import { mkdtempSync, rmSync } from "node:fs";
import os from "node:os";
import path from "node:path";
import { $ as _$ } from "bun";

import {
    MAX_BRANCH_CACHE,
    MAX_REF_LIST,
    MAX_TAG_CACHE,
    paths,
    REF_CACHE_TTL_MS,
} from "../constants.ts";

export const gitEnv = {
    ...process.env,
    LC_ALL: "C",
    LANG: "C",
    GIT_CONFIG_GLOBAL: "/dev/null",
    GIT_CONFIG_SYSTEM: "/dev/null",
    GIT_CONFIG_COUNT: "0",
    GIT_ASKPASS: "echo",
    GIT_TERMINAL_PROMPT: "0",
};

const $ = _$.env(gitEnv);

// Per-repo mutex: prevents concurrent git write operations on the same repo
// (e.g. two patches being merged simultaneously, which would corrupt the index).
const repoWriteLocks = new Map<string, Promise<void>>();

// Short-lived caches for ref lists — these change only on push/branch ops.
const branchCache = new Map<string, { value: string[]; expiresAt: number }>();
const tagCache = new Map<string, { value: string[]; expiresAt: number }>();

export function invalidateRefCache(name: string): void {
    branchCache.delete(name);
    tagCache.delete(name);
}

async function withRepoLock<T>(name: string, fn: () => Promise<T>): Promise<T> {
    const prev = repoWriteLocks.get(name) ?? Promise.resolve();
    let unlock!: () => void;
    repoWriteLocks.set(
        name,
        prev.then(
            () =>
                new Promise<void>((res) => {
                    unlock = res;
                }),
        ),
    );
    await prev;
    try {
        return await fn();
    } finally {
        unlock();
    }
}

export function repoPath(name: string): string {
    return path.join(paths.REPOS_DIR, `${name}.git`);
}

// Log an unexpected git failure. Many git calls legitimately fail for benign
// reasons (a ref that doesn't exist yet, an empty repo), so callers still
// swallow the error and return an empty result — but we surface it here so a
// corrupted repo, permission problem, or missing binary isn't completely
// invisible.
function logGitError(op: string, name: string, err: unknown): void {
    console.error(`[git] ${op} failed for ${name}:`, err);
}

// Create a private, uniquely-named temp directory (mode 0700, created
// atomically by the OS) and remove it afterward. Replaces predictable
// /tmp/hf-*-<time>-<rand> paths, which on a shared host were open to a
// pre-planted symlink redirecting our writes.
async function withTempDir<T>(
    prefix: string,
    fn: (dir: string) => Promise<T>,
): Promise<T> {
    const dir = mkdtempSync(path.join(os.tmpdir(), `hf-${prefix}-`));
    try {
        return await fn(dir);
    } finally {
        rmSync(dir, { recursive: true, force: true });
    }
}

// The 6-digit octal mode of a path at a given ref (e.g. "100644", "100755",
// "120000"), or null if it doesn't exist there. Used to preserve the
// executable bit / symlink type across UI edits instead of forcing 100644.
async function treeFileMode(
    p: string,
    ref: string,
    filePath: string,
): Promise<string | null> {
    try {
        const out =
            await $`git -C ${p} ls-tree --end-of-options ${ref} -- ${filePath}`.text();
        const mode = out.split(/\s+/)[0];
        return mode && /^\d{6}$/.test(mode) ? mode : null;
    } catch {
        return null;
    }
}

export async function archiveRepo(
    repoName: string,
    ref: string,
    slug: string,
    outDir: string,
    signal?: AbortSignal,
): Promise<void> {
    const p = repoPath(repoName);
    const base = `${slug}-${ref}`;

    const zip = Bun.spawn(
        [
            "git",
            "-C",
            p,
            "archive",
            "--format=zip",
            `--output=${path.join(outDir, `${base}.zip`)}`,
            "--end-of-options",
            ref,
        ],
        { signal, env: gitEnv },
    );
    if ((await zip.exited) !== 0) throw new Error("git archive (zip) failed");

    const tgz = Bun.spawn(
        [
            "git",
            "-C",
            p,
            "archive",
            "--format=tar.gz",
            `--output=${path.join(outDir, `${base}.tar.gz`)}`,
            "--end-of-options",
            ref,
        ],
        { signal, env: gitEnv },
    );
    if ((await tgz.exited) !== 0)
        throw new Error("git archive (tar.gz) failed");

