git-fs-s3 0.3.6 → 0.3.8

package/dist/chunk-H7IGQRIA.js

@@ -0,0 +1,118 @@
+import {
+  GitInvalidRequestError,
+  isSafeBranchName
+} from "./chunk-YQFNY6PG.js";
+
+// src/ops/branch.ts
+import git from "isomorphic-git";
+function assertSafeBranchName(name) {
+  if (!isSafeBranchName(name)) {
+    throw new GitInvalidRequestError(`Invalid branch name: ${name}`);
+  }
+}
+var FULL_SHA_RE = /^[0-9a-f]{40}$/i;
+function hasRecursiveFileLister(fs) {
+  return typeof fs === "object" && fs !== null && "listFilesRecursively" in fs && typeof fs.listFilesRecursively === "function";
+}
+async function listLooseBranches(repo) {
+  if (!hasRecursiveFileLister(repo.fs)) return null;
+  const names = await repo.fs.listFilesRecursively(`${repo.gitdir}/refs/heads`);
+  return names.filter(isSafeBranchName);
+}
+async function readPackedBranches(repo) {
+  if (!hasRecursiveFileLister(repo.fs)) return /* @__PURE__ */ new Map();
+  const promisesFs = repo.fs.promises;
+  if (!promisesFs) return /* @__PURE__ */ new Map();
+  try {
+    const content = await promisesFs.readFile(
+      `${repo.gitdir}/packed-refs`,
+      "utf8"
+    );
+    const refs = /* @__PURE__ */ new Map();
+    for (const line of (typeof content === "string" ? content : new TextDecoder().decode(content)).split("\n")) {
+      const match = /^([0-9a-f]{40}) refs\/heads\/(.+)$/i.exec(line);
+      if (match?.[1] && match[2] && isSafeBranchName(match[2])) {
+        refs.set(match[2], match[1]);
+      }
+    }
+    return refs;
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+async function getCurrentLooseBranch(repo) {
+  if (!hasRecursiveFileLister(repo.fs)) return null;
+  const promisesFs = repo.fs.promises;
+  if (!promisesFs) return null;
+  try {
+    const content = await promisesFs.readFile(`${repo.gitdir}/HEAD`, "utf8");
+    const head = (typeof content === "string" ? content : new TextDecoder().decode(content)).trim();
+    const match = /^ref: refs\/heads\/(.+)$/.exec(head);
+    return match?.[1] && isSafeBranchName(match[1]) ? match[1] : null;
+  } catch {
+    return null;
+  }
+}
+async function resolveLooseRefFast(repo, ref) {
+  const promisesFs = repo.fs.promises;
+  if (promisesFs) {
+    try {
+      const content = await promisesFs.readFile(
+        `${repo.gitdir}/${ref}`,
+        "utf8"
+      );
+      const oid = (typeof content === "string" ? content : new TextDecoder().decode(content)).trim();
+      if (FULL_SHA_RE.test(oid)) return oid;
+    } catch {
+    }
+  }
+  return git.resolveRef({ ...repo, ref });
+}
+async function listBranches(repo) {
+  try {
+    const [looseBranches, looseCurrentBranch, packedBranches] = await Promise.all([
+      listLooseBranches(repo),
+      getCurrentLooseBranch(repo),
+      readPackedBranches(repo)
+    ]);
+    const branches = looseBranches === null ? await git.listBranches(repo) : [.../* @__PURE__ */ new Set([...looseBranches, ...packedBranches.keys()])].sort();
+    const currentBranch = looseBranches === null ? await git.currentBranch({ ...repo, fullname: false }).catch(() => null) : looseCurrentBranch;
+    return Promise.all(
+      branches.map(async (branch) => {
+        const packedCommit = packedBranches.get(branch);
+        return {
+          name: branch,
+          commit: packedCommit && !looseBranches?.includes(branch) ? packedCommit : await resolveLooseRefFast(repo, `refs/heads/${branch}`),
+          isDefault: branch === currentBranch
+        };
+      })
+    );
+  } catch (err) {
+    if (err.code === "NotFoundError") return [];
+    throw err;
+  }
+}
+async function createBranchFrom(repo, name, startPoint = "main") {
+  assertSafeBranchName(name);
+  assertSafeBranchName(startPoint);
+  const object = await resolveLooseRefFast(repo, `refs/heads/${startPoint}`);
+  await git.branch({ ...repo, ref: name, checkout: false, object });
+}
+async function deleteBranchByName(repo, name) {
+  assertSafeBranchName(name);
+  await git.deleteBranch({ ...repo, ref: name });
+}
+async function assertBranchExists(repo, name) {
+  assertSafeBranchName(name);
+  await resolveLooseRefFast(repo, `refs/heads/${name}`);
+}
+
+export {
+  assertSafeBranchName,
+  resolveLooseRefFast,
+  listBranches,
+  createBranchFrom,
+  deleteBranchByName,
+  assertBranchExists
+};
+//# sourceMappingURL=chunk-H7IGQRIA.js.map

