git-fs-s3 0.4.0 → 0.5.0

package/dist/types/refs.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Git ref-name validation, mirroring isomorphic-git's own internal `isValidRef`
+ * character-class rules (the check `git.branch` and top-level `git.writeRef`
+ * run before touching disk).
+ *
+ * Several of isomorphic-git's OTHER ref-touching primitives — `git.commit`,
+ * `git.merge`, `git.deleteBranch`, and top-level `git.resolveRef`/
+ * `git.deleteRef` — do NOT run this check internally: they resolve straight
+ * through `fs.write`/`fs.rm(join(gitdir, ref))` with no jail to the gitdir.
+ * On a shared-storage server (many repos under one prefix or base directory),
+ * every branch/ref name that originates from request input must be validated
+ * against these predicates before it reaches any of those primitives —
+ * otherwise a `"../"`-laden name lets a caller with write access to any single
+ * repo read, corrupt, or delete another repo's ref/object files.
+ */
+/** Validates a fully-qualified ref (must start with refs/heads/ or refs/tags/). */
+export declare function isSafeFullRefName(ref: string): boolean;
+/**
+ * Validates a bare branch name (no refs/ prefix). Rejects anything that looks
+ * like a full ref path — a name of `"refs/heads/x"` would otherwise sail
+ * through unprefixed at call sites that build `refs/heads/${name}` themselves
+ * (doubling the prefix into something that still resolves), or be used as-is
+ * at call sites that pass a name already containing `"refs/"` straight
+ * through. Also rejects 40-hex SHA-shaped values so a stored branch name can
+ * never be ambiguous with a commit SHA at write time; use
+ * {@link isSafeRefName} on read paths that accept both shapes.
+ */
+export declare function isSafeBranchName(name: string): boolean;
+/** True for a full 40-hex-char commit SHA — the shape {@link isSafeBranchName} deliberately rejects. */
+export declare function isFullSha(value: string): boolean;
+/**
+ * Validates a "ref" field that may name either a branch or a commit SHA it's
+ * pinned to — the shape read-path route params take (permalinks, raw links).
+ * Both shapes still go through the traversal check.
+ */
+export declare function isSafeRefName(value: string): boolean;
+/**
+ * Validates a repo-relative file path from request input: relative, no `..`
+ * segments, no `.git/` prefix, no null bytes. Use this anywhere a path
+ * segment comes straight off a URL or form field rather than re-deriving the
+ * checks ad hoc.
+ */
+export declare function isSafeRepoPath(p: string): boolean;
+/**
+ * Qualify a bare branch name to `refs/heads/<name>` before handing it to
+ * isomorphic-git. `resolveRef`/`expand` try several candidate paths in
+ * sequence for a bare name — `ref`, `refs/ref`, `refs/tags/ref`,
+ * `refs/heads/ref`, … — missing (and, against object storage, paying a real
+ * round trip for) the first three every time. For a branch-only ref model,
+ * skip straight to the winner. Left untouched: already-qualified refs,
+ * `"HEAD"` (its own first candidate, already optimal), and 40-hex oids
+ * (resolved locally by isomorphic-git with no I/O at all).
+ */
+export declare function qualifyBranchRef(ref: string): string;

package/dist/types/retry.d.ts

@@ -0,0 +1,52 @@
+import type { ObjectStore } from "./types.js";
+/** Options accepted by {@link createRetryStore}. */
+export interface RetryOptions {
+    /** Retries after the first attempt (total attempts = retries + 1). Default 3. */
+    retries?: number;
+    /** Backoff base delay in milliseconds, doubled each attempt. Default 100. */
+    initialDelayMs?: number;
+    /** Upper bound for the backoff base delay. Default 5000. */
+    maxDelayMs?: number;
+    /** Random jitter added to each delay, as a fraction of it. Default 0.3. */
+    jitter?: number;
+    /**
+     * Decide whether an error is worth retrying. The store contract maps
+     * "not found" to `null` rather than throwing, so any thrown error is a
+     * genuine failure; the default retries network faults, throttling, and
+     * HTTP 5xx responses.
+     */
+    isRetryable?: (error: unknown) => boolean;
+    /**
+     * Circuit breaker configuration, or `false` to disable. After `threshold`
+     * consecutive failures the store fails fast for `resetMs`, then lets one
+     * request probe the backend again. Defaults: 5 failures, 30 000 ms.
