looply-cli 0.0.0-stage → 0.2.0

package/dist/git-driver.d.ts

@@ -0,0 +1,519 @@
+import { type TrailerInput } from '@looply/core';
+/**
+ * The git driver.
+ *
+ * Every git interaction the round loop needs, behind one injected `exec` so the
+ * behaviour is testable without a repository. Two properties are load-bearing:
+ * a branch that already exists is refused, never reused (DESIGN §12 case 2), and
+ * the state directory survives both staging and the discard path's `clean -fd`
+ * (DESIGN §12 case 12) — explicitly, via pathspec and `-e`, not by trusting the
+ * target repo's `.gitignore` to mention `.looply`.
+ */
+export interface GitExecResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export type GitExec = (args: readonly string[]) => Promise<GitExecResult>;
+export declare class GitError extends Error {
+}
+/** The runner's own files; git must never stage them and never clean them. */
+export declare const STATE_DIR = ".looply";
+/**
+ * THE EXECUTION'S OWN STATE — one directory per checkout, one writer.
+ *
+ * Everything whose correctness rests on there being a single writer lives here:
+ * the run lease, `queue.json`'s whole-file rewrite, `status.json`'s single-run
+ * shape, `events.jsonl`'s in-memory `seq` counter. Those are correct BECAUSE
+ * one run owns one checkout, and they stay correct when a second run happens in
+ * a different one.
+ */
+export declare function executionStateDir(cwd: string): string;
+/**
+ * THE PROJECT'S STATE — one directory per repository, however many worktrees.
+ *
+ * 🔴 A LINKED WORKTREE IS THE SAME PROJECT, and the state whose invariant says
+ * "per project" must not follow the checkout. Otherwise isolating executions
+ * silently un-does safety rather than adding it:
+ *
+ *   loop-safety history      keyed by the state directory and the pursuit it
+ *                            watches, and the path half exists only as where the
+ *                            file sits — so a second worktree is a FRESH
+ *                            history. Both detectors
+ *                            need three observations and each run contributes
+ *                            one, so with a worktree per run they can never
+ *                            fire at all.
+ *   exemption spend ledger   single-use holds only because there is one
+ *                            `exemptions.json` per checkout. N checkouts make
+ *                            one granted row spendable N times — a rails bypass,
+ *                            not a bookkeeping detail.
+ *   control.json             the ONE channel the daemon, the run and the
+ *                            controller share about whether a person said stop.
+ *                            Split it and the stop button reaches one run.
+ *   goals                    the daemon is the sole writer; a run reads.
+ *
+ * ⚠️ IDENTICAL TO `executionStateDir` IN THE ORDINARY CASE. In a normal checkout
+ * the main worktree IS the cwd, so both answer the same path and Simple Mode is
+ * byte-identical. They diverge only inside a linked worktree.
+ *
+ * ⚠️ FALLS BACK TO THE EXECUTION DIR when there is no repository or its metadata
+ * cannot be read — the pre-worktree behaviour, unchanged. `repoConfigTroubleAt`
+ * is the check that refuses on unreadable metadata; this is not that check.
+ *
+ * 🔴 AND THAT FALLBACK USED TO SWALLOW A CASE IT SHOULD NOT HAVE. A repository
+ * can have several worktrees and no main one — `clone --bare` plus two
+ * `worktree add`s — and there `mainWorktreeRoot` is null while the sharing is
+ * still required. The old code read null as "nothing to share" and put the
+ * project's state inside each checkout: a fresh loop-safety history per
+ * checkout, and one single-use exemption spendable once per checkout, with
+ * nothing said about it.
+ *
+ * For those, the shared state goes under `~/.looply/projects/<key>`, keyed by
+ * the common dir — the one identity every worktree of that repository agrees
+ * on. `~/.looply` is where this codebase already puts state that must survive
+ * the repository, and a bare repository has no tree to put it in anyway.
