@0xordek/git-me 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 git-me contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,248 @@
+# git-me
+
+A small self-hosted Git LFS utility for Cloudflare Workers, R2, Durable Objects, and KV-backed legacy-user migration.
+
+Built as a TypeScript Cloudflare Worker.
+
+## Requirements
+
+- Node.js 22+
+- Wrangler CLI or project-local `wrangler`
+- Cloudflare account with Workers, R2, KV, and Durable Objects enabled
+
+## Quick Start
+
+```bash
+git clone git@github.com:0xordek/git-me.git
+cd git-me
+npm ci
+npm run check
+```
+
+## Cloudflare Setup
+
+Create storage resources:
+
+```bash
+wrangler r2 bucket create git-me-objects
+wrangler kv namespace create git-me-metadata
+```
+
+Wrangler prints the KV namespace id. Create private deployment config, then replace its placeholder ID:
+
+```bash
+cp wrangler.example.toml wrangler.local.toml
+```
+
+`wrangler.local.toml` is ignored by Git. Before a real deploy, replace its placeholder KV namespace ID with your namespace ID. `npm run deploy` creates the `AuthUser` Durable Object migration.
+
+Set the admin token as a secret:
+
+```bash
+wrangler secret put GITME_AUTH_TOKEN
+```
+
+## Transfer Modes
+
+- `proxy`: default mode. The Worker handles Git LFS upload and download bytes through the `PUT /objects/{oid}` and `GET /objects/{oid}` endpoints.
+- `direct`: opt-in download acceleration. Uploads still use the Worker so every object gets SHA-256 verification; downloads receive short-lived signed R2 `GET` URLs.
+
+Leave `GITME_TRANSFER_MODE` unset for `proxy`, or set it to `direct` to opt in to signed R2 downloads. Give direct mode a bucket-scoped, read-only R2 S3 API token.
+
+## Configuration
+
+| Name | Required | Purpose |
+|------|----------|---------|
+| `GITME_AUTH_TOKEN` | Yes | Admin bearer token for user management and emergency LFS access |
+| `GITME_TRANSFER_MODE` | No | `proxy` by default; set `direct` for signed R2 downloads |
+| `GITME_SIGNED_URL_TTL_SECONDS` | No | Signed URL TTL for `direct` mode; defaults to `900` |
+| `GITME_R2_ACCOUNT_ID` | Direct mode | Cloudflare account id for R2 S3-compatible signing |
+| `GITME_R2_ACCESS_KEY_ID` | Direct mode | Read-only R2 API access key id |
+| `GITME_R2_SECRET_ACCESS_KEY` | Direct mode | Read-only R2 API secret access key |
+| `GITME_R2_BUCKET_NAME` | Direct mode | R2 bucket used in signed download URLs |
+
+Use Wrangler secrets for sensitive values:
+
+```bash
+wrangler secret put GITME_R2_SECRET_ACCESS_KEY
+```
+
+Deploy:
+
+```bash
+npm run deploy:dry
+npm run deploy
+```
+
+## Git LFS Client Setup
+
+Create a user as the deploy admin. Pass secrets through environment variables or standard input, never command arguments:
+
+```bash
+read -rsp 'Admin token: ' GITME_ADMIN_TOKEN; echo
+export GITME_ADMIN_TOKEN
+read -rsp 'LFS password: ' GITME_LFS_PASSWORD; echo
+printf '%s' "$GITME_LFS_PASSWORD" | npx @0xordek/git-me user add \
+  --target https://your-worker.workers.dev \
+  --token-env GITME_ADMIN_TOKEN \
+  --username alice \
+  --password-stdin \
+  --access write
+unset GITME_ADMIN_TOKEN GITME_LFS_PASSWORD
+```
+
+Use `"read"` for pull-only users and `"write"` for pull/push users. Delete access with:
+
+```bash
+read -rsp 'Admin token: ' GITME_ADMIN_TOKEN; echo
+export GITME_ADMIN_TOKEN
+npx @0xordek/git-me user delete \
+  --target https://your-worker.workers.dev \
+  --token-env GITME_ADMIN_TOKEN \
+  --username alice
+unset GITME_ADMIN_TOKEN
+```
+
+Configure a repo:
+
+```bash
+git lfs track "*.psd" "*.zip" "*.bin"
+git add .gitattributes
+
+git config lfs.url https://your-worker.workers.dev
+git config lfs.http.https://your-worker.workers.dev.locksverify false
+```
+
+For shared repositories, commit `.lfsconfig` so fresh clones use the Worker too:
+
+```bash
+git config -f .lfsconfig lfs.url https://your-worker.workers.dev
+git add .lfsconfig
+git commit -m "chore: configure git-me lfs"
+```
+
+Then use `git push` and `git pull` as normal. On first LFS access, Git asks for username and password. Git Credential Manager stores it on the machine, so deleting and cloning the repo again usually does not ask while the worker host stays the same.