+     */
+    breaker?: false | {
+        threshold?: number;
+        resetMs?: number;
+    };
+    /** Called before each retry sleep; useful for logging/metrics. */
+    onRetry?: (info: {
+        key: string;
+        op: string;
+        attempt: number;
+        delayMs: number;
+    }) => void;
+}
+/**
+ * Thrown instead of calling the backend while the circuit breaker is open.
+ * Carries `code: "EUNAVAILABLE"` so callers can map it to a 503.
+ */
+export declare class CircuitOpenError extends Error {
+    readonly code = "EUNAVAILABLE";
+    constructor();
+}
+/**
+ * Wrap an {@link ObjectStore} with retries (exponential backoff + jitter) and
+ * an optional per-instance circuit breaker.
+ *
+ * Place this decorator closest to the network store, underneath any cache:
+ * the cache then never stores transient failures, and callers coalesced onto
+ * one request share a single retried attempt.
+ */
+export declare function createRetryStore(store: ObjectStore, options?: RetryOptions): ObjectStore;

package/dist/types/stores/memory.d.ts

@@ -0,0 +1,16 @@
+import type { ListOptions, ListResult, ObjectStat, ObjectStore } from "../types.js";
+/**
+ * In-memory {@link ObjectStore}. Useful for tests, examples, and ephemeral
+ * repositories; also the reference implementation for the list/delimiter
+ * semantics other stores must match.
+ */
+export declare class MemoryObjectStore implements ObjectStore {
+    private readonly objects;
+    get(key: string): Promise<Uint8Array | null>;
+    put(key: string, data: Uint8Array): Promise<void>;
+    delete(key: string): Promise<void>;
+    head(key: string): Promise<ObjectStat | null>;
+    list(prefix: string, options?: ListOptions): Promise<ListResult>;
+    /** Number of stored objects (test convenience, not part of ObjectStore). */
+    get size(): number;
+}

package/dist/{s3.d.ts → types/stores/s3.d.ts}

@@ -1,7 +1,6 @@
-import { S3Client } from '@aws-sdk/client-s3';
-import { O as ObjectStore, c as ObjectStat, L as ListOptions, d as ListResult } from './types-dbHzZ4ed.js';
-
-interface S3ObjectStoreOptions {
+import { type S3Client } from "@aws-sdk/client-s3";
+import type { ListOptions, ListResult, ObjectStat, ObjectStore } from "../types.js";
+export interface S3ObjectStoreOptions {
     /** A configured S3Client. Works with AWS S3, Cloudflare R2, MinIO, Backblaze B2, … */
     client: S3Client;
     bucket: string;
@@ -19,7 +18,7 @@ interface S3ObjectStoreOptions {
  * (peer dependency). One instance per bucket/prefix; reuse a single
  * `S3Client` across stores so HTTP connections are pooled.
  */
-declare class S3ObjectStore implements ObjectStore {
+export declare class S3ObjectStore implements ObjectStore {
     private readonly client;
     private readonly bucket;
     private readonly prefix;
@@ -32,5 +31,3 @@ declare class S3ObjectStore implements ObjectStore {
     head(key: string): Promise<ObjectStat | null>;
     list(prefix: string, options?: ListOptions): Promise<ListResult>;
 }
-
-export { S3ObjectStore, type S3ObjectStoreOptions };

package/dist/{types-dbHzZ4ed.d.ts → types/types.d.ts}

@@ -5,7 +5,7 @@
  * implementations ship with the package: {@link ../stores/memory.MemoryObjectStore}
  * and {@link ../stores/s3.S3ObjectStore}.
  */
-interface ObjectStore {
+export interface ObjectStore {
     /** Return the object's bytes, or `null` if the key does not exist. */
     get(key: string): Promise<Uint8Array | null>;
     /** Create or overwrite the object at `key`. */
@@ -24,14 +24,14 @@ interface ObjectStore {
      */
     list(prefix: string, options?: ListOptions): Promise<ListResult>;
 }
-interface ObjectStat {
+export interface ObjectStat {
     size: number;
 }
-interface ListOptions {
+export interface ListOptions {
     delimiter?: string;
     limit?: number;
 }
-interface ListResult {
+export interface ListResult {
     objects: {
         key: string;
         size: number;
@@ -39,7 +39,7 @@ interface ListResult {
     prefixes: string[];
 }
 /** What a caller knows about a gitdir it registers with `registerGitdir`. */
-interface GitdirFacts {
+export interface GitdirFacts {
     /**
      * Top-level gitdir files this backend never writes, such as
      * `packed-refs` or `shallow`; reading or statting them answers ENOENT
@@ -48,7 +48,7 @@ interface GitdirFacts {
     absentFiles?: readonly string[];
 }
 /** Options accepted by {@link ../git-fs.createGitFs}. */
-interface GitFsOptions {
+export interface GitFsOptions {
     /**
      * Key prefix all paths are stored under, e.g. `"repos/alice/blog"`.