+ *
+ * ⚠️ AN ORDINARY CHECKOUT IS UNAFFECTED, and that is load-bearing for
+ * compatibility: `linkedRepoCommonDir` answers null unless the checkout is
+ * LINKED, so a single-worktree repository — bare or not — keeps the exact path
+ * it has always used and no existing state is orphaned.
+ */
+export declare function projectStateDir(cwd: string): string;
+export declare class GitDriver {
+    private readonly exec;
+    constructor(exec: GitExec);
+    private run;
+    /**
+     * The pathspec that keeps `.looply` out of a stage — WHEN NAMING IT IS LEGAL.
+     *
+     * 🔴 `:(exclude).looply` IS A REFUSAL WHEN `.looply` IS ALREADY IGNORED, and
+     * that broke evidence gathering on every round of any project that gitignores
+     * it. Git rejects a pathspec that EXPLICITLY names an ignored path, and an
+     * exclusion names it:
+     *
+     *     .looply not in .gitignore   git add -N -- . :(exclude).looply   exit 0
+     *     .looply in .gitignore       same command                        exit 1
+     *       "The following paths are ignored by one of your .gitignore files"
+     *
+     * `advice.addIgnoredFile=false` only hides the hint; the exit code stays 1.
+     *
+     * ⚠️ AND IT IS A CATCH-22 WITHOUT THIS. Leave `.looply/` untracked and the run
+     * refuses to start on a dirty tree; gitignore it — the obvious fix, and the
+     * one a person reaches for — and every round's evidence fails instead.
+     * Measured live: a round whose gate was green and whose proof said `proven`
+     * recorded `evidence could not be gathered`.
+     *
+     * When the path is already ignored the exclusion is not merely illegal, it is
+     * REDUNDANT: git skips ignored paths under a `.` pathspec anyway. So the
+     * answer is to ask, and to drop it exactly when git is already doing the job.
+     *
+     * ⚠️ ASKED EVERY TIME, NOT MEMOISED. A round may edit `.gitignore`, and the
+     * direction that goes wrong is the one a cache would get wrong: believing
+     * `.looply` is ignored when it is no longer ignored stages the state
+     * directory into somebody's commit. One `check-ignore` is a few milliseconds.
+     *
+     * `check-ignore` only reads `.gitignore` and prints; it is in the same
+     * READ-ONLY family as `status` and `rev-parse`, and none of the forbidden
+     * verbs.
+     */
+    private keepStateOut;
+    /** Create and switch to `name`. An existing branch of that name is a refusal. */
+    createBranch(name: string, from?: string): Promise<void>;
+    /** The sha of HEAD — recorded as the run's base before any round writes. */
+    headSha(): Promise<string>;
+    /**
+     * THE FIRST CONVERGENCE VERBS THIS DRIVER HAS EVER ISSUED.
+     *
+     * Until Phase 5 the complete list was add, cat-file, clean, commit, ls-tree,
+     * push, reset, rev-list, rev-parse, status, switch, worktree — no fetch, no
+     * merge, no rebase, no cherry-pick, no revert, no stash, no checkout, no tag,
+     * no remote, no branch -d, no notes, no gc, no bisect, no submodule. That was
+     * not an oversight; it was the whole safety argument, and it is why the three
+     * added here are the three that only ever READ or FAST-FORWARD.
+     *
+     * ⚠️ THERE IS STILL NO `merge`, NO `rebase` AND NO `cherry-pick`. Integration
+     * is a fast-forward or it is a refusal. A merge that had to combine two
+     * histories is the thing that can silently drop somebody's line, and
+     * "auto-resolving a merge conflict" is listed under **Never**.
+     */
+    mergeBase(a: string, b: string): Promise<string | null>;
+    /**
+     * How far apart two refs are, counted rather than assumed.
+     *
+     * `--left-right --count` answers both directions in one call, so the two
+     * numbers are read at the SAME moment — asking twice would let a ref move in
+     * between and produce a pair that never simultaneously held.
+     */
+    divergence(mine: string, theirs: string): Promise<{
+        ahead: number;
+        behind: number;
+    }>;
+    /**
+     * CREATE OR ADVANCE ONE OF LOOPLY'S OWN REFS — AND ONLY BY COMPARE-AND-SWAP.
