Push-driven SHA-1/SHA-256 pack decoder with fixed inline state and one
caller-owned 32 KiB inflate window. Neither input nor output is retained.
Supports plain, offset-delta and reference-delta entries, including thin
packs; checking base existence and graph connectivity is a host operation.
Parse fragmented, already inflated delta bytes with fixed inline state.
The trusted base must be canonical and completely resolved at base_depth.
Copies use 64-bit ranges so the host can await bounded storage reads between
events. Inserts borrow the current input, including partial instructions.
A resumable pack encoder. Retain the repository and selected order unchanged
until EOF. read performs at most one object-body read, bounded by its output
slice. The cursor owns hash/framing state, never object or pack-sized storage.
One checksummed/inflated entry. Delta data is an instruction stream rather
than a Git object body; resolve it against an authenticated materialized base.
Stream one entry from a trusted pack offset, without loading the pack or
its index. This shares framing, CRC, inflation, size and object-ID handling
with Decoder. It does not verify the whole pack’s checksum or graph.
Compare the final CRC/ID with authenticated index metadata before use.
Read plain body or delta-instruction bytes from a previously authenticated
packed entry. Supply packed bytes starting at entry_offset. Inflation skips
the prefix using caller scratch, then emits only the requested inflated range.
One update performs at most one inflater step. Scratch retains pending bytes
across output backpressure; no whole entry/body/pack is retained.
An allocation-free cursor for the same bytes as write_index. Metadata must
remain immutable until EOF. Each pull copies at most one field (32 bytes),
regardless of the supplied buffer size; zero means complete, never pending.
Construction checks metadata before output. It does not authenticate a pack.
Metadata for one complete encoded pack entry. Offsets include the pack header;
CRCs cover its type/length header and complete zlib stream. An index’s entries
must be unique and sorted by ID. Fields do not authenticate a foreign pack.
The 1032-byte fanout/header of a previously authenticated v2 index.
Parsing checks layout and fanout shape. It does NOT verify the full index
checksum, ID ordering, or its relationship to pack contents. Establish those
when importing/creating the index, before trusting lookup results or absence.
The header and every range reply must refer to that same immutable snapshot.
A resumable index lookup. Fetch status()’s range, then supply its exact
bytes to update. A storage error can be retried without advancing state.
Malformed replies are terminal. There is no allocation or provider callback.
Storage for one imported object. Initialize with Default; only materialize
populates entries. The C representation lets adapters allocate this storage
without introducing an allocator into the core.
An immutable, ID-sorted index and materialized bodies. The input pack and
decoding scratch are not retained. This validates objects and tree structure,
not graph closure, refs or commit/tag header semantics.
Assemble a version-2 pack without inflating/recompressing stored entries.
All state is inline; each sink is supplied per call so a host can await
storage/network operations between bounded writes. Preserve produced bytes.
Any error is terminal and invalidates the entire partial output.
Reconstruct a canonical object or range without retaining a base/result or
a repository-sized index. Supply metadata and representation reads requested
by request; every read is resumable across storage awaits and output limits.
Input is never retained, including when a copy descends into another delta.
Unconsumed bytes can be resubmitted or refetched at the next requested offset.
Reader over one complete downloaded pack. Construction verifies its
framing and hash; entries are then inflated/length-checked one at a time.
Each call borrows caller staging storage and a reusable 32 KiB zlib window.
Call finish (or read through None) to verify count and exact pack closure.
Forward reference deltas require host base lookup; thin-pack bases may be
supplied as ResolvedObject::external. No pack-index file parser is implied.
A canonical body with a computed ID and tracked delta depth. A decoded entry
retains its pack/offset identity, preventing cross-pack offset-base confusion.
Read inflated plain body bytes or inflated delta instructions. The host can
obtain these through EntryDecoder, a bounded cache, or immutable body storage.
Apply Git delta instructions to a canonical base, inheriting its object kind.
Both size headers, source/target ranges, instruction count and exact closure
are validated. The returned body is exposed only on success; staging output
may have changed on error. This function applies one level; resolve_delta
additionally tracks and bounds chain depth across resolved entries.
Find metadata in the sorted index produced by materialize. Adapters retaining
the raw index must keep it immutable. Default/unpopulated entries are omitted.
Import a checksummed, non-thin SHA-1 pack into caller-owned index/body storage.
Index needs object_count slots; excess slots remain untouched. Each pass
resets the reader and can resolve backward OFS or forward REF deltas against
earlier materialized objects. Depth, instruction, inflation, pass and work
limits are explicit; missing/external bases fail rather than doing I/O.
Generate a complete version-2 pack with no deltas, without buffering the pack.
Reserves 1 KiB of read scratch on the stack for streaming-only providers.
Stream a Git version-2 index for already verified pack metadata. Supports
SHA-1/SHA-256, empty packs and 64-bit offsets. The caller supplies entries in
strictly increasing ID order and the corresponding complete pack checksum.
Malformed metadata fails before output; sink failures invalidate partial
output. This validates metadata shape, not pack bytes or object bodies.
The returned index checksum is also written as its trailer.
Stream a stored-block pack and a version-2 index without buffering either.
order selects unique object indices or None selects the whole repository.
Metadata needs one slot per selected object; extra slots remain untouched.
Scratch must be nonempty for nonempty selections. The resulting pack matches
write_selected_with_scratch/write_with_scratch for every scratch size.
Stream a loose object by index. Borrowed bodies use write_loose directly;
other providers need nonempty scratch for nonempty bodies. Output is identical
for every scratch size. Discard partial output on error.
Write exactly the chosen object indices, in caller-specified order. Indices
must be valid and unique; violations fail before any output. Use a validated
repository’s select_objects result for an exact reachable closure. Encoder
and read budgets match write_with_scratch; no pack-sized buffer is needed.
Stream borrowed, file-backed, or generated objects using caller-owned scratch.
A nonempty buffer suffices for any body size; borrowed bodies need no scratch.
Output is independent of the buffer size, preserving pack/cache identities.
Errors invalidate partial output. Scratch is reused for each object; encoder
and hash state are inline and independent of object/pack sizes.