      * Defaults to `""` (paths map directly to keys).
@@ -63,25 +63,16 @@ interface GitFsOptions {
      * Default false.
      */
     looseObjectHints?: boolean;
-    /**
-     * Paths (relative to the fs, before `prefix` is applied) that are known
-     * never to exist; `readFile`/`stat` answer ENOENT for them with zero
-     * store calls. Useful for files git probes on every operation but this
-     * backend never writes, such as `packed-refs` or `shallow` under a known
-     * gitdir layout. Match precisely — a plain suffix check is wrong, since
-     * e.g. `refs/heads/packed-refs` is a legal branch ref.
-     */
-    isStructurallyAbsent?: (path: string) => boolean;
     /** Time-to-live for loose-object hints in milliseconds. Default 3 600 000. */
     hintTtlMs?: number;
     /** Diagnostic sink for notable fs events (hint detection results). */
     onNote?: (message: string) => void;
 }
-type Encoding = "utf8";
-interface ReadFileOptions {
+export type Encoding = "utf8";
+export interface ReadFileOptions {
     encoding?: Encoding;
 }
-interface WriteFileOptions {
+export interface WriteFileOptions {
     encoding?: Encoding;
     mode?: number;
 }
@@ -89,7 +80,7 @@ interface WriteFileOptions {
  * The stat shape isomorphic-git expects. Object storage has no inodes,
  * owners, or modification times, so numeric fields are zero.
  */
-interface Stat {
+export interface Stat {
     type: "file" | "dir";
     mode: number;
     size: number;
@@ -110,7 +101,7 @@ interface Stat {
  * option. Declared locally so the package has no dependency on
  * isomorphic-git itself.
  */
-interface GitFsClient {
+export interface GitFsClient {
     promises: {
         readFile(filepath: string, options?: ReadFileOptions | Encoding): Promise<Uint8Array | string>;
         writeFile(filepath: string, data: Uint8Array | string, options?: WriteFileOptions | Encoding): Promise<void>;
@@ -127,5 +118,3 @@ interface GitFsClient {
         chmod(filepath: string, mode: number): Promise<void>;
     };
 }
-
-export type { GitFsClient as G, ListOptions as L, ObjectStore as O, Stat as S, GitdirFacts as a, GitFsOptions as b, ObjectStat as c, ListResult as d };

package/package.json

@@ -1,28 +1,24 @@
 {
   "name": "git-fs-s3",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "isomorphic-git filesystem backend for S3-compatible object storage (AWS S3, Cloudflare R2, MinIO) — run git servers without a disk",
   "type": "module",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "require": "./dist/index.cjs"
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/index.js"
     },
     "./s3": {
-      "types": "./dist/s3.d.ts",
-      "import": "./dist/s3.js",
-      "require": "./dist/s3.cjs"
+      "types": "./dist/types/stores/s3.d.ts",
+      "import": "./dist/s3.js"
     },
     "./ops": {
-      "types": "./dist/ops.d.ts",
-      "import": "./dist/ops.js",
-      "require": "./dist/ops.cjs"
+      "types": "./dist/types/ops/index.d.ts",
+      "import": "./dist/ops.js"
     },
     "./http": {
-      "types": "./dist/http.d.ts",
-      "import": "./dist/http.js",
-      "require": "./dist/http.cjs"
+      "types": "./dist/types/http/index.d.ts",
+      "import": "./dist/http.js"
     }
   },
   "files": [
@@ -30,7 +26,7 @@
   ],
   "sideEffects": false,
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && tsc -p tsconfig.build.json",
     "test": "vitest run",
     "test:watch": "vitest",
     "coverage": "vitest run --coverage",
@@ -66,10 +62,10 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "dependencies": {
