@pierre/storage 0.0.3 → 0.0.6

package/dist/index.js

@@ -1,10 +1,392 @@
 import { importPKCS8, SignJWT } from 'jose';
+import snakecaseKeys from 'snakecase-keys';
+
+// src/index.ts
+
+// src/fetch.ts
+var ApiFetcher = class {
+  constructor(API_BASE_URL2, version) {
+    this.API_BASE_URL = API_BASE_URL2;
+    this.version = version;
+    console.log("api fetcher created", API_BASE_URL2, version);
+  }
+  getBaseUrl() {
+    return `${this.API_BASE_URL}/api/v${this.version}`;
+  }
+  getRequestUrl(path) {
+    if (typeof path === "string") {
+      return `${this.getBaseUrl()}/${path}`;
+    } else if (path.params) {
+      const paramStr = new URLSearchParams(path.params).toString();
+      return `${this.getBaseUrl()}/${path.path}${paramStr ? `?${paramStr}` : ""}`;
+    } else {
+      return `${this.getBaseUrl()}/${path.path}`;
+    }
+  }
+  async fetch(path, method, jwt, options) {
+    const requestUrl = this.getRequestUrl(path);
+    const requestOptions = {
+      method,
+      headers: {
+        Authorization: `Bearer ${jwt}`,
+        "Content-Type": "application/json"
+      }
+    };
+    if (method !== "GET" && typeof path !== "string" && path.body) {
+      requestOptions.body = JSON.stringify(path.body);
+    }
+    const response = await fetch(requestUrl, requestOptions);
+    if (!response.ok) {
+      const allowed = options?.allowedStatus ?? [];
+      if (!allowed.includes(response.status)) {
+        throw new Error(`Failed to fetch ${method} ${requestUrl}: ${response.statusText}`);
+      }
+    }
+    return response;
+  }
+  async get(path, jwt, options) {
+    return this.fetch(path, "GET", jwt, options);
+  }
+  async post(path, jwt, options) {
+    return this.fetch(path, "POST", jwt, options);
+  }
+  async put(path, jwt, options) {
+    return this.fetch(path, "PUT", jwt, options);
+  }
+  async delete(path, jwt, options) {
+    return this.fetch(path, "DELETE", jwt, options);
+  }
+};
+
+// src/util.ts
+function timingSafeEqual(a, b) {
+  const bufferA = typeof a === "string" ? new TextEncoder().encode(a) : a;
+  const bufferB = typeof b === "string" ? new TextEncoder().encode(b) : b;
+  if (bufferA.length !== bufferB.length) return false;
+  let result = 0;
+  for (let i = 0; i < bufferA.length; i++) {
+    result |= bufferA[i] ^ bufferB[i];
+  }
+  return result === 0;
+}
+async function getEnvironmentCrypto() {
+  if (!globalThis.crypto) {
+    const { webcrypto } = await import('crypto');
+    return webcrypto;
+  }
+  return globalThis.crypto;
+}
+async function createHmac(algorithm, secret, data) {
+  if (!secret || secret.length === 0) {
+    throw new Error("Secret is required");
+  }
+  const crypto2 = await getEnvironmentCrypto();
+  const encoder = new TextEncoder();
+  const key = await crypto2.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto2.subtle.sign("HMAC", key, encoder.encode(data));
+  return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// src/webhook.ts
+var DEFAULT_MAX_AGE_SECONDS = 300;
+function parseSignatureHeader(header) {
+  if (!header || typeof header !== "string") {
+    return null;
+  }
+  let timestamp = "";
+  let signature = "";
+  const elements = header.split(",");
+  for (const element of elements) {
+    const trimmedElement = element.trim();
+    const parts = trimmedElement.split("=", 2);
+    if (parts.length !== 2) {
+      continue;
+    }
+    const [key, value] = parts;
+    switch (key) {
+      case "t":
+        timestamp = value;
+        break;
+      case "sha256":
+        signature = value;
+        break;
+    }
+  }
+  if (!timestamp || !signature) {
+    return null;
+  }
+  return { timestamp, signature };
+}
+async function validateWebhookSignature(payload, signatureHeader, secret, options = {}) {
+  if (!secret || secret.length === 0) {
+    return {
+      valid: false,
+      error: "Empty secret is not allowed"
+    };
+  }
+  const parsed = parseSignatureHeader(signatureHeader);
+  if (!parsed) {
+    return {
+      valid: false,
+      error: "Invalid signature header format"
+    };
+  }
+  const timestamp = Number.parseInt(parsed.timestamp, 10);
+  if (isNaN(timestamp)) {
+    return {
+      valid: false,
+      error: "Invalid timestamp in signature"
+    };
+  }
+  const maxAge = options.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS;
+  if (maxAge > 0) {
+    const now = Math.floor(Date.now() / 1e3);
+    const age = now - timestamp;
+    if (age > maxAge) {
+      return {
+        valid: false,
+        error: `Webhook timestamp too old (${age} seconds)`,
+        timestamp
+      };
+    }
+    if (age < -60) {
+      return {
+        valid: false,
+        error: "Webhook timestamp is in the future",
+        timestamp
+      };
+    }
+  }
+  const payloadStr = typeof payload === "string" ? payload : payload.toString("utf8");
+  const signedData = `${parsed.timestamp}.${payloadStr}`;
+  const expectedSignature = await createHmac("sha256", secret, signedData);
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(parsed.signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return {
+      valid: false,
+      error: "Invalid signature",
+      timestamp
+    };
+  }
+  const signaturesMatch = timingSafeEqual(expectedBuffer, actualBuffer);
+  if (!signaturesMatch) {
+    return {
+      valid: false,
+      error: "Invalid signature",
+      timestamp
+    };
+  }
+  return {
+    valid: true,
+    timestamp
+  };
+}
+async function validateWebhook(payload, headers, secret, options = {}) {
