandle. Returned by `openWithNoFollow`.
+ *
+ * Lifetime: callers MUST `close()` the handle in a `finally` block. Holding handles open
+ * across async boundaries can leak file descriptors on Node — keep usage tight.
+ */
+interface FileHandle {
+    /** Read up to `length` bytes into `buffer` at `offset` (in the buffer). */
+    readonly read: (buffer: Uint8Array, offset: number, length: number, position?: number) => Promise<number>;
+    /** Write the buffer to the file. */
+    readonly write: (buffer: Uint8Array) => Promise<void>;
+    /** Stat the open file (cheap — uses fstat on Node). */
+    readonly stat: () => Promise<FileStat>;
+    /** Release the underlying file descriptor. Idempotent — safe to call twice. */
+    readonly close: () => Promise<void>;
+}
+interface FileSystem {
+    /** Read entire file as bytes. Throws FILE_NOT_FOUND if not found. */
+    readonly read: (path: string) => Promise<Uint8Array>;
+    /** Read a byte slice from a file at the given offset. Throws FILE_NOT_FOUND if not found. */
+    readonly readSlice: (path: string, offset: number, length: number) => Promise<Uint8Array>;
+    /** Read entire file as UTF-8 string. Throws FILE_NOT_FOUND if not found. */
+    readonly readUtf8: (path: string) => Promise<string>;
+    /** Write bytes to file, creating parent directories as needed. Overwrites if exists. */
+    readonly write: (path: string, data: Uint8Array) => Promise<void>;
+    /**
+     * Write bytes to file. Fails with FILE_EXISTS if the file already exists (exclusive create).
+     *
+     * Contract obligations (Phase 7 §14.17):
+     * - **Parent-directory creation:** the adapter MUST ensure parent directories exist before the
+     *   exclusive write. Equivalent to `mkdir -p dirname(path)` before `open(path, O_EXCL)`. If the
+     *   parent is removed between the implicit mkdir and the open (e.g. concurrent `git gc` prunes
+     *   the fanout), the adapter retries once: re-create the parent, re-attempt the open. On a second
+     *   ENOENT the error propagates as FILE_NOT_FOUND.
+     * - **Symlink-safe ancestor check:** the adapter MUST reject writes where any ancestor directory
+     *   of `path` is a symbolic link whose resolved target is outside the containment root. This
+     *   closes the attack where an attacker replaces `objects/xx/` with a symlink pointing elsewhere.
+     *   Implementation: lstat-walk the ancestor chain, or use `openat`-style relative opens.
+     */
+    readonly writeExclusive: (path: string, data: Uint8Array) => Promise<void>;
+    /** Write UTF-8 string to file, creating parent directories as needed. */
+    readonly writeUtf8: (path: string, content: string) => Promise<void>;
+    /** Check if path exists. */
+    readonly exists: (path: string) => Promise<boolean>;
+    /** Get file/directory metadata. Throws FILE_NOT_FOUND if not found. Follows symlinks. */
+    readonly stat: (path: string) => Promise<FileStat>;
+    /** Get file/directory metadata. Throws FILE_NOT_FOUND if not found. Does NOT follow symlinks. */
+    readonly lstat: (path: string) => Promise<FileStat>;
+    /** List directory entries. Throws NOT_A_DIRECTORY if not a directory. */
+    readonly readdir: (path: string) => Promise<ReadonlyArray<DirEntry>>;
+    /** Create directory and all parents. No-op if already exists. */
+    readonly mkdir: (path: string) => Promise<void>;
+    /** Remove file or empty directory. Throws FILE_NOT_FOUND if not found. */
+    readonly rm: (path: string) => Promise<void>;
+    /**
+     * Rename `src` to `dst`. Atomic where the platform supports it (Node: yes on POSIX;
+     * Browser OPFS: no — emulated as read + write + rm, caller must tolerate partial
+     * failure between steps). Both paths must be on the same logical root.
+     */
+    readonly rename: (src: string, dst: string) => Promise<void>;
+    /** Read the target of a symbolic link. Throws FILE_NOT_FOUND if not a symlink. */
+    readonly readlink: (path: string) => Promise<string>;
+    /** Create a symbolic link. Creates parent directories as needed. */
+    readonly symlink: (target: string, path: string) => Promise<void>;
+    /** Set file permissions. No-op on platforms without permission support (OPFS). */
+    readonly chmod: (path: string, mode: number) => Promise<void>;
+    /**
+     * Recursively remove a file or directory tree.