+
+The admin bearer token also works for LFS as an emergency write credential, but normal users should use Basic auth users created through `/admin/users/{username}`.
+
+If you do not want the CLI, the same operations are available through `PUT` and `DELETE /admin/users/{username}`.
+
+## Migrating Existing LFS Objects
+
+Use the migration CLI from a local repository to copy objects from the current LFS server into `git-me`:
+
+```bash
+read -rsp 'Target token: ' GITME_TARGET_TOKEN; echo
+export GITME_TARGET_TOKEN
+npx @0xordek/git-me migrate --target https://your-worker.workers.dev --token-env GITME_TARGET_TOKEN --dry-run
+unset GITME_TARGET_TOKEN
+```
+
+Run `--dry-run` first. It scans local Git LFS pointer files, deduplicates object IDs, and reports `scanned`, `unique`, `migrated`, `skipped`, and `failed` without transferring object bytes or writing Git config.
+
+For a GitHub source, pass the source LFS URL explicitly when it is not already in `git config lfs.url`:
+
+```bash
+read -rsp 'Target token: ' GITME_TARGET_TOKEN; echo
+export GITME_TARGET_TOKEN
+npx @0xordek/git-me migrate \
+  --source-url https://github.com/OWNER/REPO.git/info/lfs \
+  --target https://your-worker.workers.dev \
+  --token-env GITME_TARGET_TOKEN \
+  --dry-run
+unset GITME_TARGET_TOKEN
+```
+
+For another Git LFS server, use its Batch API base URL as `--source-url`:
+
+```bash
+read -rsp 'Target token: ' GITME_TARGET_TOKEN; echo
+export GITME_TARGET_TOKEN
+npx @0xordek/git-me migrate \
+  --source-url https://source.example.com/repo.git/info/lfs \
+  --target https://your-worker.workers.dev \
+  --token-env GITME_TARGET_TOKEN \
+  --dry-run
+unset GITME_TARGET_TOKEN
+```
+
+Private source repositories usually require an extra source header. Repeat `--source-header-env` for every environment variable containing a `name: value` header:
+
+```bash
+read -rsp 'Target token: ' GITME_TARGET_TOKEN; echo
+export GITME_TARGET_TOKEN
+read -rsp 'Source header: ' GITME_SOURCE_AUTH; echo
+export GITME_SOURCE_AUTH
+npx @0xordek/git-me migrate \
+  --source-url https://github.com/OWNER/PRIVATE-REPO.git/info/lfs \
+  --source-header-env GITME_SOURCE_AUTH \
+  --target https://your-worker.workers.dev \
+  --token-env GITME_TARGET_TOKEN \
+  --dry-run
+unset GITME_TARGET_TOKEN GITME_SOURCE_AUTH
+```
+
+After a successful real migration, add `--write-config` to update the repository's `lfs.url` to the target:
+
+```bash
+read -rsp 'Target token: ' GITME_TARGET_TOKEN; echo
+export GITME_TARGET_TOKEN
+npx @0xordek/git-me migrate \
+  --target https://your-worker.workers.dev \
+  --token-env GITME_TARGET_TOKEN \
+  --write-config
+unset GITME_TARGET_TOKEN
+```
+
+Safety model: the CLI uses the generic Git LFS Batch API for source downloads and target uploads. Object bytes are streamed through temporary files named `git-me-migrate-*` in the OS temp directory, not buffered in memory, and each downloaded file must match the pointer SHA-256 OID before upload. Temporary files are removed after each object attempt, and `--write-config` only runs when the migration has no failures.