    // Compressed in-process via CompressionStream("zstd") rather than piping
    // to a `zstd` binary, so the container needs no zstd package. A failure
    // here must not leave a truncated artifact behind — log it and unlink.
    const zstPath = path.join(outDir, `${base}.tar.zst`);
    try {
        const tar = Bun.spawn(
            [
                "git",
                "-C",
                p,
                "archive",
                "--format=tar",
                "--end-of-options",
                ref,
            ],
            { signal, env: gitEnv, stdout: "pipe" },
        );
        // Streamed through a FileSink rather than buffered: a source archive
        // can be hundreds of megabytes. (Bun.write() with a Response wrapping
        // the compressed stream hangs, so do not "simplify" this to that.)
        const compressed = tar.stdout.pipeThrough(
            new CompressionStream("zstd"),
        ) as unknown as AsyncIterable<Uint8Array>;
        const sink = Bun.file(zstPath).writer();
        // Inner finally, so the fd is closed on a mid-stream write error or an
        // abort. It must nest inside the catch rather than sit beside it: a
        // trailing `finally` would run after the cleanup below and flush the
        // sink back onto the file that was just unlinked.
        try {
            for await (const chunk of compressed) sink.write(chunk);
        } finally {
            await sink.end();
        }

        const tarCode = await tar.exited;
        if (tarCode !== 0) throw new Error(`git archive exited ${tarCode}`);
    } catch (err) {
        console.error(
            `[git] archive (tar.zst) failed for ${repoName}@${ref}:`,
            err,
        );
        await $`rm -f ${zstPath}`.quiet().nothrow();
    }
}

export interface CommitEntry {
    hash: string;
    subject: string;
    author: string;
    date: string;
    sigStatus: "good" | "bad" | "none";
}

export interface CommitMeta {
    hash: string;
    subject: string;
    body: string;
    author: string;
    email: string;
    date: string;
    committer: string;
    committerEmail: string;
    committerDate: string;
    parents: string[];
    sigStatus: "good" | "bad" | "none";
}

export interface TreeEntry {
    mode: string;
    type: "blob" | "tree";
    hash: string;
    size: string;
    name: string;
}

function parseSigStatus(code: string): "good" | "bad" | "none" {
    if (code === "G" || code === "X" || code === "Y" || code === "R")
        return "good";
    if (code === "B" || code === "U" || code === "E") return "bad";
    return "none";
}

function parseLog(out: string): CommitEntry[] {
    return out
        .split("\n")
        .filter(Boolean)
        .map((line) => {
            const parts = line.split("\x1f");
            return {
                hash: parts[0] ?? "",
                subject: parts[1] ?? "",
                author: parts[2] ?? "",
                date: parts[3] ?? "",
                sigStatus: parseSigStatus(parts[4] ?? ""),
            };
        });
}

function parseLsTree(out: string): TreeEntry[] {
    return out
        .split("\n")
        .filter(Boolean)
        .map((line) => {
            // format: <mode> SP <type> SP <object> SP <object size> TAB <file>
            const tabIdx = line.indexOf("\t");
            const name = line.slice(tabIdx + 1);
            const meta = line.slice(0, tabIdx).trim().split(/\s+/);
            return {
                mode: meta[0] ?? "",
                type: (meta[1] ?? "blob") as "blob" | "tree",
                hash: meta[2] ?? "",
                size: meta[3] ?? "-",
                name,
            };
        });
}

export function extractPatchSubject(patch: string): string {
    for (const line of patch.split("\n").slice(0, 30)) {
        if (line.startsWith("Subject: ")) {
            // Strip "[PATCH ...] " prefix added by git format-patch
            return line.slice(9).replace(/^\[PATCH[^\]]*\]\s*/, "");
        }
    }
    return "";
}

export interface BranchInfo {
    name: string;
    shortHash: string;
    subject: string;
    authorName: string;
    date: string;
}

export interface TagInfo {
    name: string;
    shortHash: string;
    subject: string;
    taggerName: string;
    date: string;
    isAnnotated: boolean;
}

export interface PatchMeta {
    subject: string;
    body: string;
    author: string;
    email: string;
    date: string;
}

export function extractPatchMeta(patch: string): PatchMeta {
    const lines = patch.split("\n");
    let subject = "";
    let author = "";
    let email = "";
    let date = "";
    const bodyLines: string[] = [];
    let inHeaders = true;
    let pastSubject = false;

