codexgpt 1.0.0

package/dist/git/repositoryStore.js

@@ -0,0 +1,237 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHmac, randomBytes as nodeRandomBytes } from "node:crypto";
+import { z } from "zod";
+import { AtomicJsonFileStore } from "../transactions/atomicStateFile.js";
+import { deriveGateRSubkey, gateRError, gateRRecordMac, gitStateDirectories, openGitState, sealGitState, verifyGateRRecordMac } from "./durableState.js";
+const timestampSchema = z.string().datetime({ offset: true });
+const sealedSchema = z.object({
+    schemaVersion: z.literal(1),
+    iv: z.string().min(16).max(32),
+    ciphertext: z.string().min(4).max(400_000),
+    tag: z.string().min(20).max(32)
+}).strict();
+const recordSchema = z.object({
+    schemaVersion: z.literal(1),
+    repositoryStateKey: z.string().regex(/^grs_[a-f0-9]{32}$/),
+    repositoryId: z.string().regex(/^repo_[a-f0-9]{32}$/),
+    generation: z.number().int().positive().safe(),
+    state: z.enum(["active", "recovery_required"]),
+    stableIdentityFingerprint: z.string().regex(/^[a-f0-9]{64}$/),
+    repositoryFingerprint: z.string().regex(/^[a-f0-9]{64}$/),
+    capabilityRevision: z.string().regex(/^[a-f0-9]{64}$/),
+    objectFormat: z.enum(["sha1", "sha256"]),
+    refStorage: z.enum(["files", "reftable"]),
+    worktreeStateKeys: z.array(z.string().regex(/^gws_[a-f0-9]{32}$/)).max(64)
+        .refine((values) => new Set(values).size === values.length),
+    recoveryCode: z.string().min(1).max(160).regex(/^[A-Z][A-Z0-9_]*$/).nullable(),
+    privateState: sealedSchema,
+    createdAt: timestampSchema,
+    updatedAt: timestampSchema,
+    recordMac: z.string().regex(/^[a-f0-9]{64}$/)
+}).strict().superRefine((value, context) => {
+    if ((value.state === "recovery_required") !== (value.recoveryCode !== null)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["recoveryCode"], message: "Repository recovery state is inconsistent." });
+    }
+});
+function timestamp(now) {
+    const value = new Date(now()).toISOString();
+    if (value === "Invalid Date")
+        throw gateRError();
+    return value;
+}
+function withoutMac(record) {
+    const { recordMac: _recordMac, ...rest } = record;
+    return rest;
+}
+function privateStateSchema(value) {
+    try {
+        return z.object({
+            worktreeRoot: z.string().min(1).max(32_768),
+            gitDir: z.string().min(1).max(32_768),
+            commonDir: z.string().min(1).max(32_768)
+        }).strict().parse(value);
+    }
+    catch {
+        throw gateRError();
+    }
+}
+export function repositoryStateKeyForIdentity(stableIdentityFingerprint, key) {
+    if (!/^[a-f0-9]{64}$/.test(stableIdentityFingerprint) || key.length !== 32)
+        throw gateRError();
+    return `grs_${createHmac("sha256", key)
+        .update("repository-state\0", "utf8")
+        .update(stableIdentityFingerprint, "utf8")
+        .digest("hex").slice(0, 32)}`;
+}
+export function durableRepositoryIdForIdentity(stableIdentityFingerprint, key) {
+    if (!/^[a-f0-9]{64}$/.test(stableIdentityFingerprint) || key.length !== 32)
+        throw gateRError();
+    return `repo_${createHmac("sha256", key)
+        .update("repository-public-id\0", "utf8")
+        .update(stableIdentityFingerprint, "utf8")
+        .digest("hex").slice(0, 32)}`;
+}
+export class GitRepositoryStore {
+    #stateRoot;
+    #directory;
+    #atomic;
+    #stateKey;
+    #publicIdKey;
+    #encryptionKey;
+    #recordKey;
+    #now;
+    #randomBytes;
+    #disposed = false;
+    constructor(options) {
+        this.#stateRoot = path.resolve(options.stateRoot);
+        this.#directory = gitStateDirectories(this.#stateRoot).repositories;
+        this.#atomic = new AtomicJsonFileStore(this.#stateRoot, recordSchema);
+        this.#stateKey = deriveGateRSubkey(options.masterKey, "repository-state-key");
+        this.#publicIdKey = deriveGateRSubkey(options.masterKey, "repository-public-id");
+        this.#encryptionKey = deriveGateRSubkey(options.masterKey, "repository-private-state");
+        this.#recordKey = deriveGateRSubkey(options.masterKey, "repository-record-mac");
+        this.#now = options.now ?? Date.now;
+        this.#randomBytes = options.randomBytes ?? nodeRandomBytes;
+    }
+    recordPath(repositoryStateKey) {
+        this.#assertOpen();
+        if (!/^grs_[a-f0-9]{32}$/.test(repositoryStateKey))
+            throw gateRError();
+        return path.join(this.#directory, `${repositoryStateKey}.json`);
+    }
+    register(identity) {
+        this.#assertOpen();
+        const repositoryStateKey = repositoryStateKeyForIdentity(identity.stableIdentityFingerprint, this.#stateKey);
+        const repositoryId = durableRepositoryIdForIdentity(identity.stableIdentityFingerprint, this.#publicIdKey);
+        const file = this.recordPath(repositoryStateKey);
+        if (fs.existsSync(file)) {
+            const existing = this.read(repositoryStateKey).record;
+            if (existing.repositoryId !== repositoryId ||
+                existing.stableIdentityFingerprint !== identity.stableIdentityFingerprint ||
+                existing.capabilityRevision !== identity.capabilityRevision ||
+                existing.objectFormat !== identity.objectFormat ||
+                existing.refStorage !== identity.refStorage)