package/dist/chunk-H7IGQRIA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ops/branch.ts"],"sourcesContent":["import git from \"isomorphic-git\";\nimport { GitInvalidRequestError } from \"../git-errors.js\";\nimport { isSafeBranchName } from \"../refs.js\";\nimport type { Repo } from \"./types.js\";\n\nexport interface Branch {\n\tname: string;\n\tcommit: string;\n\tisDefault: boolean;\n}\n\n/**\n * Defense in depth for every branch-name argument below: `git.deleteBranch`\n * and raw resolveRef/writeRef reads don't validate ref names internally the\n * way `git.branch` does (see refs.ts) — guard at the point the primitives are\n * actually called, not just at an API boundary far above.\n */\nexport function assertSafeBranchName(name: string): void {\n\tif (!isSafeBranchName(name)) {\n\t\tthrow new GitInvalidRequestError(`Invalid branch name: ${name}`);\n\t}\n}\n\nconst FULL_SHA_RE = /^[0-9a-f]{40}$/i;\n\ntype RecursiveFileLister = {\n\tlistFilesRecursively(dirpath: string): Promise<string[]>;\n};\n\nfunction hasRecursiveFileLister(\n\tfs: Repo[\"fs\"],\n): fs is Repo[\"fs\"] & RecursiveFileLister {\n\treturn (\n\t\ttypeof fs === \"object\" &&\n\t\tfs !== null &&\n\t\t\"listFilesRecursively\" in fs &&\n\t\ttypeof (fs as Partial<RecursiveFileLister>).listFilesRecursively ===\n\t\t\t\"function\"\n\t);\n}\n\n/**\n * Lists loose branch names without isomorphic-git's recursive readdir/stat\n * traversal. Object stores already return only leaf keys in a recursive LIST,\n * so this is one request regardless of branch-name nesting. Ordinary\n * filesystems retain isomorphic-git's implementation and packed refs remain\n * supported there.\n */\nasync function listLooseBranches(repo: Repo): Promise<string[] | null> {\n\tif (!hasRecursiveFileLister(repo.fs)) return null;\n\tconst names = await repo.fs.listFilesRecursively(`${repo.gitdir}/refs/heads`);\n\treturn names.filter(isSafeBranchName);\n}\n\n/** Read packed branch refs so the object-store fast path preserves Git semantics. */\nasync function readPackedBranches(repo: Repo): Promise<Map<string, string>> {\n\tif (!hasRecursiveFileLister(repo.fs)) return new Map();\n\tconst promisesFs = (\n\t\trepo.fs as {\n\t\t\tpromises?: {\n\t\t\t\treadFile(path: string, encoding: \"utf8\"): Promise<string | Uint8Array>;\n\t\t\t};\n\t\t}\n\t).promises;\n\tif (!promisesFs) return new Map();\n\ttry {\n\t\tconst content = await promisesFs.readFile(\n\t\t\t`${repo.gitdir}/packed-refs`,\n\t\t\t\"utf8\",\n\t\t);\n\t\tconst refs = new Map<string, string>();\n\t\tfor (const line of (typeof content === \"string\"\n\t\t\t? content\n\t\t\t: new TextDecoder().decode(content)\n\t\t).split(\"\\n\")) {\n\t\t\tconst match = /^([0-9a-f]{40}) refs\\/heads\\/(.+)$/i.exec(line);\n\t\t\tif (match?.[1] && match[2] && isSafeBranchName(match[2])) {\n\t\t\t\trefs.set(match[2], match[1]);\n\t\t\t}\n\t\t}\n\t\treturn refs;\n\t} catch {\n\t\treturn new Map();\n\t}\n}\n\n/** Read the symbolic HEAD directly when the object-store fs is available. */\nasync function getCurrentLooseBranch(repo: Repo): Promise<string | null> {\n\tif (!hasRecursiveFileLister(repo.fs)) return null;\n\tconst promisesFs = (\n\t\trepo.fs as {\n\t\t\tpromises?: {\n\t\t\t\treadFile(path: string, encoding: \"utf8\"): Promise<string | Uint8Array>;\n\t\t\t};\n\t\t}\n\t).promises;\n\tif (!promisesFs) return null;\n\ttry {\n\t\tconst content = await promisesFs.readFile(`${repo.gitdir}/HEAD`, \"utf8\");\n\t\tconst head = (\n\t\t\ttypeof content === \"string\" ? content : new TextDecoder().decode(content)\n\t\t).trim();\n\t\tconst match = /^ref: refs\\/heads\\/(.+)$/.exec(head);\n\t\treturn match?.[1] && isSafeBranchName(match[1]) ? match[1] : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Resolve a fully-qualified ref's oid with one read instead of isomorphic-\n * git's own `resolveRef`, which does a stat *then* a read for a loose ref\n * (two round trips against object storage) — wasteful specifically here,\n * where the caller already knows the ref exists (it came from a directory\n * listing moments earlier). Reads the loose file directly and falls back to\n * `git.resolveRef` only when that doesn't pan out (packed-refs, or anything\n * else the plain-loose-file assumption doesn't cover), so correctness for\n * those cases is unchanged — this only removes the redundant round trip on\n * the common path.\n */\nexport async function resolveLooseRefFast(\n\trepo: Repo,\n\tref: string,\n): Promise<string> {\n\t// Repo.fs is typed as isomorphic-git's own fs union (promise- or\n\t// callback-based) since that's what git.readTree's signature allows, but\n\t// every fs this package actually constructs (git-fs.ts) is promise-based\n\t// — the runtime check just keeps the callback-style branch honest instead\n\t// of crashing on it.\n\tconst promisesFs = (\n\t\trepo.fs as {\n\t\t\tpromises?: {\n\t\t\t\treadFile(path: string, encoding: \"utf8\"): Promise<string | Uint8Array>;\n\t\t\t};\n\t\t}\n\t).promises;\n\tif (promisesFs) {\n\t\ttry {\n\t\t\tconst content = await promisesFs.readFile(\n\t\t\t\t`${repo.gitdir}/${ref}`,\n\t\t\t\t\"utf8\",\n\t\t\t);\n\t\t\tconst oid = (\n\t\t\t\ttypeof content === \"string\"\n\t\t\t\t\t? content\n\t\t\t\t\t: new TextDecoder().decode(content)\n\t\t\t).trim();\n\t\t\tif (FULL_SHA_RE.test(oid)) return oid;\n\t\t} catch {\n\t\t\t// Not a loose file (packed-refs, or genuinely absent) — fall through.