@scolladon/tsgit 2.0.1 → 3.1.0

package/dist/types/adapters/node/index.d.ts

@@ -1,5 +1,5 @@
-import { b as Context, C as Compressor, I as InflateStreamResult, F as FileSystem, d as FileStat, D as DirEntry, e as FileHandle, H as HashService, f as Hasher, a as HookRunner, i as HookRequest, h as HookResult } from '../../chunks/context-CCL0_F8R.js';
-import { H as HttpTransport, a as HttpRequest, b as HttpResponse } from '../../chunks/http-transport--_NdQOiw.js';
+import { c as Context, C as CommandRunner, z as CommandRequest, B as CommandResult, a as Compressor, I as InflateStreamResult, g as FileSystem, f as FileStat, D as DirEntry, y as FileHandle, h as HashService, i as Hasher, m as HookRunner, k as HookRequest, l as HookResult } from '../../chunks/context-sIhhtk2u.js';
+import { b as HttpTransport, H as HttpRequest, a as HttpResponse } from '../../chunks/http-transport-DirKfK2S.js';
 
 interface NodeAdapterOptions {
     readonly workDir: string;
@@ -15,9 +15,62 @@ interface NodeAdapterOptions {
      * `process.env` — disable it for repositories you do not trust.
      */
     readonly hooks?: boolean;
+    /**
+     * Wire the merge-driver command runner (default true). Pass `false` to
+     * disable external merge drivers. A wired runner executes the configured
+     * `[merge "<driver>"].driver` shell command with the full `process.env`.
+     */
+    readonly command?: boolean;
+    /**
+     * Wire the ssh transport (default true). Pass `false` to refuse ssh/scp
+     * remotes. A wired transport spawns the resolved ssh command
+     * (`GIT_SSH_COMMAND`/`GIT_SSH`/`core.sshCommand`, else `ssh`) inheriting
+     * the full `process.env`.
+     */
+    readonly ssh?: boolean;
 }
 declare function createNodeContext(options: NodeAdapterOptions): Context;
 
