@usecontextlayer/pggit 1.0.0 → 1.1.0

package/dist/index.mjs

@@ -1,8 +1,9 @@
-import { gunzipSync } from "node:zlib";
+import { createInflate, deflateSync, gunzipSync } from "node:zlib";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { performance } from "node:perf_hooks";
+import { createHash } from "node:crypto";
 import { Kysely, sql } from "kysely";
 import { PostgresJSDialect } from "kysely-postgres-js";
 
@@ -592,6 +593,14 @@ var GitFormatError = class extends Error {
 
 //#endregion
 //#region src/object/object.ts
+/**
+* The git object ID: SHA-1 of the loose-object representation
+* `"<type> <byteLength>\0" + content`. Returns the 40-char lowercase hex digest.
+*/
+function computeOid(type, content) {
+	const header = Buffer.from(`${type} ${content.length}\0`, "latin1");
+	return createHash("sha1").update(header).update(content).digest("hex");
+}
 /** OIDs in the leading `key <oid>` headers (up to the blank line) for given keys. */
 function headerOids(content, keys) {
 	const oids = [];
@@ -626,12 +635,33 @@ function treeEntries(content) {
 function isTreeEntryMode(mode) {
 	return mode === "40000";
 }
+/** OIDs of a tree's entries (all kinds), in tree order. */
+function treeEntryOids(content) {
+	return treeEntries(content).map((e) => e.oid);
+}
+/** A commit's parent OIDs only (ancestry walk; excludes its tree). */
+function commitParents(content) {
+	return headerOids(content, /* @__PURE__ */ new Set(["parent"]));
+}
 /** A commit's root tree OID. Every commit has exactly one `tree` header. */
 function commitTreeOid(content) {
 	const [tree] = headerOids(content, /* @__PURE__ */ new Set(["tree"]));
 	if (!tree) throw new GitFormatError("missing-tree-header", "commitTreeOid: commit has no tree header");
 	return tree;
 }
+/**
+* The OIDs an object directly references: a commit → its tree + parents, a tree
+* → its entries, a tag → its target, a blob → nothing. The basis of reachability
+* enumeration (fetch, connectivity).
+*/
+function referencedOids(type, content) {
+	switch (type) {
+		case "blob": return [];
+		case "commit": return headerOids(content, /* @__PURE__ */ new Set(["tree", "parent"]));
+		case "tag": return headerOids(content, /* @__PURE__ */ new Set(["object"]));
+		case "tree": return treeEntryOids(content);
+	}
+}
 
 //#endregion
 //#region src/repo-view/build-file-list.ts
@@ -796,10 +826,217 @@ async function copyInsert(tx, target, columns, rows) {
 	await tx.unsafe(`insert into ${target} (${cols}) select ${cols} from ${staging} on conflict do nothing`);
 }
 
+//#endregion
+//#region src/store/repo-resolver.ts
+/**
+* Resolves a wire repo name to its `repos.id` surrogate, memoized. The object and
+* ref stores both key on the bigint `repo_id`, so each builds one of these as its
+* name→id boundary.
+*
+* The mapping is immutable once a repo exists (ids are `generated always`, names
+* are unique), so a found id is cached for the resolver's lifetime — keeping the
+* per-object hot path (getObject) at one point-read, not a join. Misses are NEVER
+* cached: a name the lookup didn't find may be created by a later push, and a
+* cached `null` would mask it.
+*
+* Reads resolve (lookup; `null` ⇒ the repo has never been written, i.e. empty).
+* Writes ensure (race-safe get-or-create).
+*/
+function createRepoResolver(db) {
+	const cache = /* @__PURE__ */ new Map();
+	return {
+		/** The repo's id, creating the row if absent. Race-safe under concurrent
+		* first-pushes, and avoids a no-op UPDATE on the common (exists) path. */
+		async ensureRepoId(name) {
+			const cached = cache.get(name);
+			if (cached !== void 0) return cached;
+			const existing = await db.selectFrom("repos").select("id").where("name", "=", name).executeTakeFirst();
+			if (existing) {
+				cache.set(name, existing.id);
+				return existing.id;
+			}
+			const id = (await db.insertInto("repos").values({ name }).onConflict((oc) => oc.doNothing()).returning("id").executeTakeFirst())?.id ?? (await db.selectFrom("repos").select("id").where("name", "=", name).executeTakeFirstOrThrow()).id;
+			cache.set(name, id);
+			return id;
+		},
+		/** The repo's id, or `null` if it has never been written to. */
+		async resolveRepoId(name) {
+			const cached = cache.get(name);
+			if (cached !== void 0) return cached;
+			const row = await db.selectFrom("repos").select("id").where("name", "=", name).executeTakeFirst();
+			if (!row) return null;
+			cache.set(name, row.id);
+			return row.id;
+		}
+	};
+}
+
+//#endregion
+//#region src/repo-view/repo-file-projection.ts
+/**
+* Write-only maintainer of `repo_file`: the slim per-branch-tip `path → (mode,
+* blob_oid)` index that IS pggit's public read surface. Reads never go through this
+* module — a consumer queries `repo_file ⋈ git_object` (on `oid = blob_oid`) with
+* direct SQL, the one read mechanism (docs/2026-06-26-read-surface-sharpening-design.md).
+* So this only ever rebuilds or drops the projection on push; there is no read method
+* here by design. It is a derived projection of the canonical objects — no duplicate
+* blob bytes, no orphan reaper (the redesign's collapse, §4.5) — droppable and
+* rebuildable at will. The wire repo name resolves to its bigint surrogate (memoized)
+* here, like the other stores.
+*/
+function createRepoFileProjection(pg) {
+	const db = initKysely(pg);
+	const repos = createRepoResolver(db);
+	return {
+		/** Drop a repo's entire projection (all branches) — the clean slate for a full
+		* rebuild. No blob bytes to reap; the index is the only state. */
+		async clearRepo(repoId) {
+			const id = await repos.resolveRepoId(repoId);
+			if (id === null) return;
+			await db.deleteFrom("repo_file").where("repo_id", "=", id).execute();
+		},
+		/** Drop `refName`'s snapshot (branch deleted). */
+		async dropRefSnapshot(repoId, refName) {
+			const id = await repos.resolveRepoId(repoId);
+			if (id === null) return;
+			await db.deleteFrom("repo_file").where("repo_id", "=", id).where("ref_name", "=", refName).execute();
+		},
+		/** Replace `refName`'s snapshot with `fileList` (one atomic transaction). The
+		* blobs already live in git_object — we store only the path→blob_oid index. */
+		async rebuildRefSnapshot(repoId, refName, fileList) {
+			const id = await repos.ensureRepoId(repoId);
+			const rows = fileList.files.map((f) => [
+				{
+					t: "int8",
+					v: id
+				},
+				{
+					t: "text",
+					v: refName
+				},
+				{
+					t: "text",
+					v: f.path
+				},
+				{
+					t: "text",
+					v: f.mode
+				},
+				{
+					t: "bytea",
+					v: Buffer.from(f.blobOid, "hex")
+				}
+			]);
+			await pg.begin(async (tx) => {
+				await tx`delete from repo_file where repo_id = ${id} and ref_name = ${refName}`;
+				await copyInsert(tx, "repo_file", [
+					"repo_id",
+					"ref_name",
+					"path",
+					"mode",
+					"blob_oid"
+				], rows);
+			});
+		}
+	};
+}
+
 //#endregion
 //#region src/object/edges.ts
+/**
+* Edge kinds stored in `git_edge.kind`. tree→blob (would be `4`) is deliberately
+* NOT a kind: blobs are enumerated from tree content, never stored as edges (§4.3),
+* so `4` is reserved/unused.