+
+## API Endpoints
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| POST | `/objects/batch` | Git LFS Batch API |
+| PUT | `/objects/{oid}` | Upload object bytes |
+| GET | `/objects/{oid}` | Download object bytes |
+| PUT | `/admin/users/{username}` | Create or update LFS user |
+| DELETE | `/admin/users/{username}` | Delete LFS user |
+| GET | `/health` | Configuration health check |
+
+Batch requests and error responses use `application/vnd.git-lfs+json`.
+`GET /health` returns `application/json`.
+
+## Storage Layout
+
+- R2 object key: `objects/<oid>`
+- Temporary proxy-upload key prefix: `objects/.tmp/`
+- Durable Object: one `AuthUser` instance per normalized username
+- KV user key: `user:<username>` only during legacy SHA-256 credential upgrade
+
+## Development
+
+```bash
+npm ci
+npm run check
+wrangler dev --config wrangler.local.toml
+```
+
+## Security
+
+Do not commit auth tokens or R2 API secrets. Use `wrangler secret put GITME_AUTH_TOKEN` and `wrangler secret put GITME_R2_SECRET_ACCESS_KEY`.
+
+`proxy` uploads stream through the Worker and must match their Git LFS SHA-256 OID before becoming readable. `direct` mode only signs R2 downloads; it never signs uploads. Use a bucket-scoped, read-only R2 credential for direct mode.
+
+Existing deployments upgraded from a release that signed direct uploads must first set `GITME_TRANSFER_MODE=proxy`, audit every `objects/<oid>` object against its SHA-256 filename, and quarantine mismatches. Rotate the old R2 S3 API token before enabling direct downloads again. Objects without the `v0.3` Worker verification marker always fall back to proxy downloads, even when `direct` mode is enabled.
+
+New passwords use salted PBKDF2-SHA-256 records in Durable Objects. Existing KV SHA-256 records upgrade after one successful login. Deleted users leave a Durable Object tombstone, so stale KV reads cannot restore access. Authentication locks one client source for one username for one minute after five failed attempts in one minute.
+
+`GET /health` checks configuration only. It does not prove R2, KV, or Durable Object availability. Failed requests emit a request ID in `X-Request-Id`; logs never include credentials or request bodies.
+
+Report vulnerabilities through GitHub Security Advisories. See `SECURITY.md`.
+
+## Contributing
+
+Small fixes and focused issues are welcome. See `CONTRIBUTING.md`.
+
+## License
+
+MIT — see `LICENSE`.

package/dist/cli.js

@@ -0,0 +1,526 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { pathToFileURL } from "node:url";
+
+// src/lfs-client.ts
+var LFS_JSON = "application/vnd.git-lfs+json";
+var ERROR_SNIPPET_BYTES = 200;
+var nodeImport = (specifier) => import(
+  /* @vite-ignore */
+  specifier
+);
+function mergeActionHeaders(base, actionHeaders) {
+  return { ...base, ...actionHeaders ?? {} };
+}
+var LfsClient = class {
+  baseUrl;
+  baseOrigin;
+  headers;
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.baseOrigin = new URL(this.baseUrl).origin;
+    this.headers = options.headers ?? {};
+  }
+  async batch(operation, objects) {
+    const response = await fetch(`${this.baseUrl}/objects/batch`, {
+      method: "POST",
+      headers: { ...this.headers, "Content-Type": LFS_JSON, Accept: LFS_JSON },
+      body: JSON.stringify({ operation, transfers: ["basic"], objects })
+    });
+    await throwIfFailed(response, "LFS batch");
+    return await response.json();
+  }
+  async downloadToFile(href, filePath, headers) {
+    const response = await fetch(href, { method: "GET", headers: this.actionHeaders(href, headers) });
+    await throwIfFailed(response, "LFS download");
+    if (!response.body) throw new Error("LFS download failed: response body missing");
+    const [fs, stream, streamPromises] = await Promise.all([
+      nodeImport("node:fs"),
+      nodeImport("node:stream"),
+      nodeImport("node:stream/promises")
+    ]);
+    await streamPromises.pipeline(stream.Readable.fromWeb(response.body), fs.createWriteStream(filePath));