-    "lru-cache": "^11.5.2"
+    "lru-cache": "^11.5.3"
   },
   "peerDependencies": {
     "@aws-sdk/client-s3": ">=3.0.0",
@@ -88,13 +84,13 @@
     }
   },
   "devDependencies": {
-    "@aws-sdk/client-s3": "^3.1130.0",
-    "@biomejs/biome": "^2.5.13",
-    "@types/node": "^22.20.2",
-    "isomorphic-git": "^1.42.0",
+    "@aws-sdk/client-s3": "^3.1149.0",
+    "@biomejs/biome": "^2.5.15",
+    "@types/node": "^26.6.5",
+    "isomorphic-git": "^1.43.3",
     "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
-    "vitest": "^5.0.0",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.3",
     "diff": "^9.0.0"
   },
   "allowScripts": {

package/dist/chunk-YQFNY6PG.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/edge-utils.ts","../src/git-errors.ts","../src/refs.ts"],"sourcesContent":["/**\n * Edge-compatible utilities replacing node:crypto, node:zlib, and Buffer.\n *\n * Every function here uses only Web APIs (SubtleCrypto, CompressionStream,\n * TextEncoder/TextDecoder) — no Node built-ins. They work on Cloudflare\n * Workers, Vercel Edge, Deno Deploy, and Node >= 18.\n */\n\nconst textEncoder = new TextEncoder();\nconst textDecoder = new TextDecoder();\n\n// ---------------------------------------------------------------------------\n// Text\n// ---------------------------------------------------------------------------\n\n/**\n * Encode a UTF-8 string to bytes.\n *\n * Return type pinned to `Uint8Array<ArrayBuffer>` (not the bare `Uint8Array`,\n * whose default type argument differs across TypeScript versions) so it's\n * always assignable to Fetch API `BodyInit` regardless of a consumer's own\n * TypeScript/lib version.\n */\nexport function encodeUtf8(data: string): Uint8Array<ArrayBuffer> {\n\treturn textEncoder.encode(data);\n}\n\n/** Decode bytes as UTF-8. */\nexport function decodeUtf8(data: Uint8Array): string {\n\treturn textDecoder.decode(data);\n}\n\n/** Decode bytes as ASCII. */\nexport function decodeAscii(data: Uint8Array): string {\n\tlet s = \"\";\n\tfor (let i = 0; i < data.length; i++)\n\t\ts += String.fromCharCode(data[i] as number);\n\treturn s;\n}\n\n// ---------------------------------------------------------------------------\n// Array manipulation\n// ---------------------------------------------------------------------------\n\n/** Concatenate any number of Uint8Arrays into one. */\nexport function concat(...parts: Uint8Array[]): Uint8Array<ArrayBuffer> {\n\tlet total = 0;\n\tfor (const p of parts) total += p.length;\n\tconst out = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const p of parts) {\n\t\tout.set(p, offset);\n\t\toffset += p.length;\n\t}\n\treturn out;\n}\n\n// ---------------------------------------------------------------------------\n// Encoding\n// ---------------------------------------------------------------------------\n\n/** Uint8Array → lowercase hex string. */\nexport function toHex(data: Uint8Array): string {\n\tlet hex = \"\";\n\tfor (let i = 0; i < data.length; i++)\n\t\thex += (data[i] as number).toString(16).padStart(2, \"0\");\n\treturn hex;\n}\n\n/** Uint8Array → base64 string. */\nexport function toBase64(data: Uint8Array): string {\n\tlet binary = \"\";\n\tfor (let i = 0; i < data.length; i++)\n\t\tbinary += String.fromCharCode(data[i] as number);\n\treturn btoa(binary);\n}\n\n/** Hex string → Uint8Array. */\nexport function fromHex(hex: string): Uint8Array<ArrayBuffer> {\n\tconst bytes = new Uint8Array(hex.length / 2);\n\tfor (let i = 0; i < bytes.length; i++) {\n\t\tbytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n\t}\n\treturn bytes;\n}\n\n// ---------------------------------------------------------------------------\n// Crypto\n// ---------------------------------------------------------------------------\n\n/** SHA-1 hash via Web Crypto API. Returns a hex string. */\nexport async function sha1(data: Uint8Array | string): Promise<string> {\n\tconst bytes = typeof data === \"string\" ? encodeUtf8(data) : data;\n\tconst hash = await globalThis.crypto.subtle.digest(\"SHA-1\", bytes);\n\treturn toHex(new Uint8Array(hash));\n}\n\n// ---------------------------------------------------------------------------\n// Compression\n// ---------------------------------------------------------------------------\n\n/**\n * Deflate compress via the CompressionStream Web API.\n * Falls back to throwing if CompressionStream is unavailable (very old runtimes).\n */\nexport async function deflate(\n\tdata: Uint8Array,\n): Promise<Uint8Array<ArrayBuffer>> {\n\tconst stream = new Blob([data])\n\t\t.stream()\n\t\t.pipeThrough(new CompressionStream(\"deflate\"));\n\treturn new Uint8Array(await new Response(stream).arrayBuffer());\n}\n\n// ---------------------------------------------------------------------------\n// Binary detection (replaces Buffer.includes(0) pattern)\n// ---------------------------------------------------------------------------\n\n/** Check if a Uint8Array contains a null byte. */\nexport function hasNullByte(data: Uint8Array): boolean {\n\treturn data.includes(0);\n}\n\n/**\n * Read a blob as text or binary metadata — the edge-compatible replacement\n * for the `Buffer.from(blob)` pattern used throughout diff.ts and history.ts.\n */\nexport function readBlobContent(blob: Uint8Array): {\n\tisBinary: boolean;\n\ttext: string;\n\tbytes: Uint8Array;\n} {\n\tconst isBinary = hasNullByte(blob);\n\treturn {\n\t\tisBinary,\n\t\ttext: isBinary ? \"\" : decodeUtf8(blob),\n\t\tbytes: blob,\n\t};\n}\n","/**\n * Git-server error types carrying an HTTP status and a retryability flag, so\n * transport layers can map internal failures to responses without inspecting\n * messages. Extend {@link GitError} for app-specific cases (storage backends,\n * quota, …) and {@link formatErrorResponse} keeps working for them.\n */\nexport class GitError extends Error {\n\tstatusCode: number;\n\tretryable: boolean;\n\n\tconstructor(message: string, statusCode = 500, retryable = false) {\n\t\tsuper(message);\n\t\tthis.name = this.constructor.name;\n\t\tthis.statusCode = statusCode;\n\t\tthis.retryable = retryable;\n\t\tError.captureStackTrace?.(this, this.constructor);\n\t}\n\n\ttoJSON(): Record<string, unknown> {\n\t\treturn {\n\t\t\terror: this.name,\n\t\t\tmessage: this.message,\n\t\t\tstatusCode: this.statusCode,\n\t\t\tretryable: this.retryable,\n\t\t};\n\t}\n}\n\n/** A file/directory path not found within a tree (404). */\nexport class GitPathNotFoundError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 404, false);\n\t}\n}\n\n/** A git object not found (404). */\nexport class GitObjectNotFoundError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 404, false);\n\t}\n}\n\n/** A ref (branch/tag) not found (404). */\nexport class GitRefNotFoundError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 404, false);\n\t}\n}\n\n/** The repository itself not found (404). */\nexport class GitRepositoryNotFoundError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 404, false);\n\t}\n}\n\nexport interface MergeConflictDetail {\n\tfile: string;\n\tbaseLines?: string[];\n\tsourceLines?: string[];\n\ttargetLines?: string[];\n}\n\n/** A merge conflict (409), carrying per-file conflict detail. */\nexport class GitConflictError extends GitError {\n\tconflicts: MergeConflictDetail[];\n\n\tconstructor(message: string, conflicts: MergeConflictDetail[] = []) {\n\t\tsuper(message, 409, false);\n\t\tthis.conflicts = conflicts;\n\t}\n\n\toverride toJSON(): Record<string, unknown> {\n\t\treturn { ...super.toJSON(), conflicts: this.conflicts };\n\t}\n}\n\n/** Authentication failed (401). */\nexport class GitAuthenticationError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 401, false);\n\t}\n}\n\n/** Authorization failed (403). */\nexport class GitAuthorizationError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 403, false);\n\t}\n}\n\n/** Too many failed attempts (429). */\nexport class GitRateLimitError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 429, false);\n\t}\n}\n\n/** Malformed request (400). */\nexport class GitInvalidRequestError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 400, false);\n\t}\n}\n\n/** Git wire-protocol violation (400). */\nexport class GitProtocolError extends GitError {\n\tconstructor(message: string) {\n\t\tsuper(message, 400, false);\n\t}\n}\n\n/**\n * Map any error to an HTTP response shape. 401s carry the WWW-Authenticate\n * header git clients need before they will prompt for credentials. Non-GitError\n * failures are masked as opaque 500s — internal messages don't leak.\n */\nexport function formatErrorResponse(error: unknown): {\n\tstatus: number;\n\tbody: Record<string, unknown>;\n\theaders?: Record<string, string>;\n} {\n\tif (error instanceof GitError) {\n\t\treturn {\n\t\t\tstatus: error.statusCode,\n\t\t\tbody: error.toJSON(),\n\t\t\theaders:\n\t\t\t\terror.statusCode === 401\n\t\t\t\t\t? { \"WWW-Authenticate\": 'Basic realm=\"Git Repository\"' }\n\t\t\t\t\t: undefined,\n\t\t};\n\t}\n\n\tif (error instanceof Error) {\n\t\treturn {\n\t\t\tstatus: 500,\n\t\t\tbody: {\n\t\t\t\terror: \"InternalServerError\",\n\t\t\t\tmessage: \"An internal error occurred\",\n\t\t\t\tretryable: true,\n\t\t\t},\n\t\t};\n\t}\n\n\treturn {\n\t\tstatus: 500,\n\t\tbody: {\n\t\t\terror: \"UnknownError\",\n\t\t\tmessage: \"An unknown error occurred\",\n\t\t\tretryable: true,\n\t\t},\n\t};\n}\n","/**\n * Git ref-name validation, mirroring isomorphic-git's own internal `isValidRef`\n * character-class rules (the check `git.branch` and top-level `git.writeRef`\n * run before touching disk).\n *\n * Several of isomorphic-git's OTHER ref-touching primitives — `git.commit`,\n * `git.merge`, `git.deleteBranch`, and top-level `git.resolveRef`/\n * `git.deleteRef` — do NOT run this check internally: they resolve straight\n * through `fs.write`/`fs.rm(join(gitdir, ref))` with no jail to the gitdir.\n * On a shared-storage server (many repos under one prefix or base directory),\n * every branch/ref name that originates from request input must be validated\n * against these predicates before it reaches any of those primitives —\n * otherwise a `\"../\"`-laden name lets a caller with write access to any single\n * repo read, corrupt, or delete another repo's ref/object files.\n */\n\nconst BAD_REF_COMPONENT =\n\t// biome-ignore lint/suspicious/noControlCharactersInRegex: control chars are exactly what git's own ref-name rules reject — this needs to match the same range.\n\t/(^|[/.])([/.]|$)|^@$|@\\{|[\\x00-\\x20\\x7f~^:?