\n\t\t}\n\t}\n\treturn git.resolveRef({ ...repo, ref });\n}\n\n/** All branches with their tip commits; [] for an empty repository. */\nexport async function listBranches(repo: Repo): Promise<Branch[]> {\n\ttry {\n\t\tconst [looseBranches, looseCurrentBranch, packedBranches] =\n\t\t\tawait Promise.all([\n\t\t\t\tlistLooseBranches(repo),\n\t\t\t\tgetCurrentLooseBranch(repo),\n\t\t\t\treadPackedBranches(repo),\n\t\t\t]);\n\t\tconst branches =\n\t\t\tlooseBranches === null\n\t\t\t\t? await git.listBranches(repo)\n\t\t\t\t: [...new Set([...looseBranches, ...packedBranches.keys()])].sort();\n\t\tconst currentBranch =\n\t\t\tlooseBranches === null\n\t\t\t\t? await git\n\t\t\t\t\t\t.currentBranch({ ...repo, fullname: false })\n\t\t\t\t\t\t.catch(() => null)\n\t\t\t\t: looseCurrentBranch;\n\n\t\treturn Promise.all(\n\t\t\tbranches.map(async (branch) => {\n\t\t\t\tconst packedCommit = packedBranches.get(branch);\n\t\t\t\treturn {\n\t\t\t\t\tname: branch,\n\t\t\t\t\tcommit:\n\t\t\t\t\t\tpackedCommit && !looseBranches?.includes(branch)\n\t\t\t\t\t\t\t? packedCommit\n\t\t\t\t\t\t\t: await resolveLooseRefFast(repo, `refs/heads/${branch}`),\n\t\t\t\t\tisDefault: branch === currentBranch,\n\t\t\t\t};\n\t\t\t}),\n\t\t);\n\t} catch (err: unknown) {\n\t\tif ((err as { code?: string }).code === \"NotFoundError\") return [];\n\t\tthrow err;\n\t}\n}\n\n/** Create `name` pointing at the tip of `startPoint` (no checkout). */\nexport async function createBranchFrom(\n\trepo: Repo,\n\tname: string,\n\tstartPoint = \"main\",\n): Promise<void> {\n\tassertSafeBranchName(name);\n\tassertSafeBranchName(startPoint);\n\tconst object = await resolveLooseRefFast(repo, `refs/heads/${startPoint}`);\n\tawait git.branch({ ...repo, ref: name, checkout: false, object });\n}\n\n/** Delete a branch ref (validated — deleteBranch has no internal ref check). */\nexport async function deleteBranchByName(\n\trepo: Repo,\n\tname: string,\n): Promise<void> {\n\tassertSafeBranchName(name);\n\tawait git.deleteBranch({ ...repo, ref: name });\n}\n\n/** Throws (NotFoundError) unless the branch resolves. */\nexport async function assertBranchExists(\n\trepo: Repo,\n\tname: string,\n): Promise<void> {\n\tassertSafeBranchName(name);\n\tawait resolveLooseRefFast(repo, `refs/heads/${name}`);\n}\n"],"mappings":";;;;;;AAAA,OAAO,SAAS;AAiBT,SAAS,qBAAqB,MAAoB;AACxD,MAAI,CAAC,iBAAiB,IAAI,GAAG;AAC5B,UAAM,IAAI,uBAAuB,wBAAwB,IAAI,EAAE;AAAA,EAChE;AACD;AAEA,IAAM,cAAc;AAMpB,SAAS,uBACR,IACyC;AACzC,SACC,OAAO,OAAO,YACd,OAAO,QACP,0BAA0B,MAC1B,OAAQ,GAAoC,yBAC3C;AAEH;AASA,eAAe,kBAAkB,MAAsC;AACtE,MAAI,CAAC,uBAAuB,KAAK,EAAE,EAAG,QAAO;AAC7C,QAAM,QAAQ,MAAM,KAAK,GAAG,qBAAqB,GAAG,KAAK,MAAM,aAAa;AAC5E,SAAO,MAAM,OAAO,gBAAgB;AACrC;AAGA,eAAe,mBAAmB,MAA0C;AAC3E,MAAI,CAAC,uBAAuB,KAAK,EAAE,EAAG,QAAO,oBAAI,IAAI;AACrD,QAAM,aACL,KAAK,GAKJ;AACF,MAAI,CAAC,WAAY,QAAO,oBAAI,IAAI;AAChC,MAAI;AACH,UAAM,UAAU,MAAM,WAAW;AAAA,MAChC,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,IACD;AACA,UAAM,OAAO,oBAAI,IAAoB;AACrC,eAAW,SAAS,OAAO,YAAY,WACpC,UACA,IAAI,YAAY,EAAE,OAAO,OAAO,GACjC,MAAM,IAAI,GAAG;AACd,YAAM,QAAQ,sCAAsC,KAAK,IAAI;AAC7D,UAAI,QAAQ,CAAC,KAAK,MAAM,CAAC,KAAK,iBAAiB,MAAM,CAAC,CAAC,GAAG;AACzD,aAAK,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,MAC5B;AAAA,IACD;AACA,WAAO;AAAA,EACR,QAAQ;AACP,WAAO,oBAAI,IAAI;AAAA,EAChB;AACD;AAGA,eAAe,sBAAsB,MAAoC;AACxE,MAAI,CAAC,uBAAuB,KAAK,EAAE,EAAG,QAAO;AAC7C,QAAM,aACL,KAAK,GAKJ;AACF,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI;AACH,UAAM,UAAU,MAAM,WAAW,SAAS,GAAG,KAAK,MAAM,SAAS,MAAM;AACvE,UAAM,QACL,OAAO,YAAY,WAAW,UAAU,IAAI,YAAY,EAAE,OAAO,OAAO,GACvE,KAAK;AACP,UAAM,QAAQ,2BAA2B,KAAK,IAAI;AAClD,WAAO,QAAQ,CAAC,KAAK,iBAAiB,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI;AAAA,EAC9D,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AAaA,eAAsB,oBACrB,MACA,KACkB;AAMlB,QAAM,aACL,KAAK,GAKJ;AACF,MAAI,YAAY;AACf,QAAI;AACH,YAAM,UAAU,MAAM,WAAW;AAAA,QAChC,GAAG,KAAK,MAAM,IAAI,GAAG;AAAA,QACrB;AAAA,MACD;AACA,YAAM,OACL,OAAO,YAAY,WAChB,UACA,IAAI,YAAY,EAAE,OAAO,OAAO,GAClC,KAAK;AACP,UAAI,YAAY,KAAK,GAAG,EAAG,QAAO;AAAA,IACnC,QAAQ;AAAA,IAER;AAAA,EACD;AACA,SAAO,IAAI,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC;AACvC;AAGA,eAAsB,aAAa,MAA+B;AACjE,MAAI;AACH,UAAM,CAAC,eAAe,oBAAoB,cAAc,IACvD,MAAM,QAAQ,IAAI;AAAA,MACjB,kBAAkB,IAAI;AAAA,MACtB,sBAAsB,IAAI;AAAA,MAC1B,mBAAmB,IAAI;AAAA,IACxB,CAAC;AACF,UAAM,WACL,kBAAkB,OACf,MAAM,IAAI,aAAa,IAAI,IAC3B,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,eAAe,GAAG,eAAe,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK;AACpE,UAAM,gBACL,kBAAkB,OACf,MAAM,IACL,cAAc,EAAE,GAAG,MAAM,UAAU,MAAM,CAAC,EAC1C,MAAM,MAAM,IAAI,IACjB;AAEJ,WAAO,QAAQ;AAAA,MACd,SAAS,IAAI,OAAO,WAAW;AAC9B,cAAM,eAAe,eAAe,IAAI,MAAM;AAC9C,eAAO;AAAA,UACN,MAAM;AAAA,UACN,QACC,gBAAgB,CAAC,eAAe,SAAS,MAAM,IAC5C,eACA,MAAM,oBAAoB,MAAM,cAAc,MAAM,EAAE;AAAA,UAC1D,WAAW,WAAW;AAAA,QACvB;AAAA,MACD,CAAC;AAAA,IACF;AAAA,EACD,SAAS,KAAc;AACtB,QAAK,IAA0B,SAAS,gBAAiB,QAAO,CAAC;AACjE,UAAM;AAAA,EACP;AACD;AAGA,eAAsB,iBACrB,MACA,MACA,aAAa,QACG;AAChB,uBAAqB,IAAI;AACzB,uBAAqB,UAAU;AAC/B,QAAM,SAAS,MAAM,oBAAoB,MAAM,cAAc,UAAU,EAAE;AACzE,QAAM,IAAI,OAAO,EAAE,GAAG,MAAM,KAAK,MAAM,UAAU,OAAO,OAAO,CAAC;AACjE;AAGA,eAAsB,mBACrB,MACA,MACgB;AAChB,uBAAqB,IAAI;AACzB,QAAM,IAAI,aAAa,EAAE,GAAG,MAAM,KAAK,KAAK,CAAC;AAC9C;AAGA,eAAsB,mBACrB,MACA,MACgB;AAChB,uBAAqB,IAAI;AACzB,QAAM,oBAAoB,MAAM,cAAc,IAAI,EAAE;AACrD;","names":[]}