+  const signatureHeader = headers["x-pierre-signature"] || headers["X-Pierre-Signature"];
+  if (!signatureHeader || Array.isArray(signatureHeader)) {
+    return {
+      valid: false,
+      error: "Missing or invalid X-Pierre-Signature header"
+    };
+  }
+  const eventType = headers["x-pierre-event"] || headers["X-Pierre-Event"];
+  if (!eventType || Array.isArray(eventType)) {
+    return {
+      valid: false,
+      error: "Missing or invalid X-Pierre-Event header"
+    };
+  }
+  const validationResult = await validateWebhookSignature(
+    payload,
+    signatureHeader,
+    secret,
+    options
+  );
+  if (!validationResult.valid) {
+    return validationResult;
+  }
+  const payloadStr = typeof payload === "string" ? payload : payload.toString("utf8");
+  let parsedPayload;
+  try {
+    parsedPayload = JSON.parse(payloadStr);
+  } catch {
+    return {
+      valid: false,
+      error: "Invalid JSON payload",
+      timestamp: validationResult.timestamp
+    };
+  }
+  return {
+    valid: true,
+    eventType,
+    timestamp: validationResult.timestamp,
+    payload: parsedPayload
+  };
+}
 
 // src/index.ts
 var API_BASE_URL = "https://api.git.storage";
 var STORAGE_BASE_URL = "git.storage";
-var GitStorage = class {
+var API_VERSION = 1;
+var apiInstanceMap = /* @__PURE__ */ new Map();
+function getApiInstance(baseUrl, version) {
+  if (!apiInstanceMap.has(`${baseUrl}--${version}`)) {
+    apiInstanceMap.set(`${baseUrl}--${version}`, new ApiFetcher(baseUrl, version));
+  }
+  return apiInstanceMap.get(`${baseUrl}--${version}`);
+}
+var RepoImpl = class {
+  constructor(id, options, generateJWT) {
+    this.id = id;
+    this.options = options;
+    this.generateJWT = generateJWT;
+    this.api = getApiInstance(
+      this.options.apiBaseUrl ?? API_BASE_URL,
+      this.options.apiVersion ?? API_VERSION
+    );
+  }
+  api;
+  async getRemoteURL(urlOptions) {
+    const storageBaseUrl = this.options.storageBaseUrl ?? STORAGE_BASE_URL;
+    const url = new URL(`https://${this.options.name}.${storageBaseUrl}/${this.id}.git`);
+    url.username = `t`;
+    url.password = await this.generateJWT(this.id, urlOptions);
+    return url.toString();
+  }
+  async getFile(options) {
+    const jwt = await this.generateJWT(this.id, {
+      permissions: ["git:read"],
+      ttl: options?.ttl ?? 1 * 60 * 60
+      // 1hr in seconds
+    });
+    const params = {
+      path: options.path
+    };
+    if (options.ref) {
+      params.ref = options.ref;
+    }
+    const response = await this.api.get({ path: "repos/file", params }, jwt);
+    return await response.json();
+  }
+  async listFiles(options) {
+    const jwt = await this.generateJWT(this.id, {
+      permissions: ["git:read"],
+      ttl: options?.ttl ?? 1 * 60 * 60
+      // 1hr in seconds
+    });
+    const params = options?.ref ? { ref: options.ref } : void 0;
+    const response = await this.api.get({ path: "repos/files", params }, jwt);
+    return await response.json();
+  }
+  async listBranches(options) {
+    const jwt = await this.generateJWT(this.id, {
+      permissions: ["git:read"],
+      ttl: options?.ttl ?? 1 * 60 * 60
+      // 1hr in seconds
+    });
+    let params;
+    if (options?.cursor || !options?.limit) {
+      params = {};
+      if (options?.cursor) {
+        params.cursor = options.cursor;
+      }
+      if (typeof options?.limit == "number") {
+        params.limit = options.limit.toString();
+      }
+    }
+    const response = await this.api.get({ path: "repos/branches", params }, jwt);
+    return await response.json();
+  }
+  async listCommits(options) {
+    const jwt = await this.generateJWT(this.id, {
+      permissions: ["git:read"],
+      ttl: options?.ttl ?? 1 * 60 * 60
+      // 1hr in seconds
+    });
+    let params;
+    if (options?.branch || options?.cursor || options?.limit) {
+      params = {};
+      if (options?.branch) {
+        params.branch = options.branch;
+      }
+      if (options?.cursor) {
+        params.cursor = options.cursor;
+      }
+      if (typeof options?.limit == "number") {
+        params.limit = options.limit.toString();
+      }
+    }
+    const response = await this.api.get({ path: "repos/commits", params }, jwt);
+    return await response.json();
+  }
+  async getBranchDiff(options) {
+    const jwt = await this.generateJWT(this.id, {
+      permissions: ["git:read"],
+      ttl: options?.ttl ?? 1 * 60 * 60
+      // 1hr in seconds
+    });
+    const params = {
+      branch: options.branch
+    };
+    if (options.base) {
+      params.base = options.base;
+    }
+    const response = await this.api.get({ path: "repos/branches/diff", params }, jwt);
+    return await response.json();
+  }
+  async getCommitDiff(options) {
+    const jwt = await this.generateJWT(this.id, {
+      permissions: ["git:read"],
+      ttl: options?.ttl ?? 1 * 60 * 60
+      // 1hr in seconds
+    });
+    const params = {
+      sha: options.sha
+    };
+    const response = await this.api.get({ path: "repos/diff", params }, jwt);
+    return await response.json();
+  }
+  async getCommit(options) {
+    const jwt = await this.generateJWT(this.id, {
+      permissions: ["git:read"],
+      ttl: options?.ttl ?? 1 * 60 * 60
+      // 1hr in seconds
+    });
+    const params = {
+      repo: this.id,
+      sha: options.sha
+    };
+    const response = await this.api.get({ path: "commit", params }, jwt);
+    return await response.json();
+  }
+  async repull(options) {
+    const jwt = await this.generateJWT(this.id, {