*[\\\\]|\\.lock(\\/|$)/;\n\nconst FULL_SHA_RE = /^[0-9a-f]{40}$/i;\n\n/** Validates a fully-qualified ref (must start with refs/heads/ or refs/tags/). */\nexport function isSafeFullRefName(ref: string): boolean {\n\tif (!ref.startsWith(\"refs/heads/\") && !ref.startsWith(\"refs/tags/\")) {\n\t\treturn false;\n\t}\n\treturn !BAD_REF_COMPONENT.test(ref);\n}\n\n/**\n * Validates a bare branch name (no refs/ prefix). Rejects anything that looks\n * like a full ref path — a name of `\"refs/heads/x\"` would otherwise sail\n * through unprefixed at call sites that build `refs/heads/${name}` themselves\n * (doubling the prefix into something that still resolves), or be used as-is\n * at call sites that pass a name already containing `\"refs/\"` straight\n * through. Also rejects 40-hex SHA-shaped values so a stored branch name can\n * never be ambiguous with a commit SHA at write time; use\n * {@link isSafeRefName} on read paths that accept both shapes.\n */\nexport function isSafeBranchName(name: string): boolean {\n\tif (!name || name.startsWith(\"refs/\") || name === \"HEAD\") return false;\n\tif (FULL_SHA_RE.test(name)) return false;\n\treturn !BAD_REF_COMPONENT.test(name);\n}\n\n/** True for a full 40-hex-char commit SHA — the shape {@link isSafeBranchName} deliberately rejects. */\nexport function isFullSha(value: string): boolean {\n\treturn FULL_SHA_RE.test(value);\n}\n\n/**\n * Validates a \"ref\" field that may name either a branch or a commit SHA it's\n * pinned to — the shape read-path route params take (permalinks, raw links).\n * Both shapes still go through the traversal check.\n */\nexport function isSafeRefName(value: string): boolean {\n\treturn isSafeBranchName(value) || isFullSha(value);\n}\n\n/**\n * Validates a repo-relative file path from request input: relative, no `..`\n * segments, no `.git/` prefix, no null bytes. Use this anywhere a path\n * segment comes straight off a URL or form field rather than re-deriving the\n * checks ad hoc.\n */\nexport function isSafeRepoPath(p: string): boolean {\n\tif (p.startsWith(\"/\")) return false;\n\tif (p.split(\"/\").some((segment) => segment === \"..\")) return false;\n\tif (/^\\.git(\\/|$)/i.test(p)) return false;\n\tif (p.includes(\"\\0\")) return false;\n\treturn true;\n}\n\n/**\n * Qualify a bare branch name to `refs/heads/<name>` before handing it to\n * isomorphic-git. `resolveRef`/`expand` try several candidate paths in\n * sequence for a bare name — `ref`, `refs/ref`, `refs/tags/ref`,\n * `refs/heads/ref`, … — missing (and, against object storage, paying a real\n * round trip for) the first three every time. For a branch-only ref model,\n * skip straight to the winner. Left untouched: already-qualified refs,\n * `\"HEAD\"` (its own first candidate, already optimal), and 40-hex oids\n * (resolved locally by isomorphic-git with no I/O at all).\n */\nexport function qualifyBranchRef(ref: string): string {\n\tif (ref.startsWith(\"refs/\") || ref === \"HEAD\" || FULL_SHA_RE.test(ref)) {\n\t\treturn ref;\n\t}\n\treturn `refs/heads/${ref}`;\n}\n"],"mappings":";AAQA,IAAM,cAAc,IAAI,YAAY;AACpC,IAAM,cAAc,IAAI,YAAY;AAc7B,SAAS,WAAW,MAAuC;AACjE,SAAO,YAAY,OAAO,IAAI;AAC/B;AAGO,SAAS,WAAW,MAA0B;AACpD,SAAO,YAAY,OAAO,IAAI;AAC/B;AAGO,SAAS,YAAY,MAA0B;AACrD,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ;AAChC,SAAK,OAAO,aAAa,KAAK,CAAC,CAAW;AAC3C,SAAO;AACR;AAOO,SAAS,UAAU,OAA8C;AACvE,MAAI,QAAQ;AACZ,aAAW,KAAK,MAAO,UAAS,EAAE;AAClC,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACtB,QAAI,IAAI,GAAG,MAAM;AACjB,cAAU,EAAE;AAAA,EACb;AACA,SAAO;AACR;AAOO,SAAS,MAAM,MAA0B;AAC/C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ;AAChC,WAAQ,KAAK,CAAC,EAAa,