package/dist/{chunk-RUE2NR43.js → chunk-YQFNY6PG.js}

@@ -64,6 +64,109 @@ function readBlobContent(blob) {
   };
 }
 
+// src/git-errors.ts
+var GitError = class extends Error {
+  statusCode;
+  retryable;
+  constructor(message, statusCode = 500, retryable = false) {
+    super(message);
+    this.name = this.constructor.name;
+    this.statusCode = statusCode;
+    this.retryable = retryable;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+  toJSON() {
+    return {
+      error: this.name,
+      message: this.message,
+      statusCode: this.statusCode,
+      retryable: this.retryable
+    };
+  }
+};
+var GitPathNotFoundError = class extends GitError {
+  constructor(message) {
+    super(message, 404, false);
+  }
+};
+var GitObjectNotFoundError = class extends GitError {
+  constructor(message) {
+    super(message, 404, false);
+  }
+};
+var GitRefNotFoundError = class extends GitError {
+  constructor(message) {
+    super(message, 404, false);
+  }
+};
+var GitRepositoryNotFoundError = class extends GitError {
+  constructor(message) {
+    super(message, 404, false);
+  }
+};
+var GitConflictError = class extends GitError {
+  conflicts;
+  constructor(message, conflicts = []) {
+    super(message, 409, false);
+    this.conflicts = conflicts;
+  }
+  toJSON() {
+    return { ...super.toJSON(), conflicts: this.conflicts };
+  }
+};
+var GitAuthenticationError = class extends GitError {
+  constructor(message) {
+    super(message, 401, false);
+  }
+};
+var GitAuthorizationError = class extends GitError {
+  constructor(message) {
+    super(message, 403, false);
+  }
+};
+var GitRateLimitError = class extends GitError {
+  constructor(message) {
+    super(message, 429, false);
+  }
+};
+var GitInvalidRequestError = class extends GitError {
+  constructor(message) {
+    super(message, 400, false);
+  }
+};
+var GitProtocolError = class extends GitError {
+  constructor(message) {
+    super(message, 400, false);
+  }
+};
+function formatErrorResponse(error) {
+  if (error instanceof GitError) {
+    return {
+      status: error.statusCode,
+      body: error.toJSON(),
+      headers: error.statusCode === 401 ? { "WWW-Authenticate": 'Basic realm="Git Repository"' } : void 0
+    };
+  }
+  if (error instanceof Error) {
+    return {
+      status: 500,
+      body: {
+        error: "InternalServerError",
+        message: "An internal error occurred",
+        retryable: true
+      }
+    };
+  }
+  return {
+    status: 500,
+    body: {
+      error: "UnknownError",
+      message: "An unknown error occurred",
+      retryable: true
+    }
+  };
+}
+
 // src/refs.ts
 var BAD_REF_COMPONENT = (
   // biome-ignore lint/suspicious/noControlCharactersInRegex: control chars are exactly what git's own ref-name rules reject — this needs to match the same range.
@@ -113,6 +216,18 @@ export {
   deflate,
   hasNullByte,
   readBlobContent,
+  GitError,
+  GitPathNotFoundError,
+  GitObjectNotFoundError,
+  GitRefNotFoundError,
+  GitRepositoryNotFoundError,
+  GitConflictError,
+  GitAuthenticationError,
+  GitAuthorizationError,
+  GitRateLimitError,
+  GitInvalidRequestError,
+  GitProtocolError,
+  formatErrorResponse,
   isSafeFullRefName,
   isSafeBranchName,
   isFullSha,
@@ -120,4 +235,4 @@ export {
   isSafeRepoPath,
   qualifyBranchRef
 };
-//# sourceMappingURL=chunk-RUE2NR43.js.map
+//# sourceMappingURL=chunk-YQFNY6PG.js.map