+  }
+  async uploadFromFile(href, filePath, headers) {
+    const [fs, fsPromises] = await Promise.all([nodeImport("node:fs"), nodeImport("node:fs/promises")]);
+    const stat = await fsPromises.stat(filePath);
+    const init = {
+      method: "PUT",
+      headers: { ...this.actionHeaders(href, headers), "Content-Length": String(stat.size) },
+      body: fs.createReadStream(filePath),
+      duplex: "half"
+    };
+    const response = await fetch(href, init);
+    await throwIfFailed(response, "LFS upload");
+  }
+  actionHeaders(href, headers) {
+    const actionOrigin = new URL(href, this.baseUrl).origin;
+    if (actionOrigin !== this.baseOrigin) return headers ?? {};
+    return mergeActionHeaders(this.headers, headers);
+  }
+};
+async function throwIfFailed(response, label) {
+  if (response.ok) return;
+  const body = await response.text().catch(() => "");
+  const snippet = body.slice(0, ERROR_SNIPPET_BYTES);
+  throw new Error(`${label} failed with status ${response.status}: ${snippet}`);
+}
+
+// src/pointers.ts
+var VERSION_LINE = "version https://git-lfs.github.com/spec/v1";
+var OID_LINE = /^oid sha256:([0-9a-fA-F]{64})$/;
+var SIZE_LINE = /^size ([0-9]+)$/;
+var MAX_POINTER_BYTES = 1024;
+var nodeImport2 = (specifier) => import(
+  /* @vite-ignore */
+  specifier
+);
+function parsePointer(text, path) {
+  const lines = text.replace(/\r\n/g, "\n").split("\n");
+  if (lines.at(-1) === "") lines.pop();
+  if (lines.length !== 3 || lines[0] !== VERSION_LINE) return null;
+  const oid = OID_LINE.exec(lines[1])?.[1];
+  if (!oid) return null;
+  const sizeText = SIZE_LINE.exec(lines[2])?.[1];
+  if (!sizeText) return null;
+  const size = Number(sizeText);
+  if (!Number.isSafeInteger(size)) return null;
+  return { path, oid: oid.toLowerCase(), size };
+}
+async function scanPointers(repoPath) {
+  const trackedPaths = await listTrackedFiles(repoPath);
+  const [fs, path] = await Promise.all([nodeImport2("node:fs/promises"), nodeImport2("node:path")]);
+  const pointers = [];
+  for (const trackedPath of trackedPaths) {
+    const text = await readSmallUtf8File(fs, path.join(repoPath, trackedPath));
+    if (text === null) continue;
+    const pointer = parsePointer(text, trackedPath);
+    if (pointer) pointers.push(pointer);
+  }
+  return pointers;
+}
+async function listTrackedFiles(repoPath) {
+  const childProcess = await nodeImport2("node:child_process");
+  const stdout = await new Promise((resolve, reject) => {
+    childProcess.execFile("git", ["-C", repoPath, "ls-files", "-z"], { encoding: "utf8", maxBuffer: 10 * 1024 * 1024 }, (error, output, stderr) => {
+      if (error) {
+        reject(new Error(`${error.message}
+${stderr}`));
+        return;
+      }
+      resolve(output);
+    });
+  });
+  return stdout.split("\0").filter((trackedPath) => trackedPath.length > 0);
+}
+async function readSmallUtf8File(fs, path) {
+  let file = null;
+  try {
+    file = await fs.open(path, "r");
+    const bytes = new Uint8Array(MAX_POINTER_BYTES);
+    const { bytesRead } = await file.read(bytes, 0, bytes.byteLength, 0);
+    const chunk = bytes.subarray(0, bytesRead);
+    if (chunk.includes(0)) return null;
+    return new TextDecoder("utf-8", { fatal: true }).decode(chunk);
+  } catch {
+    return null;
+  } finally {
+    await file?.close().catch(() => void 0);
+  }
+}
+
+// src/migrate.ts
+var nodeImport3 = (specifier) => import(
+  /* @vite-ignore */
+  specifier
+);
+async function migrate(options, deps = {}) {
+  const scan = deps.scanPointers ?? scanPointers;
+  const createClient = deps.createClient ?? ((clientOptions) => new LfsClient(clientOptions));
+  const createTempPath = deps.createTempPath ?? defaultCreateTempPath;
+  const removeFile = deps.removeFile ?? defaultRemoveFile;
+  const getGitConfig = deps.getGitConfig ?? getGitConfigValue;
+  const setGitConfig = deps.setGitConfig ?? setGitConfigValue;
+  const pointers = await scan(options.repoPath);