+     *
+     * Idempotent: a missing path returns void (no error).
+     *
+     * Symlink-safe: does NOT follow symlinks during traversal. When a directory entry is a
+     * symlink, the symlink itself is removed (the link, not its target), and the walk does
+     * not descend into it. This prevents an attacker who plants a symlink under a doomed
+     * directory from having `rmRecursive` reach outside the containment root.
+     */
+    readonly rmRecursive: (path: string) => Promise<void>;
+    /**
+     * Open a file with the platform equivalent of `O_NOFOLLOW` — refuses to open the path
+     * if its leaf is a symbolic link. Used by callers that must read/write a regular file
+     * without crossing a symlink hop (e.g., lockfile creation under the git dir).
+     *
+     * - Node: `fs.open(path, O_NOFOLLOW | (mode === 'write' ? O_WRONLY : O_RDONLY))`.
+     * - Memory: rejects with `PERMISSION_DENIED` when the leaf is a memory symlink entry.
+     * - Browser OPFS: throws `UNSUPPORTED_OPERATION` (OPFS has no symlinks; callers can
+     *   fall back to a plain `read`/`write` because the no-follow guarantee holds vacuously).
+     *
+     * Throws `FILE_NOT_FOUND` if the leaf does not exist (in `read` mode).
+     * Throws `PERMISSION_DENIED` if the leaf is a symlink.
+     */
+    readonly openWithNoFollow: (path: string, mode: 'read' | 'write') => Promise<FileHandle>;
+}
+
+/** Incremental hash computation context. Single-use: consumed after digest. */
+interface Hasher {
+    /** Feed data into the hash. Can be called multiple times before digest. Throws HASH_FAILED if called after digest/digestHex. */
+    readonly update: (data: Uint8Array) => void;
+    /** Finalize and return the raw digest bytes. Consumes the hasher — no further update/digest calls allowed. */
+    readonly digest: () => Promise<Uint8Array>;
+    /** Finalize and return the hex-encoded digest. Consumes the hasher — no further update/digest calls allowed. */
+    readonly digestHex: () => Promise<string>;
+}
+interface HashService {
+    /** Compute the digest of data in one shot. Returns raw bytes (20 for SHA-1, 32 for SHA-256). */
+    readonly hash: (data: Uint8Array) => Promise<Uint8Array>;
+    /** Compute the hex-encoded digest of data in one shot. */
+    readonly hashHex: (data: Uint8Array) => Promise<string>;
+    /** Create an incremental hasher for streaming hash computation. */
+    readonly createHasher: () => Hasher;
+    /** The hash algorithm name. */
+    readonly algorithm: 'sha1' | 'sha256';
+    /** Digest length in bytes (20 for SHA-1, 32 for SHA-256). */
+    readonly digestLength: 20 | 32;
+}
+
+type ObjectId = string & {
+    readonly __brand: unique symbol;
+};
+declare const ObjectId: {
+    readonly from: (hex: string) => ObjectId;
+    readonly fromRaw: (bytes: Uint8Array) => ObjectId;
+};
+type RefName = string & {
+    readonly __brand: unique symbol;
+};
+declare const RefName: {
+    readonly from: (name: string) => RefName;
+};
+type FilePath = string & {
+    readonly __brand: unique symbol;
+};
+declare const FilePath: {
+    readonly from: (path: string) => FilePath;
+};
+
+interface HashConfig {
+    readonly digestLength: 20 | 32;
+    readonly hexLength: 40 | 64;
+}
+
+interface LruCache<V> {
+    get(key: string): V | undefined;
+    set(key: string, value: V, byteSize: number): void;
+    has(key: string): boolean;
+    delete(key: string): boolean;
+    clear(): void;
+    readonly currentSize: number;
+    readonly maxSize: number;
+    readonly entryCount: number;
+}
+
+/**
+ * General-purpose level-based logger consumed by the facade and any cross-cutting
+ * concern (dispose, validation, lifecycle). Independent from the transport-tier
+ * `Logger` in `transport/types.ts`, which is event-based and HTTP-shaped.
+ *
+ * The facade wraps user-supplied loggers with sanitization at construction time
+ * (see Phase 10 design §8.5). Implementations should be tolerant of high call
+ * frequency and MUST NOT throw — a throwing logger crashes nothing.