+/** Minimal child-process surface `NodeCommandRunner` consumes. */
+interface CommandChild {
+    on(event: 'error', listener: (err: Error) => void): void;
+    on(event: 'close', listener: (code: number | null) => void): void;
+    kill(): void;
+    readonly stdin: {
+        write(chunk: Uint8Array): void;
+        end(): void;
+    };
+    readonly stdout: {
+        on(event: 'data', listener: (chunk: Uint8Array) => void): void;
+    };
+}
+/**
+ * Injectable process surface. Production uses `node:child_process` spawn; unit
+ * tests inject a fake so every branch runs deterministically without a real
+ * process (mirrors `HookRunnerOps`).
+ */
+interface CommandRunnerOps {
+    readonly spawn: (command: string, args: ReadonlyArray<string>, options: {
+        readonly cwd: string;
+        readonly env: NodeJS.ProcessEnv;
+        readonly stdio: ['pipe', 'pipe', 'inherit'];
+    }) => CommandChild;
+}
+declare const realCommandRunnerOps: CommandRunnerOps;
+/**
+ * Node `CommandRunner`: runs a command line through the platform shell
+ * (`sh -c` on POSIX, `cmd /c` on Windows) with `cwd` and an environment that
+ * merges `request.env` over `process.env`. Stdin is piped from `request.stdin`
+ * when present; stdout is captured into `result.stdout`. Never rejects for a
+ * non-zero exit.
+ */
+declare class NodeCommandRunner implements CommandRunner {
+    private readonly isWindows;
+    private readonly ops;
+    constructor(platform?: NodeJS.Platform, ops?: CommandRunnerOps);
+    run(request: CommandRequest): Promise<CommandResult>;
+}
+
 interface NodeCompressorOptions {
     /** Override the inflated-output cap. Tests use a small value to exercise the overflow branch. */
     readonly maxInflatedBytes?: number;
@@ -25,7 +78,8 @@ interface NodeCompressorOptions {
 declare class NodeCompressor implements Compressor {
     private readonly maxInflatedBytes;
     constructor(options?: NodeCompressorOptions);
-    deflate: (data: Uint8Array) => Promise<Uint8Array>;
+    deflate: (data: Uint8Array, level?: number) => Promise<Uint8Array>;
+    deflateRaw: (data: Uint8Array, level?: number) => Promise<Uint8Array>;
     inflate: (data: Uint8Array) => Promise<Uint8Array>;
     streamInflate: (bytes: Uint8Array, offset: number) => Promise<InflateStreamResult>;
     createInflateStream: () => TransformStream<Uint8Array, Uint8Array>;
@@ -95,61 +149,86 @@ declare class NodeFileSystem implements FileSystem {
     private readonly fsOps;
     /**
      * Memoised realpath of an *existing* parent directory, keyed by the raw
-     * (pre-realpath) parent path. Populated on every cache-miss inside
-     * `resolveForCreation` so a clone/checkout that writes N files into the
-     * same tree pays the realpath walk-up once per parent rather than once
-     * per file.
+     * (pre-realpath) parent path, paired with that parent's containment
+     * verdict (`isContainedInEitherRoot(realParent, …)`, computed once right
+     * after the realpath resolves). The cached value is mode-independent, so
+     * this single cache serves BOTH `resolveForCreation` (creation mode) and
+     * `resolveForMode`'s lstat arm (lstat mode): a clone/checkout writing N
+     * files into the same tree, or a status walk lstat-ing N entries under
+     * the same directory, pays the realpath walk-up — and, for the lstat
+     * arm, the containment POST-check — once per parent rather than once per
+     * file/entry. The verdict is a per-clean-leaf equivalence
+     * (`isContainedInEitherRoot(join(realParent, basename))` ≡
+     * `isContainedInEitherRoot(realParent)`, see the design doc's proof) and
+     * is consulted ONLY by the lstat arm; `read`/`creation` realpath the full
+     * leaf and keep their own per-entry post-check.
      *
      * Invariants:
      * - Only EXISTING parents are cached. ENOENT walks fall back to
-     *   `realpathNearestExisting` and are never recorded.
-     * - `rmRecursive` and `rename` clear the cache, which is correct (the
-     *   parent realpath may have changed) and cheap (the cache holds at
-     *   most a handful of small strings).
+     *   `realpathNearestExisting` (creation) or propagate (lstat) and are
+     *   never recorded.
+     * - The realpath and the verdict are set together — never divergent.
+     * - `rmRecursive` and `rename` clear the cache (invalidating BOTH the
+     *   realpath and the verdict), which is correct (the parent realpath may
+     *   have changed) and cheap relative to a re-walk. `rm` clears neither —
+     *   a leaf removal does not change the parent's realpath or containment.
+     * - Sized to exceed the 256 loose-object fanout directories so a
+     *   full-history walk does not thrash the cache.
      */
-    private readonly creationParentCache;
+    private readonly parentRealpathCache;
     /**
-     * Lazy long-name canonicalisation of `rootDir` for containment checks.
-     * Promise so concurrent first calls share one `realpath`; cleared on
-     * rejection so a transient ENOENT can be retried.
+     * Lazy long-name canonicalisation of `rootDir` for containment checks,
+     * resolving to the canonical root's `RootPrefix`. Promise so concurrent
+     * first calls share one `realpath`; cleared on rejection so a transient
+     * ENOENT can be retried.
      */
     private canonicalRootPromise;
     /**
-     * Memoised result of `pathPolicy.normalizeForCompare(rootDir)`. The
-     * rootDir is `readonly` for the adapter's lifetime, so a single
-     * normalisation is amortised across every containment check.
+     * Synchronous cache of the resolved canonical-root `RootPrefix`, set on
+     * `getCanonicalRoot()`'s promise-resolution arm and cleared on its
