// Types for git-read.mjs (plain ESM, shipped and run as is; the server loads it from the package root).
export declare const COMMANDS: readonly ["show", "log", "diff", "ls-tree"];
export declare const MAX_ARGS: number;
export declare const MAX_ARG_LEN: number;
export declare const STDOUT_CAP: number;
/** What is kept of a process's stderr; past it stderr is cut and the process runs on. */
export declare const STDERR_CAP: number;
export declare const TIMEOUT_MS: number;
export declare const BASE: readonly string[];
export declare const FORCED: Readonly<Record<"show" | "log" | "diff" | "ls-tree", readonly string[]>>;
export declare const RUNS: Readonly<Record<"show" | "log" | "diff" | "ls-tree", readonly string[]>>;
export declare const DENIED: Readonly<Record<string, string>>;
export declare function refusal(arg: unknown): string | null;
/** The options each command takes (an allow-list): flags, valued options given as --name=value, and short forms with
 *  an attached value. */
export declare const OPTIONS: Readonly<Record<"show" | "log" | "diff" | "ls-tree", { flags: readonly string[]; valued: readonly string[]; patterns: readonly RegExp[] }>>;
/** The call decided before git starts: options, revisions (resolved to object ids by gitRead before git runs) and paths. */
export declare function plan(command: unknown, args?: unknown):
  | { command: string; options: string[]; revs: string[]; paths: string[]; argv: string[]; args: string[] }
  | { refused: string };
export declare function resolveRepo(repo: string | undefined, roots: readonly string[], fallback?: string):
  Promise<{ ok: true; repo: string; root: string } | { ok: false; message: string }>;
export declare function gitEnv(base: Record<string, string | undefined>, ceiling: string, extra?: Record<string, string>): Record<string, string>;
export interface GitRun {
  err: (Error & { code?: string | number | null; killed?: boolean; signal?: string | null }) | null;
  /** git's exit code, unchanged; null when it did not finish on its own or the sandbox did not run it */
  code: number | null;
  stdout: Buffer;
  stderr: Buffer;
  timedOut?: boolean;
  overflow?: "stdout" | "stderr" | null;
  /** why the sandbox did not run git, read before the exit code: from the launcher's report pipe (fd 3), or for macOS git
   *  from sandbox-exec's own stderr line */
  wrapper?: string;
  /** with `status`: what the launcher wrote on its report pipe ("ok", or a sentinel line) */
  status?: Buffer;
  /** whose reason the wrapper's failure is: "workspace" only for an identity or link refusal on a doer's path */
  wrapperWhose?: "host" | "workspace";
  /** stderr passed its cap and was cut (the process ran on) */
  stderrCut?: boolean;
  /** the process (and process group) id */
  pid?: number;
  /** reap mode: the command left a process running after it ended (it was killed) */
  leftBehind?: boolean;
}
export interface RunOptions { timeoutMs?: number; maxBuffer?: number; input?: string | Buffer }
/** The runner every git goes through: its own process group, killed whole on a timeout or an overflow. */
export declare function runGroup(file: string, args: readonly string[], o?: RunOptions & { cwd?: string; env?: Record<string, string | undefined>; maxStderr?: number; reap?: { marker: string; dir?: string } | null; status?: boolean }): Promise<GitRun>;
export interface GitRunner { run(args: readonly string[], o?: RunOptions): Promise<GitRun> }
export interface Operation {
  dir: string;
  /** the directory's identity, dev:ino, recorded as it was made */
  id: string;
  emptyConfig: string; seq: number; closed: boolean; close(): Promise<void>;
}
/** A rule path of a sandbox policy: a validated path with the identity recorded for it, or a system path. */
export type Rule = { path: string; id: string; exec?: boolean; doer?: true } | { path: string; system: true; exec: boolean };
export declare function ruleOf(path: string, id: string, more?: { exec?: boolean }): Rule;
/** A rule on a path of the doer's: read only, its identity or link refusal reported as the workspace's. */
export declare function doerRule(path: string, id: string): Rule;
/** The first Landlock ABI the launcher runs under. */
export declare const MIN_LANDLOCK_ABI: number;
export declare function configure(o: { stateDir?: string }): void;
export declare function openOperation(o?: { stateDir?: string }): Promise<Operation>;
export declare function withOperation<T>(o: { op?: Operation; stateDir?: string } | undefined, fn: (op: Operation) => Promise<T>): Promise<T>;
export declare const NO_PRIVATE_DIR: string;
export declare const PRIVATE: readonly string[];
export declare const MAX_REFS: number;
export interface Sandbox { ok: true; kind: "sandbox-exec" | "landlock"; helper: string; install: { binary: string; execPath: string; prefix: string; libs: string[]; loaderFiles: string[]; loader: string | null; key: string } }
export type SandboxStatus = Sandbox | { ok: false; why: string; measured: boolean; noGit?: true };
export declare const NO_SANDBOX: string;
export declare const LAUNCH_SENTINEL: string;
/** The Linux launcher (landlock/xmesh-sandbox.c), built beside this module. */
export declare const SANDBOX_HELPER: string;
/** This kernel's Landlock ABI as the launcher reads it; 0 off Linux or when it cannot say. */
export declare function landlockAbi(helper?: string): Promise<number>;