package/dist/chunk-YQFNY6PG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/edge-utils.ts","../src/git-errors.ts","../src/refs.ts"],"sourcesContent":["/**\n * Edge-compatible utilities replacing node:crypto, node:zlib, and Buffer.\n *\n * Every function here uses only Web APIs (SubtleCrypto, CompressionStream,\n * TextEncoder/TextDecoder) — no Node built-ins. They work on Cloudflare\n * Workers, Vercel Edge, Deno Deploy, and Node >= 18.\n */\n\nconst textEncoder = new TextEncoder();\nconst textDecoder = new TextDecoder();\n\n// ---------------------------------------------------------------------------\n// Text\n// ---------------------------------------------------------------------------\n\n/**\n * Encode a UTF-8 string to bytes.\n *\n * Return type pinned to `Uint8Array<ArrayBuffer>` (not the bare `Uint8Array`,\n * whose default type argument differs across TypeScript versions) so it's\n * always assignable to Fetch API `BodyInit` regardless of a consumer's own\n * TypeScript/lib version.\n */\nexport function encodeUtf8(data: string): Uint8Array<ArrayBuffer> {\n\treturn textEncoder.encode(data);\n}\n\n/** Decode bytes as UTF-8. */\nexport function decodeUtf8(data: Uint8Array): string {\n\treturn textDecoder.decode(data);\n}\n\n/** Decode bytes as ASCII. */\nexport function decodeAscii(data: Uint8Array): string {\n\tlet s = \"\";\n\tfor (let i = 0; i < data.length; i++)\n\t\ts += String.fromCharCode(data[i] as number);\n\treturn s;\n}\n\n// ---------------------------------------------------------------------------\n// Array manipulation\n// ---------------------------------------------------------------------------\n\n/** Concatenate any number of Uint8Arrays into one. */\nexport function concat(...parts: Uint8Array[]): Uint8Array<ArrayBuffer> {\n\tlet total = 0;\n\tfor (const p of parts) total += p.length;\n\tconst out = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const p of parts) {\n\t\tout.set(p, offset);\n\t\toffset += p.length;\n\t}\n\treturn out;\n}\n\n// ---------------------------------------------------------------------------\n// Encoding\n// ---------------------------------------------------------------------------\n\n/** Uint8Array → lowercase hex string. */\nexport function toHex(data: Uint8Array): string {\n\tlet hex = \"\";\n\tfor (let i = 0; i < data.length; i++)\n\t\thex += (data[i] as number).toString(16).padStart(2, \"0\");\n\treturn hex;\n}\n\n/** Uint8Array → base64 string. */\nexport function toBase64(data: Uint8Array): string {\n\tlet binary = \"\";\n\tfor (let i = 0; i < data.length; i++)\n\t\tbinary += String.fromCharCode(data[i] as number);\n\treturn btoa(binary);\n}\n\n/** Hex string → Uint8Array. */\nexport function fromHex(hex: string): Uint8Array<ArrayBuffer> {\n\tconst bytes = new Uint8Array(hex.length / 2);\n\tfor (let i = 0; i < bytes.length; i++) {\n\t\tbytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n\t}\n\treturn bytes;\n}\n\n// ---------------------------------------------------------------------------\n// Crypto\n// ---------------------------------------------------------------------------\n\n/** SHA-1 hash via Web Crypto API. Returns a hex string. */\nexport async function sha1(data: Uint8Array | string): Promise<string> {\n\tconst bytes = typeof data === \"string\" ? encodeUtf8(data) : data;\n\tconst hash = await globalThis.crypto.subtle.digest(\"SHA-1\", bytes);\n\treturn toHex(new Uint8Array(hash));\n}\n\n// ---------------------------------------------------------------------------\n// Compression\n// ---------------------------------------------------------------------------\n\n/**\n * Deflate compress via the CompressionStream Web API.\n * Falls back to throwing if CompressionStream is unavailable (very old runtimes).\n */\nexport async function deflate(\n\tdata: Uint8Array,\n): Promise<Uint8Array<ArrayBuffer>> {\n\tconst stream = new Blob([data])\n\t\t.stream()\n\t\t.pipeThrough(new CompressionStream(\"deflate\"));\n\treturn new Uint8Array(await new Response(stream).arrayBuffer());\n}\n\n// ---------------------------------------------------------------------------\n// Binary detection (replaces Buffer.includes(0) pattern)\n// ---------------------------------------------------------------------------\n\n/** Check if a Uint8Array contains a null byte. */\nexport function hasNullByte(data: Uint8Array): boolean {\n\treturn data.includes(0);\n}\n\n/**\n * Read a blob as text or binary metadata — the edge-compatible replacement\n * for the `Buffer.from(blob)` pattern used throughout diff.ts and history.ts.\n */\nexport function readBlobContent(blob: Uint8Array): {\n\tisBinary: boolean;\n\ttext: string;\n\tbytes: Uint8Array;\n} {\n\tconst isBinary = hasNullByte(blob);\n\treturn {\n\t\tisBinary,\n\t\ttext: isBinary ? \"\" : decodeUtf8(blob),\n\t\tbytes: blob,\n\t};\n}\n","/**\n * Git-server error types carrying an HTTP status and a retryability flag, so\n * transport layers can map internal failures to responses without inspecting\n * messages. Extend {@link GitError} for app-specific cases (storage backends,\n * quota, …) and {@link formatErrorResponse} keeps working for them.\n */\nexport class GitError extends Error {\n\tstatusCode: number;\n\tretryable: boolean;\n\n\tconstructor(message: string, statusCode = 500, retryable = false) {\n\t\tsuper(message);\n\t\tthis.name = this.constructor.name;\n\t\tthis.statusCode = statusCode;\n\t\tthis.retryable = retryable;\n\t\tError.captureStackTrace?.(this, this.constructor);\n\t}\n\n\ttoJSON(): Record<string, unknown> {\n\t\treturn {\n\t\t\terror: this.name,\n\t\t\tmessage: this.message,\n\t\t\tstatusCode: this.statusCode,\n\t\t\tretryable: this.retryable,\n\t\t};\n\t}\n}\n\n/** A file/directory path not found within a tree (404). */\nexport class GitPathNotFoundError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 404, false);\n\t}\n}\n\n/** A git object not found (404). */\nexport class GitObjectNotFoundError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 404, false);\n\t}\n}\n\n/** A ref (branch/tag) not found (404). */\nexport class GitRefNotFoundError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 404, false);\n\t}\n}\n\n/** The repository itself not found (404). */\nexport class GitRepositoryNotFoundError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 404, false);\n\t}\n}\n\nexport interface MergeConflictDetail {\n\tfile: string;\n\tbaseLines?: string[];\n\tsourceLines?: string[];\n\ttargetLines?: string[];\n}\n\n/** A merge conflict (409), carrying per-file conflict detail. */\nexport class GitConflictError extends GitError {\n\tconflicts: MergeConflictDetail[];\n\n\tconstructor(message: string, conflicts: MergeConflictDetail[] = []) {\n\t\tsuper(message, 409, false);\n\t\tthis.conflicts = conflicts;\n\t}\n\n\toverride toJSON(): Record<string, unknown> {\n\t\treturn { ...super.toJSON(), conflicts: this.conflicts };\n\t}\n}\n\n/** Authentication failed (401). */\nexport class GitAuthenticationError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 401, false);\n\t}\n}\n\n/** Authorization failed (403). */\nexport class GitAuthorizationError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 403, false);\n\t}\n}\n\n/** Too many failed attempts (429). */\nexport class GitRateLimitError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 429, false);\n\t}\n}\n\n/** Malformed request (400). */\nexport class GitInvalidRequestError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 400, false);\n\t}\n}\n\n/** Git wire-protocol violation (400). */\nexport class GitProtocolError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 400, false);\n\t}\n}\n\n/**\n * Map any error to an HTTP response shape. 401s carry the WWW-Authenticate\n * header git clients need before they will prompt for credentials. Non-GitError\n * failures are masked as opaque 500s — internal messages don't leak.\n */\nexport function formatErrorResponse(error: unknown): {\n\tstatus: number;\n\tbody: Record<string, unknown>;\n\theaders?: Record<string, string>;\n} {\n\tif (error instanceof GitError) {\n\t\treturn {\n\t\t\tstatus: error.statusCode,\n\t\t\tbody: error.toJSON(),\n\t\t\theaders:\n\t\t\t\terror.statusCode === 401\n\t\t\t\t\t? { \"WWW-Authenticate\": 'Basic realm=\"Git Repository\"' }\n\t\t\t\t\t: undefined,\n\t\t};\n\t}\n\n\tif (error instanceof Error) {\n\t\treturn {\n\t\t\tstatus: 500,\n\t\t\tbody: {\n\t\t\t\terror: \"InternalServerError\",\n\t\t\t\tmessage: \"An internal error occurred\",\n\t\t\t\tretryable: true,\n\t\t\t},\n\t\t};\n\t}\n\n\treturn {\n\t\tstatus: 500,\n\t\tbody: {\n\t\t\terror: \"UnknownError\",\n\t\t\tmessage: \"An unknown error occurred\",\n\t\t\tretryable: true,\n\t\t},\n\t};\n}\n","/**\n * Git ref-name validation, mirroring isomorphic-git's own internal `isValidRef`\n * character-class rules (the check `git.branch` and top-level `git.writeRef`\n * run before touching disk).