+ */
+interface Logger {
+    readonly debug?: (message: string, context?: Readonly<Record<string, unknown>>) => void;
+    readonly info?: (message: string, context?: Readonly<Record<string, unknown>>) => void;
+    readonly warn?: (message: string, context?: Readonly<Record<string, unknown>>) => void;
+    readonly error?: (message: string, context?: Readonly<Record<string, unknown>>) => void;
+}
+/** No-op Logger — every level method is absent (callers use optional chaining). */
+declare const noopLogger: Logger;
+/**
+ * Wrap a user-supplied logger so every `message` + every string value in the
+ * `context` object passes through `sanitize()` (Phase 9 §4.7) before reaching
+ * the sink. Per design §8.5 the facade applies this at construction time so no
+ * downstream caller ever feeds raw control bytes to a user-controlled sink.
+ *
+ * Methods that the user did not supply are absent on the wrapper (preserves
+ * the optional-method contract). Throws from the underlying sink are caught
+ * and dropped — a faulty logger must not crash the operation.
+ */
+declare const wrapLoggerSanitizer: (logger: Logger) => Logger;
+
+/**
+ * Progress reporter shape consumed by long-running commands. The facade
+ * (Phase 10) accepts a user-supplied implementation via
+ * `OpenRepositoryOptions.progress` and plumbs it onto `Context.progress`.
+ *
+ * Reporters are synchronous and fire-and-forget. The facade wraps every call
+ * site in try/catch; a throwing reporter never crashes the operation.
+ */
+interface ProgressReporter {
+    /**
+     * Called once before the first work unit of a sub-task. `op` is a stable
+     * internal identifier (e.g., 'clone:write-objects'). `total`, when known,
+     * lets consumers render a percentage; absent for indeterminate work.
+     */
+    readonly start: (op: string, total?: number) => void;
+    /**
+     * Called periodically during the sub-task. `current` is the count of items
+     * processed so far; `total` may be undefined when not known. `text`, when
+     * provided, is sideband-style auxiliary text (sanitized by built-in reporters).
+     */
+    readonly update: (op: string, current: number, total?: number, text?: string) => void;
+    /** Called when the sub-task completes (success OR failure). */
+    readonly end: (op: string) => void;
+}
+
+/**
+ * Repository physical layout — where the working tree and .git directory live.
+ * Renamed in Phase 10 from the previous `RepositoryConfig` (port-tier) to free that
+ * name for the facade-tier `RepositoryConfig` shape (auth/parallelism/etc.).
+ */
+interface RepositoryLayout {
+    /** Absolute path to the repository root (working tree). */
+    readonly workDir: string;
+    /** Absolute path to the .git directory (usually `${workDir}/.git`, but may differ for bare repos or worktrees). */
+    readonly gitDir: string;
+    /** Whether this is a bare repository. */
+    readonly bare: boolean;
+}
+/**
+ * Author / committer identity — Phase 9 §4.7 shape.
+ */
+interface AuthorIdentity {
+    readonly name: string;
+    readonly email: string;
+}
+/**
+ * Authentication strategy for transport — narrowed shape consumed by withAuth.
+ */
+type AuthStrategy = {
+    readonly type: 'bearer';
+    readonly token: string;
+} | {
+    readonly type: 'basic';
+    readonly username: string;
+    readonly password: string;
+};
+/**
+ * Facade-tier configuration. Phase 10 introduces this shape; it carries the
+ * auth/parallelism/SSRF/network options the facade plumbs into network-pipeline.
+ * All fields are optional — primitives and commands consult only the keys they need.