    for (const line of lines) {
        if (inHeaders) {
            if (line.startsWith("From: ")) {
                const match = line.slice(6).match(/^(.*?)\s*<([^>]+)>/);
                if (match) {
                    author = match[1]!.trim();
                    email = match[2]!;
                } else {
                    author = line.slice(6).trim();
                }
            } else if (line.startsWith("Date: ")) {
                date = line.slice(6).trim();
            } else if (line.startsWith("Subject: ")) {
                subject = line.slice(9).replace(/^\[PATCH[^\]]*\]\s*/, "");
                pastSubject = true;
            } else if (pastSubject && line === "") {
                inHeaders = false;
            }
        } else {
            if (line === "---") break;
            bodyLines.push(line);
        }
    }

    while (
        bodyLines.length > 0 &&
        bodyLines[bodyLines.length - 1]!.trim() === ""
    ) {
        bodyLines.pop();
    }

    return { subject, body: bodyLines.join("\n"), author, email, date };
}

export const git = {
    async init(name: string, branch = "main") {
        return withRepoLock(name, async () => {
            const p = repoPath(name);
            await $`git init --bare --initial-branch=${branch} ${p}`;
        });
    },

    async ensureBare(name: string): Promise<void> {
        const cfg = path.join(repoPath(name), "config");
        return withRepoLock(name, async () => {
            const current = await $`git config --file ${cfg} --get core.bare`
                .quiet()
                .nothrow();
            if (current.exitCode === 0 && current.text().trim() === "true") {
                return;
            }

            const res = await $`git config --file ${cfg} core.bare true`
                .quiet()
                .nothrow();
            if (res.exitCode !== 0) {
                logGitError("ensureBare", name, res.stderr.toString().trim());
            }
        });
    },

    async log(
        name: string,
        ref = "HEAD",
        limit = 30,
        skip = 0,
    ): Promise<CommitEntry[]> {
        const p = repoPath(name);
        const sigArgs = [
            "-c",
            "gpg.format=ssh",
            "-c",
            `gpg.ssh.allowedSignersFile=${paths.ALLOWED_SIGNERS_PATH}`,
        ];
        try {
            // `--end-of-options` before the ref stops a user-supplied ref that
            // begins with `-` from being parsed as a git option (e.g. `--output=`,
            // which would write to an arbitrary file). All real options must
            // therefore precede it.
            const out =
                await $`git ${sigArgs} -C ${p} log --format=%H%x1f%s%x1f%an%x1f%ai%x1f%G? --max-count=${limit} --skip=${skip} --end-of-options ${ref}`.text();
            return parseLog(out);
        } catch (e) {
            logGitError(`log(${ref})`, name, e);
            return [];
        }
    },

    async lsTree(
        name: string,
        ref: string,
        subpath = "",
    ): Promise<TreeEntry[]> {
        const p = repoPath(name);
        try {
            const args = subpath
                ? [
                      "git",
                      "-C",
                      p,
                      "ls-tree",
                      "--long",
                      "--end-of-options",
                      ref,
                      "--",
                      `${subpath}/`,
                  ]
                : [
                      "git",
                      "-C",
                      p,
                      "ls-tree",
                      "--long",
                      "--end-of-options",
                      ref,
                  ];
            const out = await $`${args}`.text();
            const entries = parseLsTree(out);
            if (subpath) {
                // git ls-tree returns full paths like "subpath/name" — strip the prefix
                const prefix = `${subpath}/`;
                return entries.map((e) => ({
                    ...e,
                    name: e.name.startsWith(prefix)
                        ? e.name.slice(prefix.length)
                        : e.name,
                }));
            }
            return entries;
        } catch (e) {
            logGitError(`lsTree(${ref})`, name, e);
            return [];
        }
    },

    async show(
        name: string,
        ref: string,
        filePath: string,
    ): Promise<Buffer | null> {
        const p = repoPath(name);
        try {
            const buf =
                await $`git -C ${p} show --end-of-options ${`${ref}:${filePath}`}`.arrayBuffer();
            return Buffer.from(buf);
        } catch (e) {
            logGitError(`show(${ref}:${filePath})`, name, e);
            return null;
        }
    },

    async diff(name: string, sha: string): Promise<string> {
        const p = repoPath(name);
        try {
            return await $`git -C ${p} diff-tree --no-commit-id -r -p -M --root --end-of-options ${sha}`.text();
        } catch (e) {
            logGitError(`diff(${sha})`, name, e);
            return "";
        }
    },

    async blobSize(name: string, hash: string): Promise<number> {
        if (/^0+$/.test(hash)) return 0;
        const p = repoPath(name);
        try {
            const out =
                await $`git -C ${p} cat-file -s --end-of-options ${hash}`.text();
            return parseInt(out.trim(), 10) || 0;
        } catch {
            return 0;
        }
    },