+  const uniqueObjects = uniqueLfsObjects(pointers);
+  const result = {
+    scanned: pointers.length,
+    unique: uniqueObjects.length,
+    migrated: 0,
+    skipped: pointers.length - uniqueObjects.length,
+    failed: []
+  };
+  if (options.dryRun) return result;
+  const sourceUrl = options.sourceUrl ?? await getGitConfig(options.repoPath, "lfs.url");
+  const source = createClient({ baseUrl: sourceUrl.trim(), headers: options.sourceHeaders });
+  const target = createClient({ baseUrl: options.targetUrl, headers: { Authorization: `Bearer ${options.targetToken}` } });
+  await runPool(uniqueObjects, options.concurrency, async (object) => {
+    const tempPath = await createTempPath();
+    try {
+      const download = await batchAction(source, "download", object, "download");
+      if (!download) throw new Error("download action missing");
+      await source.downloadToFile(download.href, tempPath, download.header);
+      if (await sha256File(tempPath) !== object.oid) throw new Error("hash mismatch");
+      const upload = await batchAction(target, "upload", object, "upload");
+      if (!upload) {
+        result.skipped += 1;
+        return;
+      }
+      await target.uploadFromFile(upload.href, tempPath, upload.header);
+      const targetDownload = await batchAction(target, "download", object, "download");
+      if (!targetDownload) throw new Error("target download action missing");
+      result.migrated += 1;
+    } catch (error) {
+      result.failed.push({ oid: object.oid, reason: errorMessage(error) });
+    } finally {
+      await removeFile(tempPath).catch(() => void 0);
+    }
+  });
+  if (options.writeConfig && result.failed.length === 0) {
+    await setGitConfig(options.repoPath, "lfs.url", options.targetUrl);
+  }
+  return result;
+}
+function uniqueLfsObjects(pointers) {
+  const seen = /* @__PURE__ */ new Set();
+  const objects = [];
+  for (const pointer of pointers) {
+    if (seen.has(pointer.oid)) continue;
+    seen.add(pointer.oid);
+    objects.push({ oid: pointer.oid, size: pointer.size });
+  }
+  return objects;
+}
+async function batchAction(client, operation, object, action) {
+  const response = await client.batch(operation, [object]);
+  const responseObject = response.objects.find((item) => item.oid === object.oid);
+  if (!responseObject) throw new Error(`${operation} batch missing object`);
+  if (responseObject.error) throw new Error(responseObject.error.message);
+  return responseObject.actions?.[action] ?? null;
+}
+async function runPool(items, concurrency, worker) {
+  let index = 0;
+  const workers = Array.from({ length: Math.min(Math.max(1, concurrency), items.length) }, async () => {
+    while (index < items.length) {
+      const item = items[index];
+      index += 1;
+      await worker(item);
+    }
+  });
+  await Promise.all(workers);
+}
+async function sha256File(path) {
+  const [fs, cryptoModule] = await Promise.all([nodeImport3("node:fs"), nodeImport3("node:crypto")]);
+  const hash = cryptoModule.createHash("sha256");
+  const stream = fs.createReadStream(path);
+  return await new Promise((resolve, reject) => {
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("error", reject);
+    stream.on("end", () => resolve(hash.digest("hex")));
+  });
+}
+async function defaultCreateTempPath() {
+  const [os, path] = await Promise.all([nodeImport3("node:os"), nodeImport3("node:path")]);
+  return path.join(os.tmpdir(), `git-me-migrate-${crypto.randomUUID()}`);
+}
+async function defaultRemoveFile(path) {
+  const fs = await nodeImport3("node:fs/promises");
+  await fs.rm(path, { force: true });
+}
+async function getGitConfigValue(repoPath, key) {
+  return (await execGit(repoPath, ["config", "--get", key])).trim();
+}
+async function setGitConfigValue(repoPath, key, value) {
+  await execGit(repoPath, ["config", key, value]);
+}
+async function execGit(repoPath, args) {
+  const childProcess = await nodeImport3("node:child_process");