\n *\n * Several of isomorphic-git's OTHER ref-touching primitives — `git.commit`,\n * `git.merge`, `git.deleteBranch`, and top-level `git.resolveRef`/\n * `git.deleteRef` — do NOT run this check internally: they resolve straight\n * through `fs.write`/`fs.rm(join(gitdir, ref))` with no jail to the gitdir.\n * On a shared-storage server (many repos under one prefix or base directory),\n * every branch/ref name that originates from request input must be validated\n * against these predicates before it reaches any of those primitives —\n * otherwise a `\"../\"`-laden name lets a caller with write access to any single\n * repo read, corrupt, or delete another repo's ref/object files.\n */\n\nconst BAD_REF_COMPONENT =\n\t// biome-ignore lint/suspicious/noControlCharactersInRegex: control chars are exactly what git's own ref-name rules reject — this needs to match the same range.\n\t/(^|[/.])([/.]|$)|^@$|@\\{|[\\x00-\\x20\\x7f~^:?*[\\\\]|\\.lock(\\/|$)/;\n\nconst FULL_SHA_RE = /^[0-9a-f]{40}$/i;\n\n/** Validates a fully-qualified ref (must start with refs/heads/ or refs/tags/). */\nexport function isSafeFullRefName(ref: string): boolean {\n\tif (!ref.startsWith(\"refs/heads/\") && !ref.startsWith(\"refs/tags/\")) {\n\t\treturn false;\n\t}\n\treturn !BAD_REF_COMPONENT.test(ref);\n}\n\n/**\n * Validates a bare branch name (no refs/ prefix). Rejects anything that looks\n * like a full ref path — a name of `\"refs/heads/x\"` would otherwise sail\n * through unprefixed at call sites that build `refs/heads/${name}` themselves\n * (doubling the prefix into something that still resolves), or be used as-is\n * at call sites that pass a name already containing `\"refs/\"` straight\n * through. Also rejects 40-hex SHA-shaped values so a stored branch name can\n * never be ambiguous with a commit SHA at write time; use\n * {@link isSafeRefName} on read paths that accept both shapes.\n */\nexport function isSafeBranchName(name: string): boolean {\n\tif (!name || name.startsWith(\"refs/\") || name === \"HEAD\") return false;\n\tif (FULL_SHA_RE.test(name)) return false;\n\treturn !BAD_REF_COMPONENT.test(name);\n}\n\n/** True for a full 40-hex-char commit SHA — the shape {@link isSafeBranchName} deliberately rejects. */\nexport function isFullSha(value: string): boolean {\n\treturn FULL_SHA_RE.test(value);\n}\n\n/**\n * Validates a \"ref\" field that may name either a branch or a commit SHA it's\n * pinned to — the shape read-path route params take (permalinks, raw links).\n * Both shapes still go through the traversal check.\n */\nexport function isSafeRefName(value: string): boolean {\n\treturn isSafeBranchName(value) || isFullSha(value);\n}\n\n/**\n * Validates a repo-relative file path from request input: relative, no `..`\n * segments, no `.git/` prefix, no null bytes. Use this anywhere a path\n * segment comes straight off a URL or form field rather than re-deriving the\n * checks ad hoc.\n */\nexport function isSafeRepoPath(p: string): boolean {\n\tif (p.startsWith(\"/\")) return false;\n\tif (p.split(\"/\").some((segment) => segment === \"..\")) return false;\n\tif (/^\\.git(\\/|$)/i.test(p)) return false;\n\tif (p.includes(\"\\0\")) return false;\n\treturn true;\n}\n\n/**\n * Qualify a bare branch name to `refs/heads/<name>` before handing it to\n * isomorphic-git. `resolveRef`/`expand` try several candidate paths in\n * sequence for a bare name — `ref`, `refs/ref`, `refs/tags/ref`,\n * `refs/heads/ref`, … — missing (and, against object storage, paying a real\n * round trip for) the first three every time. For a branch-only ref model,\n * skip straight to the winner. Left untouched: already-qualified refs,\n * `\"HEAD\"` (its own first candidate, already optimal), and 40-hex oids\n * (resolved locally by isomorphic-git with no I/O at all).\n */\nexport function qualifyBranchRef(ref: string): string {\n\tif (ref.startsWith(\"refs/\") || ref === \"HEAD\" || FULL_SHA_RE.test(ref)) {\n\t\treturn ref;\n\t}\n\treturn `refs/heads/${ref}`;\n}\n"],"mappings":";AAQA,IAAM,cAAc,IAAI,YAAY;AACpC,IAAM,cAAc,IAAI,YAAY;AAc7B,SAAS,WAAW,MAAuC;AACjE,SAAO,YAAY,OAAO,IAAI;AAC/B;AAGO,SAAS,WAAW,MAA0B;AACpD,SAAO,YAAY,OAAO,IAAI;AAC/B;AAGO,SAAS,YAAY,MAA0B;AACrD,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ;AAChC,SAAK,OAAO,aAAa,KAAK,CAAC,CAAW;AAC3C,SAAO;AACR;AAOO,SAAS,UAAU,OAA8C;AACvE,MAAI,QAAQ;AACZ,aAAW,KAAK,MAAO,UAAS,EAAE;AAClC,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACtB,QAAI,IAAI,GAAG,MAAM;AACjB,cAAU,EAAE;AAAA,EACb;AACA,SAAO;AACR;AAOO,SAAS,MAAM,MAA0B;AAC/C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ;AAChC,WAAQ,KAAK,CAAC,EAAa,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACxD,SAAO;AACR;AAGO,SAAS,SAAS,MAA0B;AAClD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ;AAChC,cAAU,OAAO,aAAa,KAAK,CAAC,CAAW;AAChD,SAAO,KAAK,MAAM;AACnB;AAGO,SAAS,QAAQ,KAAsC;AAC7D,QAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,CAAC;AAC3C,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;AAAA,EAC3D;AACA,SAAO;AACR;AAOA,eAAsB,KAAK,MAA4C;AACtE,QAAM,QAAQ,OAAO,SAAS,WAAW,WAAW,IAAI,IAAI;AAC5D,QAAM,OAAO,MAAM,WAAW,OAAO,OAAO,OAAO,SAAS,KAAK;AACjE,SAAO,MAAM,IAAI,WAAW,IAAI,CAAC;AAClC;AAUA,eAAsB,QACrB,MACmC;AACnC,QAAM,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,EAC5B,OAAO,EACP,YAAY,IAAI,kBAAkB,SAAS,CAAC;AAC9C,SAAO,IAAI,WAAW,MAAM,IAAI,SAAS,MAAM,EAAE,YAAY,CAAC;AAC/D;AAOO,SAAS,YAAY,MAA2B;AACtD,SAAO,KAAK,SAAS,CAAC;AACvB;AAMO,SAAS,gBAAgB,MAI9B;AACD,QAAM,WAAW,YAAY,IAAI;AACjC,SAAO;AAAA,IACN;AAAA,IACA,MAAM,WAAW,KAAK,WAAW,IAAI;AAAA,IACrC,OAAO;AAAA,EACR;AACD;;;ACpIO,IAAM,WAAN,cAAuB,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EAEA,YAAY,SAAiB,aAAa,KAAK,YAAY,OAAO;AACjE,UAAM,OAAO;AACb,SAAK,OAAO,KAAK,YAAY;AAC7B,SAAK,aAAa;AAClB,SAAK,YAAY;AACjB,UAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA,EACjD;AAAA,EAEA,SAAkC;AACjC,WAAO;AAAA,MACN,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,IACjB;AAAA,EACD;AACD;AAGO,IAAM,uBAAN,cAAmC,SAAS;AAAA,EAClD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,yBAAN,cAAqC,SAAS;AAAA,EACpD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,sBAAN,cAAkC,SAAS;AAAA,EACjD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,6BAAN,cAAyC,SAAS;AAAA,EACxD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAUO,IAAM,mBAAN,cAA+B,SAAS;AAAA,EAC9C;AAAA,EAEA,YAAY,SAAiB,YAAmC,CAAC,GAAG;AACnE,UAAM,SAAS,KAAK,KAAK;AACzB,SAAK,YAAY;AAAA,EAClB;AAAA,EAES,SAAkC;AAC1C,WAAO,EAAE,GAAG,MAAM,OAAO,GAAG,WAAW,KAAK,UAAU;AAAA,EACvD;AACD;AAGO,IAAM,yBAAN,cAAqC,SAAS;AAAA,EACpD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,wBAAN,cAAoC,SAAS;AAAA,EACnD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,oBAAN,cAAgC,SAAS;AAAA,EAC/C,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,yBAAN,cAAqC,SAAS;AAAA,EACpD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,mBAAN,cAA+B,SAAS;AAAA,EAC9C,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAOO,SAAS,oBAAoB,OAIlC;AACD,MAAI,iBAAiB,UAAU;AAC9B,WAAO;AAAA,MACN,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM,OAAO;AAAA,MACnB,SACC,MAAM,eAAe,MAClB,EAAE,oBAAoB,+BAA+B,IACrD;AAAA,IACL;AAAA,EACD;AAEA,MAAI,iBAAiB,OAAO;AAC3B,WAAO;AAAA,MACN,QAAQ;AAAA,MACR,MAAM;AAAA,QACL,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,MACZ;AAAA,IACD;AAAA,EACD;AAEA,SAAO;AAAA,IACN,QAAQ;AAAA,IACR,MAAM;AAAA,MACL,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,IACZ;AAAA,EACD;AACD;;;ACxIA,IAAM;AAAA;AAAA,EAEL;AAAA;AAED,IAAM,cAAc;AAGb,SAAS,kBAAkB,KAAsB;AACvD,MAAI,CAAC,IAAI,WAAW,aAAa,KAAK,CAAC,IAAI,WAAW,YAAY,GAAG;AACpE,WAAO;AAAA,EACR;AACA,SAAO,CAAC,kBAAkB,KAAK,GAAG;AACnC;AAYO,SAAS,iBAAiB,MAAuB;AACvD,MAAI,CAAC,QAAQ,KAAK,WAAW,OAAO,KAAK,SAAS,OAAQ,QAAO;AACjE,MAAI,YAAY,KAAK,IAAI,EAAG,QAAO;AACnC,SAAO,CAAC,kBAAkB,KAAK,IAAI;AACpC;AAGO,SAAS,UAAU,OAAwB;AACjD,SAAO,YAAY,KAAK,KAAK;AAC9B;AAOO,SAAS,cAAc,OAAwB;AACrD,SAAO,iBAAiB,KAAK,KAAK,UAAU,KAAK;AAClD;AAQO,SAAS,eAAe,GAAoB;AAClD,MAAI,EAAE,WAAW,GAAG,EAAG,QAAO;AAC9B,MAAI,EAAE,MAAM,GAAG,EAAE,KAAK,CAAC,YAAY,YAAY,IAAI,EAAG,QAAO;AAC7D,MAAI,gBAAgB,KAAK,CAAC,EAAG,QAAO;AACpC,MAAI,EAAE,SAAS,IAAI,EAAG,QAAO;AAC7B,SAAO;AACR;AAYO,SAAS,iBAAiB,KAAqB;AACrD,MAAI,IAAI,WAAW,OAAO,KAAK,QAAQ,UAAU,YAAY,KAAK,GAAG,GAAG;AACvE,WAAO;AAAA,EACR;AACA,SAAO,cAAc,GAAG;AACzB;","names":[]}