+      permissions: ["git:write"],
+      ttl: options?.ttl ?? 1 * 60 * 60
+      // 1hr in seconds
+    });
+    const body = {};
+    if (options.ref) {
+      body.ref = options.ref;
+    }
+    const response = await this.api.post({ path: "repos/repull", body }, jwt);
+    if (response.status !== 202) {
+      throw new Error(`Repull failed: ${response.status} ${await response.text()}`);
+    }
+    return;
+  }
+};
+var GitStorage = class _GitStorage {
+  static overrides = {};
   options;
+  api;
   constructor(options) {
     if (!options || options.name === void 0 || options.key === void 0 || options.name === null || options.key === null) {
       throw new Error(
@@ -17,11 +399,21 @@ var GitStorage = class {
     if (typeof options.key !== "string" || options.key.trim() === "") {
       throw new Error("GitStorage key must be a non-empty string.");
     }
+    const resolvedApiBaseUrl = options.apiBaseUrl ?? _GitStorage.overrides.apiBaseUrl ?? API_BASE_URL;
+    const resolvedApiVersion = options.apiVersion ?? _GitStorage.overrides.apiVersion ?? API_VERSION;
+    const resolvedStorageBaseUrl = options.storageBaseUrl ?? _GitStorage.overrides.storageBaseUrl ?? STORAGE_BASE_URL;
+    this.api = getApiInstance(resolvedApiBaseUrl, resolvedApiVersion);
     this.options = {
       key: options.key,
-      name: options.name
+      name: options.name,
+      apiBaseUrl: resolvedApiBaseUrl,
+      apiVersion: resolvedApiVersion,
+      storageBaseUrl: resolvedStorageBaseUrl
     };
   }
+  static override(options) {
+    this.overrides = Object.assign({}, this.overrides, options);
+  }
   /**
    * Create a new repository
    * @returns The created repository
@@ -30,27 +422,24 @@ var GitStorage = class {
     const repoId = options?.id || crypto.randomUUID();
     const jwt = await this.generateJWT(repoId, {
       permissions: ["repo:write"],
-      ttl: 1 * 60 * 60
+      ttl: options?.ttl ?? 1 * 60 * 60
       // 1hr in seconds
     });
-    const response = await fetch(`${API_BASE_URL}/api/v1/repos`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${jwt}`
+    const baseRepoOptions = options?.baseRepo ? {
+      provider: "github",
+      ...snakecaseKeys(options.baseRepo)
+    } : null;
+    const createRepoPath = baseRepoOptions ? {
+      path: "repos",
+      body: {
+        base_repo: baseRepoOptions
       }
-    });
-    if (!response.ok) {
-      throw new Error(`Failed to create repository: ${response.statusText}`);
+    } : "repos";
+    const resp = await this.api.post(createRepoPath, jwt, { allowedStatus: [409] });
+    if (resp.status === 409) {
+      throw new Error("Repository already exists");
     }
-    return {
-      id: repoId,
-      getRemoteURL: async (urlOptions) => {
-        const url = new URL(`https://${this.options.name}.${STORAGE_BASE_URL}/${repoId}.git`);
-        url.username = `t`;
-        url.password = await this.generateJWT(repoId, urlOptions);
-        return url.toString();
-      }
-    };
+    return new RepoImpl(repoId, this.options, this.generateJWT.bind(this));
   }
   /**
    * Find a repository by ID
@@ -58,15 +447,15 @@ var GitStorage = class {
    * @returns The found repository
    */
   async findOne(options) {
-    return {
-      id: options.id,
-      getRemoteURL: async (urlOptions) => {
-        const url = new URL(`https://${this.options.name}.${STORAGE_BASE_URL}/${options.id}.git`);
-        url.username = `t`;
-        url.password = await this.generateJWT(options.id, urlOptions);
-        return url.toString();
-      }
-    };
+    const jwt = await this.generateJWT(options.id, {
+      permissions: ["git:read"],
+      ttl: 1 * 60 * 60
+    });
+    const resp = await this.api.get("repo", jwt, { allowedStatus: [404] });
+    if (resp.status === 404) {
+      return null;
+    }
+    return new RepoImpl(options.id, this.options, this.generateJWT.bind(this));
   }
   /**
    * Get the current configuration
@@ -100,6 +489,6 @@ function createClient(options) {
   return new GitStorage(options);
 }
 
-export { GitStorage, createClient };
+export { GitStorage, createClient, parseSignatureHeader, validateWebhook, validateWebhookSignature };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AA8CA,IAAM,YAAe,GAAA,yBAAA;AACrB,IAAM,gBAAmB,GAAA,aAAA;AAElB,IAAM,aAAN,MAAiB;AAAA,EACf,OAAA;AAAA,EAER,YAAY,OAA4B,EAAA;AACvC,IAAA,IACC,CAAC,OAAA,IACD,OAAQ,CAAA,IAAA,KAAS,MACjB,IAAA,OAAA,CAAQ,GAAQ,KAAA,MAAA,IAChB,OAAQ,CAAA,IAAA,KAAS,IACjB,IAAA,OAAA,CAAQ,QAAQ,IACf,EAAA;AACD,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA;AAGD,IAAI,IAAA,OAAO,QAAQ,IAAS,KAAA,QAAA,IAAY,QAAQ,IAAK,CAAA,IAAA,OAAW,EAAI,EAAA;AACnE,MAAM,MAAA,IAAI,MAAM,6CAA6C,CAAA;AAAA;AAG9D,IAAI,IAAA,OAAO,QAAQ,GAAQ,KAAA,QAAA,IAAY,QAAQ,GAAI,CAAA,IAAA,OAAW,EAAI,EAAA;AACjE,MAAM,MAAA,IAAI,MAAM,4CAA4C,CAAA;AAAA;AAG7D,IAAA,IAAA,CAAK,OAAU,GAAA;AAAA,MACd,KAAK,OAAQ,CAAA,GAAA;AAAA,MACb,MAAM,OAAQ,CAAA;AAAA,KACf;AAAA;AACD;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,OAA4C,EAAA;AAC5D,IAAA,MAAM,MAAS,GAAA,OAAA,EAAS,EAAM,IAAA,MAAA,CAAO,UAAW,EAAA;AAEhD,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,MAAQ,EAAA;AAAA,MAC1C,WAAA,EAAa,CAAC,YAAY,CAAA;AAAA,MAC1B,GAAA,EAAK,IAAI,EAAK,GAAA;AAAA;AAAA,KACd,CAAA;AAED,IAAA,MAAM,QAAW,GAAA,MAAM,KAAM,CAAA,CAAA,EAAG,YAAY,CAAiB,aAAA,CAAA,EAAA;AAAA,MAC5D,MAAQ,EAAA,MAAA;AAAA,MACR,OAAS,EAAA;AAAA,QACR,aAAA,EAAe,UAAU,GAAG,CAAA;AAAA;AAC7B,KACA,CAAA;AAED,IAAI,IAAA,CAAC,SAAS,EAAI,EAAA;AACjB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAgC,6BAAA,EAAA,QAAA,CAAS,UAAU,CAAE,CAAA,CAAA;AAAA;AAGtE,IAAO,OAAA;AAAA,MACN,EAAI,EAAA,MAAA;AAAA,MACJ,YAAA,EAAc,OAAO,UAAsD,KAAA;AAC1E,QAAM,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,CAAW,QAAA,EAAA,IAAA,CAAK,OAAQ,CAAA,IAAI,CAAI,CAAA,EAAA,gBAAgB,CAAI,CAAA,EAAA,MAAM,CAAM,IAAA,CAAA,CAAA;AACpF,QAAA,GAAA,CAAI,QAAW,GAAA,CAAA,CAAA,CAAA;AACf,QAAA,GAAA,CAAI,QAAW,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,QAAQ,UAAU,CAAA;AACxD,QAAA,OAAO,IAAI,QAAS,EAAA;AAAA;AACrB,KACD;AAAA;AACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,QAAQ,OAA+C,EAAA;AAC5D,IAAO,OAAA;AAAA,MACN,IAAI,OAAQ,CAAA,EAAA;AAAA,MACZ,YAAA,EAAc,OAAO,UAAsD,KAAA;AAC1E,QAAA,MAAM,GAAM,GAAA,IAAI,GAAI,CAAA,CAAA,QAAA,EAAW,IAAK,CAAA,OAAA,CAAQ,IAAI,CAAA,CAAA,EAAI,gBAAgB,CAAA,CAAA,EAAI,OAAQ,CAAA,EAAE,CAAM,IAAA,CAAA,CAAA;AACxF,QAAA,GAAA,CAAI,QAAW,GAAA,CAAA,CAAA,CAAA;AACf,QAAA,GAAA,CAAI,WAAW,MAAM,IAAA,CAAK,WAAY,CAAA,OAAA,CAAQ,IAAI,UAAU,CAAA;AAC5D,QAAA,OAAO,IAAI,QAAS,EAAA;AAAA;AACrB,KACD;AAAA;AACD;AAAA;AAAA;AAAA;AAAA,EAMA,SAA+B,GAAA;AAC9B,IAAO,OAAA,EAAE,GAAG,IAAA,CAAK,OAAQ,EAAA;AAAA;AAC1B;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,WAAY,CAAA,MAAA,EAAgB,OAAgD,EAAA;AAEzF,IAAA,MAAM,WAAc,GAAA,OAAA,EAAS,WAAe,IAAA,CAAC,aAAa,UAAU,CAAA;AACpE,IAAA,MAAM,GAAM,GAAA,OAAA,EAAS,GAAO,IAAA,GAAA,GAAM,KAAK,EAAK,GAAA,EAAA;AAG5C,IAAA,MAAM,MAAM,IAAK,CAAA,KAAA,CAAM,IAAK,CAAA,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,OAAU,GAAA;AAAA,MACf,GAAA,EAAK,KAAK,OAAQ,CAAA,IAAA;AAAA,MAClB,GAAK,EAAA,iBAAA;AAAA,MACL,IAAM,EAAA,MAAA;AAAA,MACN,MAAQ,EAAA,WAAA;AAAA,MACR,GAAK,EAAA,GAAA;AAAA,MACL,KAAK,GAAM,GAAA;AAAA,KACZ;AAIA,IAAA,MAAM,MAAM,MAAM,WAAA,CAAY,IAAK,CAAA,OAAA,CAAQ,KAAK,OAAO,CAAA;AAEvD,IAAA,MAAM,GAAM,GAAA,MAAM,IAAI,OAAA,CAAQ,OAAO,CACnC,CAAA,kBAAA,CAAmB,EAAE,GAAA,EAAK,SAAS,GAAK,EAAA,KAAA,EAAO,CAAA,CAC/C,KAAK,GAAG,CAAA;AAEV,IAAO,OAAA,GAAA;AAAA;AAET;AAGO,SAAS,aAAa,OAAwC,EAAA;AACpE,EAAO,OAAA,IAAI,WAAW,OAAO,CAAA;AAC9B","file":"index.js","sourcesContent":["/**\n * Pierre Git Storage SDK\n *\n * A TypeScript SDK for interacting with Pierre's git storage system\n */\n\nimport { importPKCS8, SignJWT } from 'jose';\n\n/**\n * Type definitions for Pierre Git Storage SDK\n */\n\nexport interface GitStorageOptions {\n\tkey: string;\n\tname: string;\n}\n\nexport interface GetRemoteURLOptions {\n\tpermissions?: ('git:write' | 'git:read' | 'repo:write')[];\n\tttl?: number;\n}\n\nexport interface Repo {\n\tid: string;\n\tgetRemoteURL(options?: GetRemoteURLOptions): Promise<string>;\n}\n\nexport interface FindOneOptions {\n\tid: string;\n}\n\nexport interface CreateRepoOptions {\n\tid?: string;\n}\n\nexport interface CreateRepoResponse {\n\trepo_id: string;\n\turl: string;\n}\n\n/**\n * Git Storage API\n */\ndeclare const __API_BASE_URL__: string;\ndeclare const __STORAGE_BASE_URL__: string;\n\nconst API_BASE_URL = __API_BASE_URL__;\nconst STORAGE_BASE_URL = __STORAGE_BASE_URL__;\n\nexport class GitStorage {\n\tprivate options: GitStorageOptions;\n\n\tconstructor(options: GitStorageOptions) {\n\t\tif (\n\t\t\t!options ||\n\t\t\toptions.name === undefined ||\n\t\t\toptions.key === undefined ||\n\t\t\toptions.name === null ||\n\t\t\toptions.key === null\n\t\t) {\n\t\t\tthrow new Error(\n\t\t\t\t'GitStorage requires a name and key. Please check your configuration and try again.',\n\t\t\t);\n\t\t}\n\n\t\tif (typeof options.name !== 'string' || options.name.trim() === '') {\n\t\t\tthrow new Error('GitStorage name must be a non-empty string.');\n\t\t}\n\n\t\tif (typeof options.key !== 'string' || options.key.trim() === '') {\n\t\t\tthrow new Error('GitStorage key must be a non-empty string.');\n\t\t}\n\n\t\tthis.options = {\n\t\t\tkey: options.key,\n\t\t\tname: options.name,\n\t\t};\n\t}\n\n\t/**\n\t * Create a new repository\n\t * @returns The created repository\n\t */\n\tasync createRepo(options?: CreateRepoOptions): Promise<Repo> {\n\t\tconst repoId = options?.id || crypto.randomUUID();\n\n\t\tconst jwt = await this.generateJWT(repoId, {\n\t\t\tpermissions: ['repo:write'],\n\t\t\tttl: 1 * 60 * 60, // 1hr in seconds\n\t\t});\n\n\t\tconst response = await fetch(`${API_BASE_URL}/api/v1/repos`, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${jwt}`,\n\t\t\t},\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to create repository: ${response.statusText}`);\n\t\t}\n\n\t\treturn {\n\t\t\tid: repoId,\n\t\t\tgetRemoteURL: async (urlOptions?: GetRemoteURLOptions): Promise<string> => {\n\t\t\t\tconst url = new URL(`https://${this.options.name}.${STORAGE_BASE_URL}/${repoId}.git`);\n\t\t\t\turl.username = `t`;\n\t\t\t\turl.password = await this.generateJWT(repoId, urlOptions);\n\t\t\t\treturn url.toString();\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Find a repository by ID\n\t * @param options The search options\n\t * @returns The found repository\n\t */\n\tasync findOne(options: FindOneOptions): Promise<Repo | null> {\n\t\treturn {\n\t\t\tid: options.id,\n\t\t\tgetRemoteURL: async (urlOptions?: GetRemoteURLOptions): Promise<string> => {\n\t\t\t\tconst url = new URL(`https://${this.options.name}.