+  return await new Promise((resolve, reject) => {
+    childProcess.execFile("git", ["-C", repoPath, ...args], { encoding: "utf8" }, (error, stdout, stderr) => {
+      if (error) {
+        reject(new Error(`${error.message}
+${stderr}`));
+        return;
+      }
+      resolve(stdout);
+    });
+  });
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/cli.ts
+async function runCli(argv, io = {}) {
+  const out = io.stdout ?? ((text) => process.stdout.write(text));
+  const err = io.stderr ?? ((text) => process.stderr.write(text));
+  if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
+    out(topLevelUsage());
+    return 0;
+  }
+  const [command, ...args] = argv;
+  if (command === "migrate") return await runMigrate(args, { ...io, stdout: out, stderr: err });
+  if (command === "user") return await runUser(args, { ...io, stdout: out, stderr: err });
+  err(`unknown command: ${command}
+
+${topLevelUsage()}`);
+  return 2;
+}
+async function runUser(args, io) {
+  if (args.includes("--help") || args.includes("-h")) {
+    io.stdout(userUsage());
+    return 0;
+  }
+  const parsed = await parseUserArgs(args, io);
+  if ("error" in parsed) {
+    io.stderr(`${parsed.error}
+
+${userUsage()}`);
+    return 2;
+  }
+  try {
+    const result = await (io.userRequest ?? requestUser)(parsed.options);
+    io.stdout(formatUserResult(result));
+    return 0;
+  } catch (error) {
+    io.stderr(`${error instanceof Error ? error.message : String(error)}
+`);
+    return 1;
+  }
+}
+async function runMigrate(args, io) {
+  if (args.includes("--help") || args.includes("-h")) {
+    io.stdout(migrateUsage());
+    return 0;
+  }
+  const parsed = await parseMigrateArgs(args, io.cwd?.() ?? process.cwd(), io);
+  if ("error" in parsed) {
+    io.stderr(`${parsed.error}
+
+${migrateUsage()}`);
+    return 2;
+  }
+  try {
+    const result = await (io.migrate ?? migrate)(parsed.options);
+    io.stdout(formatResult(result));
+    return result.failed.length === 0 ? 0 : 1;
+  } catch (error) {
+    io.stderr(`${error instanceof Error ? error.message : String(error)}
+`);
+    return 1;
+  }
+}
+async function parseUserArgs(args, io) {
+  const action = args[0];
+  if (action !== "add" && action !== "delete") return { error: "missing user action: add or delete" };
+  let targetUrl = "";
+  let token;
+  let username = "";
+  let password;
+  let access = "";
+  for (let index = 1; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--token-stdin") {
+      if (token) return { error: "duplicate token source" };
+      token = { stdin: true };
+      continue;
+    }
+    if (arg === "--password-stdin") {
+      if (password) return { error: "duplicate password source" };
+      password = { stdin: true };
+      continue;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) return { error: `missing value for ${arg}` };
+    index += 1;
+    if (arg === "--target") targetUrl = value;
+    else if (arg === "--token-env") {
+      if (token) return { error: "duplicate token source" };
+      const source = envSecret(value);
+      if (!source) return { error: `invalid environment variable name: ${value}` };
+      token = source;
+    } else if (arg === "--username") username = value;
+    else if (arg === "--password-env") {
+      if (password) return { error: "duplicate password source" };
+      const source = envSecret(value);
+      if (!source) return { error: `invalid environment variable name: ${value}` };
+      password = source;
+    } else if (arg === "--access") access = value;
+    else return { error: `unknown option: ${arg}` };
+  }
+  if (!targetUrl) return { error: "missing required option: --target" };
+  if (!token) return { error: "missing required option: --token-env or --token-stdin" };
+  if (!username) return { error: "missing required option: --username" };
+  if (action === "add" && !password) return { error: "missing required option: --password-env or --password-stdin" };