+                throw gateRError();
+            return existing;
+        }
+        const at = timestamp(this.#now);
+        const privateState = sealGitState(this.#encryptionKey, `git-repository-v1:${repositoryStateKey}`, privateStateSchema({
+            worktreeRoot: identity.worktreeRoot,
+            gitDir: identity.gitDir,
+            commonDir: identity.commonDir
+        }), this.#randomBytes);
+        const unsigned = {
+            schemaVersion: 1,
+            repositoryStateKey,
+            repositoryId,
+            generation: 1,
+            state: "active",
+            stableIdentityFingerprint: identity.stableIdentityFingerprint,
+            repositoryFingerprint: identity.repositoryFingerprint,
+            capabilityRevision: identity.capabilityRevision,
+            objectFormat: identity.objectFormat,
+            refStorage: identity.refStorage,
+            worktreeStateKeys: [],
+            recoveryCode: null,
+            privateState,
+            createdAt: at,
+            updatedAt: at
+        };
+        let record;
+        try {
+            record = recordSchema.parse({
+                ...unsigned,
+                recordMac: gateRRecordMac(this.#recordKey, unsigned)
+            });
+        }
+        catch {
+            throw gateRError();
+        }
+        try {
+            this.#atomic.write(file, record);
+        }
+        catch {
+            throw gateRError();
+        }
+        return Object.freeze(record);
+    }
+    read(repositoryStateKey) {
+        this.#assertOpen();
+        try {
+            const record = recordSchema.parse(this.#atomic.read(this.recordPath(repositoryStateKey)));
+            verifyGateRRecordMac(this.#recordKey, withoutMac(record), record.recordMac);
+            const privateState = privateStateSchema(openGitState(this.#encryptionKey, `git-repository-v1:${repositoryStateKey}`, record.privateState));
+            return { record: Object.freeze(record), privateState: Object.freeze(privateState) };
+        }
+        catch {
+            throw gateRError();
+        }
+    }
+    list() {
+        this.#assertOpen();
+        let names;
+        try {
+            names = fs.readdirSync(this.#directory);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return [];
+            throw gateRError();
+        }
+        return names.filter((name) => /^grs_[a-f0-9]{32}\.json$/.test(name)).sort()
+            .map((name) => this.read(name.slice(0, -5)).record);
+    }
+    markRecoveryRequired(repositoryStateKey, recoveryCode) {
+        this.#assertOpen();
+        if (!/^[A-Z][A-Z0-9_]{0,159}$/.test(recoveryCode))
+            throw gateRError();
+        const current = this.read(repositoryStateKey).record;
+        if (current.state === "recovery_required")
+            return current;
+        const unsigned = {
+            ...withoutMac(current),
+            generation: current.generation + 1,
+            state: "recovery_required",
+            recoveryCode,
+            updatedAt: timestamp(this.#now)
+        };
+        let next;
+        try {
+            next = recordSchema.parse({ ...unsigned, recordMac: gateRRecordMac(this.#recordKey, unsigned) });
+        }
+        catch {
+            throw gateRError();
+        }
+        try {
+            const persisted = this.read(repositoryStateKey).record;
+            if (persisted.generation !== current.generation || persisted.recordMac !== current.recordMac)
+                throw gateRError();
+            this.#atomic.write(this.recordPath(repositoryStateKey), next);
+            return Object.freeze(next);
+        }
+        catch {
+            throw gateRError();
+        }
+    }
+    activate(repositoryStateKey) {
+        const current = this.read(repositoryStateKey).record;
+        if (current.state !== "active")
+            throw gateRError();
+        return current;
+    }
+    dispose() {
+        if (this.#disposed)
+            return;
+        this.#disposed = true;
+        this.#stateKey.fill(0);
+        this.#publicIdKey.fill(0);
+        this.#encryptionKey.fill(0);
+        this.#recordKey.fill(0);
+    }
+    #assertOpen() {
+        if (this.#disposed)
+            throw gateRError();
+    }
+}
+//# sourceMappingURL=repositoryStore.js.map

package/dist/git/repositoryStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repositoryStore.js","sourceRoot":"","sources":["../../src/git/repositoryStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,oBAAoB,EAErB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,MAAM,YAAY,GAAgC,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAChC,CAAC,CAAC,MAAM,EAAE,CAAC;AA2BZ,MAAM,YAAY,GAAqC,CAAC,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAC1D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;IAC9C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC9C,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC7D,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACzD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACtD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;SACvE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC;IAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAC9E,YAAY,EAAE,YAAY;IAC1B,