+     * rejection arm — always in lockstep with `canonicalRootPromise`. Lets
+     * hot-path callers (`checkContainment`, `exists`, `symlink`) read the
+     * settled value directly, without an `await` (and its microtask), once
+     * the root has resolved at least once.
      */
-    private normalizedRootDir;
+    private resolvedCanonicalRootPrefix;
     /**
-     * Memoised result of `pathPolicy.normalizeForCompare(canonicalRoot)`.
-     * Tracked alongside the canonical-root promise: when the promise
-     * resolves we cache the normalised form once. The promise's
-     * rejection-clears-cache rule means a transient ENOENT also clears
-     * this field (so the next call re-normalises against the retried
-     * canonical root).
+     * Memoised `{ normalized, withSep }` pair for `pathPolicy.normalizeForCompare(rootDir)`.
+     * The rootDir is `readonly` for the adapter's lifetime, so a single
+     * normalisation (and its `+sep` prefix) is amortised across every
+     * containment check. Bundled in one field — never two — so the prefix
+     * can never diverge from the root it was derived from.
      */
-    private normalizedCanonicalRoot;
+    private normalizedRootDirPrefix;
     constructor(rootDir: string, pathPolicy?: PathPolicy, fsOps?: FsOperations);
+    /**
+     * Lazily normalises `rootDir` and its `+sep` prefix as one bundled
+     * `RootPrefix`, memoised for the adapter's lifetime.
+     */
+    private getRootDirPrefix;
     private getNormalizedRootDir;
     /**
-     * Returns the cached normalised canonical root. Caller must have
-     * `await this.getCanonicalRoot()` immediately prior — the cache is
-     * populated by the promise's success arm and cleared on rejection, so
-     * a successful `await` guarantees the field is set.
-     *
-     * Kept synchronous (vs `async` + `await this.getCanonicalRoot()`
-     * inside) so the hot path doesn't pay an extra microtask suspension
-     * per containment check on a settled promise. The `!` is the only
-     * machine-readable form of "trust the post-await invariant"; the
-     * private `await getCanonicalRoot()` discipline at every call site is
-     * what makes it safe.
+     * Resolves and memoises the canonical-root `RootPrefix`. Returns the
+     * bundled `{ normalized, withSep }` value directly from the promise
+     * chain — callers thread the returned value onward, so there is no
+     * synchronous "trust it's been set" field read: the type system proves
+     * the value is defined via the `await`'s return, not a nullable field.
      */
-    private getResolvedNormalizedCanonicalRoot;
     private getCanonicalRoot;
+    /**
+     * Synchronous-first-path accessor for the canonical root: returns the
+     * already-settled `resolvedCanonicalRootPrefix` field when populated (no
+     * `await`, no microtask), falling back to `getCanonicalRoot()` only on
+     * the first call or after a rejection cleared the field. Used by every
+     * hot-path call site (`checkContainment`, `exists`, `symlink`) instead of
+     * an unconditional `await this.getCanonicalRoot()`.
+     */
+    private resolveCanonicalRoot;
     read: (path: string) => Promise<Uint8Array>;
     readSlice: (path: string, offset: number, length: number) => Promise<Uint8Array>;
     readUtf8: (path: string) => Promise<string>;
     write: (path: string, data: Uint8Array) => Promise<void>;
+    writeStream: (path: string, source: AsyncIterable<Uint8Array>) => Promise<void>;
     writeExclusive: (path: string, data: Uint8Array) => Promise<void>;
     writeUtf8: (path: string, content: string) => Promise<void>;
     appendUtf8: (path: string, content: string) => Promise<void>;
@@ -168,8 +247,35 @@ declare class NodeFileSystem implements FileSystem {
     private isSymlinkLeaf;
     private removeTree;
     private resolveForCreation;
+    private cachedParentRealpath;
     private realpathForCreation;
+    /**
+     * Resolves `resolved` to its real, containment-checkable form. `contained`
+     * is `undefined` for `read`/`creation` — those arms realpath a full leaf,
+     * so `checkContainment` still runs its own per-entry POST-check on the
+     * returned `real`. For `lstat`, `contained` carries the per-parent
+     * verdict `cachedParentRealpath` already computed (once per parent,
+     * proven verdict-identical to a per-entry check for a single clean leaf)
+     * — `checkContainment` consults it directly instead of re-normalising.
+     */
     private resolveForMode;
+    /**
+     * `abs` is normalised ONCE (not once per root) and compared against
+     * both roots' precomputed `+sep` prefixes. Both the `=== root` equality
+     * arm and the `startsWith(root + sep)` prefix arm are retained per
+     * root — dropping either changes the verdict (a bare `startsWith(root)`
+     * would admit the prefix-only sibling `root-evil`). Both roots are
+     * passed in as already-resolved `RootPrefix` values — no field read-back.
+     */
+    private isContainedInEitherRoot;
+    /**
+     * Single source of truth for the two-root, two-arm containment test —
+     * `isContainedInEitherRoot` and the lstat arm's PRE-check both delegate
+     * here so the "is `abs` exactly one of the roots" fact (needed by the
+     * lstat arm's exact-root shortcut) is derived from the SAME normalise
+     * call as the containment verdict, not a second one.
+     */
+    private containmentVerdict;
     private checkContainment;
     homedir(): string;
     xdgConfigHome(): string;
@@ -249,5 +355,5 @@ declare class NodeHttpTransport implements HttpTransport {
     request: (req: HttpRequest) => Promise<HttpResponse>;
 }
 