+*/
+const EDGE_KIND = {
+	COMMIT_PARENT: 2,
+	COMMIT_TREE: 1,
+	TAG_TARGET: 5,
+	TREE_SUBTREE: 3
+};
 /** A tree entry pointing at a commit in *another* repo — no blob, no edge here. */
 const GITLINK_MODE = "160000";
+const WELL_FORMED_OID = /^[0-9a-f]{40}$/;
+/**
+* Validate an OID parsed from a commit/tag header. `commitParents`/`commitTreeOid`/
+* `referencedOids` take whatever follows the header key verbatim — a forged object
+* could carry a non-OID there and yield a bogus edge child — so reject it loudly at
+* the ingest boundary (§5.1). Tree-entry OIDs are exempt: `treeEntries` already
+* guarantees a 20-byte value, and the `bytea CHECK(length(child)=20)` is the
+* database-level backstop for every edge.
+*/
+function assertOid(oid, context) {
+	if (!WELL_FORMED_OID.test(oid)) throw new GitFormatError("malformed-oid", `${context}: not a well-formed object id: ${JSON.stringify(oid)}`);
+	return oid;
+}
+/** Count the leading `key value` header lines (up to the blank line that ends a
+* commit/tag's header block). */
+function countHeader(content, key) {
+	const prefix = `${key} `;
+	let n = 0;
+	for (const line of content.toString("latin1").split("\n")) {
+		if (line === "") break;
+		if (line.startsWith(prefix)) n++;
+	}
+	return n;
+}
+/**
+* fsck-grade structural validation at the ingest boundary (§5.1, invariant §10.2):
+* reject the malformed objects that OID-wellformedness and tree parsing do not
+* catch. A commit must not carry more than one `tree` header (git fsck:
+* multipleTrees — `commitTreeOid` would otherwise silently take the first and drop
+* the rest, recording an edge to a tree the object does not actually root). An
+* annotated tag must carry exactly one `object` header (git fsck: missingObject /
+* an extra object line): zero yields no `kind=5` edge and silently breaks peeling
+* and connectivity; more than one yields multiple divergent `kind=5` edges and a
+* nondeterministic `peeled_oid`. The other structural guarantees are already
+* enforced downstream: `assertOid` on every referenced OID (below), a present root
+* `tree` (`commitTreeOid`, which also rejects a zero-tree commit), and a well-formed
+* tree body (`treeEntries` throws). Called by the store once per object before
+* derivation, in the ingest transaction, so a malformed push aborts before any row
+* lands.
+*/
+function validateObject(type, content) {
+	if (type === "commit" && countHeader(content, "tree") > 1) throw new GitFormatError("multiple-tree-headers", "commit carries more than one tree header");
+	if (type === "tag") {
+		const objects = countHeader(content, "object");
+		if (objects < 1) throw new GitFormatError("missing-tag-object", "annotated tag has no object header");
+		if (objects > 1) throw new GitFormatError("multiple-tag-objects", "annotated tag carries more than one object header");
+	}
+}
+/**
+* The edges an object contributes to `git_edge`, with the object's own OID as the
+* parent — the §4.3 standing rule, mode-aware:
+* - commit → its tree (kind 1) then each parent (kind 2);
+* - tree → its **subtrees only** (mode `40000` → kind 3). Blobs and gitlinks
+*   (`160000`, a commit living in another repo) are NOT edges — `isTreeEntryMode`
+*   admits only `40000`, so both are dropped;
+* - tag → its target (kind 5);
+* - blob → nothing.
+*
+* This is the single derivation the store inserts alongside the object row, in the
+* same transaction (§10.1), so edges are a validated total function of content.
+*/
+function deriveEdges(type, content) {
+	switch (type) {
+		case "blob": return [];
+		case "commit": return [{
+			child: assertOid(commitTreeOid(content), "commit tree"),
+			kind: EDGE_KIND.COMMIT_TREE
+		}, ...commitParents(content).map((p) => ({
+			child: assertOid(p, "commit parent"),
+			kind: EDGE_KIND.COMMIT_PARENT
+		}))];
+		case "tag": return referencedOids("tag", content).map((t) => ({
+			child: assertOid(t, "tag target"),
+			kind: EDGE_KIND.TAG_TARGET
+		}));
+		case "tree": return treeEntries(content).filter((e) => isTreeEntryMode(e.mode)).map((e) => ({
+			child: e.oid,
+			kind: EDGE_KIND.TREE_SUBTREE
+		}));
+	}
+}
 /**
 * The blob OIDs directly in a tree — the §4.3 standing rule's other half: blobs
 * are enumerated from tree content, never stored as edges. A tree entry is a blob
@@ -833,13 +1070,297 @@ const PACK_OBJ_TYPE = {
 	TAG: 4,
 	TREE: 2
 };
+function encodeObjectHeader(type, size) {
+	let rest = Math.floor(size / 16);
+	let first = type << 4 | size % 16;
+	if (rest > 0) first |= 128;
+	const bytes = [first];
+	while (rest > 0) {
+		let byte = rest % 128;
+		rest = Math.floor(rest / 128);
+		if (rest > 0) byte |= 128;
+		bytes.push(byte);
+	}
+	return Buffer.from(bytes);
+}
+function decodeObjectHeader(buf, offset) {
+	let b = buf.readUInt8(offset);
+	let bytesRead = 1;
+	const type = b >> 4 & 7;
+	let size = b & 15;
+	let mult = 16;
+	while (b & 128) {
+		b = buf.readUInt8(offset + bytesRead);
+		bytesRead++;
+		size += (b & 127) * mult;
+		mult *= 128;
+	}
+	return {
+		bytesRead,
+		size,
+		type
+	};
+}
+
+//#endregion
+//#region src/pack/delta.ts
+/**
+* Apply a git delta to its base, producing the target object. The delta begins
+* with two LEB128 varints (source size, target size), then a stream of
+* instructions: a COPY (high bit set — copy a run from the base at a given
+* offset/size) or an INSERT (1..127 literal bytes that follow). See
+* gitformat-pack "Deltified representation". We only ever READ/apply deltas;
+* the serve path emits none (spec §3.4).