+     *
+     * 🔴 THE FOURTH CONVERGENCE VERB, AND THE ONLY ONE THAT WRITES. Phase 5's
+     * integration queue has to move `looply/integration` forward, and until now
+     * this driver could not move a ref at all. What it must NOT become is a
+     * general `update-ref`: that is one typo away from moving `main`.
+     *
+     * Three narrowings, all of them enforced here rather than by convention:
+     *
+     *   1. THE NAME MUST BE LOOPLY'S. Anything not under `refs/heads/looply/` is
+     *      refused before git is asked. A person's branch is theirs, and `main`
+     *      is nobody's to move from here.
+     *   2. IT IS A COMPARE-AND-SWAP, ALWAYS. `git update-ref <ref> <new> <old>`
+     *      fails if the ref is not still `old`, so a base that moved between
+     *      validation and publication cannot be overwritten — git itself refuses,
+     *      atomically, without this code having to re-read and hope. Creating a
+     *      ref passes the all-zero oid as `old`, which is git's own way of saying
+     *      "and it must not exist yet".
+     *   3. FAST-FORWARD ONLY. The caller must have established that `newSha` has
+     *      `oldSha` as an ancestor; there is still no `merge`, `rebase` or
+     *      `cherry-pick` in this file, so nothing here can combine two histories.
+     *
+     * ⚠️ GIT'S REFERENCE API, NOT A FILE WRITE. Writing `.git/refs/...` by hand
+     * would miss packed refs, the reflog and the lock — and would be a second,
+     * worse implementation of the compare-and-swap that is the whole point.
+     *
+     * Answers `false` when the swap was refused (the ref moved, or already
+     * existed); throws only when git could not be asked at all.
+     */
+    compareAndSetRef(ref: string, newSha: string, oldSha: string | null): Promise<boolean>;
+    /** Local branches under a prefix, with their tips — the finished runs the lane may be offered (M5-1). */
+    listBranches(prefix: string): Promise<Array<{
+        name: string;
+        sha: string;
+    }>>;
+    /** Whether a ref exists at all. Integration may not have been cut yet. */
+    refExists(ref: string): Promise<boolean>;
+    /**
+     * WHAT THE REPOSITORY CONTAINS, as distinct from which commit produced it.
+     *
+     * ─────────────────────────────────────────────────────────────────────────
+     * A COMMIT SHA IS THE WRONG IDENTITY FOR "IS THIS THE SAME STATE AGAIN"
+     *
+     * A commit id covers the parent, the author, the message and the timestamp,
+     * so it differs on every commit even when the content is byte-identical.
+     * Loop safety needs to notice a pursuit moving A → B → A → B, and with commit
+     * ids that reads as four distinct states and no cycle is ever detectable.
+     *
+     * A tree id is the content. The same files reached twice by two different
+     * commits are ONE state, which is exactly the equality the detector needs.
+     *
+     * ⚠️ IT DESCRIBES THE COMMITTED TREE, NOT THE WORKING ONE. Uncommitted edits
+     * do not move it — the same limit `headSha` has. That is the honest reading
+     * for a Round that commits its work; a caller comparing dirty trees would
+     * need something else, and inventing one here would mean writing to the index
+     * (see `diff()`, which is not read-only despite its name).
+     *
+     * READ-ONLY. `rev-parse` resolves; it changes nothing.
+     */
+    headTreeSha(): Promise<string>;
+    /**
+     * The tree a ref or commit points at — `headTreeSha` for any ref (F25: the lane
+     * judges coverage on the integration tip's tree). READ-ONLY, the same `rev-parse`.
+     */
+    treeOf(ref: string): Promise<string>;
+    /**
+     * Whether `ancestor` is in `of`'s history (a commit is its own ancestor) — F31. READ-ONLY:
+     * `merge-base --is-ancestor` answers by exit code, 0 yes and 1 no; anything else is a fault.