    async branches(name: string): Promise<string[]> {
        const now = Date.now();
        const cached = branchCache.get(name);
        if (cached && cached.expiresAt > now) return cached.value;
        const p = repoPath(name);
        try {
            // %(refname:short) must be a variable — Bun Shell parses bare `()` as subshell syntax
            const fmt = "%(refname:short)";
            const out = await $`git -C ${p} branch --format=${fmt}`.text();
            const value = out.split("\n").filter(Boolean);
            branchCache.set(name, { value, expiresAt: now + REF_CACHE_TTL_MS });
            if (branchCache.size > MAX_BRANCH_CACHE) {
                branchCache.delete(branchCache.keys().next().value!);
            }
            return value;
        } catch (e) {
            logGitError("branches", name, e);
            return [];
        }
    },

    async tags(name: string): Promise<string[]> {
        const now = Date.now();
        const cached = tagCache.get(name);
        if (cached && cached.expiresAt > now) return cached.value;
        const p = repoPath(name);
        try {
            const fmt = "%(refname:short)";
            const out =
                await $`git -C ${p} for-each-ref --format=${fmt} refs/tags/`.text();
            const value = out.split("\n").filter(Boolean);
            tagCache.set(name, { value, expiresAt: now + REF_CACHE_TTL_MS });
            if (tagCache.size > MAX_TAG_CACHE) {
                tagCache.delete(tagCache.keys().next().value!);
            }
            return value;
        } catch (e) {
            logGitError("tags", name, e);
            return [];
        }
    },

    async branchesWithInfo(
        name: string,
        maxCount = MAX_REF_LIST,
    ): Promise<BranchInfo[]> {
        const p = repoPath(name);
        try {
            // Use actual unit separator byte (\x1f) — git for-each-ref does not
            // support the %x1f hex escape (that is a git-log pretty-format feature).
            const sep = "\x1f";
            const fmt = `%(refname:short)${sep}%(objectname:short)${sep}%(contents:subject)${sep}%(authorname)${sep}%(authordate:iso8601)`;
            const out =
                await $`git -C ${p} for-each-ref --sort=-creatordate --count=${maxCount} --format=${fmt} refs/heads/`.text();
            return out
                .split("\n")
                .filter(Boolean)
                .map((line) => {
                    const parts = line.split(sep);
                    return {
                        name: parts[0] ?? "",
                        shortHash: parts[1] ?? "",
                        subject: parts[2] ?? "",
                        authorName: parts[3] ?? "",
                        date: parts[4] ?? "",
                    };
                });
        } catch (e) {
            logGitError("branchesWithInfo", name, e);
            return [];
        }
    },

    async tagsWithInfo(name: string, maxCount = 1000): Promise<TagInfo[]> {
        const p = repoPath(name);
        try {
            // Use actual unit separator byte (\x1f) — git for-each-ref does not
            // support the %x1f hex escape (that is a git-log pretty-format feature).
            // %(*objectname:short) is the dereferenced commit for annotated tags; empty for lightweight.
            const sep = "\x1f";
            const fmt = `%(refname:short)${sep}%(*objectname:short)${sep}%(objectname:short)${sep}%(contents:subject)${sep}%(taggername)${sep}%(creatordate:iso8601)`;
            const out =
                await $`git -C ${p} for-each-ref --sort=-creatordate --count=${maxCount} --format=${fmt} refs/tags/`.text();
            return out
                .split("\n")
                .filter(Boolean)
                .map((line) => {
                    const parts = line.split(sep);
                    const derefHash = (parts[1] ?? "").trim();
                    const ownHash = (parts[2] ?? "").trim();
                    const isAnnotated = derefHash.length > 0;
                    return {
                        name: parts[0] ?? "",
                        shortHash: isAnnotated ? derefHash : ownHash,
                        subject: parts[3] ?? "",
                        taggerName: parts[4] ?? "",
                        date: parts[5] ?? "",
                        isAnnotated,
                    };
                });
        } catch (e) {
            logGitError("tagsWithInfo", name, e);
            return [];
        }
    },

    async defaultBranch(name: string): Promise<string> {
        const p = repoPath(name);
        try {
            const branches = await git.branches(name);

            // Read what HEAD points to (may be an unborn branch).
            let headBranch: string | null = null;
            try {
                const out =
                    await $`git -C ${p} symbolic-ref --short HEAD`.text();
                headBranch = out.trim();
            } catch {
                // detached HEAD — fall through
            }