package/dist/http.cjs

@@ -52,7 +52,7 @@ __export(http_exports, {
 module.exports = __toCommonJS(http_exports);
 
 // src/http/info-refs.ts
-var import_isomorphic_git = __toESM(require("isomorphic-git"), 1);
+var import_isomorphic_git2 = __toESM(require("isomorphic-git"), 1);
 
 // src/edge-utils.ts
 var textEncoder = new TextEncoder();
@@ -96,6 +96,39 @@ async function deflate(data) {
   return new Uint8Array(await new Response(stream).arrayBuffer());
 }
 
+// src/ops/branch.ts
+var import_isomorphic_git = __toESM(require("isomorphic-git"), 1);
+
+// src/refs.ts
+var BAD_REF_COMPONENT = (
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: control chars are exactly what git's own ref-name rules reject — this needs to match the same range.
+  /(^|[/.])([/.]|$)|^@$|@\{|[\x00-\x20\x7f~^:?*[\\]|\.lock(\/|$)/
+);
+function isSafeFullRefName(ref) {
+  if (!ref.startsWith("refs/heads/") && !ref.startsWith("refs/tags/")) {
+    return false;
+  }
+  return !BAD_REF_COMPONENT.test(ref);
+}
+
+// src/ops/branch.ts
+var FULL_SHA_RE = /^[0-9a-f]{40}$/i;
+async function resolveLooseRefFast(repo, ref) {
+  const promisesFs = repo.fs.promises;
+  if (promisesFs) {
+    try {
+      const content = await promisesFs.readFile(
+        `${repo.gitdir}/${ref}`,
+        "utf8"
+      );
+      const oid = (typeof content === "string" ? content : new TextDecoder().decode(content)).trim();
+      if (FULL_SHA_RE.test(oid)) return oid;
+    } catch {
+    }
+  }
+  return import_isomorphic_git.default.resolveRef({ ...repo, ref });
+}
+
 // src/http/pkt-line.ts
 var FLUSH = new Uint8Array([
   48,
@@ -155,19 +188,16 @@ function rawFs(repo) {
 // src/http/info-refs.ts
 async function listAllRefs(repo, defaultBranch = "main") {
   const [branches, tags, headSymref] = await Promise.all([
-    import_isomorphic_git.default.listBranches(repo),
-    import_isomorphic_git.default.listTags(repo),
+    import_isomorphic_git2.default.listBranches(repo),
+    import_isomorphic_git2.default.listTags(repo),
     // Wrap with Promise.resolve so a mock/stub returning undefined doesn't crash .then()
-    Promise.resolve(import_isomorphic_git.default.currentBranch({ ...repo, fullname: true })).then((cb) => cb ?? `refs/heads/${defaultBranch}`).catch(() => `refs/heads/${defaultBranch}`)
+    Promise.resolve(import_isomorphic_git2.default.currentBranch({ ...repo, fullname: true })).then((cb) => cb ?? `refs/heads/${defaultBranch}`).catch(() => `refs/heads/${defaultBranch}`)
   ]);
   const [branchRefs, tagRefs] = await Promise.all([
     Promise.all(
       branches.map(async (branch) => {
         try {
-          const oid = await import_isomorphic_git.default.resolveRef({
-            ...repo,
-            ref: `refs/heads/${branch}`
-          });
+          const oid = await resolveLooseRefFast(repo, `refs/heads/${branch}`);
           return { name: `refs/heads/${branch}`, oid };
         } catch {
           return null;
@@ -177,10 +207,7 @@ async function listAllRefs(repo, defaultBranch = "main") {
     Promise.all(
       tags.map(async (tag) => {
         try {
-          const oid = await import_isomorphic_git.default.resolveRef({
-            ...repo,
-            ref: `refs/tags/${tag}`
-          });
+          const oid = await resolveLooseRefFast(repo, `refs/tags/${tag}`);
           return { name: `refs/tags/${tag}`, oid };
         } catch {
           return null;
@@ -188,7 +215,7 @@ async function listAllRefs(repo, defaultBranch = "main") {
       })
     )
   ]);
-  const headOid = branchRefs.find((r) => r?.name === headSymref)?.oid ?? await import_isomorphic_git.default.resolveRef({ ...repo, ref: "HEAD" }).catch(() => null);
+  const headOid = branchRefs.find((r) => r?.name === headSymref)?.oid ?? await import_isomorphic_git2.default.resolveRef({ ...repo, ref: "HEAD" }).catch(() => null);
   const refs = [];
   if (headOid) refs.push({ name: "HEAD", oid: headOid });
   for (const r of branchRefs) if (r) refs.push(r);
@@ -237,7 +264,7 @@ async function handleInfoRefs(repo, options, hooks) {
 }
 