+     */
+    isAncestor(ancestor: string, of: string): Promise<boolean>;
+    /** The commit a ref points at (F27). READ-ONLY, the same `rev-parse`. */
+    commitOf(ref: string): Promise<string>;
+    /**
+     * Put HEAD on `sha`, detached — the tree a goal-met Start must judge (F27).
+     *
+     * ⚠️ `switch`, the verb this driver already uses, and never forced: `switch --detach`
+     * refuses when local changes would be lost, and the caller has already found the tree clean.
+     */
+    switchDetached(sha: string): Promise<void>;
+    /**
+     * The branch HEAD is on, or `(detached)` when it is not on one.
+     *
+     * Recorded in the run lease as the branch the run was cut from. Nothing
+     * returns to it — run branches stack — so knowing where a run started is the
+     * only way a later process can tell an ordinary stacked branch from a tree
+     * somebody has since moved somewhere else entirely.
+     */
+    /**
+     * Every tracked file at a revision, with its blob sha and size.
+     *
+     * 🔴 ENUMERATED FROM THE GIT INDEX, NEVER FROM THE FILESYSTEM, AND THAT ONE
+     * DECISION SETTLES FOUR SEPARATE PROBLEMS THE AUDIT FOUND.
+     *
+     *   ignore rules   git has already applied `.gitignore`. Nothing in this
+     *                  repository reads that file, and the one production skip
+     *                  list is three hardcoded basenames that would happily walk
+     *                  `dist/` and `coverage/` — build output that is by
+     *                  construction different on every machine.
+     *   symlink escape the existing physical-path defence is a NAMED-PATH
+     *                  defence: it says nothing about an enumeration, so a
+     *                  directory walk inherits none of it. The git index cannot
+     *                  contain an entry outside the repository, so the escape is
+     *                  impossible here rather than guarded against.
+     *   ordering       `ls-tree` output is deterministic, unlike `readdir`.
+     *   portability    paths are already project-relative.
+     *
+     * `-r` recurses into subtrees; `-z` because a path may contain anything a
+     * newline could, and `-l` adds the size git already knows so nothing has to
+     * stat the working tree.
+     */
+    listTree(treeIsh: string): Promise<Array<{
+        path: string;
+        blobSha: string;
+        bytes: number;
+    }>>;
+    /**
+     * The COMMITTED content of one blob.
+     *
+     * ⚠️ THE COMMITTED CONTENT, NOT THE WORKING TREE'S. An index describes a
+     * revision; reading the file from disk would describe whatever somebody has
+     * half-edited, and two machines would then disagree about a revision they
+     * both have.
+     */
+    readBlob(blobSha: string): Promise<string>;
+    currentBranch(): Promise<string>;
+    /**
+     * Working-tree paths that differ from HEAD, with `.looply/**` filtered out —
+     * the runner's own state writes must never read as "the agent changed
+     * something", or the no-op branch becomes unreachable (DESIGN §2.4).
+     */
+    changedPaths(): Promise<string[]>;
+    /**
+     * Every changed path WITH what happened to it, as `git status` reports it.
+     *
+     * The manifest a rejected candidate is retained with. `changedPaths` is the
+     * same list with the status dropped, and the two share one parse so they
+     * cannot disagree about which paths a round touched. `status` is the
+     * two-character porcelain code (`??` new, ` M` modified, `R ` renamed…).
+     */
+    changedEntries(): Promise<Array<{
+        path: string;
+        status: string;
+    }>>;
+    /**
+     * Commits in `fromSha..toSha` that touch any of `paths` — the input to the
+     * re-verification trigger (DESIGN §12 case 19). Zero paths short-circuits to
+     * 0 without calling git: `rev-list --count` with an empty pathspec counts
+     * *every* commit, which would read as "everything touched the evidence".
+     */
+    countCommitsTouching(fromSha: string, toSha: string, paths: readonly string[]): Promise<number>;
+    /** `add -A`, with the state directory excluded by pathspec. */
+    /**
+     * The round's changes as a unified diff, for the prover.
+     *
+     * Staged and unstaged both, because the round is inspected before anything is
+     * committed. State and run logs are excluded by the same pathspec the commit
+     * uses — a prover reading its own run's ledger would be grading the story.