+*/
+function applyDelta(base, delta) {
+	let pos = 0;
+	const readVarint = () => {
+		let result = 0;
+		let shift = 0;
+		let byte;
+		do {
+			byte = delta.readUInt8(pos);
+			pos += 1;
+			result += (byte & 127) * 2 ** shift;
+			shift += 7;
+		} while (byte & 128);
+		return result;
+	};
+	const sourceSize = readVarint();
+	const targetSize = readVarint();
+	if (base.length !== sourceSize) throw new GitFormatError("delta-base-size-mismatch", `delta: base size ${base.length} ≠ declared ${sourceSize}`);
+	const out = Buffer.alloc(targetSize);
+	let outPos = 0;
+	while (pos < delta.length) {
+		const op = delta.readUInt8(pos);
+		pos += 1;
+		if (op & 128) {
+			let copyOffset = 0;
+			if (op & 1) copyOffset |= delta.readUInt8(pos++);
+			if (op & 2) copyOffset |= delta.readUInt8(pos++) << 8;
+			if (op & 4) copyOffset |= delta.readUInt8(pos++) << 16;
+			if (op & 8) copyOffset += delta.readUInt8(pos++) * 2 ** 24;
+			let copySize = 0;
+			if (op & 16) copySize |= delta.readUInt8(pos++);
+			if (op & 32) copySize |= delta.readUInt8(pos++) << 8;
+			if (op & 64) copySize |= delta.readUInt8(pos++) << 16;
+			if (copySize === 0) copySize = 65536;
+			base.copy(out, outPos, copyOffset, copyOffset + copySize);
+			outPos += copySize;
+		} else if (op !== 0) {
+			delta.copy(out, outPos, pos, pos + op);
+			outPos += op;
+			pos += op;
+		} else throw new GitFormatError("delta-reserved-opcode", "delta: reserved opcode 0x00");
+	}
+	if (outPos !== targetSize) throw new GitFormatError("delta-target-size-mismatch", `delta: produced ${outPos} bytes, declared ${targetSize}`);
+	return out;
+}
+
+//#endregion
+//#region src/pack/read-pack.ts
+const CODE_TO_TYPE$1 = {
+	[PACK_OBJ_TYPE.COMMIT]: "commit",
+	[PACK_OBJ_TYPE.TREE]: "tree",
+	[PACK_OBJ_TYPE.BLOB]: "blob",
+	[PACK_OBJ_TYPE.TAG]: "tag"
+};
+/**
+* Inflate exactly one zlib stream at the front of `buf`, returning the data and
+* how many COMPRESSED bytes it consumed — the seam for walking the back-to-back
+* zlib streams in a packfile. (`bytesWritten` = input consumed up to
+* Z_STREAM_END; trailing bytes untouched — verified empirically against
+* node:zlib.)
+*/
+function inflateOne(buf) {
+	return new Promise((resolve, reject) => {
+		const inf = createInflate();
+		const chunks = [];
+		inf.on("data", (chunk) => chunks.push(chunk));
+		inf.on("end", () => resolve({
+			compressedLength: inf.bytesWritten,
+			data: Buffer.concat(chunks)
+		}));
+		inf.on("error", (e) => reject(new GitFormatError("inflate-failed", `pack: zlib inflate failed: ${e instanceof Error ? e.message : String(e)}`)));
+		inf.end(buf);
+	});
+}
+/**
+* The pack OFS_DELTA "offset encoding" — NOT plain LEB128. Each continuation
+* adds 1 before shifting, so encodings are unambiguous. Arithmetic (not `<<`) so
+* offsets ≥ 2³¹ stay correct.
+*/
+function readOffsetVarint(buf, offset) {
+	let b = buf.readUInt8(offset);
+	let bytesRead = 1;
+	let value = b & 127;
+	while (b & 128) {
+		b = buf.readUInt8(offset + bytesRead);
+		bytesRead += 1;
+		value = (value + 1) * 128 + (b & 127);
+	}
+	return {
+		bytesRead,
+		value
+	};
+}
+/**
+* Parse a v2 packfile into its objects, resolving OFS_DELTA and REF_DELTA
+* (including delta chains). Bases come from the same pack; a REF_DELTA whose base
+* is NOT in the pack — a thin pack, as `git push` sends by default — is resolved
+* via `resolveExternalBase` (the Postgres store on push ingest). Without a
+* resolver, an external base is a hard error.
+*/
+async function readPack(pack, resolveExternalBase) {
+	count("readPackCalls");
+	if (pack.subarray(0, 4).toString("latin1") !== "PACK") throw new GitFormatError("bad-magic", "pack: bad magic");
+	const version = pack.readUInt32BE(4);
+	if (version !== 2) throw new GitFormatError("unsupported-version", `pack: unsupported version ${version}`);
+	const objectCount = pack.readUInt32BE(8);
+	const trailerOffset = pack.length - 20;
+	const actualTrailer = createHash("sha1").update(pack.subarray(0, trailerOffset)).digest();
+	if (!pack.subarray(trailerOffset).equals(actualTrailer)) throw new GitFormatError("trailer-mismatch", "pack: trailer SHA-1 mismatch");
+	const entries = /* @__PURE__ */ new Map();
+	const order = [];
+	let offset = 12;
+	for (let i = 0; i < objectCount; i++) {
+		const start = offset;
+		const { type, size, bytesRead } = decodeObjectHeader(pack, offset);
+		offset += bytesRead;
+		if (type === PACK_OBJ_TYPE.OFS_DELTA) {
+			const { value: negOffset, bytesRead: ob } = readOffsetVarint(pack, offset);
+			offset += ob;
+			const { data, compressedLength } = await inflateOne(pack.subarray(offset));
+			count("bytesInflated", data.length);
+			offset += compressedLength;
+			entries.set(start, {
+				baseOffset: start - negOffset,
+				delta: data,
+				kind: "ofs"
+			});
+		} else if (type === PACK_OBJ_TYPE.REF_DELTA) {
+			const baseOid = pack.subarray(offset, offset + 20).toString("hex");
+			offset += 20;
+			const { data, compressedLength } = await inflateOne(pack.subarray(offset));
+			count("bytesInflated", data.length);
+			offset += compressedLength;
+			entries.set(start, {
+				baseOid,
+				delta: data,
+				kind: "ref"
+			});
+		} else {
+			const typeName = CODE_TO_TYPE$1[type];
+			if (!typeName) throw new GitFormatError("unknown-object-type", `pack: unknown object type ${type}`);
+			const { data, compressedLength } = await inflateOne(pack.subarray(offset));
+			count("bytesInflated", data.length);
+			if (data.length !== size) throw new GitFormatError("size-mismatch", `pack: size mismatch (header ${size}, inflated ${data.length})`);
+			offset += compressedLength;
+			entries.set(start, {
+				content: data,
+				kind: "base",
+				type: typeName
+			});
+		}
+		order.push(start);
+	}
+	if (offset !== trailerOffset) throw new GitFormatError("trailing-bytes", `pack: consumed ${offset} bytes, expected ${trailerOffset} before trailer`);
+	const resolved = /* @__PURE__ */ new Map();
+	const byOid = /* @__PURE__ */ new Map();
+	const externalCache = /* @__PURE__ */ new Map();
+	const fetchExternal = async (oid) => {
+		const cached = externalCache.get(oid);
+		if (cached !== void 0) return cached;
+		const fetched = resolveExternalBase ? await resolveExternalBase(oid) : null;
+		externalCache.set(oid, fetched);
+		return fetched;
+	};
+	const record = (off, type, content) => {
+		const obj = {
+			content,
+			oid: computeOid(type, content),
+			type
+		};
+		resolved.set(off, obj);
+		byOid.set(obj.oid, obj);
+	};
+	for (const off of order) {
+		const entry = entries.get(off);
+		if (entry?.kind === "base") record(off, entry.type, entry.content);
+	}
+	let pending = order.filter((off) => !resolved.has(off));
+	while (pending.length > 0) {
+		const stillPending = [];
+		for (const off of pending) {
+			const entry = entries.get(off);
+			if (!entry || entry.kind === "base") continue;
+			const base = entry.kind === "ofs" ? resolved.get(entry.baseOffset) ?? null : byOid.get(entry.baseOid) ?? await fetchExternal(entry.baseOid);
+			if (!base) {
+				stillPending.push(off);
+				continue;
+			}
+			record(off, base.type, applyDelta(base.content, entry.delta));
+		}
+		if (stillPending.length === pending.length) {
+			const off = stillPending[0];
+			const entry = entries.get(off);
+			throw new GitFormatError("unresolved-base", `pack: ref-delta base ${entry?.kind === "ref" ? entry.baseOid : `offset ${entry?.kind === "ofs" ? entry.baseOffset : "?"}`} not found in pack or store`);
+		}
+		pending = stillPending;
+	}
+	return order.map((off) => resolved.get(off));
+}
+
+//#endregion
+//#region src/pack/write-pack.ts
+const TYPE_CODE = {
+	blob: PACK_OBJ_TYPE.BLOB,
+	commit: PACK_OBJ_TYPE.COMMIT,
+	tag: PACK_OBJ_TYPE.TAG,
+	tree: PACK_OBJ_TYPE.TREE
+};
+/**
+* The 12-byte pack header: `PACK` magic, version 2, object count. The count is
+* fixed up front, so a streaming encoder must know its object total before the
+* first object (the row-store's closure provides it without reading content).