            // Only trust HEAD if it names a branch that actually exists.
            if (headBranch && branches.includes(headBranch)) {
                return headBranch;
            }

            // HEAD points to an unborn branch or is detached — prefer "main",
            // then "master", then whatever branch exists first.
            return (
                branches.find((b) => b === "main") ??
                branches.find((b) => b === "master") ??
                branches[0] ??
                "main"
            );
        } catch {
            return "main";
        }
    },

    async getFileSize(
        name: string,
        ref: string,
        filePath: string,
    ): Promise<number | null> {
        const p = repoPath(name);
        try {
            const out =
                await $`git -C ${p} cat-file -s --end-of-options ${`${ref}:${filePath}`}`.text();
            return parseInt(out.trim(), 10);
        } catch {
            return null;
        }
    },

    async checkPatch(
        name: string,
        patchContent: string,
    ): Promise<{ clean: boolean; output: string }> {
        const p = repoPath(name);
        try {
            return await withTempDir("patch", async (dir) => {
                const tmpFile = path.join(dir, "change.patch");
                // Use a throwaway index (GIT_INDEX_FILE) so this read-only
                // preview never mutates — nor races a concurrent
                // applyPatch/editFile on — the repo's shared index. Without it,
                // this GET-triggered check could reset the index mid-merge and
                // silently drop the patch being written.
                const idxEnv = {
                    ...gitEnv,
                    GIT_INDEX_FILE: path.join(dir, "index"),
                };
                await Bun.write(tmpFile, patchContent);
                // Bare repos have no working tree; populate the index from HEAD
                // so we can check against git objects (--cached) rather than the
                // filesystem.
                await $`git -C ${p} read-tree HEAD`.env(idxEnv).quiet();
                const result =
                    await $`git -C ${p} apply --check --cached ${tmpFile}`
                        .env(idxEnv)
                        .quiet()
                        .nothrow();
                return {
                    clean: result.exitCode === 0,
                    output: result.stderr.toString(),
                };
            });
        } catch (e) {
            return { clean: false, output: String(e) };
        }
    },

    async applyPatch(
        name: string,
        patchContent: string,
        authorName: string,
        authorEmail: string,
        committerName: string,
        committerEmail: string,
    ): Promise<void> {
        return withRepoLock(name, async () => {
            const p = repoPath(name);
            await withTempDir("patch", async (dir) => {
                const tmpFile = path.join(dir, "change.patch");
                await Bun.write(tmpFile, patchContent);
                // Populate index, apply to index, then create a real commit in the bare repo.
                await $`git -C ${p} read-tree HEAD`;
                await $`git -C ${p} apply --cached ${tmpFile}`;
                const tree = (await $`git -C ${p} write-tree`.text()).trim();
                const parent = (
                    await $`git -C ${p} rev-parse HEAD`.text()
                ).trim();
                const msg = extractPatchSubject(patchContent);
                const sigArgs = [
                    "-c",
                    "gpg.format=ssh",
                    "-c",
                    `user.signingKey=${paths.SSH_HOST_KEY_PATH}`,
                ];
                const commit = (
                    await $`git ${sigArgs} -C ${p} commit-tree -S ${tree} -p ${parent} -m ${msg}`
                        .env({
                            ...gitEnv,
                            GIT_AUTHOR_NAME: authorName,
                            GIT_AUTHOR_EMAIL: authorEmail,
                            GIT_COMMITTER_NAME: committerName,
                            GIT_COMMITTER_EMAIL: committerEmail,
                        })
                        .text()
                ).trim();
                const ref = (
                    await $`git -C ${p} symbolic-ref HEAD`.text()
                ).trim();
                await $`git -C ${p} update-ref ${ref} ${commit}`;
            });
        });
    },