+     */
+    /**
+     * Create a linked worktree at `path`, on a NEW branch cut from `baseSha`.
+     *
+     * ⚠️ THROUGH THE SAME `exec` AS EVERY OTHER VERB, deliberately. A worktree
+     * provisioner with its own git runner would be a second "safe enough" path
+     * around the config check, the repository-root check, the rebuilt `GIT_`
+     * namespace and the absolute binary resolution — all four of which exist
+     * because the repository is untrusted input.
+     *
+     * ⚠️ A NEW BRANCH, NEVER AN EXISTING ONE. `-b` fails if the branch is already
+     * there, which is the same refusal `createBranch` makes and for the same
+     * reason: reusing a branch would stack this execution's commits on whatever a
+     * previous one left behind. Linked worktrees SHARE the ref namespace, so this
+     * is the check that makes two simultaneous executions safe to start.
+     */
+    addWorktree(path: string, branch: string, baseSha: string): Promise<void>;
+    /**
+     * Every worktree of this repository: its path, its HEAD, its branch.
+     *
+     * `--porcelain` because the human-readable form is not parseable — a path may
+     * contain spaces, and the columns are aligned rather than delimited.
+     */
+    listWorktrees(): Promise<Array<{
+        path: string;
+        head: string;
+        branch: string | null;
+    }>>;
+    /**
+     * Remove a linked worktree.
+     *
+     * 🔴 NEVER `--force`, AND THIS IS NOT A STYLE CHOICE. `git worktree remove
+     * --force` deletes IGNORED files — `node_modules`, `.env` — which `discard()`
+     * one method below deliberately preserves by omitting `-x` from `clean`. It
+     * also fires exactly when git has already refused the safe form, which is to
+     * say exactly when something is there that git thought worth refusing over.
+     *
+     * So git's own refusal IS the check. A caller that cannot remove a worktree
+     * should leave it and say so, not insist.
+     */
+    removeWorktree(path: string): Promise<void>;
+    /**
+     * Drop the administrative records of worktrees whose directories are gone.
+     *
+     * Touches no working tree — it only reconciles `.git/worktrees/*` with what is
+     * actually on disk, which is what makes a directory that a person deleted by
+     * hand stop counting against the ref namespace.
+     */
+    pruneWorktrees(): Promise<void>;
+    /**
+     * Everything THIS checkout holds that a pristine one would not — INCLUDING
+     * ignored files.
+     *
+     * ⚠️ `--ignored` IS THE WHOLE POINT. Without it this asks exactly the question
+     * `git worktree remove` already answers by refusing, and learns nothing new.
+     * With it, it sees the `node_modules` and the `.env` that `remove` deletes
+     * silently.
+     *
+     * 🔴 AND IT ANSWERS ABOUT *THIS* DRIVER'S CHECKOUT — the first version took a
+     * `workspace` and passed `-C <workspace>`, which does nothing here.
+     * `trustedGitEnv` pins GIT_DIR and GIT_WORK_TREE from the cwd the driver was
+     * built with, and a pinned work tree beats `-C`. Measured: it reported the
+     * MAIN checkout's residue while claiming to describe a workspace — so a dirty
+     * main checkout would have blocked every reap, and a clean one would have
+     * waved through a workspace full of files. To ask about another checkout,
+     * build a driver for it.
+     */
+    statusWithIgnored(): Promise<string>;
+    diff(maxBytes?: number): Promise<string>;
+    /**
+     * The working tree's change against HEAD as one applicable patch — the
+     * artifact a rejected candidate is retained as, before `discard()` resets it.
+     *
+     * `diff()` is this with the prover's own truncation notice; the two share the
+     * implementation so the patch a repair restores and the diff a prover judged
+     * are the same text. `truncated` is a FLAG here rather than a notice in the
+     * text, because a truncated patch must never be applied: `git apply` would
+     * either refuse it or, worse, apply the part it could read.