+*/
+function packHeader(objectCount) {
+	const header = Buffer.alloc(12);
+	header.write("PACK", 0, "latin1");
+	header.writeUInt32BE(2, 4);
+	header.writeUInt32BE(objectCount, 8);
+	return header;
+}
+/** One packed object: its varint (type, uncompressed size) header + zlib-deflated
+* content. Undeltified — we never emit deltas (spec §3.4 asymmetric kernel). */
+function packObject(type, content) {
+	const deflated = deflateSync(content);
+	count("deflateInputBytes", content.length);
+	count("deflateOutputBytes", deflated.length);
+	return Buffer.concat([encodeObjectHeader(TYPE_CODE[type], content.length), deflated]);
+}
+/**
+* Serialize objects into a self-contained, **undeltified** packfile (v2): the
+* header, each object's (header + deflated content), then a trailing SHA-1 of all
+* preceding bytes. The serve path streams the same primitives object-by-object
+* (object-store `buildPack`); this all-at-once form builds test packs and the
+* empty pack.
+*/
+function writePack(objects) {
+	count("writePackCalls");
+	const parts = [packHeader(objects.length)];
+	for (const obj of objects) parts.push(packObject(obj.type, obj.content));
+	const body = Buffer.concat(parts);
+	const trailer = createHash("sha1").update(body).digest();
+	return Buffer.concat([body, trailer]);
+}
 
 //#endregion
 //#region src/store/reachability.ts
 /** Objects looked up per round-trip when chunking tree/blob existence queries. */
 const LOOKUP_BATCH = 1e3;
 /** Split `items` into consecutive batches of at most `size`. */
-function batches(items, size) {
+function batches$1(items, size) {
 	const out = [];
 	for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
 	return out;
@@ -888,7 +1409,7 @@ async function reachableClosure(db, id, roots, omitBlobs) {
 		present
 	};
 	const blobCandidates = /* @__PURE__ */ new Set();
-	for (const batch of batches(treeOids, LOOKUP_BATCH)) {
+	for (const batch of batches$1(treeOids, LOOKUP_BATCH)) {
 		const trees = await db.selectFrom("git_object").select("content").where("repo_id", "=", id).where("oid", "in", batch).execute();
 		for (const t of trees) for (const blob of treeBlobOids(t.content)) blobCandidates.add(blob);
 	}
@@ -897,7 +1418,7 @@ async function reachableClosure(db, id, roots, omitBlobs) {
 		present
 	};
 	const presentBlobs = /* @__PURE__ */ new Set();
-	for (const batch of batches([...blobCandidates], LOOKUP_BATCH)) {
+	for (const batch of batches$1([...blobCandidates], LOOKUP_BATCH)) {
 		const rows = await db.selectFrom("git_object").select("oid").where("repo_id", "=", id).where("oid", "in", batch.map((h) => Buffer.from(h, "hex"))).execute();
 		for (const r of rows) presentBlobs.add(r.oid.toString("hex"));
 	}
@@ -907,48 +1428,551 @@ async function reachableClosure(db, id, roots, omitBlobs) {
 		present
 	};
 }
+/** Does `want`'s commit/tag ancestry (edge kinds 2,5) reach any oid in `common`?
+* The ancestry-only CTE that underpins `readyToGiveUp`. */
+async function ancestryReachesCommon(db, id, want, commonBufs) {
+	if (commonBufs.length === 0) return false;
+	const commons = sql.join(commonBufs.map((b) => sql`(${b}::bytea)`));
+	return (await sql`
+		with recursive anc(oid) as (
+			select ${Buffer.from(want, "hex")}::bytea
+			union
+			select e.child from git_edge e
+				join anc a on e.parent = a.oid
+				where e.repo_id = ${id}::bigint
+					and e.kind in (${EDGE_KIND.COMMIT_PARENT}, ${EDGE_KIND.TAG_TARGET})
+		)
+		select exists (
+			select 1 from anc join (values ${commons}) as c(oid) on c.oid = anc.oid
+		) as reached
+	`.execute(db)).rows[0]?.reached ?? false;
+}
 
 //#endregion
-//#region src/store/repo-resolver.ts
+//#region src/store/object-store.ts
+/** Objects fetched per round-trip when streaming content into a served pack. */
+const PACK_BATCH = 1e3;
 /**
-* Resolves a wire repo name to its `repos.id` surrogate, memoized. The object and
-* ref stores both key on the bigint `repo_id`, so each builds one of these as its
-* name→id boundary.
+* A stored object at/over this size is read in size-bounded chunks, never in one
+* round-trip. The porsager driver decodes a `bytea` RESULT from its text form
+* (`\x` + hex, DOUBLE the byte length), so a value over ~256MiB would build a JS
+* string past V8's max length and throw on the SERVE path — the read-side mirror of
+* the ingest string-cap that binary COPY fixed (a07/blb01). Kept well under the cap
+* so the doubled hex of a single chunk stays safely below it.
+*/
+const BIG_OBJECT_BYTES = 2e8;
+const READ_CHUNK_BYTES = 1e8;
+/** Split `items` into consecutive batches of at most `size`. */
+function batches(items, size) {
+	const out = [];
+	for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+	return out;
+}
+const TYPE_TO_CODE = {
+	blob: PACK_OBJ_TYPE.BLOB,
+	commit: PACK_OBJ_TYPE.COMMIT,
+	tag: PACK_OBJ_TYPE.TAG,
+	tree: PACK_OBJ_TYPE.TREE
+};
+const CODE_TO_TYPE = /* @__PURE__ */ new Map([
+	[PACK_OBJ_TYPE.BLOB, "blob"],
+	[PACK_OBJ_TYPE.COMMIT, "commit"],
+	[PACK_OBJ_TYPE.TAG, "tag"],
+	[PACK_OBJ_TYPE.TREE, "tree"]
+]);
+function typeFromCode(code) {
+	const type = CODE_TO_TYPE.get(code);
+	if (!type) throw new Error(`object-store: unknown git object type code ${code}`);
+	return type;
+}
+/**
+* Postgres-backed git object store. Each immutable object is one row in the
+* per-repo, HASH-partitioned `git_object` (raw 20-byte `bytea` OID, pack type
+* code, raw inflated body lz4-TOASTed Postgres-side) — packs are a transport
+* encoding produced on serve and consumed on ingest, never stored. So a fetch is
+* a primary-key point-read, not a whole-pack re-inflate.