+  if (action === "add" && access !== "read" && access !== "write") return { error: "missing required option: --access read|write" };
+  if (isStdinSecret(token) && password && isStdinSecret(password)) return { error: "only one secret may use standard input" };
+  try {
+    return {
+      options: {
+        action,
+        targetUrl,
+        token: await readSecret(token, io),
+        username,
+        password: password ? await readSecret(password, io) : void 0,
+        access: access || void 0
+      }
+    };
+  } catch (error) {
+    return { error: error instanceof Error ? error.message : String(error) };
+  }
+}
+async function requestUser(options) {
+  const url = new URL(`/admin/users/${encodeURIComponent(options.username)}`, options.targetUrl.endsWith("/") ? options.targetUrl : `${options.targetUrl}/`);
+  const res = await fetch(url, {
+    method: options.action === "add" ? "PUT" : "DELETE",
+    headers: {
+      Authorization: `Bearer ${options.token}`,
+      ...options.action === "add" ? { "Content-Type": "application/json" } : {}
+    },
+    body: options.action === "add" ? JSON.stringify({ password: options.password, access: options.access }) : void 0
+  });
+  const text = await res.text();
+  if (!res.ok) throw new Error(text.trim() || `request failed: ${res.status}`);
+  return JSON.parse(text);
+}
+async function parseMigrateArgs(args, defaultRepoPath, io) {
+  const sourceHeaderSources = [];
+  let repoPath = defaultRepoPath;
+  let sourceUrl;
+  let targetUrl;
+  let targetToken;
+  let concurrency = 4;
+  let dryRun = false;
+  let writeConfig = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (arg === "--write-config") {
+      writeConfig = true;
+      continue;
+    }
+    if (arg === "--token-stdin") {
+      if (targetToken) return { error: "duplicate token source" };
+      targetToken = { stdin: true };
+      continue;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) return { error: `missing value for ${arg}` };
+    index += 1;
+    if (arg === "--repo") repoPath = value;
+    else if (arg === "--source-url") sourceUrl = value;
+    else if (arg === "--target") targetUrl = value;
+    else if (arg === "--token-env") {
+      if (targetToken) return { error: "duplicate token source" };
+      const source = envSecret(value);
+      if (!source) return { error: `invalid environment variable name: ${value}` };
+      targetToken = source;
+    } else if (arg === "--concurrency") {
+      concurrency = Number(value);
+      if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > 16) return { error: "invalid --concurrency" };
+    } else if (arg === "--source-header-env") {
+      const source = envSecret(value);
+      if (!source) return { error: `invalid environment variable name: ${value}` };
+      sourceHeaderSources.push(source);
+    } else return { error: `unknown option: ${arg}` };
+  }
+  if (!targetUrl) return { error: "missing required option: --target" };
+  if (!targetToken) return { error: "missing required option: --token-env or --token-stdin" };
+  try {
+    const sourceHeaders = {};
+    for (const source of sourceHeaderSources) {
+      const header = parseHeader(await readSecret(source, io));
+      if (!header) return { error: "invalid --source-header-env value" };
+      sourceHeaders[header.name] = header.value;
+    }
+    return { options: { repoPath, sourceUrl, sourceHeaders, targetUrl, targetToken: await readSecret(targetToken, io), concurrency, dryRun, writeConfig } };
+  } catch (error) {
+    return { error: error instanceof Error ? error.message : String(error) };
+  }
+}
+function envSecret(name) {
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ? { env: name } : null;
+}
+function isStdinSecret(source) {
+  return "stdin" in source;
+}
+async function readSecret(source, io) {
+  if ("env" in source) {
+    const value2 = (io.env ?? process.env)[source.env];