${STORAGE_BASE_URL}/${options.id}.git`);\n\t\t\t\turl.username = `t`;\n\t\t\t\turl.password = await this.generateJWT(options.id, urlOptions);\n\t\t\t\treturn url.toString();\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Get the current configuration\n\t * @returns The client configuration\n\t */\n\tgetConfig(): GitStorageOptions {\n\t\treturn { ...this.options };\n\t}\n\n\t/**\n\t * Generate a JWT token for git storage URL authentication\n\t * @private\n\t */\n\tprivate async generateJWT(repoId: string, options?: GetRemoteURLOptions): Promise<string> {\n\t\t// Default permissions and TTL\n\t\tconst permissions = options?.permissions || ['git:write', 'git:read'];\n\t\tconst ttl = options?.ttl || 365 * 24 * 60 * 60; // 1 year in seconds\n\n\t\t// Create the JWT payload\n\t\tconst now = Math.floor(Date.now() / 1000);\n\t\tconst payload = {\n\t\t\tiss: this.options.name,\n\t\t\tsub: '@pierre/storage',\n\t\t\trepo: repoId,\n\t\t\tscopes: permissions,\n\t\t\tiat: now,\n\t\t\texp: now + ttl,\n\t\t};\n\n\t\t// Sign the JWT with the key as the secret\n\t\t// Using HS256 for symmetric signing with the key\n\t\tconst key = await importPKCS8(this.options.key, 'ES256');\n\t\t// Sign the JWT with the key as the secret\n\t\tconst jwt = await new SignJWT(payload)\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT' })\n\t\t\t.sign(key);\n\n\t\treturn jwt;\n\t}\n}\n\n// Export a default client factory\nexport function createClient(options: GitStorageOptions): GitStorage {\n\treturn new GitStorage(options);\n}\n\n// Type alias for backward compatibility\nexport type StorageOptions = GitStorageOptions;\n"]}
+{"version":3,"sources":["../src/fetch.ts","../src/util.ts","../src/webhook.ts","../src/index.ts"],"names":["API_BASE_URL","crypto"],"mappings":";;;;;;AAMO,IAAM,aAAN,MAAiB;AAAA,EACvB,WAAA,CACkBA,eACA,OAChB,EAAA;AAFgB,IAAAA,IAAAA,CAAAA,YAAAA,GAAAA,aAAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAEjB,IAAQ,OAAA,CAAA,GAAA,CAAI,qBAAuBA,EAAAA,aAAAA,EAAc,OAAO,CAAA;AAAA;AACzD,EAEQ,UAAa,GAAA;AACpB,IAAA,OAAO,CAAG,EAAA,IAAA,CAAK,YAAY,CAAA,MAAA,EAAS,KAAK,OAAO,CAAA,CAAA;AAAA;AACjD,EAEQ,cAAc,IAAiB,EAAA;AACtC,IAAI,IAAA,OAAO,SAAS,QAAU,EAAA;AAC7B,MAAA,OAAO,CAAG,EAAA,IAAA,CAAK,UAAW,EAAC,IAAI,IAAI,CAAA,CAAA;AAAA,KACpC,MAAA,IAAW,KAAK,MAAQ,EAAA;AACvB,MAAA,MAAM,WAAW,IAAI,eAAA,CAAgB,IAAK,CAAA,MAAM,EAAE,QAAS,EAAA;AAC3D,MAAA,OAAO,CAAG,EAAA,IAAA,CAAK,UAAW,EAAC,CAAI,CAAA,EAAA,IAAA,CAAK,IAAI,CAAA,EAAG,QAAW,GAAA,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA,KACnE,MAAA;AACN,MAAA,OAAO,GAAG,IAAK,CAAA,UAAA,EAAY,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA;AACzC;AACD,EAEA,MAAc,KAAA,CAAM,IAAiB,EAAA,MAAA,EAAqB,KAAa,OAA0B,EAAA;AAChG,IAAM,MAAA,UAAA,GAAa,IAAK,CAAA,aAAA,CAAc,IAAI,CAAA;AAE1C,IAAA,MAAM,cAA8B,GAAA;AAAA,MACnC,MAAA;AAAA,MACA,OAAS,EAAA;AAAA,QACR,aAAA,EAAe,UAAU,GAAG,CAAA,CAAA;AAAA,QAC5B,cAAgB,EAAA;AAAA;AACjB,KACD;AAEA,IAAA,IAAI,WAAW,KAAS,IAAA,OAAO,IAAS,KAAA,QAAA,IAAY,KAAK,IAAM,EAAA;AAC9D,MAAA,cAAA,CAAe,IAAO,GAAA,IAAA,CAAK,SAAU,CAAA,IAAA,CAAK,IAAI,CAAA;AAAA;AAG/C,IAAA,MAAM,QAAW,GAAA,MAAM,KAAM,CAAA,UAAA,EAAY,cAAc,CAAA;AAEvD,IAAI,IAAA,CAAC,SAAS,EAAI,EAAA;AACjB,MAAM,MAAA,OAAA,GAAU,OAAS,EAAA,aAAA,IAAiB,EAAC;AAC3C,MAAA,IAAI,CAAC,OAAA,CAAQ,QAAS,CAAA,QAAA,CAAS,MAAM,CAAG,EAAA;AACvC,QAAM,MAAA,IAAI,MAAM,CAAmB,gBAAA,EAAA,MAAM,IAAI,UAAU,CAAA,EAAA,EAAK,QAAS,CAAA,UAAU,CAAE,CAAA,CAAA;AAAA;AAClF;AAED,IAAO,OAAA,QAAA;AAAA;AACR,EAEA,MAAM,GAAA,CAAI,IAAiB,EAAA,GAAA,EAAa,OAA0B,EAAA;AACjE,IAAA,OAAO,IAAK,CAAA,KAAA,CAAM,IAAM,EAAA,KAAA,EAAO,KAAK,OAAO,CAAA;AAAA;AAC5C,EAEA,MAAM,IAAA,CAAK,IAAiB,EAAA,GAAA,EAAa,OAA0B,EAAA;AAClE,IAAA,OAAO,IAAK,CAAA,KAAA,CAAM,IAAM,EAAA,MAAA,EAAQ,KAAK,OAAO,CAAA;AAAA;AAC7C,EAEA,MAAM,GAAA,CAAI,IAAiB,EAAA,GAAA,EAAa,OAA0B,EAAA;AACjE,IAAA,OAAO,IAAK,CAAA,KAAA,CAAM,IAAM,EAAA,KAAA,EAAO,KAAK,OAAO,CAAA;AAAA;AAC5C,EAEA,MAAM,MAAA,CAAO,IAAiB,EAAA,GAAA,EAAa,OAA0B,EAAA;AACpE,IAAA,OAAO,IAAK,CAAA,KAAA,CAAM,IAAM,EAAA,QAAA,EAAU,KAAK,OAAO,CAAA;AAAA;AAEhD,CAAA;;;ACtEO,SAAS,eAAA,CAAgB,GAAwB,CAAiC,EAAA;AACxF,EAAM,MAAA,OAAA,GAAU,OAAO,CAAM,KAAA,QAAA,GAAW,IAAI,WAAY,EAAA,CAAE,MAAO,CAAA,CAAC,CAAI,GAAA,CAAA;AACtE,EAAM,MAAA,OAAA,GAAU,OAAO,CAAM,KAAA,QAAA,GAAW,IAAI,WAAY,EAAA,CAAE,MAAO,CAAA,CAAC,CAAI,GAAA,CAAA;AAEtE,EAAA,IAAI,OAAQ,CAAA,MAAA,KAAW,OAAQ,CAAA,MAAA,EAAe,OAAA,KAAA;AAE9C,EAAA,IAAI,MAAS,GAAA,CAAA;AACb,EAAA,KAAA,IAAS,CAAI,GAAA,CAAA,EAAG,CAAI,GAAA,OAAA,CAAQ,QAAQ,CAAK,EAAA,EAAA;AACxC,IAAA,MAAA,IAAU,OAAQ,CAAA,CAAC,CAAI,GAAA,OAAA,CAAQ,CAAC,CAAA;AAAA;AAEjC,EAAA,OAAO,MAAW,KAAA,CAAA;AACnB;AAEA,eAAsB,oBAAuB,GAAA;AAC5C,EAAI,IAAA,CAAC,WAAW,MAAQ,EAAA;AACvB,IAAA,MAAM,EAAE,SAAA,EAAc,GAAA,MAAM,OAAO,QAAa,CAAA;AAChD,IAAO,OAAA,SAAA;AAAA;AAER,EAAA,OAAO,UAAW,CAAA,MAAA;AACnB;AAEA,eAAsB,UAAA,CAAW,SAAmB,EAAA,MAAA,EAAgB,IAA+B,EAAA;AAIlG,EAAA,IAAI,CAAC,MAAA,IAAU,MAAO,CAAA,MAAA,KAAW,CAAG,EAAA;AACnC,IAAM,MAAA,IAAI,MAAM,oBAAoB,CAAA;AAAA;AAGrC,EAAMC,MAAAA,OAAAA,GAAS,MAAM,oBAAqB,EAAA;AAC1C,EAAM,MAAA,OAAA,GAAU,IAAI,WAAY,EAAA;AAChC,EAAM,MAAA,GAAA,GAAM,MAAMA,OAAAA,CAAO,MAAO,CAAA,SAAA;AAAA,IAC/B,KAAA;AAAA,IACA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACrB,EAAE,IAAA,EAAM,MAAQ,EAAA,IAAA,EAAM,SAAU,EAAA;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACR;AAEA,EAAM,MAAA,SAAA,GAAY,MAAMA,OAAAA,CAAO,MAAO,CAAA,IAAA,CAAK,QAAQ,GAAK,EAAA,OAAA,CAAQ,MAAO,CAAA,IAAI,CAAC,CAAA;AAC5E,EAAO,OAAA,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,SAAS,CAAC,CAAA,CACzC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAS,CAAA,EAAE,EAAE,QAAS,CAAA,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AACV;;;AC9BA,IAAM,uBAA0B,GAAA,GAAA;AAMzB,SAAS,qBAAqB,MAA+C,EAAA;AACnF,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAU,EAAA;AAC1C,IAAO,OAAA,IAAA;AAAA;AAGR,EAAA,IAAI,SAAY,GAAA,EAAA;AAChB,EAAA,IAAI,SAAY,GAAA,EAAA;AAGhB,EAAM,MAAA,QAAA,GAAW,MAAO,CAAA,KAAA,CAAM,GAAG,CAAA;AACjC,EAAA,KAAA,MAAW,WAAW,QAAU,EAAA;AAC/B,IAAM,MAAA,cAAA,GAAiB,QAAQ,IAAK,EAAA;AACpC,IAAA,MAAM,KAAQ,GAAA,cAAA,CAAe,KAAM,CAAA,GAAA,EAAK,CAAC,CAAA;AACzC,IAAI,IAAA,KAAA,CAAM,WAAW,CAAG,EAAA;AACvB,MAAA;AAAA;AAGD,IAAM,MAAA,CAAC,GAAK,EAAA,KAAK,CAAI,GAAA,KAAA;AACrB,IAAA,QAAQ,GAAK;AAAA,MACZ,KAAK,GAAA;AACJ,QAAY,SAAA,GAAA,KAAA;AACZ,QAAA;AAAA,MACD,KAAK,QAAA;AACJ,QAAY,SAAA,GAAA