 *
-* The mapping is immutable once a repo exists (ids are `generated always`, names
-* are unique), so a found id is cached for the resolver's lifetime — keeping the
-* per-object hot path (getObject) at one point-read, not a join. Misses are NEVER
-* cached: a name the lookup didn't find may be created by a later push, and a
-* cached `null` would mask it.
+* The store is the wire→DB boundary: callers speak hex OIDs and the wire repo
+* name; OIDs are coerced hex↔raw here, and the repo name is resolved to its
+* bigint surrogate (memoized) here.
+*/
+function createObjectStore(pg) {
+	const db = initKysely(pg);
+	const repos = createRepoResolver(db);
+	const store = {
+		/**
+		* Build the served pack for a fetch: the want-closure minus the have-closure,
+		* re-adding the explicit wants (promisor lazy-fetch roots — a partial clone may
+		* want a blob reachable from a tree it already has, so it must not be
+		* subtracted). The object count is known from the closure before any content is
+		* read; content then streams in keyset batches into the pack encoder, so only
+		* one batch of inflated content is ever held (never the whole repo).
+		*/
+		async buildPack(repoId, wants, haves, omitBlobs, includeTag = false) {
+			const id = await repos.resolveRepoId(repoId);
+			if (id === null || wants.length === 0) return writePack([]);
+			const served = await withPhase("closure", async () => {
+				const want = await reachableClosure(db, id, wants, omitBlobs);
+				if (want.missing.size > 0) throw new WantNotFoundError([...want.missing]);
+				const have = haves.length > 0 ? await reachableClosure(db, id, haves, omitBlobs) : {
+					missing: /* @__PURE__ */ new Set(),
+					present: /* @__PURE__ */ new Set()
+				};
+				const set = /* @__PURE__ */ new Set();
+				for (const o of want.present) if (!have.present.has(o)) set.add(o);
+				if (omitBlobs) {
+					for (const w of wants) if (want.present.has(w)) set.add(w);
+				}
+				if (includeTag) await augmentWithTags(id, set);
+				return [...set];
+			});
+			return withPhase("pack-encode", async () => {
+				const hash = createHash("sha1");
+				const parts = [];
+				const push = (chunk) => {
+					hash.update(chunk);
+					parts.push(chunk);
+				};
+				push(packHeader(served.length));
+				for (const batch of batches(served, PACK_BATCH)) {
+					const rows = await db.selectFrom("git_object").select(["oid", "type"]).select(sql`octet_length(content)`.as("size")).select(sql`case when octet_length(content) < ${BIG_OBJECT_BYTES} then content end`.as("content")).where("repo_id", "=", id).where("oid", "in", batch.map((h) => Buffer.from(h, "hex"))).execute();
+					for (const r of rows) {
+						const content = r.content ?? await readContentChunked(id, r.oid, r.size);
+						push(packObject(typeFromCode(r.type), content));
+					}
+				}
+				const pack = Buffer.concat([...parts, hash.digest()]);
+				count("objectsServed", served.length);
+				count("packBytes", pack.length);
+				return pack;
+			});
+		},
+		/** The subset of `haves` this repo actually has — the negotiation common set,
+		* in one indexed lookup rather than a per-have probe. */
+		async commonHaves(repoId, haves) {
+			if (haves.length === 0) return [];
+			const id = await repos.resolveRepoId(repoId);
+			if (id === null) return [];
+			const rows = await db.selectFrom("git_object").select("oid").where("repo_id", "=", id).where("oid", "in", haves.map((h) => Buffer.from(h, "hex"))).execute();
+			const present = new Set(rows.map((r) => r.oid.toString("hex")));
+			return haves.filter((h) => present.has(h));
+		},
+		async getObject(repoId, oid) {
+			count("getObjectCalls");
+			const id = await repos.resolveRepoId(repoId);
+			if (id === null) return null;
+			const row = await db.selectFrom("git_object").select(["type"]).select(sql`octet_length(content)`.as("size")).select(sql`case when octet_length(content) < ${BIG_OBJECT_BYTES} then content end`.as("content")).where("repo_id", "=", id).where("oid", "=", Buffer.from(oid, "hex")).executeTakeFirst();
+			if (!row) return null;
+			const content = row.content ?? await readContentChunked(id, Buffer.from(oid, "hex"), row.size);
+			count("objectBytesRead", content.length);
+			return {
+				content,
+				type: typeFromCode(row.type)
+			};
+		},
+		async hasObject(repoId, oid) {
+			const id = await repos.resolveRepoId(repoId);
+			if (id === null) return false;
+			return await db.selectFrom("git_object").select("oid").where("repo_id", "=", id).where("oid", "=", Buffer.from(oid, "hex")).executeTakeFirst() !== void 0;
+		},
+		/**
+		* Ingest a received pack: parse it — resolving in-pack deltas, and thin-pack
+		* REF_DELTA bases against objects already in this repo — then insert every
+		* resolved object as a row.
+		*/
+		async ingestPack(repoId, packBytes) {
+			return { oids: await insertObjects(await repos.ensureRepoId(repoId), (await readPack(packBytes, (oid) => store.getObject(repoId, oid))).map((p) => ({
+				content: p.content,
+				type: p.type
+			}))) };
+		},
+		/**
+		* Connectivity check (spec §5.2): is every object reachable from `oid` present?
+		* A push whose new tip fails this references an object the pack neither carried
+		* nor delta-resolved, and must be rejected. Delegates to the one reachability
+		* engine (`reachableClosure`) shared with clone/fetch, so connectivity and
+		* serving can never disagree on what is reachable. Full-closure (matching the
+		* old walk's scope); the bounded "new objects only" form is a deferred
+		* optimization (OQ-14).
+		*/
+		async isConnected(repoId, oid) {
+			const id = await repos.resolveRepoId(repoId);
+			if (id === null) return false;
+			const { missing } = await reachableClosure(db, id, [oid], false);
+			return missing.size === 0;
+		},
+		/** Seed objects directly (the differential harness + perf bench path): insert
+		* each as a row, idempotently. Equivalent to `ingestPack` minus the pack codec. */
+		async putPack(repoId, objects) {
+			return { oids: await insertObjects(await repos.ensureRepoId(repoId), objects) };
+		},
+		/**
+		* git's `ok_to_give_up`: ready once every want reaches a common have by commit/
+		* tag ancestry (the haves form a cut below all wants, so the delta is well-
+		* defined). One ancestry CTE (edge kinds 2,5) per want replaces `reachesCommon`'s
+		* per-object BFS. Generation-number pruning is a deferred §6.4 lever.