 // src/http/reachability.ts
-var import_isomorphic_git2 = __toESM(require("isomorphic-git"), 1);
+var import_isomorphic_git3 = __toESM(require("isomorphic-git"), 1);
 var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var MISSING_OBJECT_RETRY_DELAY_MS = 200;
 async function collectReachableOids(repo, startOids, hooks) {
@@ -245,17 +272,17 @@ async function collectReachableOids(repo, startOids, hooks) {
   let complete = true;
   const promises = /* @__PURE__ */ new Map();
   async function readAndVisitChildren(oid) {
-    const obj = await import_isomorphic_git2.default.readObject({ ...repo, oid });
+    const obj = await import_isomorphic_git3.default.readObject({ ...repo, oid });
     seen.add(oid);
     let children = [];
     if (obj.type === "commit") {
-      const { commit } = await import_isomorphic_git2.default.readCommit({ ...repo, oid });
+      const { commit } = await import_isomorphic_git3.default.readCommit({ ...repo, oid });
       children = [commit.tree, ...commit.parent];
     } else if (obj.type === "tree") {
-      const { tree } = await import_isomorphic_git2.default.readTree({ ...repo, oid });
+      const { tree } = await import_isomorphic_git3.default.readTree({ ...repo, oid });
       children = tree.map((e) => e.oid);
     } else if (obj.type === "tag") {
-      const { tag } = await import_isomorphic_git2.default.readTag({ ...repo, oid });
+      const { tag } = await import_isomorphic_git3.default.readTag({ ...repo, oid });
       children = [tag.object];
     }
     await Promise.all(children.map(visit));
@@ -284,22 +311,10 @@ async function collectReachableOids(repo, startOids, hooks) {
 }
 
 // src/http/receive-pack.ts
-var import_isomorphic_git4 = __toESM(require("isomorphic-git"), 1);
-
-// src/refs.ts
-var BAD_REF_COMPONENT = (
-  // biome-ignore lint/suspicious/noControlCharactersInRegex: control chars are exactly what git's own ref-name rules reject — this needs to match the same range.
-  /(^|[/.])([/.]|$)|^@$|@\{|[\x00-\x20\x7f~^:?*[\\]|\.lock(\/|$)/
-);
-function isSafeFullRefName(ref) {
-  if (!ref.startsWith("refs/heads/") && !ref.startsWith("refs/tags/")) {
-    return false;
-  }
-  return !BAD_REF_COMPONENT.test(ref);
-}
+var import_isomorphic_git5 = __toESM(require("isomorphic-git"), 1);
 
 // src/http/repack.ts
-var import_isomorphic_git3 = __toESM(require("isomorphic-git"), 1);
+var import_isomorphic_git4 = __toESM(require("isomorphic-git"), 1);
 var PACK_OBJECT_TYPE_BITS = {
   commit: 16,
   tree: 32,
@@ -331,7 +346,7 @@ async function readAndVerifyObjects(repo, oids) {
     const batch = oids.slice(i, i + BATCH_SIZE);
     const entries = await Promise.all(
       batch.map(async (oid) => {
-        const { type, object } = await import_isomorphic_git3.default.readObject({
+        const { type, object } = await import_isomorphic_git4.default.readObject({
           ...repo,
           oid,
           format: "content"
@@ -406,8 +421,8 @@ async function repackRepository(repo, options, hooks) {
       return [];
     }
     const [branches, tags] = await Promise.all([
-      import_isomorphic_git3.default.listBranches(repo),
-      import_isomorphic_git3.default.listTags(repo)
+      import_isomorphic_git4.default.listBranches(repo),
+      import_isomorphic_git4.default.listTags(repo)
     ]);
     const refNames = [
       ...branches.map((b) => `refs/heads/${b}`),
@@ -415,7 +430,7 @@ async function repackRepository(repo, options, hooks) {
     ];
     const tipOids = (await Promise.all(
       refNames.map(
-        (ref) => import_isomorphic_git3.default.resolveRef({ ...repo, ref }).catch(() => null)
+        (ref) => import_isomorphic_git4.default.resolveRef({ ...repo, ref }).catch(() => null)
       )
     )).filter((oid) => oid !== null);
     if (tipOids.length === 0) return [];
@@ -429,7 +444,7 @@ async function repackRepository(repo, options, hooks) {
     const newPackFile = `${newBase}.pack`;
     const newIdxFile = `${newBase}.idx`;
     await fsp.writeFile(`${packDir}/${newPackFile}`, packBuffer);
-    const { oids: indexedOids } = await import_isomorphic_git3.default.indexPack({
+    const { oids: indexedOids } = await import_isomorphic_git4.default.indexPack({
       ...repo,
       dir: packDir,
       filepath: newPackFile
@@ -489,7 +504,7 @@ async function ensureRepoInitialized(repo, defaultBranch = "main") {
   } catch {
     await fsp.mkdir(repo.gitdir, { recursive: true }).catch(() => {
     });
-    await import_isomorphic_git4.default.init({ ...repo, dir: repo.gitdir, defaultBranch, bare: true });
+    await import_isomorphic_git5.default.init({ ...repo, dir: repo.gitdir, defaultBranch, bare: true });
   }
 }
 async function indexIncomingPack(repo, packData, hooks) {
@@ -500,7 +515,7 @@ async function indexIncomingPack(repo, packData, hooks) {
     await fsp.mkdir(packDir, { recursive: true });
     const packName = `recv-${Date.now()}`;
     await fsp.writeFile(`${packDir}/${packName}.pack`, packData);
-    await import_isomorphic_git4.default.indexPack({
+    await import_isomorphic_git5.default.indexPack({
       ...repo,
       dir: packDir,
       filepath: `${packName}.pack`
@@ -516,7 +531,7 @@ async function applyRefUpdates(repo, refUpdates, hooks) {
         if (!isSafeFullRefName(refName)) {
           return { refName, ok: false, reason: "invalid ref name" };
         }
-        const currentOid = await import_isomorphic_git4.default.resolveRef({ ...repo, ref: refName }).catch(() => ZERO_OID);
+        const currentOid = await import_isomorphic_git5.default.resolveRef({ ...repo, ref: refName }).catch(() => ZERO_OID);
         if (currentOid !== oldOid) {
           return {
             refName,
@@ -525,10 +540,10 @@ async function applyRefUpdates(repo, refUpdates, hooks) {
           };
         }
         if (newOid === ZERO_OID) {
-          await import_isomorphic_git4.default.deleteRef({ ...repo, ref: refName }).catch(() => {
+          await import_isomorphic_git5.default.deleteRef({ ...repo, ref: refName }).catch(() => {
           });
         } else {
-          await import_isomorphic_git4.default.writeRef({
+          await import_isomorphic_git5.default.writeRef({
             ...repo,
             ref: refName,
             value: newOid,
@@ -573,7 +588,7 @@ async function applyReceivePack(repo, parsed, options, hooks) {
 }
 
 // src/http/upload-pack.ts
-var import_isomorphic_git5 = __toESM(require("isomorphic-git"), 1);
+var import_isomorphic_git6 = __toESM(require("isomorphic-git"), 1);
 var ZERO_OID2 = "0".repeat(40);
 async function handleUploadPack(repo, body, options, hooks) {
   const lines = parsePktLines(body);
@@ -656,7 +671,7 @@ async function handleUploadPack(repo, body, options, hooks) {
   const { packfile } = await runStep(
     hooks,
     `packObjects (${oids.length} oids)`,
-    () => import_isomorphic_git5.default.packObjects({ ...repo, oids })
+    () => import_isomorphic_git6.default.packObjects({ ...repo, oids })
   );
   const packBytes = packfile instanceof Uint8Array ? packfile : new Uint8Array(packfile ?? []);
   return {