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;CAC9C,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACzC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;IACnI,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,GAAiB;IAClC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,KAAK,cAAc;QAAE,MAAM,UAAU,EAAE,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,MAA6B;IAC/C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,MAAM,CAAC;YACd,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;SACzC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,yBAAiC,EACjC,GAAW;IAEX,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,UAAU,EAAE,CAAC;IAC/F,OAAO,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACpC,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC;SACpC,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAAC;SACzC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,yBAAiC,EACjC,GAAW;IAEX,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,UAAU,EAAE,CAAC;IAC/F,OAAO,QAAQ,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACrC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC;SACxC,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAAC;SACzC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,OAAO,CAA6C;IACpD,SAAS,CAAS;IAClB,YAAY,CAAS;IACrB,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,IAAI,CAAe;IACnB,YAAY,CAA2B;IAChD,SAAS,GAAG,KAAK,CAAC;IAElB,YAAY,OAKX;QACC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC;QACpE,IAAI,CAAC,OAAO,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;QACjF,IAAI,CAAC,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;IAC7D,CAAC;IAED,UAAU,CAAC,kBAA0B;QACnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAAE,MAAM,UAAU,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,kBAAkB,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,QAAQ,CAAC,QAA+B;QACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,QAAQ,CAAC,yBAAyB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7G,MAAM,YAAY,GAAG,8BAA8B,CAAC,QAAQ,CAAC,yBAAyB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;YACtD,IACE,QAAQ,CAAC,YAAY,KAAK,YAAY;gBACtC,QAAQ,CAAC,yBAAyB,KAAK,QAAQ,CAAC,yBAAyB;gBACzE,QAAQ,CAAC,kBAAkB,KAAK,QAAQ,CAAC,kBAAkB;gBAC3D,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;gBAC/C,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;gBAC3C,MAAM,UAAU,EAAE,CAAC;YACrB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG,YAAY,CAC/B,IAAI,CAAC,cAAc,EACnB,qBAAqB,kBAAkB,EAAE,EACzC,kBAAkB,CAAC;YACjB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,CAAC,EACF,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,MAAM,QAAQ,GAA6C;YACzD,aAAa,EAAE,CAAC;YAChB,kBAAkB;YAClB,YAAY;YACZ,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,QAAQ;YACf,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;YAC7D,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;YACrD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,iBAAiB,EAAE,EAAE;YACrB,YAAY,EAAE,IAAI;YAClB,YAAY;YACZ,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;SACd,CAAC;QACF,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC;gBAC1B,GAAG,QAAQ;gBACX,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC,kBAA0B;QAI7B,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YAC1F,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5E,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAClD,IAAI,CAAC,cAAc,EACnB,qBAAqB,kBAAkB,EAAE,EACzC,MAAM,CAAC,YAAY,CACpB,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAClE,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;aACxE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAED,oBAAoB,CAAC,kBAA0B,EAAE,YAAoB;QACnE,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,MAAM,UAAU,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;QACrD,IAAI,OAAO,CAAC,KAAK,KAAK,mBAAmB;YAAE,OAAO,OAAO,CAAC;QAC1D,MAAM,QAAQ,GAA6C;YACzD,GAAG,UAAU,CAAC,OAAO,CAAC;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC;YAClC,KAAK,EAAE,mBAAmB;YAC1B,YAAY;YACZ,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAChC,CAAC;QACF,IAAI,IAA2B,CAAC;QAChC,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;YACvD,IAAI,SAAS,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBAAE,MAAM,UAAU,EAAE,CAAC;YACjH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,kBAA0B;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;QACrD,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,UAAU,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,UAAU,EAAE,CAAC;IACzC,CAAC;CACF"}

package/dist/git/resources.js

@@ -0,0 +1,113 @@
+import { computeGitResourceV4Fingerprint, gitResourceV4Schema } from "../policy/schemas.js";
+import { gateRError } from "./durableState.js";
+function scopes(...values) {
+    return Object.freeze(values);
+}
+function definition(riskClass, requiredScopes, handlerState = "disabled") {
+    return Object.freeze({
+        riskClass,
+        requiredScopes,
+        resourceMode: "resolved",
+        handlerState
+    });
+}
+const OPERATION_DEFINITIONS = Object.freeze({
+    read: definition("R0", scopes("git:read"), "enabled"),
+    create_branch: definition("R3", scopes("git:refs:write"), "enabled"),
+    stage: definition("R2", scopes("git:index:write", "filesystem:read"), "enabled"),
+    commit: definition("R3", scopes("git:commit", "git:refs:write"), "enabled"),