export declare function sandbox(o?: { baseEnv?: Record<string, string | undefined>; mutation?: "empty" | "broken" | null; unprobed?: boolean; helper?: string }): Promise<SandboxStatus>;
export declare function privateGit(o: { op: Operation; objects: string; objectsId?: string | null; format: "sha1" | "sha256"; sandbox: SandboxStatus; baseEnv?: Record<string, string | undefined>; timeoutMs?: number }): Promise<GitRunner & { gitDir: string }>;
export type Located =
  | { kind: "none" }
  /** objectsId: the objects directory's identity, dev:ino, recorded when locate checked it */
  | { kind: "repo"; tree: string; rel: string; gitDir: string; commonDir: string; objects: string; objectsId: string }
  | { kind: "notStated"; tree: string; rel: string; why: string };
export declare const MAX_SYMREF_DEPTH: number;
export declare const MAX_PACKED_REFS: number;
export declare function refNameOk(name: unknown): boolean;
export declare function locate(start: string, o?: { stopAt?: string | null }): Promise<Located>;
export declare function packedRefs(commonDir: string): Promise<{ ok: true; refs: Map<string, string> } | { ok: false; why: string }>;
export declare const REFS_WALK_MS: number;
export declare function allRefs(repo: Extract<Located, { kind: "repo" }>, o?: { deadlineMs?: number; maxRefs?: number }): Promise<{ ok: true; refs: Map<string, string> } | { ok: false; why: string }>;
export declare function readHead(repo: Extract<Located, { kind: "repo" }>):
  Promise<{ kind: "commit"; commit: string; format: "sha1" | "sha256" } | { kind: "unborn"; ref: string } | { kind: "notStated"; why: string }>;
export interface HeadFacts {
  tree: string;
  rel: string;
  commit: string | null;
  state: "clean" | "modified" | "absent" | "unknown";
  blob: string | null;
  entry?: { mode: string; type: string; oid: string };
  /** for state "modified": the bytes and the commit's blob differ only in CRLF and LF */
  lineEndingsOnly?: true;
  why?: "filter" | "git" | "size" | "repository" | "private-dir" | "sandbox";
  /** for why "sandbox": what the probe found */
  sandboxWhy?: string;
  detail?: string;
}
export declare const MAX_COMPARE: number;
export declare function namesFilter(gitattributes: string): boolean;
export interface FactsOptions { baseEnv?: Record<string, string | undefined>; timeoutMs?: number; maxBytes?: number; op?: Operation; stateDir?: string; sandbox?: SandboxStatus }
export declare function headFacts(file: string, bytes: Buffer | Uint8Array | null, o?: FactsOptions): Promise<HeadFacts | null>;
/** headFacts for many files in one operation: per repository at most six git runs (rev-parse, ls-tree, and cat-file
 *  batches for the attributes and the blobs), whatever the file count. In order. */
export declare function headFactsMany(files: readonly string[], o?: FactsOptions): Promise<(HeadFacts | null)[]>;
export declare function headDiff(file: string, o?: FactsOptions & { maxBuffer?: number }): Promise<{ ok: true; diff: string } | { ok: false; message: string } | null>;
export declare function noIndexDiff(before: Buffer | Uint8Array | string, after: Buffer | Uint8Array | string, rel: string, o?: FactsOptions & { maxBuffer?: number }):
  Promise<{ ok: true; diff: string } | { ok: false; message: string }>;
export declare const NO_CHECK_SANDBOX: string;
export declare const CHECK_TIMEOUT_MS: number;
export declare const CHECK_OUTPUT_CAP: number;
export declare const MAX_CHECK_COPY: number;
export declare const MAX_CHECK_FILES: number;
export type CheckSandboxStatus = { ok: true; kind: "sandbox-exec" | "landlock"; helper: string; toolchain: { node: string; nodePrefix: string; dirs: string[]; rules: Rule[]; key: string } } | { ok: false; why: string; measured: boolean };
export declare function checkSandbox(o?: { baseEnv?: Record<string, string | undefined>; mutation?: "empty" | "broken" | null; unprobed?: boolean; helper?: string }): Promise<CheckSandboxStatus>;
export type CheckRun =
  /** host: not run for this host's reason (no enforcing sandbox, no private directory), so the check is not verified;
   *  without it, not run for the workspace's reason, which the caller counts as a failed check */
  | { ran: false; why: string; host?: true; sandboxWhy?: string }
  | { ran: true; code: number | null; signal: string | null; stdout: Buffer; stderr: Buffer; timedOut: boolean; overflow: "stdout" | "stderr" | null; leftBehind: boolean };
export declare function runCheck(command: string, o: { cwd: string; roots?: readonly string[]; timeoutMs?: number; baseEnv?: Record<string, string | undefined>; sandbox?: CheckSandboxStatus; maxBuffer?: number }): Promise<CheckRun>;
export declare function checkoutHead(dir: string): Promise<string | null>;
export declare function changedPaths(dir: string, from: string, to: string, o?: { op?: Operation; sandbox?: SandboxStatus; baseEnv?: Record<string, string | undefined>; timeoutMs?: number }): Promise<string[]>;
export interface GitReadInput { command: string; args?: string[]; repo?: string }
export interface GitReadOptions { roots: readonly string[]; defaultRepo?: string; baseEnv?: Record<string, string | undefined>; stateDir?: string; sandbox?: SandboxStatus; /** the whole call's time, TIMEOUT_MS by default */ timeoutMs?: number }
export declare function gitRead(input: GitReadInput, opts: GitReadOptions): Promise<{ text: string; isError: boolean; argv?: string[] }>;