+		*/
+		async readyToGiveUp(repoId, wants, common) {
+			if (common.length === 0) return false;
+			const id = await repos.resolveRepoId(repoId);
+			if (id === null) return false;
+			const commonBufs = common.map((h) => Buffer.from(h, "hex"));
+			for (const want of wants) if (!await ancestryReachesCommon(db, id, want, commonBufs)) return false;
+			return true;
+		}
+	};
+	/** Insert objects as rows + their derived edges, idempotent (re-sent objects are
+	* skipped). Each object row and its complete edge set go in ONE transaction from
+	* ONE derivation (§10.1) — so no object ever exists without its edges. Edge
+	* derivation validates at the boundary and throws on malformed content (§5.1),
+	* aborting the ingest before any row lands. Returns every object's hex OID, in
+	* input order. */
+	async function insertObjects(id, objects) {
+		const entries = objects.map((obj) => {
+			validateObject(obj.type, obj.content);
+			const hex = computeOid(obj.type, obj.content);
+			const oid = Buffer.from(hex, "hex");
+			return {
+				edges: deriveEdges(obj.type, obj.content).map((e) => ({
+					child: Buffer.from(e.child, "hex"),
+					kind: e.kind,
+					parent: oid,
+					repo_id: id
+				})),
+				hex,
+				row: {
+					content: obj.content,
+					oid,
+					repo_id: id,
+					size: obj.content.length,
+					type: TYPE_TO_CODE[obj.type]
+				}
+			};
+		});
+		if (entries.length === 0) return [];
+		const objectRows = entries.map((e) => [
+			{
+				t: "int8",
+				v: e.row.repo_id
+			},
+			{
+				t: "bytea",
+				v: e.row.oid
+			},
+			{
+				t: "int2",
+				v: e.row.type
+			},
+			{
+				t: "int4",
+				v: e.row.size
+			},
+			{
+				t: "bytea",
+				v: e.row.content
+			}
+		]);
+		const edgeRows = entries.flatMap((e) => e.edges.map((edge) => [
+			{
+				t: "int8",
+				v: edge.repo_id
+			},
+			{
+				t: "bytea",
+				v: edge.parent
+			},
+			{
+				t: "bytea",
+				v: edge.child
+			},
+			{
+				t: "int2",
+				v: edge.kind
+			}
+		]));
+		await pg.begin(async (tx) => {
+			await copyInsert(tx, "git_object", [
+				"repo_id",
+				"oid",
+				"type",
+				"size",
+				"content"
+			], objectRows);
+			await copyInsert(tx, "git_edge", [
+				"repo_id",
+				"parent",
+				"child",
+				"kind"
+			], edgeRows);
+		});
+		await pg`update repos set last_pushed_at = clock_timestamp() where id = ${id}::bigint`;
+		return entries.map((e) => e.hex);
+	}
+	/**
+	* Read a single object's `content` in size-bounded chunks via `substring`, so a
+	* blob larger than V8's max string length never reaches the porsager driver as one
+	* over-cap `\x`+hex string — the serve-side mirror of the binary COPY ingest. Used
+	* only for objects at/over BIG_OBJECT_BYTES (smaller content comes back inline).
+	*/
+	async function readContentChunked(id, oid, size) {
+		const parts = [];
+		for (let off = 0; off < size; off += READ_CHUNK_BYTES) {
+			const len = Math.min(READ_CHUNK_BYTES, size - off);
+			const row = await db.selectFrom("git_object").select(sql`substring(content from ${off + 1} for ${len})`.as("chunk")).where("repo_id", "=", id).where("oid", "=", oid).executeTakeFirstOrThrow();
+			parts.push(row.chunk);
+		}
+		return Buffer.concat(parts);
+	}
+	/**
+	* include-tag augmentation (§6.5): annotated tags whose peeled target is in the
+	* served set get their tag OBJECTS added — transitively over `kind=5`, so a
+	* tag-of-tag chain ships every tag object in it (each must be present for the
+	* client's fsck). Annotated tags are few, so we fetch them all and filter by
+	* served membership app-side rather than feeding the whole served set into SQL.
+	* Mutates `served`. Peeled targets are already in `served` (they qualified the
+	* tag), so re-adding the chain's terminal commit is a no-op.
+	*/
+	async function augmentWithTags(id, served) {
+		const qualifying = (await db.selectFrom("git_ref").select(["oid", "peeled_oid"]).where("repo_id", "=", id).where("oid", "is not", null).where("peeled_oid", "is not", null).execute()).filter((r) => r.peeled_oid !== null && served.has(r.peeled_oid.toString("hex"))).map((r) => r.oid.toString("hex"));
+		if (qualifying.length === 0) return;
+		const chain = await sql`
+			with recursive tags(oid) as (
+				select oid from (values ${sql.join(qualifying.map((r) => sql`(${Buffer.from(r, "hex")}::bytea)`))}) as roots(oid)
+				union
+				select e.child from git_edge e
+					join tags t on e.parent = t.oid
+					where e.repo_id = ${id}::bigint and e.kind = ${EDGE_KIND.TAG_TARGET}
+			)
+			select oid from tags
+		`.execute(db);
+		for (const r of chain.rows) served.add(r.oid.toString("hex"));
+	}
+	return store;
+}
+
+//#endregion
+//#region src/store/refs-store.ts
+const isZero = (oid) => /^0{40}$/.test(oid);
+const toOid = (hex) => Buffer.from(hex, "hex");
+function classifyRefUpdate(cmd) {
+	const create = isZero(cmd.oldOid);
+	if (isZero(cmd.newOid)) return {
+		kind: "delete",
+		oldOid: create ? null : toOid(cmd.oldOid)
+	};
+	if (create) return {
+		kind: "create",
+		newOid: toOid(cmd.newOid)
+	};
+	return {
+		kind: "update",
+		newOid: toOid(cmd.newOid),
+		oldOid: toOid(cmd.oldOid)
+	};
+}
+/**
+* The peeled target of a ref oid: if it is an annotated tag, follow the `kind=5`
+* (tag→target) chain — while the current node is a tag — to its terminal non-tag
+* object. A branch or a lightweight tag (the oid is not a tag object) peels to
+* `null` → `ls-refs` emits no `peeled` line. git imposes NO depth bound on ref
+* peeling, so neither do we: the `is_tag` predicate terminates the recursion at the
+* first non-tag, and a content-addressed tag chain is acyclic (an oid cannot embed
+* its own hash) hence finite. Computed at ref-write, so the tag's edges + target
+* are already present (connectivity proved the chain on push). Replaces the
+* per-`ls-refs` app-side tag walk.