    async editFile(
        name: string,
        branch: string,
        filePath: string,
        content: string,
        message: string,
        committerName: string,
        committerEmail: string,
        newPath?: string,
    ): Promise<string> {
        return withRepoLock(name, async () => {
            const targetPath =
                newPath && newPath !== filePath ? newPath : filePath;
            const isMove = targetPath !== filePath;
            const p = repoPath(name);
            // Preserve the file's existing mode (executable bit / symlink)
            // rather than forcing every edit back to a plain 100644 file.
            const mode =
                (await treeFileMode(p, `refs/heads/${branch}`, filePath)) ??
                "100644";
            return await withTempDir("edit", async (dir) => {
                const tmpFile = path.join(dir, "blob");
                await Bun.write(tmpFile, content);
                if (isMove) {
                    await $`git --work-tree=/tmp -C ${p} read-tree refs/heads/${branch}`;
                } else {
                    await $`git -C ${p} read-tree refs/heads/${branch}`;
                }
                const blobHash = (
                    await $`git -C ${p} hash-object -w ${tmpFile}`.text()
                ).trim();
                if (isMove) {
                    await $`git --work-tree=/tmp -C ${p} update-index --remove ${filePath}`;
                }
                const cacheInfo = `${mode},${blobHash},${targetPath}`;
                await $`git -C ${p} update-index --add --cacheinfo ${cacheInfo}`;
                const tree = isMove
                    ? (
                          await $`git --work-tree=/tmp -C ${p} write-tree`.text()
                      ).trim()
                    : (await $`git -C ${p} write-tree`.text()).trim();
                const parent = (
                    await $`git -C ${p} rev-parse refs/heads/${branch}`.text()
                ).trim();
                const sigArgs = [
                    "-c",
                    "gpg.format=ssh",
                    "-c",
                    `user.signingKey=${paths.SSH_HOST_KEY_PATH}`,
                ];
                const commit = (
                    await $`git ${sigArgs} -C ${p} commit-tree -S ${tree} -p ${parent} -m ${message}`
                        .env({
                            ...gitEnv,
                            GIT_AUTHOR_NAME: committerName,
                            GIT_AUTHOR_EMAIL: committerEmail,
                            GIT_COMMITTER_NAME: committerName,
                            GIT_COMMITTER_EMAIL: committerEmail,
                        })
                        .text()
                ).trim();
                await $`git -C ${p} update-ref refs/heads/${branch} ${commit}`;
                return commit;
            });
        });
    },

    async createFile(
        name: string,
        branch: string,
        filePath: string,
        content: string,
        message: string,
        committerName: string,
        committerEmail: string,
    ): Promise<string> {
        return withRepoLock(name, async () => {
            const p = repoPath(name);
            return await withTempDir("new", async (dir) => {
                const tmpFile = path.join(dir, "blob");
                await Bun.write(tmpFile, content);
                const parentSha = await git.resolveRef(
                    name,
                    `refs/heads/${branch}`,
                );
                if (parentSha) {
                    await $`git -C ${p} read-tree refs/heads/${branch}`;
                }
                const blobHash = (
                    await $`git -C ${p} hash-object -w ${tmpFile}`.text()
                ).trim();
                await $`git -C ${p} update-index --add --cacheinfo 100644,${blobHash},${filePath}`;
                const tree = (await $`git -C ${p} write-tree`.text()).trim();
                const sigArgs = [
                    "-c",
                    "gpg.format=ssh",
                    "-c",
                    `user.signingKey=${paths.SSH_HOST_KEY_PATH}`,
                ];
                const commitEnv = {
                    ...gitEnv,
                    GIT_AUTHOR_NAME: committerName,
                    GIT_AUTHOR_EMAIL: committerEmail,
                    GIT_COMMITTER_NAME: committerName,
                    GIT_COMMITTER_EMAIL: committerEmail,
                };
                const commit = parentSha
                    ? (
                          await $`git ${sigArgs} -C ${p} commit-tree -S ${tree} -p ${parentSha} -m ${message}`
                              .env(commitEnv)
                              .text()
                      ).trim()
                    : (
                          await $`git ${sigArgs} -C ${p} commit-tree -S ${tree} -m ${message}`
                              .env(commitEnv)
                              .text()
                      ).trim();
                await $`git -C ${p} update-ref refs/heads/${branch} ${commit}`;
                return commit;
            });
        });
    },

    async deleteFile(
        name: string,
        branch: string,
        filePath: string,
        message: string,
        committerName: string,
        committerEmail: string,
    ): Promise<string> {
        return withRepoLock(name, async () => {
            const p = repoPath(name);
            // --work-tree=/tmp is needed because bare repos have no work tree and
            // `update-index --remove` requires one (even though it only touches the index).
            await $`git --work-tree=/tmp -C ${p} read-tree refs/heads/${branch}`;
            await $`git --work-tree=/tmp -C ${p} update-index --remove ${filePath}`;
            const tree = (
                await $`git --work-tree=/tmp -C ${p} write-tree`.text()
            ).trim();
            const parent = (
                await $`git -C ${p} rev-parse refs/heads/${branch}`.text()
            ).trim();
            const sigArgs = [
                "-c",
                "gpg.format=ssh",
                "-c",
                `user.signingKey=${paths.SSH_HOST_KEY_PATH}`,
            ];
            const commit = (
                await $`git ${sigArgs} -C ${p} commit-tree -S ${tree} -p ${parent} -m ${message}`
                    .env({
                        ...gitEnv,
                        GIT_AUTHOR_NAME: committerName,
                        GIT_AUTHOR_EMAIL: committerEmail,
                        GIT_COMMITTER_NAME: committerName,
                        GIT_COMMITTER_EMAIL: committerEmail,
                    })
                    .text()
            ).trim();
            await $`git -C ${p} update-ref refs/heads/${branch} ${commit}`;
            return commit;
        });
    },