+    restore_review: definition("R1", scopes("git:read"), "enabled"),
+    restore_execute: definition("R3", scopes("git:index:write", "filesystem:write"), "enabled"),
+    stash_list: definition("R0", scopes("git:read"), "enabled"),
+    stash_create: definition("R3", scopes("git:index:write", "git:refs:write", "filesystem:write"), "enabled"),
+    stash_apply_review: definition("R1", scopes("git:read"), "enabled"),
+    stash_apply_execute: definition("R3", scopes("git:index:write", "filesystem:write"), "enabled"),
+    stash_forget_review: definition("R1", scopes("git:read"), "enabled"),
+    stash_forget_execute: definition("R3", scopes("git:refs:write"), "enabled"),
+    task_create_review: definition("R2", scopes("worktree:manage", "filesystem:read"), "enabled"),
+    task_create: definition("R3", scopes("worktree:manage", "git:refs:write"), "enabled"),
+    task_list: definition("R0", scopes("git:read"), "enabled"),
+    task_get: definition("R0", scopes("git:read"), "enabled"),
+    task_merge_prepare_review: definition("R2", scopes("git:merge"), "enabled"),
+    task_merge_prepare_finalize: definition("R3", scopes("git:merge", "git:refs:write"), "enabled"),
+    task_merge_execute: definition("R3", scopes("git:merge", "git:refs:write", "filesystem:write"), "enabled"),
+    task_remove: definition("R3", scopes("worktree:manage"), "enabled")
+});
+function operations(...values) {
+    return Object.freeze(values);
+}
+const TOOL_OPERATIONS = Object.freeze({
+    git_log: operations("read"),
+    git_branch: operations("read"),
+    git_create_branch: operations("create_branch"),
+    git_stage: operations("stage"),
+    git_commit: operations("commit"),
+    git_restore: operations("restore_review", "restore_execute"),
+    git_stash: operations("stash_list", "stash_create", "stash_apply_review", "stash_apply_execute", "stash_forget_review", "stash_forget_execute"),
+    create_task_worktree: operations("task_create_review", "task_create"),
+    list_task_worktrees: operations("task_list"),
+    get_task_worktree: operations("task_get"),
+    merge_task_worktree: operations("task_merge_prepare_review", "task_merge_prepare_finalize", "task_merge_execute"),
+    remove_task_worktree: operations("task_remove")
+});
+export function gitV4PolicyDefinition(toolName, operation) {
+    const allowed = TOOL_OPERATIONS[toolName];
+    if (!allowed)
+        throw gateRError();
+    const resolved = operation ?? (allowed.length === 1 ? allowed[0] : undefined);
+    if (!resolved || !allowed.includes(resolved))
+        throw gateRError();
+    return OPERATION_DEFINITIONS[resolved];
+}
+export function requiredScopesForGitV4Tool(toolName, operation) {
+    return gitV4PolicyDefinition(toolName, operation).requiredScopes;
+}
+export function localGitApprovalSummaryV4(resource) {
+    let parsed;
+    try {
+        parsed = gitResourceV4Schema.parse(resource);
+    }
+    catch {
+        throw gateRError();
+    }
+    return Object.freeze({
+        operation: parsed.operation,
+        repositoryId: parsed.repositoryId,
+        worktreeId: parsed.worktreeId,
+        branchId: parsed.branchId,
+        affectedPathCount: parsed.affectedPathCount,
+        affectedByteCount: parsed.affectedByteCount,
+        pathDigestCount: parsed.pathDigests.length,
+        refDigestCount: parsed.refDigests.length,
+        objectCount: parsed.objectIds.length,
+        integrationMode: parsed.integrationMode,
+        executionIsolation: parsed.executionIsolation,
+        resourceFingerprint: parsed.resourceFingerprint
+    });
+}
+export function createGitResourceV4(input) {
+    const semantic = {
+        schemaVersion: 4,
+        kind: "git_v4",
+        operation: input.operation,
+        repositoryId: input.repositoryId,
+        worktreeId: input.worktreeId,
+        branchId: input.branchId,
+        pathDigests: [...input.pathDigests].sort(),
+        refDigests: [...input.refDigests].sort(),
+        objectIds: [...input.objectIds].sort(),
+        affectedPathCount: input.affectedPathCount,
+        affectedByteCount: input.affectedByteCount,
+        stateTokenFingerprint: input.stateTokenFingerprint,
+        integrationMode: input.integrationMode,
+        executionIsolation: input.executionIsolation
+    };
+    const resourceFingerprint = computeGitResourceV4Fingerprint(semantic);
+    try {
+        return Object.freeze(gitResourceV4Schema.parse({ ...semantic, resourceFingerprint }));
+    }
+    catch {
+        throw gateRError();
+    }
+}
+//# sourceMappingURL=resources.js.map