+*/
+async function peelRef(exec, repoId, oid) {
+	return (await sql`
+		with recursive chain(oid, is_tag, depth) as (
+			select o.oid, o.type = ${PACK_OBJ_TYPE.TAG}, 0
+				from git_object o
+				where o.repo_id = ${repoId}::bigint and o.oid = ${oid}::bytea
+			union all
+			select e.child, co.type = ${PACK_OBJ_TYPE.TAG}, c.depth + 1
+				from chain c
+				join git_edge e
+					on e.repo_id = ${repoId}::bigint
+					and e.parent = c.oid
+					and e.kind = ${EDGE_KIND.TAG_TARGET}
+				left join git_object co
+					on co.repo_id = ${repoId}::bigint and co.oid = e.child
+				where c.is_tag
+		)
+		select oid as peeled from chain where not is_tag and depth > 0
+			order by depth desc limit 1
+	`.execute(exec)).rows[0]?.peeled ?? null;
+}
+/** Sentinel thrown inside a transaction to roll an atomic batch all the way back. */
+var AtomicAbort = class extends Error {};
+/**
+* A repo is born with `HEAD → refs/heads/main`, mirroring `git init --bare`
+* (init.defaultBranch). Established lazily on the first ref write — a repo's birth
+* is its first push — and never overwritten (do-nothing on conflict). So once the
+* default branch exists `ls-refs` advertises HEAD and a clone checks it out;
+* before then HEAD dangles unadvertised, exactly like a bare repo whose HEAD
+* points at an unborn `main`.
+*/
+const DEFAULT_HEAD_TARGET = "refs/heads/main";
+async function ensureHeadDefault(exec, repoId) {
+	await exec.insertInto("git_ref").values({
+		name: "HEAD",
+		repo_id: repoId,
+		symref_target: DEFAULT_HEAD_TARGET
+	}).onConflict((oc) => oc.columns(["repo_id", "name"]).doNothing()).execute();
+}
+/**
+* Stamp the repo's GC-activity watermark (`repos.last_pushed_at`) — a ref change
+* makes the prior tip a reclaim candidate, so the self-scheduling drain must judge
+* the repo eligible (gc-scheduler.ts §2). Called only when a ref ROW actually
+* changed (not on a no-op success like deleting an absent ref), so non-mutating
+* traffic never re-triggers GC. A tiny single-row HOT update on the churn-tuned
+* `repos` (0004); `clock_timestamp()` is the server-side wall clock.
+*/
+async function stampPushed(exec, repoId) {
+	await exec.updateTable("repos").set({ last_pushed_at: sql`clock_timestamp()` }).where("id", "=", repoId).execute();
+}
+/**
+* Apply one ref change by compare-and-swap against the client's advertised old
+* oid, on the given executor (the db, or a transaction for an atomic batch).
+* Returns the report-status `ok` and whether a row actually changed (`mutated`).
+* Non-ff is accepted by default — CAS guards concurrency, not ancestry (spec §3.6).
+*/
+async function casRefUpdate(exec, repoId, cmd) {
+	const name = cmd.ref;
+	const op = classifyRefUpdate(cmd);
+	switch (op.kind) {
+		case "create": {
+			const peeled = await peelRef(exec, repoId, op.newOid);
+			const mutated = (await exec.insertInto("git_ref").values({
+				name,
+				oid: op.newOid,
+				peeled_oid: peeled,
+				repo_id: repoId
+			}).onConflict((oc) => oc.doNothing()).returningAll().execute()).length === 1;
+			return {
+				mutated,
+				ok: mutated
+			};
+		}
+		case "delete": {
+			let q = exec.deleteFrom("git_ref").where("repo_id", "=", repoId).where("name", "=", name);
+			if (op.oldOid !== null) q = q.where("oid", "=", op.oldOid);
+			const mutated = (await q.returningAll().execute()).length === 1;
+			return {
+				mutated,
+				ok: op.oldOid === null || mutated
+			};
+		}
+		case "update": {
+			const peeled = await peelRef(exec, repoId, op.newOid);
+			const mutated = (await exec.updateTable("git_ref").set({
+				oid: op.newOid,
+				peeled_oid: peeled,
+				symref_target: null
+			}).where("repo_id", "=", repoId).where("name", "=", name).where("oid", "=", op.oldOid).returningAll().execute()).length === 1;
+			return {
+				mutated,
+				ok: mutated
+			};
+		}
+	}
+}
+/**
+* Postgres-backed git refs: direct refs (name → oid) and symbolic refs
+* (HEAD → refs/heads/...). Push applies ref changes through `applyRefUpdates`;
+* `setRef`/`setSymref` are the seeding helpers.
 *
-* Reads resolve (lookup; `null` ⇒ the repo has never been written, i.e. empty).
-* Writes ensure (race-safe get-or-create).
+* Like the object store, this is the wire→DB boundary: the repo name resolves to
+* its bigint surrogate (memoized) here, ref names cast to their branded column
+* type, and oids coerce hex↔raw `bytea`.
 */
-function createRepoResolver(db) {
-	const cache = /* @__PURE__ */ new Map();
+function createRefStore(pg) {
+	const db = initKysely(pg);
+	const repos = createRepoResolver(db);
 	return {
-		/** The repo's id, creating the row if absent. Race-safe under concurrent
-		* first-pushes, and avoids a no-op UPDATE on the common (exists) path. */
-		async ensureRepoId(name) {
-			const cached = cache.get(name);
-			if (cached !== void 0) return cached;
-			const existing = await db.selectFrom("repos").select("id").where("name", "=", name).executeTakeFirst();
-			if (existing) {
-				cache.set(name, existing.id);
-				return existing.id;
+		/**
+		* Apply a batch of ref CAS updates. Non-atomic (the default push mode): each
+		* ref is independent and the returned flags are per-command. Atomic
+		* (`--atomic`): all-or-nothing in one transaction — if any CAS fails, every
+		* command is rolled back and the result is all-false (spec §3.6).