    async moveFile(
        name: string,
        branch: string,
        oldPath: string,
        newPath: string,
        message: string,
        committerName: string,
        committerEmail: string,
    ): Promise<string> {
        return withRepoLock(name, async () => {
            const p = repoPath(name);
            // Preserve the moved file's mode (executable bit / symlink).
            const mode =
                (await treeFileMode(p, `refs/heads/${branch}`, oldPath)) ??
                "100644";
            return await withTempDir("move", async (dir) => {
                const tmpFile = path.join(dir, "blob");
                const contentBuf =
                    await $`git -C ${p} show --end-of-options ${`${branch}:${oldPath}`}`.arrayBuffer();
                await Bun.write(tmpFile, contentBuf);
                // --work-tree=/tmp is needed because bare repos have no work tree and
                // `update-index --remove` requires one (even though it only touches the index).
                await $`git --work-tree=/tmp -C ${p} read-tree refs/heads/${branch}`;
                const blobHash = (
                    await $`git -C ${p} hash-object -w ${tmpFile}`.text()
                ).trim();
                await $`git --work-tree=/tmp -C ${p} update-index --remove ${oldPath}`;
                const cacheInfo = `${mode},${blobHash},${newPath}`;
                await $`git -C ${p} update-index --add --cacheinfo ${cacheInfo}`;
                const tree = (
                    await $`git --work-tree=/tmp -C ${p} write-tree`.text()
                ).trim();
                const parent = (
                    await $`git -C ${p} rev-parse refs/heads/${branch}`.text()
                ).trim();
                const sigArgs = [
                    "-c",
                    "gpg.format=ssh",
                    "-c",
                    `user.signingKey=${paths.SSH_HOST_KEY_PATH}`,
                ];
                const commit = (
                    await $`git ${sigArgs} -C ${p} commit-tree -S ${tree} -p ${parent} -m ${message}`
                        .env({
                            ...gitEnv,
                            GIT_AUTHOR_NAME: committerName,
                            GIT_AUTHOR_EMAIL: committerEmail,
                            GIT_COMMITTER_NAME: committerName,
                            GIT_COMMITTER_EMAIL: committerEmail,
                        })
                        .text()
                ).trim();
                await $`git -C ${p} update-ref refs/heads/${branch} ${commit}`;
                return commit;
            });
        });
    },

    async createTag(
        repoName: string,
        tagName: string,
        ref: string,
        message?: string,
        taggerName?: string,
        taggerEmail?: string,
    ): Promise<"ok" | "already_exists" | "bad_ref" | "error"> {
        return withRepoLock(repoName, async () => {
            const p = repoPath(repoName);
            const sigArgs = [
                "-c",
                "gpg.format=ssh",
                "-c",
                `user.signingKey=${paths.SSH_HOST_KEY_PATH}`,
            ];
            const result =
                message !== undefined
                    ? await $`git ${sigArgs} -C ${p} tag -s -m ${message} --end-of-options ${tagName} ${ref}`
                          .env({
                              ...gitEnv,
                              GIT_COMMITTER_NAME: taggerName!,
                              GIT_COMMITTER_EMAIL: taggerEmail!,
                          })
                          .nothrow()
                    : await $`git -C ${p} tag --end-of-options ${tagName} ${ref}`.nothrow();
            if (result.exitCode === 0) {
                invalidateRefCache(repoName);
                return "ok";
            }
            const stderr = result.stderr.toString();
            if (stderr.includes("already exists")) return "already_exists";
            if (
                stderr.includes("not a valid object name") ||
                stderr.includes("unknown revision") ||
                stderr.includes("ambiguous argument")
            )
                return "bad_ref";
            return "error";
        });
    },

    async createBranch(
        name: string,
        branchName: string,
        sourceRef: string,
    ): Promise<"ok" | "already_exists" | "bad_ref" | "error"> {
        return withRepoLock(name, async () => {
            const p = repoPath(name);
            try {
                const sha = await git.resolveRef(name, sourceRef);
                if (!sha) return "bad_ref";
                const exists = await git.resolveRef(
                    name,
                    `refs/heads/${branchName}`,
                );
                if (exists) return "already_exists";
                await $`git -C ${p} update-ref refs/heads/${branchName} ${sha}`;
                invalidateRefCache(name);
                return "ok";
            } catch {
                return "error";
            }
        });
    },