+     */
+    patch(maxBytes: number): Promise<{
+        text: string;
+        bytes: number;
+        truncated: boolean;
+    }>;
+    /**
+     * The change one commit range makes, as one applicable patch — the same
+     * artifact `patch()` produces for a working tree, asked about history
+     * instead.
+     *
+     * 🔴 THIS IS WHAT A REPLAY CARRIES, and it is deliberately a PATCH rather
+     * than a range of commits. Carrying commits would mean replaying their
+     * identities onto a new base, which is the rewrite `integration.spec.ts`
+     * forbids; carrying the change means a NEW commit that must earn its own
+     * proof. The distinction is the whole reason a replay is not a rebase.
+     *
+     * ⚠️ `truncated` is a flag, never a notice in the text: a truncated patch
+     * must never be applied, because `git apply` would either refuse it or,
+     * worse, apply the part it could read.
+     */
+    patchBetween(fromSha: string, toSha: string, maxBytes: number): Promise<{
+        text: string;
+        bytes: number;
+        truncated: boolean;
+    }>;
+    /**
+     * The paths a commit range touched — what the replay fold is asked about.
+     *
+     * ⚠️ The state directory is excluded for the same reason it is excluded from
+     * the patch: it is looply's own bookkeeping, not the candidate's work, and a
+     * replay that carried it would carry one run's ledger onto another's base.
+     */
+    changedPathsBetween(fromSha: string, toSha: string): Promise<string[]>;
+    /**
+     * Restore a retained candidate into the working tree from its patch file.
+     *
+     * ⚠️ CHECKED FIRST, THEN APPLIED, AND NEVER PARTIALLY. `--check` asks git
+     * whether the whole patch fits the tree as it stands; only then is it applied
+     * — and `git apply` without `--reject` is itself all-or-nothing, so a hunk
+     * that no longer fits leaves the tree exactly as it was. The runner decides
+     * WHETHER to restore (base matches, patch complete, paths permitted); this
+     * only does the restoring, and answers a refusal as a value rather than a
+     * throw because "the patch no longer applies" is a finding, not a fault.
+     *
+     * `patchFile` is a path on this machine, never patch text on a command line.
+     */
+    applyPatch(patchFile: string): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        because: string;
+    }>;
+    stageAll(): Promise<void>;
+    /**
+     * Is there anything staged to commit?
+     *
+     * 🔴 BECAUSE "ALREADY DONE" WAS ENDING WHOLE RUNS. `git commit` exits 1 on an
+     * empty tree, the driver turns a non-zero exit into a `GitError`, and the
+     * runner's crash path turns that into `run-aborted` — severity critical, the
+     * run over, every remaining item dropped.
+     *
+     * Measured live: a round whose gate was GREEN in 2,148 ms and whose prover
+     * answered `proven` at 0.83 killed its run, because the previous round's
+     * implementer had already written the tests this round's item asked for. The
+     * work was right, the checks agreed it was right, and being right is what
+     * ended the run.
+     *
+     * `--quiet` implies `--exit-code`: 0 means no staged difference against HEAD,
+     * 1 means there is one. Anything else is a real git failure and is raised
+     * rather than read as "nothing staged" — answering "empty" to a broken
+     * repository would silently skip a commit that should have happened.
+     */
+    hasStagedChanges(): Promise<boolean>;
+    /**
+     * Commit the staged tree. The trailer is generated here from the executed step
+     * list — the driver takes `TrailerInput`, not a finished string, so no caller
+     * can hand-write a trailer that claims a check it never ran.
+     */
+    commit(subject: string, trailer: TrailerInput): Promise<string>;
+    /**
+     * The full message of a commit, or null when the ref does not resolve.
+     *
+     * Read-only, and used by recovery for one narrow question: whether the commit
+     * at HEAD is the one a crashed round was about to record. A round commits
+     * with the item's title as the subject, and only ever after the commit permit
+     * passed — so finding it is evidence the round finished, not a substitute for
+     * the checks that let it.