+ */
+interface RepositoryConfig {
+    readonly user?: AuthorIdentity;
+    readonly auth?: AuthStrategy;
+    /** Bounded parallelism for fan-out work. 1..32, default 8 (enforced by facade validation). */
+    readonly parallelism?: number;
+    readonly upstreamRef?: RefName;
+    readonly allowInsecure?: boolean;
+    readonly allowPrivateNetworks?: boolean;
+    readonly maxResponseBytes?: number;
+    readonly maxObjectsPerPack?: number;
+    readonly detectRenames?: boolean;
+    readonly breakStaleLockMs?: number;
+    readonly dnsResolver?: (host: string) => Promise<ReadonlyArray<string>>;
+    /** Hard cap on `dnsResolver` return-array length to bound resolver-amplification DoS. Default 64. */
+    readonly maxDnsResults?: number;
+}
+interface Context {
+    readonly fs: FileSystem;
+    readonly hash: HashService;
+    readonly compressor: Compressor;
+    readonly transport: HttpTransport;
+    readonly progress: ProgressReporter;
+    /** Repository physical layout. Required — every primitive needs gitDir/workDir. */
+    readonly layout: RepositoryLayout;
+    /** User-supplied working directory (may be a sub-path of layout.workDir). Defaults to layout.workDir when not set by the facade. */
+    readonly cwd: string;
+    /** Object serialization parameters (sha1 vs sha256 digest+hex sizes). */
+    readonly hashConfig: HashConfig;
+    /** Shared delta-base LRU cache; consumed by primitives' iterative delta walker. */
+    readonly deltaCache: LruCache<Uint8Array>;
+    /** Optional facade-tier configuration (auth, parallelism, SSRF, …). Populated by openRepository. */
+    readonly config?: RepositoryConfig;
+    /** Optional sanitized logger. Populated by openRepository. */
+    readonly logger?: Logger;
+    /** Optional abort signal for cancelling long-running operations. */
+    readonly signal?: AbortSignal;
+}
+interface CreateContextParts {
+    readonly fs: FileSystem;
+    readonly hash: HashService;
+    readonly compressor: Compressor;
+    readonly transport: HttpTransport;
+    readonly progress: ProgressReporter;
+    readonly layout: RepositoryLayout;
+    readonly cwd?: string;
+    readonly hashConfig: HashConfig;
+    readonly deltaCache: LruCache<Uint8Array>;
+    readonly config?: RepositoryConfig;
+    readonly logger?: Logger;
+    readonly signal?: AbortSignal;
+}
+/** Assemble a frozen Context from its constituent ports + layout. */
+declare function createContext(parts: CreateContextParts): Context;
+
+export { ObjectId as O, FilePath as b, createContext as i, RefName as j, noopLogger as n, wrapLoggerSanitizer as w };
+export type { AuthStrategy as A, Compressor as C, DirEntry as D, FileSystem as F, HashService as H, InflateStreamResult as I, Logger as L, ProgressReporter as P, RepositoryConfig as R, Context as a, FileStat as c, FileHandle as d, Hasher as e, AuthorIdentity as f, CreateContextParts as g, RepositoryLayout as h };

package/dist/types/chunks/diff-change-BwO75AgS.d.cts

@@ -0,0 +1,59 @@
+import { b as FilePath, O as ObjectId } from './context-Ku1aP8Ie.cjs';
+
+interface AuthorIdentity {
+    readonly name: string;
+    readonly email: string;
+    readonly timestamp: number;
+    readonly timezoneOffset: string;
+}
+
+declare const FILE_MODE: {
+    readonly REGULAR: "100644";
+    readonly EXECUTABLE: "100755";
+    readonly SYMLINK: "120000";
+    readonly DIRECTORY: "40000";
+    readonly GITLINK: "160000";
+};
+type FileMode = (typeof FILE_MODE)[keyof typeof FILE_MODE];
+
+interface AddChange {
+    readonly type: 'add';
+    readonly newPath: FilePath;
+    readonly newId: ObjectId;
+    readonly newMode: FileMode;
+}
+interface DeleteChange {
+    readonly type: 'delete';
+    readonly oldPath: FilePath;
+    readonly oldId: ObjectId;
+    readonly oldMode: FileMode;
+}
+interface ModifyChange {
+    readonly type: 'modify';
+    readonly path: FilePath;
+    readonly oldId: ObjectId;
+    readonly newId: ObjectId;
+    readonly oldMode: FileMode;
+    readonly newMode: FileMode;
+}
+interface RenameChange {
+    readonly type: 'rename';
+    readonly oldPath: FilePath;
+    readonly newPath: FilePath;
+    readonly id: ObjectId;
+    readonly mode: FileMode;
+}
+interface TypeChangeChange {
+    readonly type: 'type-change';
+    readonly path: FilePath;
+    readonly oldId: ObjectId;
+    readonly newId: ObjectId;
+    readonly oldMode: FileMode;
+    readonly newMode: FileMode;