package/dist/git/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/git/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AA0B/C,SAAS,MAAM,CAAC,GAAG,MAAuB;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CACjB,SAAoB,EACpB,cAAwC,EACxC,eAAuC,UAAU;IAEjD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS;QACT,cAAc;QACd,YAAY,EAAE,UAAU;QACxB,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,MAAM,qBAAqB,GAA4D,MAAM,CAAC,MAAM,CAAC;IACnG,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;IACrD,aAAa,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC;IACpE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,SAAS,CAAC;IAChF,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC3E,cAAc,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;IAC/D,eAAe,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,SAAS,CAAC;IAC3F,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;IAC3D,YAAY,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,EAAE,SAAS,CAAC;IAC1G,kBAAkB,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;IACnE,mBAAmB,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,SAAS,CAAC;IAC/F,mBAAmB,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;IACpE,oBAAoB,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC3E,kBAAkB,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,SAAS,CAAC;IAC7F,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,SAAS,CAAC;IACrF,SAAS,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;IAC1D,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;IACzD,yBAAyB,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC;IAC3E,2BAA2B,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC/F,kBAAkB,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,EAAE,SAAS,CAAC;IAC1G,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC;CACpE,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,GAAG,MAAwB;IAC7C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,eAAe,GAAwD,MAAM,CAAC,MAAM,CAAC;IACzF,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;IAC3B,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;IAC9B,iBAAiB,EAAE,UAAU,CAAC,eAAe,CAAC;IAC9C,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;IAChC,WAAW,EAAE,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAC5D,SAAS,EAAE,UAAU,CACnB,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,CACvB;IACD,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,EAAE,aAAa,CAAC;IACrE,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC;IAC5C,iBAAiB,EAAE,UAAU,CAAC,UAAU,CAAC;IACzC,mBAAmB,EAAE,UAAU,CAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,CACrB;IACD,oBAAoB,EAAE,UAAU,CAAC,aAAa,CAAC;CAChD,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,SAA0B;IAE1B,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,MAAM,UAAU,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,MAAM,UAAU,EAAE,CAAC;IACjE,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,QAAgB,EAChB,SAA0B;IAE1B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,cAAc,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAuB;IAC/D,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;QAC1C,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;QACxC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QACpC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,MAAM,QAAQ,GAAG;QACf,aAAa,EAAE,CAAU;QACzB,IAAI,EAAE,QAAiB;QACvB,SAAS,EAAE,KAAK,CAAC,SAA2B;QAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE;QAC1C,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE;QACxC,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC;IACF,MAAM,mBAAmB,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/git/restoreService.js

@@ -0,0 +1,178 @@
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { hasSecretValue } from "../redact.js";
+import { gitMutationError, runGitRequired, sha256Git } from "./mutationContext.js";
+import { gitIndexIdentityV4, replaceLiveIndexV4 } from "./privateIndex.js";
+async function asciiOid(context, repository, args) {
+    return (await runGitRequired(context.options.executor, repository, args, { stdoutLimitBytes: 256 })).stdout.toString("ascii").trim();
+}
+async function indexEntry(context, repository, source, relPath) {
+    const args = source === "HEAD"
+        ? ["ls-tree", "-z", "HEAD", "--", relPath]
+        : ["ls-files", "--stage", "-z", "--", relPath];
+    const result = await context.options.executor.run(repository, args, { stdoutLimitBytes: 4096 });
+    if (result.status !== 0 || result.timedOut || result.stdoutTruncated || result.stderrTruncated) {
+        throw gitMutationError("GIT_STATE_CHANGED");
+    }
+    if (result.stdout.length === 0)
+        return null;
+    const text = result.stdout.toString("utf8");
+    const match = source === "HEAD"
+        ? /^(100644|100755) blob ([a-f0-9]{40}|[a-f0-9]{64})\t/.exec(text)
+        : /^(100644|100755) ([a-f0-9]{40}|[a-f0-9]{64}) 0\t/.exec(text);
+    if (!match)
+        throw gitMutationError("GIT_UNMERGED");
+    return { mode: match[1], oid: match[2] };
+}
+async function safeBlob(context, repository, oid) {
+    const result = await runGitRequired(context.options.executor, repository, ["cat-file", "blob", oid], {
+        stdoutLimitBytes: 16 * 1024 * 1024
+    });
+    if (hasSecretValue(result.stdout.toString("latin1")))
+        throw gitMutationError("GIT_SECRET_BLOCKED");
+    return result.stdout;
+}
+export class GitRestoreServiceV4 {
+    context;
+    reviews;
+    fileTransactions;
+    constructor(context, reviews, fileTransactions) {
+        this.context = context;
+        this.reviews = reviews;
+        this.fileTransactions = fileTransactions;
+    }
+    async prepare(input) {
+        const verified = await this.context.verifyState({
+            workspace: input.workspace,
+            guard: input.guard,
+            stateToken: input.stateToken,
+            paths: input.paths
+        });
+        const repository = verified.repository;
+        const headOid = await asciiOid(this.context, repository, ["rev-parse", "--verify", "HEAD"]);