+     */
+    messageOf(ref: string): Promise<string | null>;
+    /**
+     * Drop everything the round did: `reset --hard`, then `clean -fd` with the
+     * state directory explicitly spared. `-fd` (never `-fdx`) plus `-e` means
+     * `.looply/**` survives even in a repo whose `.gitignore` forgot it.
+     */
+    discard(): Promise<void>;
+    /**
+     * WHAT THE REMOTE SAYS THIS REF IS, OR NULL.
+     *
+     * The reconciliation read, and the reason a push is the right first real
+     * action: the question "did it happen" has an exact answer that can be asked
+     * afterwards, from a different process, with nothing carried over but the
+     * approved sha.
+     *
+     * A ref the remote does not have is `null`, which is not an error — a branch
+     * that has never existed is the ordinary case for a first push.
+     */
+    remoteRef(remoteName: string, ref: string): Promise<string | null>;
+    /**
+     * THE ONE OUTWARD ACT.
+     *
+     * `<sha>:<ref>` rather than a branch name, so what is pushed is the exact
+     * commit a person approved and not whatever a local ref points at by the time
+     * this runs. There is no `--force` and no `+` in the refspec: this method
+     * cannot express a forced push, which is a stronger statement than declining
+     * to pass a flag.
+     *
+     * Everything else about safety it inherits: `nodeGitExec` is the one trusted
+     * construction point, so this call is refused outright if the repository's
+     * config names a program for git to run, and carries the hooks override and
+     * `GIT_TERMINAL_PROMPT=0` like every other verb.
+     */
+    push(remoteName: string, sourceSha: string, destinationRef: string): Promise<void>;
+}
+/**
+ * Real exec: argv straight to git, no shell, so message bytes arrive verbatim.
+ *
+ * THE ONE TRUSTED CONSTRUCTION POINT. Every production git call in the tree —
+ * the daemon's, the run's, the verifier's — is built here, which is why the
+ * repository-config defence can live in one place and cover all of them.
+ */
+export declare function nodeGitExec(cwd: string): GitExec;
+//# sourceMappingURL=git-driver.d.ts.map

package/dist/git-driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-driver.d.ts","sourceRoot":"","sources":["../src/git-driver.ts"],"names":[],"mappings":"AAaA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAE/D;;;;;;;;;GASG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAE1E,qBAAa,QAAS,SAAQ,KAAK;CAAG;AAEtC,8EAA8E;AAC9E,eAAO,MAAM,SAAS,YAAY,CAAC;AAEnC;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkBnD;AAoBD,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,OAAO;YAE5B,GAAG;IAQjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;YACW,YAAY;IAO1B,iFAAiF;IAC3E,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB9D,4EAA4E;IACtE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAIhC;;;;;;;;;;;;;;OAcG;IACG,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU7D;;;;;;OAMG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAwB1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB5F,yGAAyG;IACnG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAUjF,0EAA0E;IACpE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS9C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAIpC;;;OAGG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI1C;;;OAGG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOhE,yEAAyE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI5C;;;;;OAKG;IACG,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMhD;;;;;;;OAOG;IACH;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAoBjG;;;;;;;OAOG;IACG,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI1C,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAOtC;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIvC;;;;;;;OAOG;IACG,cAAc,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA+BxE;;;;;OAKG;IACG,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrG,+DAA+D;IAC/D;;;;;;OAMG;IACH;;;;;;;;;;;;;;OAcG;IACG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/E;;;;;OAKG;IACG,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAkB5F;;;;;;;;;;;OAWG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrC;;;;;;;;;;;;;;;;;OAiBG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAcpC,IAAI,CAAC,QAAQ,SAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ/C;;;;;;;;;OASG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAuB3F;;;;;;;;;;;;;;OAcG;IACG,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAM/D;;;;;;OAMG;IACG,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAU5E;;;;;;;;;;;;OAYG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAYrF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAI/B;;;;;;;;;;;;;;;;;;OAkBG;IACG,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAO1C;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAKrE;;;;;;;;OAQG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKpD;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAO9B;;;;;;;;;;OAUG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAexE;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAWzF;AAmBD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA8ChD"}