+}
+type DiffChange = AddChange | DeleteChange | ModifyChange | RenameChange | TypeChangeChange;
+interface TreeDiff {
+    readonly changes: ReadonlyArray<DiffChange>;
+}
+
+export type { AuthorIdentity as A, FileMode as F, TreeDiff as T };

package/dist/types/chunks/diff-change-CUWN3OSK.d.ts

@@ -0,0 +1,59 @@
+import { b as FilePath, O as ObjectId } from './context-C6df52Qs.js';
+
+interface AuthorIdentity {
+    readonly name: string;
+    readonly email: string;
+    readonly timestamp: number;
+    readonly timezoneOffset: string;
+}
+
+declare const FILE_MODE: {
+    readonly REGULAR: "100644";
+    readonly EXECUTABLE: "100755";
+    readonly SYMLINK: "120000";
+    readonly DIRECTORY: "40000";
+    readonly GITLINK: "160000";
+};
+type FileMode = (typeof FILE_MODE)[keyof typeof FILE_MODE];
+
+interface AddChange {
+    readonly type: 'add';
+    readonly newPath: FilePath;
+    readonly newId: ObjectId;
+    readonly newMode: FileMode;
+}
+interface DeleteChange {
+    readonly type: 'delete';
+    readonly oldPath: FilePath;
+    readonly oldId: ObjectId;
+    readonly oldMode: FileMode;
+}
+interface ModifyChange {
+    readonly type: 'modify';
+    readonly path: FilePath;
+    readonly oldId: ObjectId;
+    readonly newId: ObjectId;
+    readonly oldMode: FileMode;
+    readonly newMode: FileMode;
+}
+interface RenameChange {
+    readonly type: 'rename';
+    readonly oldPath: FilePath;
+    readonly newPath: FilePath;
+    readonly id: ObjectId;
+    readonly mode: FileMode;
+}
+interface TypeChangeChange {
+    readonly type: 'type-change';
+    readonly path: FilePath;
+    readonly oldId: ObjectId;
+    readonly newId: ObjectId;
+    readonly oldMode: FileMode;
+    readonly newMode: FileMode;
+}
+type DiffChange = AddChange | DeleteChange | ModifyChange | RenameChange | TypeChangeChange;
+interface TreeDiff {
+    readonly changes: ReadonlyArray<DiffChange>;
+}
+
+export type { AuthorIdentity as A, FileMode as F, TreeDiff as T };

package/dist/types/chunks/http-transport--_NdQOiw.d.cts

@@ -0,0 +1,20 @@
+interface HttpRequest {
+    readonly url: string;
+    readonly method: 'GET' | 'POST';
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body?: Uint8Array;
+    /** Optional abort signal for request cancellation. */
+    readonly signal?: AbortSignal;
+}
+interface HttpResponse {
+    readonly statusCode: number;
+    /** Response headers. All keys MUST be lowercased by the adapter. */
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body: ReadableStream<Uint8Array>;
+}
+interface HttpTransport {
+    /** Send an HTTP request and return the response. */
+    readonly request: (req: HttpRequest) => Promise<HttpResponse>;
+}
+
+export type { HttpTransport as H, HttpRequest as a, HttpResponse as b };

package/dist/types/chunks/http-transport--_NdQOiw.d.ts

@@ -0,0 +1,20 @@
+interface HttpRequest {
+    readonly url: string;
+    readonly method: 'GET' | 'POST';
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body?: Uint8Array;
+    /** Optional abort signal for request cancellation. */
+    readonly signal?: AbortSignal;
+}
+interface HttpResponse {
+    readonly statusCode: number;
+    /** Response headers. All keys MUST be lowercased by the adapter. */
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body: ReadableStream<Uint8Array>;
+}
+interface HttpTransport {
+    /** Send an HTTP request and return the response. */
+    readonly request: (req: HttpRequest) => Promise<HttpResponse>;
+}
+
+export type { HttpTransport as H, HttpRequest as a, HttpResponse as b };

package/dist/types/chunks/repository-BBKJnr8a.d.ts

@@ -0,0 +1,89 @@
+import { add, branch, checkout, clone, commit, diff, fetch, init, log, merge, push, reset, revParse, rm, status, tag } from '../commands/index.js';
+import { createCommit, diffTrees, getRepoRoot, mergeBase, readBlob, readIndex, readObject, readTree, resolveRef, updateRef, walkCommits, walkTree, writeObject, writeSymbolicRef, writeTree } from '../primitives/index.js';
+import { F as FileSystem, H as HashService, C as Compressor, R as RepositoryConfig, L as Logger, P as ProgressReporter, a as Context } from './context-C6df52Qs.js';
+import { H as HttpTransport } from './http-transport--_NdQOiw.js';
+
+/**
+ * Helper that strips the leading `Context` parameter from a function type so
+ * the bound version on `Repository` exposes the user-facing signature.