+        const indexTreeOid = await asciiOid(this.context, repository, ["write-tree"]);
+        const worktreeUndo = [];
+        let affectedBytes = 0;
+        for (const relPath of input.paths) {
+            if (input.guard.isBlockedRelativePath(relPath) || hasSecretValue(relPath))
+                throw gitMutationError("GIT_PATH_BLOCKED");
+            if (input.mode === "worktree_from_index") {
+                const entry = await indexEntry(this.context, repository, "index", relPath);
+                if (!entry)
+                    throw gitMutationError("GIT_STATE_CHANGED");
+                await safeBlob(this.context, repository, entry.oid);
+                const absPath = path.resolve(input.workspace.root, ...relPath.split("/"));
+                const existing = await fsp.readFile(absPath).catch((error) => {
+                    if (error.code === "ENOENT")
+                        return null;
+                    throw gitMutationError("GIT_PATH_BLOCKED");
+                });
+                affectedBytes += existing?.length ?? 0;
+                worktreeUndo.push({
+                    path: relPath,
+                    existed: existing !== null,
+                    content: (existing ?? Buffer.alloc(0)).toString("base64"),
+                    digest: sha256Git(existing ?? Buffer.alloc(0))
+                });
+            }
+        }
+        const review = {
+            workspaceId: input.workspace.id,
+            repositoryId: repository.repositoryId,
+            repositoryFingerprint: repository.repositoryFingerprint,
+            mode: input.mode,
+            paths: [...input.paths],
+            headOid,
+            indexTreeOid,
+            worktreeUndo
+        };
+        const reviewToken = this.reviews.mint("restore", review);
+        return {
+            action: "prepare",
+            repository_id: repository.repositoryId,
+            review_token: reviewToken,
+            mode: input.mode,
+            paths: [...input.paths],
+            affected_path_count: input.paths.length,
+            affected_bytes: affectedBytes,
+            complete_undo_retained: true,
+            loss_summary: input.mode === "index_from_head"
+                ? "Selected staged entries will be restored from HEAD; worktree bytes remain unchanged."
+                : "Selected worktree bytes will be restored from the current index; encrypted undo is retained."
+        };
+    }
+    async execute(input) {
+        const review = this.reviews.inspect(input.reviewToken, "restore");
+        if (review.workspaceId !== input.workspace.id)
+            throw gitMutationError("GIT_STATE_TOKEN_INVALID");
+        const repository = await this.context.admitWorkspace(input.workspace);
+        if (repository.repositoryId !== review.repositoryId ||
+            await asciiOid(this.context, repository, ["rev-parse", "--verify", "HEAD"]) !== review.headOid ||
+            await asciiOid(this.context, repository, ["write-tree"]) !== review.indexTreeOid)
+            throw gitMutationError("GIT_STATE_CHANGED");
+        for (const undo of review.worktreeUndo) {
+            const current = await fsp.readFile(path.resolve(input.workspace.root, ...undo.path.split("/"))).catch((error) => {
+                if (error.code === "ENOENT")
+                    return null;
+                throw gitMutationError("GIT_STATE_CHANGED");
+            });
+            if ((current !== null) !== undo.existed ||
+                sha256Git(current ?? Buffer.alloc(0)) !== undo.digest)
+                throw gitMutationError("GIT_STATE_CHANGED");
+        }
+        if (review.mode === "index_from_head") {
+            const privateRoot = await this.context.options.executor.createPrivateDirectory?.("git-restore");
+            if (!privateRoot)
+                throw gitMutationError("GIT_CAPABILITY_UNAVAILABLE");
+            const privateIndex = path.join(privateRoot, "index");
+            const liveIndex = path.join(repository.gitDir, "index");
+            try {
+                const expectedIdentity = await gitIndexIdentityV4(liveIndex);
+                await fsp.copyFile(liveIndex, privateIndex);
+                for (const relPath of review.paths) {
+                    const entry = await indexEntry(this.context, repository, "HEAD", relPath);
+                    if (entry) {
+                        await runGitRequired(this.context.options.executor, repository, [
+                            "update-index", "--add", "--cacheinfo", `${entry.mode},${entry.oid},${relPath}`
+                        ], { privateIndexPath: privateIndex });
+                    }
+                    else {
+                        await runGitRequired(this.context.options.executor, repository, [
+                            "update-index", "--force-remove", "--", relPath
+                        ], { privateIndexPath: privateIndex });
+                    }
+                }
+                await replaceLiveIndexV4({ liveIndex, preparedIndex: privateIndex, expectedIdentity });
+            }
+            finally {
+                await this.context.options.executor.removePrivateDirectory?.(privateRoot).catch(() => { });
+            }
+        }
+        else {
+            const operations = [];