+		*/
+		async applyRefUpdates(repoId, commands, atomic) {
+			const id = await repos.ensureRepoId(repoId);
+			await ensureHeadDefault(db, id);
+			if (!atomic) {
+				const results = [];
+				let mutated = false;
+				for (const cmd of commands) {
+					const r = await casRefUpdate(db, id, cmd);
+					results.push(r.ok);
+					if (r.mutated) mutated = true;
+				}
+				if (mutated) await stampPushed(db, id);
+				return results;
 			}
-			const id = (await db.insertInto("repos").values({ name }).onConflict((oc) => oc.doNothing()).returning("id").executeTakeFirst())?.id ?? (await db.selectFrom("repos").select("id").where("name", "=", name).executeTakeFirstOrThrow()).id;
-			cache.set(name, id);
-			return id;
+			const ordered = [...commands].sort((a, b) => a.ref < b.ref ? -1 : a.ref > b.ref ? 1 : 0);
+			let anyMutated = false;
+			try {
+				await db.transaction().execute(async (trx) => {
+					for (const cmd of ordered) {
+						const r = await casRefUpdate(trx, id, cmd);
+						if (!r.ok) throw new AtomicAbort();
+						if (r.mutated) anyMutated = true;
+					}
+				});
+			} catch (error) {
+				if (error instanceof AtomicAbort) return commands.map(() => false);
+				throw error;
+			}
+			if (anyMutated) await stampPushed(db, id);
+			return commands.map(() => true);
 		},
-		/** The repo's id, or `null` if it has never been written to. */
-		async resolveRepoId(name) {
-			const cached = cache.get(name);
-			if (cached !== void 0) return cached;
-			const row = await db.selectFrom("repos").select("id").where("name", "=", name).executeTakeFirst();
-			if (!row) return null;
-			cache.set(name, row.id);
-			return row.id;
+		async getSymref(repoId, name) {
+			const id = await repos.resolveRepoId(repoId);
+			if (id === null) return null;
+			return (await db.selectFrom("git_ref").select("symref_target").where("repo_id", "=", id).where("name", "=", name).executeTakeFirst())?.symref_target ?? null;
+		},
+		/** Direct refs (name → oid + peeled tag target), sorted by name. Excludes
+		* symbolic refs. */
+		async listRefs(repoId) {
+			const id = await repos.resolveRepoId(repoId);
+			if (id === null) return [];
+			return (await db.selectFrom("git_ref").select([
+				"name",
+				"oid",
+				"peeled_oid"
+			]).where("repo_id", "=", id).where("oid", "is not", null).orderBy("name").execute()).map((r) => ({
+				name: r.name,
+				oid: r.oid.toString("hex"),
+				peeled: r.peeled_oid ? r.peeled_oid.toString("hex") : void 0
+			}));
+		},
+		async setRef(repoId, name, oid) {
+			const id = await repos.ensureRepoId(repoId);
+			const value = toOid(oid);
+			const peeled = await peelRef(db, id, value);
+			await db.insertInto("git_ref").values({
+				name,
+				oid: value,
+				peeled_oid: peeled,
+				repo_id: id
+			}).onConflict((oc) => oc.columns(["repo_id", "name"]).doUpdateSet({
+				oid: value,
+				peeled_oid: peeled,
+				symref_target: null
+			})).execute();
+		},
+		async setSymref(repoId, name, target) {
+			const id = await repos.ensureRepoId(repoId);
+			await db.insertInto("git_ref").values({
+				name,
+				repo_id: id,
+				symref_target: target
+			}).onConflict((oc) => oc.columns(["repo_id", "name"]).doUpdateSet({
+				oid: null,
+				peeled_oid: null,
+				symref_target: target
+			})).execute();
 		}
 	};
 }
@@ -1268,6 +2292,21 @@ async function readRequestBody(c) {
 function assertProtocolV2(header) {
 	if (!(header ?? "").split(":").map((s) => s.trim()).includes("version=2")) throw new GitProtocolError("pggit serves fetch over git protocol v2 only; set protocol.version=2 (git ≥ 2.26 negotiates it by default)");
 }
+const GIT_PATH_SUFFIXES = [
+	["/info/refs", "info/refs"],
+	["/git-upload-pack", "git-upload-pack"],
+	["/git-receive-pack", "git-receive-pack"]
+];
+function parseGitPath(path) {
+	for (const [suffix, service] of GIT_PATH_SUFFIXES) if (path.endsWith(suffix)) {
+		const repoId = path.slice(1, -suffix.length);
+		return repoId.length > 0 ? {
+			repoId,
+			service
+		} : null;
+	}
+	return null;
+}
 function backendFor(deps, repoId) {
 	return {
 		buildPack: (wants, haves, omitBlobs, includeTag) => deps.objects.buildPack(repoId, wants, haves, omitBlobs, includeTag),
@@ -1305,7 +2344,8 @@ async function receivePackAdvertBody(deps, repoId) {
 }
 /**
 * Build the git-remote Hono app (smart-HTTP, protocol v2 fetch). Mountable into
-* a host app via `host.route("/git", createGitApp(deps))`; the host owns the
+* a host app via `host.mount("/git", createGitApp(deps).fetch)` (mount, NOT route —
+* mount strips the prefix so the catch-all parses a mount-relative path); the host owns the
 * Postgres lifecycle behind `deps`.
 */
 function createGitApp(deps, opts = {}) {
@@ -1321,7 +2361,9 @@ function createGitApp(deps, opts = {}) {
 		return c.text("internal server error", 500);
 	});
 	app.get("/health", (c) => c.text("ok"));
-	app.get("/:repo/info/refs", async (c) => {
+	app.get("/*", async (c) => {
+		const parsed = parseGitPath(c.req.path);
+		if (parsed?.service !== "info/refs") return c.notFound();
 		const service = c.req.query("service");
 		if (service === "git-upload-pack") {
 			assertProtocolV2(c.req.header("git-protocol"));
@@ -1331,7 +2373,7 @@ function createGitApp(deps, opts = {}) {
 			});
 		}
 		if (service === "git-receive-pack") {
-			const body = await receivePackAdvertBody(deps, c.req.param("repo"));
+			const body = await receivePackAdvertBody(deps, parsed.repoId);
 			return c.body(toArrayBuffer(body), 200, {
 				"Cache-Control": "no-cache",
 				"Content-Type": "application/x-git-receive-pack-advertisement"
@@ -1339,24 +2381,46 @@ function createGitApp(deps, opts = {}) {
 		}
 		return c.text(`unsupported service ${JSON.stringify(service)}`, 403);
 	});
-	app.post("/:repo/git-upload-pack", async (c) => {
-		const out = await handleUploadPack(await readRequestBody(c), backendFor(deps, c.req.param("repo")));
-		count("wireBytes", out.length);
-		return c.body(toArrayBuffer(out), 200, {
-			"Cache-Control": "no-cache",
-			"Content-Type": "application/x-git-upload-pack-result"
-		});
-	});
-	app.post("/:repo/git-receive-pack", async (c) => {
-		const out = await handleReceivePack(await readRequestBody(c), receiveBackendFor(deps, c.req.param("repo")));
-		return c.body(toArrayBuffer(out), 200, {
-			"Cache-Control": "no-cache",
-			"Content-Type": "application/x-git-receive-pack-result"
-		});
+	app.post("/*", async (c) => {
+		const parsed = parseGitPath(c.req.path);
+		if (!parsed) return c.notFound();
+		if (parsed.service === "git-upload-pack") {
+			const out = await handleUploadPack(await readRequestBody(c), backendFor(deps, parsed.repoId));
+			count("wireBytes", out.length);
+			return c.body(toArrayBuffer(out), 200, {
+				"Cache-Control": "no-cache",
+				"Content-Type": "application/x-git-upload-pack-result"
+			});
+		}
+		if (parsed.service === "git-receive-pack") {
+			const out = await handleReceivePack(await readRequestBody(c), receiveBackendFor(deps, parsed.repoId));
+			return c.body(toArrayBuffer(out), 200, {
+				"Cache-Control": "no-cache",
+				"Content-Type": "application/x-git-receive-pack-result"
+			});
+		}
+		return c.notFound();
 	});
 	return app;
 }
+/**
+* Build the git-app deps from a Postgres connection — the embed-into-a-host
+* factory. The host owns the `pg` lifecycle and mounts pggit with
+* `host.mount("/git", createGitApp(createGitDeps(pg)).fetch)` — `app.mount` strips
+* the mount prefix so the catch-all parse sees a mount-relative path (`app.route`
+* would not). `startServer` (server.ts) is the standalone equivalent of this same
+* composition. `snapshots` is always
+* included so a mounted host gets the queryable `repo_file` projection maintained
+* on push (the read surface).
+*/
+function createGitDeps(pg) {
+	return {
+		objects: createObjectStore(pg),
+		refs: createRefStore(pg),
+		snapshots: createRepoFileProjection(pg)
+	};
+}
 
 //#endregion
-export { createGc, createGcScheduler, createGitApp };
+export { createGc, createGcScheduler, createGitApp, createGitDeps };
 //# sourceMappingURL=index.mjs.map