+ */
+type BindCtx<F> = F extends (ctx: Context, ...rest: infer A) => infer R ? (...args: A) => R : never;
+/**
+ * User-facing options passed to `openRepository`. Subset of the design's
+ * `OpenRepositoryOptions` that this Step 3 implementation honors. Every field
+ * is optional; the facade fills sensible defaults. Field-level validation runs
+ * eagerly before the Repository is returned (Phase 10 §8.1).
+ */
+interface OpenRepositoryOptions {
+    /** Working directory. Default: `process.cwd()` on Node, `'/'` on browser/memory. */
+    readonly cwd?: string;
+    /** Adapter overrides. Each is optional; missing slots fall back to runtime detection. */
+    readonly fs?: FileSystem;
+    readonly hash?: HashService;
+    readonly compressor?: Compressor;
+    readonly transport?: HttpTransport;
+    /** Repository config (auth, parallelism, SSRF allowlist, etc.). Frozen via deepFreeze. */
+    readonly config?: RepositoryConfig;
+    /** Logger for diagnostics. Wrapped to prevent mutation post-construction. */
+    readonly logger?: Logger;
+    /** Progress reporter; defaults to `noopProgress`. */
+    readonly progress?: ProgressReporter;
+    /** AbortSignal threaded into every bound method's ctx.signal. */
+    readonly signal?: AbortSignal;
+    /**
+     * Opt OUT of adapter validator wrapping for `fs` and `transport`. NEVER set
+     * with adapters whose code you do not control; a raw transport receives
+     * `config.auth` credentials with no SSRF guard.
+     */
+    readonly unsafeRawAdapters?: boolean;
+}
+/**
+ * The frozen repository handle returned by `openRepository`. Every command
+ * and primitive is bound to a Context constructed at facade-creation time;
+ * users never see Context except through `repo.ctx`.
+ */
+interface Repository {
+    readonly add: BindCtx<typeof add>;
+    readonly branch: BindCtx<typeof branch>;
+    readonly checkout: BindCtx<typeof checkout>;
+    readonly clone: BindCtx<typeof clone>;
+    readonly commit: BindCtx<typeof commit>;
+    readonly diff: BindCtx<typeof diff>;
+    readonly fetch: BindCtx<typeof fetch>;
+    readonly init: BindCtx<typeof init>;
+    readonly log: BindCtx<typeof log>;
+    readonly merge: BindCtx<typeof merge>;
+    readonly push: BindCtx<typeof push>;
+    readonly reset: BindCtx<typeof reset>;
+    readonly revParse: BindCtx<typeof revParse>;
+    readonly rm: BindCtx<typeof rm>;
+    readonly status: BindCtx<typeof status>;
+    readonly tag: BindCtx<typeof tag>;
+    readonly primitives: {
+        readonly createCommit: BindCtx<typeof createCommit>;
+        readonly diffTrees: BindCtx<typeof diffTrees>;
+        readonly getRepoRoot: BindCtx<typeof getRepoRoot>;
+        readonly mergeBase: BindCtx<typeof mergeBase>;
+        readonly readBlob: BindCtx<typeof readBlob>;
+        readonly readIndex: BindCtx<typeof readIndex>;
+        readonly readObject: BindCtx<typeof readObject>;
+        readonly readTree: BindCtx<typeof readTree>;
+        readonly resolveRef: BindCtx<typeof resolveRef>;
+        readonly updateRef: BindCtx<typeof updateRef>;
+        readonly walkCommits: BindCtx<typeof walkCommits>;
+        readonly walkTree: BindCtx<typeof walkTree>;
+        readonly writeObject: BindCtx<typeof writeObject>;
+        readonly writeSymbolicRef: BindCtx<typeof writeSymbolicRef>;
+        readonly writeTree: BindCtx<typeof writeTree>;
+    };
+    /** The frozen Context backing every binding. Exposed for advanced use. */
+    readonly ctx: Context;
+    /**
+     * Dispose the repository. Aborts `ctx.signal` synchronously, yields a
+     * macrotask, then runs `disposeAdapters`. Idempotent. After dispose
+     * resolves, every bound method throws `REPOSITORY_DISPOSED`.
+     */
+    readonly dispose: () => Promise<void>;
+}
+
+export type { OpenRepositoryOptions as O, Repository as R };