+    if (!value2) throw new Error(`missing environment variable: ${source.env}`);
+    return value2;
+  }
+  const value = await (io.readStdin ?? readStdin)();
+  const secret = value.replace(/\r?\n$/, "");
+  if (!secret) throw new Error("standard input secret is empty");
+  return secret;
+}
+async function readStdin() {
+  let value = "";
+  for await (const chunk of process.stdin) value += String(chunk);
+  return value;
+}
+function parseHeader(input) {
+  const index = input.indexOf(":");
+  if (index < 1) return null;
+  const name = input.slice(0, index).trim();
+  const value = input.slice(index + 1).trim();
+  return name && value ? { name, value } : null;
+}
+function topLevelUsage() {
+  return `Usage: git-me <command>
+
+Commands:
+  migrate  migrate Git LFS objects to git-me
+  user     manage git-me LFS users
+`;
+}
+function migrateUsage() {
+  return `Usage: git-me migrate --target <url> (--token-env <name>|--token-stdin) [options]
+
+Options:
+  --repo <path>                  repository path (default: current directory)
+  --source-url <url>             source LFS URL (default: git config lfs.url)
+  --source-header-env <name>     env var containing name: value, repeatable
+  --concurrency <number>         concurrent transfers, 1..16 (default: 4)
+  --dry-run                      scan without transferring objects
+  --write-config                 update lfs.url after successful migration
+`;
+}
+function userUsage() {
+  return `Usage: git-me user <add|delete> --target <url> (--token-env <name>|--token-stdin) --username <name> [options]
+
+Options:
+  --password-env <name>  env var containing password for add
+  --password-stdin       read password for add from standard input
+  --access <read|write>  access for add
+`;
+}
+function formatResult(result) {
+  const lines = [`scanned=${result.scanned} unique=${result.unique} migrated=${result.migrated} skipped=${result.skipped} failed=${result.failed.length}`];
+  for (const failure of result.failed) lines.push(`${failure.oid}: ${failure.reason}`);
+  return `${lines.join("\n")}
+`;
+}
+function formatUserResult(result) {
+  if (result.deleted) return `username=${result.username} deleted=true
+`;
+  return `username=${result.username} access=${result.access}
+`;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  runCli(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+  }, (error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}
+`);
+    process.exitCode = 1;
+  });
+}
+export {
+  runCli
+};

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@0xordek/git-me",
+  "version": "0.3.0",
+  "description": "Self-hosted Git LFS utility for Cloudflare Workers, R2, and Durable Objects.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xordek/git-me.git"
+  },
+  "homepage": "https://github.com/0xordek/git-me#readme",
+  "bugs": {
+    "url": "https://github.com/0xordek/git-me/issues"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "bin": {
+    "git-me": "dist/cli.js"
+  },
+  "files": [
+    "dist/cli.js"
+  ],
+  "scripts": {
+    "build": "wrangler deploy --dry-run --config wrangler.example.toml --outdir dist --metafile dist/bundle-meta.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "build:cli": "esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist/cli.js --banner:js=\"#!/usr/bin/env node\"",
+    "check": "npm test && npm run typecheck && npm run build:cli && git diff --exit-code -- dist/cli.js && npm pack --dry-run && npm run deploy:dry",
+    "deploy:dry": "wrangler deploy --dry-run --config wrangler.example.toml",
+    "deploy": "wrangler deploy --config wrangler.local.toml",
+    "version:upload": "wrangler versions upload --config wrangler.local.toml",
+    "version:deploy": "wrangler versions deploy --config wrangler.local.toml"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20260702.1",
+    "@types/node": "^26.1.0",
+    "esbuild": "^0.28.1",
+    "typescript": "^6.0.3",
+    "vitest": "^3.2.7",
+    "wrangler": "^4.107.1"
+  }
+}