+            for (const relPath of review.paths) {
+                const entry = await indexEntry(this.context, repository, "index", relPath);
+                if (!entry)
+                    throw gitMutationError("GIT_STATE_CHANGED");
+                const content = await safeBlob(this.context, repository, entry.oid);
+                const undo = review.worktreeUndo.find((item) => item.path === relPath);
+                if (!undo)
+                    throw gitMutationError("GIT_STATE_CHANGED");
+                operations.push(undo.existed
+                    ? { kind: "replace", path: relPath, bytes: content, expectedSha256: undo.digest }
+                    : { kind: "create", path: relPath, bytes: content });
+            }
+            await this.fileTransactions.run({ workspace: input.workspace, operations });
+        }
+        this.reviews.consume(input.reviewToken, "restore");
+        const stateToken = await this.context.refreshState({ workspace: input.workspace, guard: input.guard });
+        return {
+            action: "execute",
+            repository_id: repository.repositoryId,
+            mode: review.mode,
+            restored_paths: review.paths,
+            state_token: stateToken
+        };
+    }
+}
+//# sourceMappingURL=restoreService.js.map

package/dist/git/restoreService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restoreService.js","sourceRoot":"","sources":["../../src/git/restoreService.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAwB,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEzG,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAgB3E,KAAK,UAAU,QAAQ,CAAC,OAA6B,EAAE,UAA0D,EAAE,IAAc;IAC/H,OAAO,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AACvI,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAA6B,EAC7B,UAA0D,EAC1D,MAAwB,EACxB,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM;QAC5B,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC;QAC1C,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IAChG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/F,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,KAAK,MAAM;QAC7B,CAAC,CAAC,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC;QAClE,CAAC,CAAC,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK;QAAE,MAAM,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,OAA6B,EAC7B,UAA0D,EAC1D,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;QACnG,gBAAgB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KACnC,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAAE,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,OAAO,mBAAmB;IAEnB;IACA;IACA;IAHX,YACW,OAA6B,EAC7B,OAAgC,EAChC,gBAAsC;QAFtC,YAAO,GAAP,OAAO,CAAsB;QAC7B,YAAO,GAAP,OAAO,CAAyB;QAChC,qBAAgB,GAAhB,gBAAgB,CAAsB;IAC9C,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAMb;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5F,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9E,MAAM,YAAY,GAAoC,EAAE,CAAC;QACzD,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC;gBAAE,MAAM,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;YACtH,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC3E,IAAI,CAAC,KAAK;oBAAE,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBACxD,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;oBAClF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;wBAAE,OAAO,IAAI,CAAC;oBACzC,MAAM,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;gBAC7C,CAAC,CAAC,CAAC;gBACH,aAAa,IAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;gBACvC,YAAY,CAAC,IAAI,CAAC;oBAChB,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,QAAQ,KAAK,IAAI;oBAC1B,OAAO,EAAE,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACzD,MAAM,EAAE,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;iBAC/C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAoB;YAC9B,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE;YAC/B,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;YACvD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YACvB,OAAO;YACP,YAAY;YACZ,YAAY;SACb,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO;YACL,MAAM,EAAE,SAAkB;YAC1B,aAAa,EAAE,UAAU,CAAC,YAAY;YACtC,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YACvB,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;YACvC,cAAc,EAAE,aAAa;YAC7B,sBAAsB,EAAE,IAAI;YAC5B,YAAY,EAAE,KAAK,CAAC,IAAI,KAAK,iBAAiB;gBAC5C,CAAC,CAAC,sFAAsF;gBACxF,CAAC,CAAC,8FAA8F;SACnG,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAIb;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAkB,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE;YAAE,MAAM,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACjG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtE,IACE,UAAU,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YAC/C,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO;YAC9F,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,YAAY,CAAC,CAAC,KAAK,MAAM,CAAC,YAAY;YAChF,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CACnG,CAAC,KAA4B,EAAE,EAAE;gBAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBACzC,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;YAC9C,CAAC,CACF,CAAC;YACF,IACE,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBACnC,SAAS,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM;gBACrD,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,aAAa,CAAC,CAAC;YAChG,IAAI,CAAC,WAAW;gBAAE,MAAM,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;YACvE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBAC7D,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;gBAC5C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACnC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;oBAC1E,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE;4BAC9D,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,IAAI,OAAO,EAAE;yBAChF,EAAE,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,CAAC;oBACzC,CAAC;yBAAM,CAAC;wBACN,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE;4BAC9D,cAAc,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO;yBAChD,EAAE,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,CAAC;oBACzC,CAAC;gBACH,CAAC;gBACD,MAAM,kBAAkB,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACzF,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAwB,EAAE,CAAC;YAC3C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC3E,IAAI,CAAC,KAAK;oBAAE,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBACxD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpE,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;gBACvE,IAAI,CAAC,IAAI;oBAAE,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBACvD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;oBAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE;oBACjF,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAkB,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACvG,OAAO;YACL,MAAM,EAAE,SAAkB;YAC1B,aAAa,EAAE,UAAU,CAAC,YAAY;YACtC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,cAAc,EAAE,MAAM,CAAC,KAAK;YAC5B,WAAW,EAAE,UAAU;SACxB,CAAC;IACJ,CAAC;CACF"}

package/dist/git/reviewToken.js

@@ -0,0 +1,86 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { gitMutationError } from "./mutationContext.js";
+import { DurableOpaqueRecordStoreV4 } from "./opaqueRecordStore.js";
+export class GitReviewTokenServiceV4 {
+    #key;
+    #records = new Map();
+    #durable;
+    #now;
+    #ttlMs;
+    constructor(options) {
+        if (!Buffer.isBuffer(options.key) || options.key.length < 32)
+            throw gitMutationError("GIT_STATE_TOKEN_INVALID");
+        this.#key = Buffer.from(options.key);
+        this.#now = options.now ?? Date.now;
+        this.#ttlMs = options.ttlMs ?? 5 * 60_000;
+        this.#durable = options.stateRoot && options.masterKey
+            ? new DurableOpaqueRecordStoreV4({
+                stateRoot: options.stateRoot,
+                masterKey: options.masterKey,
+                namespace: "review-records",
+                now: this.#now,
+                maxCiphertextCharacters: options.maxCiphertextCharacters ?? 64_000_000,
+                maxPlaintextBytes: options.maxPlaintextBytes ?? 48_000_000
+            })
+            : null;
+    }
+    mint(kind, value) {
+        if (!/^[a-z][a-z0-9_]{0,63}$/.test(kind))
+            throw gitMutationError("GIT_STATE_TOKEN_INVALID");
+        const nonce = randomBytes(32);
+        const mac = createHmac("sha256", this.#key).update("codexgpt.git.review.v1\0").update(nonce).digest();
+        const token = `review_${Buffer.concat([nonce, mac]).toString("base64url")}`;
+        const now = this.#now();
+        const stored = { kind, value, issuedAt: now, expiresAt: now + this.#ttlMs };
+        if (this.#durable) {
+            this.#durable.put({ recordId: token, kind, value: stored, expiresAt: stored.expiresAt });
+        }
+        else {
+            this.#records.set(token, stored);
+        }
+        return token;
+    }
+    inspect(token, kind) {
+        if (typeof token !== "string" || !/^review_[A-Za-z0-9_-]+$/.test(token)) {
+            throw gitMutationError("GIT_STATE_TOKEN_INVALID");
+        }
+        const decoded = Buffer.from(token.slice(7), "base64url");
+        if (decoded.length !== 64 || decoded.toString("base64url") !== token.slice(7)) {
+            throw gitMutationError("GIT_STATE_TOKEN_INVALID");
+        }
+        const expected = createHmac("sha256", this.#key)
+            .update("codexgpt.git.review.v1\0")
+            .update(decoded.subarray(0, 32))
+            .digest();
+        if (!timingSafeEqual(expected, decoded.subarray(32)))
+            throw gitMutationError("GIT_STATE_TOKEN_INVALID");
+        const stored = this.#durable
+            ? this.#durable.get(token, kind)
+            : this.#records.get(token);
+        const now = this.#now();
+        if (!stored || stored.kind !== kind || stored.issuedAt > now || stored.expiresAt < now) {
+            throw gitMutationError("GIT_STATE_TOKEN_INVALID");
+        }
+        return stored.value;
+    }
+    consume(token, kind) {
+        const value = this.inspect(token, kind);
+        if (this.#durable)
+            this.#durable.consume(token, kind);
+        else
+            this.#records.delete(token);
+        return value;
+    }
+    revoke(token) {
+        if (this.#durable)
+            this.#durable.revoke(token);
+        else
+            this.#records.delete(token);
+    }
+    dispose() {
+        this.#records.clear();
+        this.#durable?.dispose();
+        this.#key.fill(0);
+    }
+}
+//# sourceMappingURL=reviewToken.js.map