-export { NodeCompressor, NodeFileSystem, NodeHashService, NodeHookRunner, NodeHttpTransport, createNodeContext };
-export type { NodeAdapterOptions, NodeHttpTransportOptions };
+export { NodeCommandRunner, NodeCompressor, NodeFileSystem, NodeHashService, NodeHookRunner, NodeHttpTransport, createNodeContext, realCommandRunnerOps };
+export type { CommandRunnerOps, NodeAdapterOptions, NodeHttpTransportOptions };

package/dist/types/chunks/{context-YDw6qicq.d.cts → context-CF1YF2S8.d.cts}

@@ -1,9 +1,11 @@
-import { H as HttpTransport } from './http-transport--_NdQOiw.cjs';
+import { b as HttpTransport } from './http-transport-DirKfK2S.cjs';
 
 interface HashConfig {
     readonly digestLength: 20 | 32;
     readonly hexLength: 40 | 64;
 }
+declare const SHA1_CONFIG: HashConfig;
+declare const SHA256_CONFIG: HashConfig;
 
 type ObjectId = string & {
     readonly __brand: unique symbol;
@@ -12,6 +14,13 @@ declare const ObjectId: {
     readonly from: (hex: string) => ObjectId;
     readonly fromRaw: (bytes: Uint8Array) => ObjectId;
 };
+declare const ZERO_OID: ObjectId;
+/**
+ * SHA-1 of the canonical empty tree object. Used by `merge` for unrelated-history
+ * three-way merges where the merge base is undefined — substituted as the
+ * "empty base" so mergeTrees produces the union of both sides.
+ */
+declare const EMPTY_TREE_OID: ObjectId;
 type RefName = string & {
     readonly __brand: unique symbol;
 };
@@ -36,6 +45,55 @@ interface LruCache<V> {
     readonly entryCount: number;
 }
 