    async deleteBranch(
        name: string,
        branchName: string,
    ): Promise<"ok" | "not_found" | "error"> {
        return withRepoLock(name, async () => {
            const p = repoPath(name);
            try {
                const exists = await git.resolveRef(
                    name,
                    `refs/heads/${branchName}`,
                );
                if (!exists) return "not_found";
                await $`git -C ${p} update-ref -d refs/heads/${branchName}`;
                invalidateRefCache(name);
                return "ok";
            } catch {
                return "error";
            }
        });
    },

    async renameBranch(
        name: string,
        oldName: string,
        newName: string,
    ): Promise<"ok" | "not_found" | "already_exists" | "error"> {
        return withRepoLock(name, async () => {
            const p = repoPath(name);
            try {
                const sha = await git.resolveRef(name, `refs/heads/${oldName}`);
                if (!sha) return "not_found";
                const exists = await git.resolveRef(
                    name,
                    `refs/heads/${newName}`,
                );
                if (exists) return "already_exists";
                await $`git -C ${p} update-ref refs/heads/${newName} ${sha}`;
                await $`git -C ${p} update-ref -d refs/heads/${oldName}`;
                invalidateRefCache(name);
                return "ok";
            } catch {
                return "error";
            }
        });
    },

    async deleteTag(
        name: string,
        tagName: string,
    ): Promise<"ok" | "not_found" | "error"> {
        return withRepoLock(name, async () => {
            const p = repoPath(name);
            try {
                const exists = await git.resolveRef(
                    name,
                    `refs/tags/${tagName}`,
                );
                if (!exists) return "not_found";
                await $`git -C ${p} tag -d ${tagName}`;
                invalidateRefCache(name);
                return "ok";
            } catch {
                return "error";
            }
        });
    },

    async setHead(name: string, branch: string): Promise<void> {
        const p = repoPath(name);
        await $`git -C ${p} symbolic-ref HEAD refs/heads/${branch}`;
    },

    async resolveRef(name: string, ref: string): Promise<string | null> {
        const p = repoPath(name);
        try {
            const out =
                await $`git -C ${p} rev-parse --verify --end-of-options ${ref}`.text();
            return out.trim() || null;
        } catch {
            return null;
        }
    },

    async hasCommits(name: string): Promise<boolean> {
        const p = repoPath(name);
        try {
            const out = await $`git -C ${p} log --oneline -1`.quiet().text();
            return out.trim().length > 0;
        } catch {
            return false;
        }
    },

    async commitMeta(name: string, sha: string): Promise<CommitMeta | null> {
        const p = repoPath(name);
        const sigArgs = [
            "-c",
            "gpg.format=ssh",
            "-c",
            `gpg.ssh.allowedSignersFile=${paths.ALLOWED_SIGNERS_PATH}`,
        ];
        try {
            const [metaOut, msgOut] = await Promise.all([
                $`git ${sigArgs} -C ${p} show --no-patch --format=%H%x1f%an%x1f%ae%x1f%ai%x1f%cn%x1f%ce%x1f%ci%x1f%P%x1f%G? --end-of-options ${sha}`.text(),
                $`git -C ${p} log --format=%B -1 --end-of-options ${sha}`.text(),
            ]);
            const parts = metaOut.trim().split("\x1f");
            const fullMsg = msgOut.trimEnd();
            const firstNl = fullMsg.indexOf("\n");
            const subject = firstNl >= 0 ? fullMsg.slice(0, firstNl) : fullMsg;
            const body =
                firstNl >= 0
                    ? fullMsg
                          .slice(firstNl + 1)
                          .trimStart()
                          .trimEnd()
                    : "";
            return {
                hash: parts[0] ?? sha,
                subject,
                body,
                author: parts[1] ?? "",
                email: parts[2] ?? "",
                date: parts[3] ?? "",
                committer: parts[4] ?? "",
                committerEmail: parts[5] ?? "",
                committerDate: parts[6] ?? "",
                parents: (parts[7] ?? "").trim().split(/\s+/).filter(Boolean),
                sigStatus: parseSigStatus(parts[8] ?? ""),
            };
        } catch (e) {
            logGitError(`commitMeta(${sha})`, name, e);
            return null;
        }
    },
};