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACxD,SAAO;AACR;AAGO,SAAS,SAAS,MAA0B;AAClD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ;AAChC,cAAU,OAAO,aAAa,KAAK,CAAC,CAAW;AAChD,SAAO,KAAK,MAAM;AACnB;AAGO,SAAS,QAAQ,KAAsC;AAC7D,QAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,CAAC;AAC3C,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;AAAA,EAC3D;AACA,SAAO;AACR;AAOA,eAAsB,KAAK,MAA4C;AACtE,QAAM,QAAQ,OAAO,SAAS,WAAW,WAAW,IAAI,IAAI;AAC5D,QAAM,OAAO,MAAM,WAAW,OAAO,OAAO,OAAO,SAAS,KAAK;AACjE,SAAO,MAAM,IAAI,WAAW,IAAI,CAAC;AAClC;AAUA,eAAsB,QACrB,MACmC;AACnC,QAAM,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,EAC5B,OAAO,EACP,YAAY,IAAI,kBAAkB,SAAS,CAAC;AAC9C,SAAO,IAAI,WAAW,MAAM,IAAI,SAAS,MAAM,EAAE,YAAY,CAAC;AAC/D;AAOO,SAAS,YAAY,MAA2B;AACtD,SAAO,KAAK,SAAS,CAAC;AACvB;AAMO,SAAS,gBAAgB,MAI9B;AACD,QAAM,WAAW,YAAY,IAAI;AACjC,SAAO;AAAA,IACN;AAAA,IACA,MAAM,WAAW,KAAK,WAAW,IAAI;AAAA,IACrC,OAAO;AAAA,EACR;AACD;;;ACpIO,IAAM,WAAN,cAAuB,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EAEA,YAAY,SAAiB,aAAa,KAAK,YAAY,OAAO;AACjE,UAAM,OAAO;AACb,SAAK,OAAO,KAAK,YAAY;AAC7B,SAAK,aAAa;AAClB,SAAK,YAAY;AACjB,UAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA,EACjD;AAAA,EAEA,SAAkC;AACjC,WAAO;AAAA,MACN,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,IACjB;AAAA,EACD;AACD;AAGO,IAAM,uBAAN,cAAmC,SAAS;AAAA,EAClD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,yBAAN,cAAqC,SAAS;AAAA,EACpD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,sBAAN,cAAkC,SAAS;AAAA,EACjD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,6BAAN,cAAyC,SAAS;AAAA,EACxD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAUO,IAAM,mBAAN,cAA+B,SAAS;AAAA,EAC9C;AAAA,EAEA,YAAY,SAAiB,YAAmC,CAAC,GAAG;AACnE,UAAM,SAAS,KAAK,KAAK;AACzB,SAAK,YAAY;AAAA,EAClB;AAAA,EAES,SAAkC;AAC1C,WAAO,EAAE,GAAG,MAAM,OAAO,GAAG,WAAW,KAAK,UAAU;AAAA,EACvD;AACD;AAGO,IAAM,yBAAN,cAAqC,SAAS;AAAA,EACpD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,wBAAN,cAAoC,SAAS;AAAA,EACnD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,oBAAN,cAAgC,SAAS;AAAA,EAC/C,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,yBAAN,cAAqC,SAAS;AAAA,EACpD,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAGO,IAAM,mBAAN,cAA+B,SAAS;AAAA,EAC9C,YAAY,SAAiB;AAC5B,UAAM,SAAS,KAAK,KAAK;AAAA,EAC1B;AACD;AAOO,SAAS,oBAAoB,OAIlC;AACD,MAAI,iBAAiB,UAAU;AAC9B,WAAO;AAAA,MACN,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM,OAAO;AAAA,MACnB,SACC,MAAM,eAAe,MAClB,EAAE,oBAAoB,+BAA+B,IACrD;AAAA,IACL;AAAA,EACD;AAEA,MAAI,iBAAiB,OAAO;AAC3B,WAAO;AAAA,MACN,QAAQ;AAAA,MACR,MAAM;AAAA,QACL,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,MACZ;AAAA,IACD;AAAA,EACD;AAEA,SAAO;AAAA,IACN,QAAQ;AAAA,IACR,MAAM;AAAA,MACL,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,IACZ;AAAA,EACD;AACD;;;ACxIA,IAAM;AAAA;AAAA,EAEL;AAAA;AAED,IAAM,cAAc;AAGb,SAAS,kBAAkB,KAAsB;AACvD,MAAI,CAAC,IAAI,WAAW,aAAa,KAAK,CAAC,IAAI,WAAW,YAAY,GAAG;AACpE,WAAO;AAAA,EACR;AACA,SAAO,CAAC,kBAAkB,KAAK,GAAG;AACnC;AAYO,SAAS,iBAAiB,MAAuB;AACvD,MAAI,CAAC,QAAQ,KAAK,WAAW,OAAO,KAAK,SAAS,OAAQ,QAAO;AACjE,MAAI,YAAY,KAAK,IAAI,EAAG,QAAO;AACnC,SAAO,CAAC,kBAAkB,KAAK,IAAI;AACpC;AAGO,SAAS,UAAU,OAAwB;AACjD,SAAO,YAAY,KAAK,KAAK;AAC9B;AAOO,SAAS,cAAc,OAAwB;AACrD,SAAO,iBAAiB,KAAK,KAAK,UAAU,KAAK;AAClD;AAQO,SAAS,eAAe,GAAoB;AAClD,MAAI,EAAE,WAAW,GAAG,EAAG,QAAO;AAC9B,MAAI,EAAE,MAAM,GAAG,EAAE,KAAK,CAAC,YAAY,YAAY,IAAI,EAAG,QAAO;AAC7D,MAAI,gBAAgB,KAAK,CAAC,EAAG,QAAO;AACpC,MAAI,EAAE,SAAS,IAAI,EAAG,QAAO;AAC7B,SAAO;AACR;AAYO,SAAS,iBAAiB,KAAqB;AACrD,MAAI,IAAI,WAAW,OAAO,KAAK,QAAQ,UAAU,YAAY,KAAK,GAAG,GAAG;AACvE,WAAO;AAAA,EACR;AACA,SAAO,cAAc,GAAG;AACzB;","names":[]}