+/**
+ * A single shell-command invocation. The port is stateless — every fact the
+ * adapter needs to run the command travels in this request.
+ */
+interface CommandRequest {
+    /** Shell command line, executed through the platform shell (`sh -c` / `cmd /c`). */
+    readonly command: string;
+    /** Working directory for the spawned process. */
+    readonly cwd: string;
+    /** Environment additions merged onto the parent environment by the adapter. */
+    readonly env: Readonly<Record<string, string>>;
+    /** Cancels a running command — the adapter kills the child when it aborts. */
+    readonly signal?: AbortSignal;
+    /** Bytes fed to the child's stdin (clean/smudge input). When absent, stdin is not written. */
+    readonly stdin?: Uint8Array;
+}
+/**
+ * Outcome of a command. Two output conventions are carried by one port:
+ * - A merge driver communicates its result by overwriting its output file `%A`
+ *   — only the exit code matters (`0` ⇒ success); `stdout` is ignored.
+ * - A textconv or clean/smudge filter driver communicates its result via stdout
+ *   — the caller reads `result.stdout` for the transformed bytes.
+ */
+interface CommandResult {
+    readonly exitCode: number;
+    /** Bytes captured from the child's stdout (textconv/filter output). Absent when not captured. */
+    readonly stdout?: Uint8Array;
+}
+/**
+ * Runs an arbitrary shell command line — the custom merge-driver / textconv /
+ * clean-smudge filter command. Optional on `Context`: when absent (browser /
+ * memory adapters cannot spawn a process), a configured external driver falls
+ * back to the built-in behaviour.
+ *
+ * NEVER rejects for a non-zero exit — interpreting the exit code is the
+ * caller's policy.
+ *
+ * Two output conventions coexist on this single port:
+ * - **Merge driver**: communicates via its `%A` output file; the caller
+ *   ignores `result.stdout`. Pass no `stdin`; `stdout` will be absent.
+ * - **Textconv / filter driver**: communicates via stdout; the caller reads
+ *   `result.stdout`. Pass `stdin` bytes when the driver reads from stdin
+ *   (clean/smudge); omit `stdin` when the driver reads from a file argument
+ *   (textconv).
+ */
+interface CommandRunner {
+    readonly run: (request: CommandRequest) => Promise<CommandResult>;
+}
+
 interface InflateStreamResult {
     /** The fully-inflated output bytes. */
     readonly output: Uint8Array;
@@ -43,8 +101,18 @@ interface InflateStreamResult {
     readonly bytesConsumed: number;
 }
 interface Compressor {
-    /** Deflate (compress) data using zlib deflate format (RFC 1950). */
-    readonly deflate: (data: Uint8Array) => Promise<Uint8Array>;
+    /**
+     * Deflate (compress) data using zlib deflate format (RFC 1950).
+     * `level` (when given and in zlib's -1..9 domain) tunes the compression
+     * level; adapters that cannot set a level accept and ignore it.
+     */
+    readonly deflate: (data: Uint8Array, level?: number) => Promise<Uint8Array>;
+    /**
+     * Raw DEFLATE (compress) using bare RFC 1951 bitstream — no zlib (RFC 1950)
+     * 2-byte header and no adler32 trailer. `level` semantics match `deflate`.
+     * Used by zip archive serializer (method 8). Additive — `deflate` unchanged.
+     */
+    readonly deflateRaw: (data: Uint8Array, level?: number) => Promise<Uint8Array>;
     /** Inflate (decompress) zlib-compressed data. */
     readonly inflate: (data: Uint8Array) => Promise<Uint8Array>;
     /**
@@ -66,6 +134,11 @@ interface Compressor {
     readonly createInflateStream: () => TransformStream<Uint8Array, Uint8Array>;
 }
 
+interface EnvReader {
+    /** A single named environment variable's value, or `undefined` when unset. */
+    readonly get: (name: string) => string | undefined;
+}
+
 /** Metadata returned by stat operations. */
 interface FileStat {
     readonly ctimeMs: number;
@@ -116,6 +189,8 @@ interface FileSystem {
     readonly readUtf8: (path: string) => Promise<string>;
     /** Write bytes to file, creating parent directories as needed. Overwrites if exists. */
     readonly write: (path: string, data: Uint8Array) => Promise<void>;
+    /** Stream bytes to file from an async source, creating parent directories as needed. Overwrites if exists. Writes bytes verbatim. */
+    readonly writeStream: (path: string, source: AsyncIterable<Uint8Array>) => Promise<void>;
     /**
      * Write bytes to file. Fails with FILE_EXISTS if the file already exists (exclusive create).
      *
@@ -244,7 +319,7 @@ interface HashService {
  * `HOOK_FAILED` command error reference it — a port may import domain, but
  * domain may never import a port.
  */
-type HookName = 'pre-commit' | 'commit-msg' | 'pre-push';
+type HookName = 'pre-commit' | 'prepare-commit-msg' | 'commit-msg' | 'post-commit' | 'post-merge' | 'post-checkout' | 'pre-push' | 'pre-rebase' | 'post-rewrite';
 
 /**
  * A single hook invocation. The port is stateless — every fact the adapter
@@ -373,6 +448,43 @@ interface PromisorRemote {
     fetch(oids: ReadonlyArray<ObjectId>): Promise<PromisorFetchOutcome>;
 }
 
+/**
+ * Request to open one SSH duplex channel. `command`/`args` are the fully
+ * resolved ssh program and argv (host token, `-p` flag, sq-quoted remote
+ * command) — the adapter performs no faithfulness logic of its own.
+ */
+interface SshSpawnRequest {
+    /** Resolved ssh program (e.g. `ssh`, or a `GIT_SSH`/`core.sshCommand` override). */
+    readonly command: string;
+    /** Full argv, incl. host token and remote-command token. */
+    readonly args: ReadonlyArray<string>;
+    /** Additions merged OVER the parent process environment by the adapter. */
+    readonly env: Readonly<Record<string, string>>;
+    readonly signal?: AbortSignal;
+}
+/**
+ * One live SSH duplex channel — a thin process bridge. Stream shapes mirror
+ * `HttpTransport`: web streams in, web streams out.
+ */
+interface SshChannel {
+    /** Request bytes written to the server. */
+    readonly stdin: WritableStream<Uint8Array>;
+    /** Advertisement + response bytes read from the server. */
+    readonly stdout: ReadableStream<Uint8Array>;
+    /** Resolves with the ssh process's exit code. */
+    readonly exit: Promise<number>;
+    /** Idempotent teardown — kills the child process. */
+    readonly close: () => Promise<void>;
+}
+/**
+ * Thin duplex process spawner. Knows nothing about git — argv building,
+ * quoting, and command resolution are pure application-tier concerns tested
+ * independently of this port.
+ */
+interface SshTransport {
+    readonly open: (req: SshSpawnRequest) => Promise<SshChannel>;
+}
+
 /**
  * Repository physical layout — where the working tree and.git directory live.
  * Renamed in from the previous `RepositoryConfig` (port-tier) to free that
@@ -383,6 +495,14 @@ interface RepositoryLayout {
     readonly workDir: string;
     /** Absolute path to the.git directory (usually `${workDir}/.git`, but may differ for bare repos or worktrees). */
     readonly gitDir: string;
+    /**
+     * Absolute path to the shared **common** git dir — objects, `packed-refs`,
+     * `config`, and shared refs/reflogs. Absent for a normal repo or the main
+     * worktree (it equals `gitDir`); set only for a linked worktree, whose
+     * `gitDir` is its own admin dir while shared state lives here. Resolve via
+     * `commonGitDir(ctx)` rather than reading this field directly.
+     */
+    readonly commonDir?: string;
     /** Whether this is a bare repository. */
     readonly bare: boolean;
     /**
@@ -438,6 +558,14 @@ interface RepositoryConfig {
      */
     readonly maxObjectsPerPack?: number;
     readonly detectRenames?: boolean;
+    /**
+     * Programmatic facade defaults for whitespace-diff modes. These are NOT git's
+     * `.git/config` settings and NOT `core.whitespace` — they are library-tier
+     * defaults applied by the `diff` command when no per-call option overrides them.
+     */
+    readonly ignoreWhitespace?: 'all' | 'change' | 'at-eol';
+    readonly ignoreCrAtEol?: boolean;
+    readonly ignoreBlankLines?: boolean;
     readonly breakStaleLockMs?: number;
     readonly dnsResolver?: (host: string) => Promise<ReadonlyArray<string>>;
     /** Hard cap on `dnsResolver` return-array length to bound resolver-amplification DoS. Default 64. */
@@ -453,6 +581,8 @@ interface Context {
     readonly layout: RepositoryLayout;
     /** User-supplied working directory (may be a sub-path of layout.workDir). Defaults to layout.workDir when not set by the facade. */
     readonly cwd: string;
+    /** The runtime this context was built for — names the adapter set in refusal messages. */
+    readonly runtime: 'node' | 'browser' | 'memory';
     /** Object serialization parameters (sha1 vs sha256 digest+hex sizes). */
     readonly hashConfig: HashConfig;
     /** Shared delta-base LRU cache; consumed by primitives' iterative delta walker. */
@@ -465,11 +595,36 @@ interface Context {
     readonly signal?: AbortSignal;
     /** Optional hook runner. Absent ⇒ hooks are inert (browser, or opted out). */
     readonly hooks?: HookRunner;
+    /**
+     * Optional shell-command runner. Absent ⇒ a configured external merge driver
+     * falls back to the built-in merge (browser / memory adapters cannot spawn a
+     * process).
+     */
+    readonly command?: CommandRunner;
+    /**
+     * Optional environment-variable reader. Absent ⇒ every variable is unset (browser /
+     * memory, where there is no process env). Notes-ref selection reads GIT_NOTES_REF through it.
+     */
+    readonly env?: EnvReader;
+    /**
+     * Optional SSH transport. Absent ⇒ ssh/scp remotes refuse — browser/memory
+     * cannot spawn a process.
+     */
+    readonly ssh?: SshTransport;
     /**
      * Optional promisor-remote capability. Populated by `openRepository`;
      * `readObject` consults it to lazy-fetch an object a partial clone omitted.
      */
     readonly promisor?: PromisorRemote;
+    /**
+     * Optional facade capability returning a `FileSystem` confined to one or more
+     * linked worktree paths AND the common dir (ADR-298). The worktree commands
+     * route worktree-directory I/O through it so worktrees outside `workDir` stay
+     * faithful without dropping containment (`move` passes both endpoints). Absent
+     * on sandboxed adapters (memory/browser), where worktrees are confined under
+     * the adapter root.
+     */
+    readonly worktreeFs?: (worktreePath: string | ReadonlyArray<string>) => FileSystem;
 }
 interface CreateContextParts {
     readonly fs: FileSystem;
@@ -479,15 +634,19 @@ interface CreateContextParts {
     readonly progress: ProgressReporter;
     readonly layout: RepositoryLayout;
     readonly cwd?: string;
+    readonly runtime: 'node' | 'browser' | 'memory';
     readonly hashConfig: HashConfig;
     readonly deltaCache: LruCache<Uint8Array>;
     readonly config?: RepositoryConfig;
     readonly logger?: Logger;
     readonly signal?: AbortSignal;
     readonly hooks?: HookRunner;
+    readonly command?: CommandRunner;
+    readonly env?: EnvReader;
+    readonly ssh?: SshTransport;
 }
 /** Assemble a frozen Context from its constituent ports + layout. */
 declare function createContext(parts: CreateContextParts): Context;
 
-export { ObjectId as O, FilePath as c, RefName as j, createContext as p, noopLogger as q, wrapLoggerSanitizer as w };
-export type { AuthStrategy as A, Compressor as C, DirEntry as D, FileSystem as F, HashService as H, InflateStreamResult as I, Logger as L, ProgressReporter as P, RepositoryConfig as R, HookRunner as a, Context as b, FileStat as d, FileHandle as e, Hasher as f, HookName as g, HookResult as h, HookRequest as i, AuthorIdentity as k, CreateContextParts as l, PromisorFetchOutcome as m, PromisorRemote as n, RepositoryLayout as o };
+export { EMPTY_TREE_OID as E, FilePath as F, ObjectId as O, RefName as R, SHA1_CONFIG as S, ZERO_OID as Z, SHA256_CONFIG as r, createContext as v, noopLogger as w, wrapLoggerSanitizer as x };
+export type { AuthStrategy as A, CommandResult as B, CommandRunner as C, DirEntry as D, HashConfig as H, InflateStreamResult as I, Logger as L, ProgressReporter as P, Compressor as a, AuthorIdentity as b, Context as c, CreateContextParts as d, EnvReader as e, FileStat as f, FileSystem as g, HashService as h, Hasher as i, HookName as j, HookRequest as k, HookResult as l, HookRunner as m, PromisorFetchOutcome as n, PromisorRemote as o, RepositoryConfig as p, RepositoryLayout as q, SshChannel as s, SshSpawnRequest as t, SshTransport as u, FileHandle as y, CommandRequest as z };