,KAAA;AACZ,QAAA;AAAA;AACF;AAGD,EAAI,IAAA,CAAC,SAAa,IAAA,CAAC,SAAW,EAAA;AAC7B,IAAO,OAAA,IAAA;AAAA;AAGR,EAAO,OAAA,EAAE,WAAW,SAAU,EAAA;AAC/B;AAyBA,eAAsB,yBACrB,OACA,EAAA,eAAA,EACA,MACA,EAAA,OAAA,GAAoC,EACD,EAAA;AACnC,EAAA,IAAI,CAAC,MAAA,IAAU,MAAO,CAAA,MAAA,KAAW,CAAG,EAAA;AACnC,IAAO,OAAA;AAAA,MACN,KAAO,EAAA,KAAA;AAAA,MACP,KAAO,EAAA;AAAA,KACR;AAAA;AAID,EAAM,MAAA,MAAA,GAAS,qBAAqB,eAAe,CAAA;AACnD,EAAA,IAAI,CAAC,MAAQ,EAAA;AACZ,IAAO,OAAA;AAAA,MACN,KAAO,EAAA,KAAA;AAAA,MACP,KAAO,EAAA;AAAA,KACR;AAAA;AAID,EAAA,MAAM,SAAY,GAAA,MAAA,CAAO,QAAS,CAAA,MAAA,CAAO,WAAW,EAAE,CAAA;AACtD,EAAI,IAAA,KAAA,CAAM,SAAS,CAAG,EAAA;AACrB,IAAO,OAAA;AAAA,MACN,KAAO,EAAA,KAAA;AAAA,MACP,KAAO,EAAA;AAAA,KACR;AAAA;AAID,EAAM,MAAA,MAAA,GAAS,QAAQ,aAAiB,IAAA,uBAAA;AACxC,EAAA,IAAI,SAAS,CAAG,EAAA;AACf,IAAA,MAAM,MAAM,IAAK,CAAA,KAAA,CAAM,IAAK,CAAA,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,MAAM,GAAM,GAAA,SAAA;AAElB,IAAA,IAAI,MAAM,MAAQ,EAAA;AACjB,MAAO,OAAA;AAAA,QACN,KAAO,EAAA,KAAA;AAAA,QACP,KAAA,EAAO,8BAA8B,GAAG,CAAA,SAAA,CAAA;AAAA,QACxC;AAAA,OACD;AAAA;AAID,IAAA,IAAI,MAAM,GAAK,EAAA;AACd,MAAO,OAAA;AAAA,QACN,KAAO,EAAA,KAAA;AAAA,QACP,KAAO,EAAA,oCAAA;AAAA,QACP;AAAA,OACD;AAAA;AACD;AAID,EAAA,MAAM,aAAa,OAAO,OAAA,KAAY,WAAW,OAAU,GAAA,OAAA,CAAQ,SAAS,MAAM,CAAA;AAIlF,EAAA,MAAM,UAAa,GAAA,CAAA,EAAG,MAAO,CAAA,SAAS,IAAI,UAAU,CAAA,CAAA;AACpD,EAAA,MAAM,iBAAoB,GAAA,MAAM,UAAW,CAAA,QAAA,EAAU,QAAQ,UAAU,CAAA;AAGvE,EAAM,MAAA,cAAA,GAAiB,MAAO,CAAA,IAAA,CAAK,iBAAiB,CAAA;AACpD,EAAA,MAAM,YAAe,GAAA,MAAA,CAAO,IAAK,CAAA,MAAA,CAAO,SAAS,CAAA;AAGjD,EAAI,IAAA,cAAA,CAAe,MAAW,KAAA,YAAA,CAAa,MAAQ,EAAA;AAClD,IAAO,OAAA;AAAA,MACN,KAAO,EAAA,KAAA;AAAA,MACP,KAAO,EAAA,mBAAA;AAAA,MACP;AAAA,KACD;AAAA;AAGD,EAAM,MAAA,eAAA,GAAkB,eAAgB,CAAA,cAAA,EAAgB,YAAY,CAAA;AACpE,EAAA,IAAI,CAAC,eAAiB,EAAA;AACrB,IAAO,OAAA;AAAA,MACN,KAAO,EAAA,KAAA;AAAA,MACP,KAAO,EAAA,mBAAA;AAAA,MACP;AAAA,KACD;AAAA;AAGD,EAAO,OAAA;AAAA,IACN,KAAO,EAAA,IAAA;AAAA,IACP;AAAA,GACD;AACD;AA6BA,eAAsB,gBACrB,OACA,EAAA,OAAA,EACA,MACA,EAAA,OAAA,GAAoC,EACmC,EAAA;AAEvE,EAAA,MAAM,eAAkB,GAAA,OAAA,CAAQ,oBAAoB,CAAA,IAAK,QAAQ,oBAAoB,CAAA;AACrF,EAAA,IAAI,CAAC,eAAA,IAAmB,KAAM,CAAA,OAAA,CAAQ,eAAe,CAAG,EAAA;AACvD,IAAO,OAAA;AAAA,MACN,KAAO,EAAA,KAAA;AAAA,MACP,KAAO,EAAA;AAAA,KACR;AAAA;AAID,EAAA,MAAM,SAAY,GAAA,OAAA,CAAQ,gBAAgB,CAAA,IAAK,QAAQ,gBAAgB,CAAA;AACvE,EAAA,IAAI,CAAC,SAAA,IAAa,KAAM,CAAA,OAAA,CAAQ,SAAS,CAAG,EAAA;AAC3C,IAAO,OAAA;AAAA,MACN,KAAO,EAAA,KAAA;AAAA,MACP,KAAO,EAAA;AAAA,KACR;AAAA;AAID,EAAA,MAAM,mBAAmB,MAAM,wBAAA;AAAA,IAC9B,OAAA;AAAA,IACA,eAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACD;AAEA,EAAI,IAAA,CAAC,iBAAiB,KAAO,EAAA;AAC5B,IAAO,OAAA,gBAAA;AAAA;AAIR,EAAA,MAAM,aAAa,OAAO,OAAA,KAAY,WAAW,OAAU,GAAA,OAAA,CAAQ,SAAS,MAAM,CAAA;AAClF,EAAI,IAAA,aAAA;AACJ,EAAI,IAAA;AACH,IAAgB,aAAA,GAAA,IAAA,CAAK,MAAM,UAAU,CAAA;AAAA,GAC9B,CAAA,MAAA;AACP,IAAO,OAAA;AAAA,MACN,KAAO,EAAA,KAAA;AAAA,MACP,KAAO,EAAA,sBAAA;AAAA,MACP,WAAW,gBAAiB,CAAA;AAAA,KAC7B;AAAA;AAGD,EAAO,OAAA;AAAA,IACN,KAAO,EAAA,IAAA;AAAA,IACP,SAAA;AAAA,IACA,WAAW,gBAAiB,CAAA,SAAA;AAAA,IAC5B,OAAS,EAAA;AAAA,GACV;AACD;;;ACvMA,IAAM,YAAe,GAAA,yBAAA;AACrB,IAAM,gBAAmB,GAAA,aAAA;AACzB,IAAM,WAA+B,GAAA,CAAA;AAErC,IAAM,cAAA,uBAAqB,GAAwB,EAAA;AAEnD,SAAS,cAAA,CAAe,SAAiB,OAA0B,EAAA;AAClE,EAAI,IAAA,CAAC,eAAe,GAAI,CAAA,CAAA,EAAG,OAAO,CAAK,EAAA,EAAA,OAAO,EAAE,CAAG,EAAA;AAClD,IAAe,cAAA,CAAA,GAAA,CAAI,CAAG,EAAA,OAAO,CAAK,EAAA,EAAA,OAAO,IAAI,IAAI,UAAA,CAAW,OAAS,EAAA,OAAO,CAAC,CAAA;AAAA;AAE9E,EAAA,OAAO,eAAe,GAAI,CAAA,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,OAAO,CAAE,CAAA,CAAA;AACnD;AAKA,IAAM,WAAN,MAA+B;AAAA,EAG9B,WAAA,CACiB,EACC,EAAA,OAAA,EACA,WAIhB,EAAA;AANe,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AACC,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAKjB,IAAA,IAAA,CAAK,GAAM,GAAA,cAAA;AAAA,MACV,IAAA,CAAK,QAAQ,UAAc,IAAA,YAAA;AAAA,MAC3B,IAAA,CAAK,QAAQ,UAAc,IAAA;AAAA,KAC5B;AAAA;AACD,EAdiB,GAAA;AAAA,EAgBjB,MAAM,aAAa,UAAmD,EAAA;AACrE,IAAM,MAAA,cAAA,GAAiB,IAAK,CAAA,OAAA,CAAQ,cAAkB,IAAA,gBAAA;AACtD,IAAA,MAAM,GAAM,GAAA,IAAI,GAAI,CAAA,CAAA,QAAA,EAAW,IAAK,CAAA,OAAA,CAAQ,IAAI,CAAA,CAAA,EAAI,cAAc,CAAA,CAAA,EAAI,IAAK,CAAA,EAAE,CAAM,IAAA,CAAA,CAAA;AACnF,IAAA,GAAA,CAAI,QAAW,GAAA,CAAA,CAAA,CAAA;AACf,IAAA,GAAA,CAAI,WAAW,MAAM,IAAA,CAAK,WAAY,CAAA,IAAA,CAAK,IAAI,UAAU,CAAA;AACzD,IAAA,OAAO,IAAI,QAAS,EAAA;AAAA;AACrB,EAEA,MAAM,QAAQ,OAAmD,EAAA;AAChE,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,KAAK,EAAI,EAAA;AAAA,MAC3C,WAAA,EAAa,CAAC,UAAU,CAAA;AAAA,MACxB,GAAK,EAAA,OAAA,EAAS,GAAO,IAAA,CAAA,GAAI,EAAK,GAAA;AAAA;AAAA,KAC9B,CAAA;AAED,IAAA,MAAM,MAAiC,GAAA;AAAA,MACtC,MAAM,OAAQ,CAAA;AAAA,KACf;AAEA,IAAA,IAAI,QAAQ,GAAK,EAAA;AAChB,MAAA,MAAA,CAAO,MAAM,OAAQ,CAAA,GAAA;AAAA;AAGtB,IAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,GAAI,CAAA,GAAA,CAAI,EAAE,IAAM,EAAA,YAAA,EAAc,MAAO,EAAA,EAAG,GAAG,CAAA;AAEvE,IAAQ,OAAA,MAAM,SAAS,IAAK,EAAA;AAAA;AAC7B,EAEA,MAAM,UAAU,OAAwD,EAAA;AACvE,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,KAAK,EAAI,EAAA;AAAA,MAC3C,WAAA,EAAa,CAAC,UAAU,CAAA;AAAA,MACxB,GAAK,EAAA,OAAA,EAAS,GAAO,IAAA,CAAA,GAAI,EAAK,GAAA;AAAA;AAAA,KAC9B,CAAA;AAED,IAAA,MAAM,SAA6C,OAAS,EAAA,GAAA,GACzD,EAAE,GAAK,EAAA,OAAA,CAAQ,KACf,GAAA,MAAA;AACH,IAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,GAAI,CAAA,GAAA,CAAI,EAAE,IAAM,EAAA,aAAA,EAAe,MAAO,EAAA,EAAG,GAAG,CAAA;AAExE,IAAQ,OAAA,MAAM,SAAS,IAAK,EAAA;AAAA;AAC7B,EAEA,MAAM,aAAa,OAA8D,EAAA;AAChF,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,KAAK,EAAI,EAAA;AAAA,MAC3C,WAAA,EAAa,CAAC,UAAU,CAAA;AAAA,MACxB,GAAK,EAAA,OAAA,EAAS,GAAO,IAAA,CAAA,GAAI,EAAK,GAAA;AAAA;AAAA,KAC9B,CAAA;AAED,IAAI,IAAA,MAAA;AAEJ,IAAA,IAAI,OAAS,EAAA,MAAA,IAAU,CAAC,OAAA,EAAS,KAAO,EAAA;AACvC,MAAA,MAAA,GAAS,EAAC;AACV,MAAA,IAAI,SAAS,MAAQ,EAAA;AACpB,QAAA,MAAA,CAAO,SAAS,OAAQ,CAAA,MAAA;AAAA;AAEzB,MAAI,IAAA,OAAO,OAAS,EAAA,KAAA,IAAS,QAAU,EAAA;AACtC,QAAO,MAAA,CAAA,KAAA,GAAQ,OAAQ,CAAA,KAAA,CAAM,QAAS,EAAA;AAAA;AACvC;AAGD,IAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,GAAI,CAAA,GAAA,CAAI,EAAE,IAAM,EAAA,gBAAA,EAAkB,MAAO,EAAA,EAAG,GAAG,CAAA;AAE3E,IAAQ,OAAA,MAAM,SAAS,IAAK,EAAA;AAAA;AAC7B,EAEA,MAAM,YAAY,OAA4D,EAAA;AAC7E,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,KAAK,EAAI,EAAA;AAAA,MAC3C,WAAA,EAAa,CAAC,UAAU,CAAA;AAAA,MACxB,GAAK,EAAA,OAAA,EAAS,GAAO,IAAA,CAAA,GAAI,EAAK,GAAA;AAAA;AAAA,KAC9B,CAAA;AAED,IAAI,IAAA,MAAA;AAEJ,IAAA,IAAI,OAAS,EAAA,MAAA,IAAU,OAAS,EAAA,MAAA,IAAU,SAAS,KAAO,EAAA;AACzD,MAAA,MAAA,GAAS,EAAC;AACV,MAAA,IAAI,SAAS,MAAQ,EAAA;AACpB,QAAA,MAAA,CAAO,SAAS,OAAQ,CAAA,MAAA;AAAA;AAEzB,MAAA,IAAI,SAAS,MAAQ,EAAA;AACpB,QAAA,MAAA,CAAO,SAAS,OAAQ,CAAA,MAAA;AAAA;AAEzB,MAAI,IAAA,OAAO,OAAS,EAAA,KAAA,IAAS,QAAU,EAAA;AACtC,QAAO,MAAA,CAAA,KAAA,GAAQ,OAAQ,CAAA,KAAA,CAAM,QAAS,EAAA;AAAA;AACvC;AAGD,IAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,GAAI,CAAA,GAAA,CAAI,EAAE,IAAM,EAAA,eAAA,EAAiB,MAAO,EAAA,EAAG,GAAG,CAAA;AAE1E,IAAQ,OAAA,MAAM,SAAS,IAAK,EAAA;AAAA;AAC7B,EAEA,MAAM,cAAc,OAA+D,EAAA;AAClF,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,KAAK,EAAI,EAAA;AAAA,MAC3C,WAAA,EAAa,CAAC,UAAU,CAAA;AAAA,MACxB,GAAK,EAAA,OAAA,EAAS,GAAO,IAAA,CAAA,GAAI,EAAK,GAAA;AAAA;AAAA,KAC9B,CAAA;AAED,IAAA,MAAM,MAAiC,GAAA;AAAA,MACtC,QAAQ,OAAQ,CAAA;AAAA,KACjB;AAEA,IAAA,IAAI,QAAQ,IAAM,EAAA;AACjB,MAAA,MAAA,CAAO,OAAO,OAAQ,CAAA,IAAA;AAAA;AAGvB,IAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,GAAI,CAAA,GAAA,CAAI,EAAE,IAAM,EAAA,qBAAA,EAAuB,MAAO,EAAA,EAAG,GAAG,CAAA;AAEhF,IAAQ,OAAA,MAAM,SAAS,IAAK,EAAA;AAAA;AAC7B,EAEA,MAAM,cAAc,OAA+D,EAAA;AAClF,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,KAAK,EAAI,EAAA;AAAA,MAC3C,WAAA,EAAa,CAAC,UAAU,CAAA;AAAA,MACxB,GAAK,EAAA,OAAA,EAAS,GAAO,IAAA,CAAA,GAAI,EAAK,GAAA;AAAA;AAAA,KAC9B,CAAA;AAED,IAAA,MAAM,MAAiC,GAAA;AAAA,MACtC,KAAK,OAAQ,CAAA;AAAA,KACd;AAEA,IAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,GAAI,CAAA,GAAA,CAAI,EAAE,IAAM,EAAA,YAAA,EAAc,MAAO,EAAA,EAAG,GAAG,CAAA;AAEvE,IAAQ,OAAA,MAAM,SAAS,IAAK,EAAA;AAAA;AAC7B,EAEA,MAAM,UAAU,OAAuD,EAAA;AACtE,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,KAAK,EAAI,EAAA;AAAA,MAC3C,WAAA,EAAa,CAAC,UAAU,CAAA;AAAA,MACxB,GAAK,EAAA,OAAA,EAAS,GAAO,IAAA,CAAA,GAAI,EAAK,GAAA;AAAA;AAAA,KAC9B,CAAA;AAED,IAAA,MAAM,MAAiC,GAAA;AAAA,MACtC,MAAM,IAAK,CAAA,EAAA;AAAA,MACX,KAAK,OAAQ,CAAA;AAAA,KACd;AACA,IAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,GAAI,CAAA,GAAA,CAAI,EAAE,IAAM,EAAA,QAAA,EAAU,MAAO,EAAA,EAAG,GAAG,CAAA;AAEnE,IAAQ,OAAA,MAAM,SAAS,IAAK,EAAA;AAAA;AAC7B,EAEA,MAAM,OAAO,OAAuC,EAAA;AACnD,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,KAAK,EAAI,EAAA;AAAA,MAC3C,WAAA,EAAa,CAAC,WAAW,CAAA;AAAA,MACzB,GAAK,EAAA,OAAA,EAAS,GAAO,IAAA,CAAA,GAAI,EAAK,GAAA;AAAA;AAAA,KAC9B,CAAA;AAED,IAAA,MAAM,OAA+B,EAAC;AAEtC,IAAA,IAAI,QAAQ,GAAK,EAAA;AAChB,MAAA,IAAA,CAAK,MAAM,OAAQ,CAAA,GAAA;AAAA;AAGpB,IAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,GAAI,CAAA,IAAA,CAAK,EAAE,IAAM,EAAA,cAAA,EAAgB,IAAK,EAAA,EAAG,GAAG,CAAA;AAExE,IAAI,IAAA,QAAA,CAAS,WAAW,GAAK,EAAA;AAC5B,MAAM,MAAA,IAAI,KAAM,CAAA,CAAA,eAAA,EAAkB,QAAS,CAAA,MAAM,IAAI,MAAM,QAAA,CAAS,IAAK,EAAC,CAAE,CAAA,CAAA;AAAA;AAG7E,IAAA;AAAA;AAEF,CAAA;AAEa,IAAA,UAAA,GAAN,MAAM,WAAW,CAAA;AAAA,EACvB,OAAe,YAA2C,EAAC;AAAA,EACnD,OAAA;AAAA,EACA,GAAA;AAAA,EAER,YAAY,OAA4B,EAAA;AACvC,IAAA,IACC,CAAC,OAAA,IACD,OAAQ,CAAA,IAAA,KAAS,MACjB,IAAA,OAAA,CAAQ,GAAQ,KAAA,MAAA,IAChB,OAAQ,CAAA,IAAA,KAAS,IACjB,IAAA,OAAA,CAAQ,QAAQ,IACf,EAAA;AACD,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA;AAGD,IAAI,IAAA,OAAO,QAAQ,IAAS,KAAA,QAAA,IAAY,QAAQ,IAAK,CAAA,IAAA,OAAW,EAAI,EAAA;AACnE,MAAM,MAAA,IAAI,MAAM,6CAA6C,CAAA;AAAA;AAG9D,IAAI,IAAA,OAAO,QAAQ,GAAQ,KAAA,QAAA,IAAY,QAAQ,GAAI,CAAA,IAAA,OAAW,EAAI,EAAA;AACjE,MAAM,MAAA,IAAI,MAAM,4CAA4C,CAAA;AAAA;AAG7D,IAAA,MAAM,kBACL,GAAA,OAAA,CAAQ,UAAc,IAAA,WAAA,CAAW,UAAU,UAAc,IAAA,YAAA;AAC1D,IAAA,MAAM,kBAAqB,GAAA,OAAA,CAAQ,UAAc,IAAA,WAAA,CAAW,UAAU,UAAc,IAAA,WAAA;AACpF,IAAA,MAAM,sBACL,GAAA,OAAA,CAAQ,cAAkB,IAAA,WAAA,CAAW,UAAU,cAAkB,IAAA,gBAAA;AAElE,IAAK,IAAA,CAAA,GAAA,GAAM,cAAe,CAAA,kBAAA,EAAoB,kBAAkB,CAAA;AAEhE,IAAA,IAAA,CAAK,OAAU,GAAA;AAAA,MACd,KAAK,OAAQ,CAAA,GAAA;AAAA,MACb,MAAM,OAAQ,CAAA,IAAA;AAAA,MACd,UAAY,EAAA,kBAAA;AAAA,MACZ,UAAY,EAAA,kBAAA;AAAA,MACZ,cAAgB,EAAA;AAAA,KACjB;AAAA;AACD,EAEA,OAAO,SAAS,OAA8C,EAAA;AAC7D,IAAA,IAAA,CAAK,YAAY,MAAO,CAAA,MAAA,CAAO,EAAI,EAAA,IAAA,CAAK,WAAW,OAAO,CAAA;AAAA;AAC3D;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,OAA4C,EAAA;AAC5D,IAAA,MAAM,MAAS,GAAA,OAAA,EAAS,EAAM,IAAA,MAAA,CAAO,UAAW,EAAA;AAEhD,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,MAAQ,EAAA;AAAA,MAC1C,WAAA,EAAa,CAAC,YAAY,CAAA;AAAA,MAC1B,GAAK,EAAA,OAAA,EAAS,GAAO,IAAA,CAAA,GAAI,EAAK,GAAA;AAAA;AAAA,KAC9B,CAAA;AAED,IAAM,MAAA,eAAA,GAAkB,SAAS,QAC9B,GAAA;AAAA,MACA,QAAU,EAAA,QAAA;AAAA,MACV,GAAG,aAAc,CAAA,OAAA,CAAQ,QAA8C;AAAA,KAEvE,GAAA,IAAA;AAEH,IAAA,MAAM,iBAAiB,eACpB,GAAA;AAAA,MACA,IAAM,EAAA,OAAA;AAAA,MACN,IAAM,EAAA;AAAA,QACL,SAAW,EAAA;AAAA;AACZ,KAEA,GAAA,OAAA;AAGH,IAAA,MAAM,IAAO,GAAA,MAAM,IAAK,CAAA,GAAA,CAAI,IAAK,CAAA,cAAA,EAAgB,GAAK,EAAA,EAAE,aAAe,EAAA,CAAC,GAAG,CAAA,EAAG,CAAA;AAC9E,IAAI,IAAA,IAAA,CAAK,WAAW,GAAK,EAAA;AACxB,MAAM,MAAA,IAAI,MAAM,2BAA2B,CAAA;AAAA;AAG5C,IAAO,OAAA,IAAI,SAAS,MAAQ,EAAA,IAAA,CAAK,SAAS,IAAK,CAAA,WAAA,CAAY,IAAK,CAAA,IAAI,CAAC,CAAA;AAAA;AACtE;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,QAAQ,OAA+C,EAAA;AAC5D,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,WAAA,CAAY,QAAQ,EAAI,EAAA;AAAA,MAC9C,WAAA,EAAa,CAAC,UAAU,CAAA;AAAA,MACxB,GAAA,EAAK,IAAI,EAAK,GAAA;AAAA,KACd,CAAA;AAGD,IAAA,MAAM,IAAO,GAAA,MAAM,IAAK,CAAA,GAAA,CAAI,GAAI,CAAA,MAAA,EAAQ,GAAK,EAAA,EAAE,aAAe,EAAA,CAAC,GAAG,CAAA,EAAG,CAAA;AACrE,IAAI,IAAA,IAAA,CAAK,WAAW,GAAK,EAAA;AACxB,MAAO,OAAA,IAAA;AAAA;AAIR,IAAO,OAAA,IAAI,QAAS,CAAA,OAAA,CAAQ,EAAI,EAAA,IAAA,CAAK,SAAS,IAAK,CAAA,WAAA,CAAY,IAAK,CAAA,IAAI,CAAC,CAAA;AAAA;AAC1E;AAAA;AAAA;AAAA;AAAA,EAMA,SAA+B,GAAA;AAC9B,IAAO,OAAA,EAAE,GAAG,IAAA,CAAK,OAAQ,EAAA;AAAA;AAC1B;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,WAAY,CAAA,MAAA,EAAgB,OAAgD,EAAA;AAEzF,IAAA,MAAM,WAAc,GAAA,OAAA,EAAS,WAAe,IAAA,CAAC,aAAa,UAAU,CAAA;AACpE,IAAA,MAAM,GAAM,GAAA,OAAA,EAAS,GAAO,IAAA,GAAA,GAAM,KAAK,EAAK,GAAA,EAAA;AAG5C,IAAA,MAAM,MAAM,IAAK,CAAA,KAAA,CAAM,IAAK,CAAA,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,OAAU,GAAA;AAAA,MACf,GAAA,EAAK,KAAK,OAAQ,CAAA,IAAA;AAAA,MAClB,GAAK,EAAA,iBAAA;AAAA,MACL,IAAM,EAAA,MAAA;AAAA,MACN,MAAQ,EAAA,WAAA;AAAA,MACR,GAAK,EAAA,GAAA;AAAA,MACL,KAAK,GAAM,GAAA;AAAA,KACZ;AAIA,IAAA,MAAM,MAAM,MAAM,WAAA,CAAY,IAAK,CAAA,OAAA,CAAQ,KAAK,OAAO,CAAA;AAEvD,IAAA,MAAM,GAAM,GAAA,MAAM,IAAI,OAAA,CAAQ,OAAO,CACnC,CAAA,kBAAA,CAAmB,EAAE,GAAA,EAAK,SAAS,GAAK,EAAA,KAAA,EAAO,CAAA,CAC/C,KAAK,GAAG,CAAA;AAEV,IAAO,OAAA,GAAA;AAAA;AAET;AAGO,SAAS,aAAa,OAAwC,EAAA;AACpE,EAAO,OAAA,IAAI,WAAW,OAAO,CAAA;AAC9B","file":"index.js","sourcesContent":["import type { ValidAPIVersion, ValidMethod, ValidPath } from './types';\n\ninterface RequestOptions {\n\tallowedStatus?: number[];\n}\n\nexport class ApiFetcher {\n\tconstructor(\n\t\tprivate readonly API_BASE_URL: string,\n\t\tprivate readonly version: ValidAPIVersion,\n\t) {\n\t\tconsole.log('api fetcher created', API_BASE_URL, version);\n\t}\n\n\tprivate getBaseUrl() {\n\t\treturn `${this.API_BASE_URL}/api/v${this.version}`;\n\t}\n\n\tprivate getRequestUrl(path: ValidPath) {\n\t\tif (typeof path === 'string') {\n\t\t\treturn `${this.getBaseUrl()}/${path}`;\n\t\t} else if (path.params) {\n\t\t\tconst paramStr = new URLSearchParams(path.params).toString();\n\t\t\treturn `${this.getBaseUrl()}/${path.path}${paramStr ? `?${paramStr}` : ''}`;\n\t\t} else {\n\t\t\treturn `${this.getBaseUrl()}/${path.path}`;\n\t\t}\n\t}\n\n\tprivate async fetch(path: ValidPath, method: ValidMethod, jwt: string, options?: RequestOptions) {\n\t\tconst requestUrl = this.getRequestUrl(path);\n\n\t\tconst requestOptions: RequestInit = {\n\t\t\tmethod,\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${jwt}`,\n\t\t\t\t'Content-Type': 'application/json',\n\t\t\t},\n\t\t};\n\n\t\tif (method !== 'GET' && typeof path !== 'string' && path.body) {\n\t\t\trequestOptions.body = JSON.stringify(path.body);\n\t\t}\n\n\t\tconst response = await fetch(requestUrl, requestOptions);\n\n\t\tif (!response.ok) {\n\t\t\tconst allowed = options?.allowedStatus ?? [];\n\t\t\tif (!allowed.includes(response.status)) {\n\t\t\t\tthrow new Error(`Failed to fetch ${method} ${requestUrl}: ${response.statusText}`);\n\t\t\t}\n\t\t}\n\t\treturn response;\n\t}\n\n\tasync get(path: ValidPath, jwt: string, options?: RequestOptions) {\n\t\treturn this.fetch(path, 'GET', jwt, options);\n\t}\n\n\tasync post(path: ValidPath, jwt: string, options?: RequestOptions) {\n\t\treturn this.fetch(path, 'POST', jwt, options);\n\t}\n\n\tasync put(path: ValidPath, jwt: string, options?: RequestOptions) {\n\t\treturn this.fetch(path, 'PUT', jwt, options);\n\t}\n\n\tasync delete(path: ValidPath, jwt: string, options?: RequestOptions) {\n\t\treturn this.fetch(path, 'DELETE', jwt, options);\n\t}\n}\n","export function timingSafeEqual(a: string | Uint8Array, b: string | Uint8Array): boolean {\n\tconst bufferA = typeof a === 'string' ? new TextEncoder().encode(a) : a;\n\tconst bufferB = typeof b === 'string' ? new TextEncoder().encode(b) : b;\n\n\tif (bufferA.length !== bufferB.length) return false;\n\n\tlet result = 0;\n\tfor (let i = 0; i < bufferA.length; i++) {\n\t\tresult |= bufferA[i] ^ bufferB[i];\n\t}\n\treturn result === 0;\n}\n\nexport async function getEnvironmentCrypto() {\n\tif (!globalThis.crypto) {\n\t\tconst { webcrypto } = await import('node:crypto');\n\t\treturn webcrypto;\n\t}\n\treturn globalThis.crypto;\n}\n\nexport async function createHmac(algorithm: string, secret: string, data: string): Promise<string> {\n\tif (algorithm !== 'sha256') {\n\t\tthrow new Error('Only sha256 algorithm is supported');\n\t}\n\tif (!secret || secret.length === 0) {\n\t\tthrow new Error('Secret is required');\n\t}\n\n\tconst crypto = await getEnvironmentCrypto();\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t'raw',\n\t\tencoder.encode(secret),\n\t\t{ name: 'HMAC', hash: 'SHA-256' },\n\t\tfalse,\n\t\t['sign'],\n\t);\n\n\tconst signature = await crypto.subtle.sign('HMAC', key, encoder.encode(data));\n\treturn Array.from(new Uint8Array(signature))\n\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t.join('');\n}\n\n// Keep the legacy async function for backward compatibility\nexport async function createHmacAsync(secret: string, data: string): Promise<string> {\n\tconst crypto = await getEnvironmentCrypto();\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t'raw',\n\t\tencoder.encode(secret),\n\t\t{ name: 'HMAC', hash: 'SHA-256' },\n\t\tfalse,\n\t\t['sign'],\n\t);\n\n\tconst signature = await crypto.subtle.sign('HMAC', key, encoder.encode(data));\n\treturn Array.from(new Uint8Array(signature))\n\t\t.map((b) => b.toString(16).padStart(2, '0'))\n\t\t.join('');\n}\n","/**\n * Webhook validation utilities for Pierre Git Storage\n */\n\nimport type {\n\tParsedWebhookSignature,\n\tWebhookEventPayload,\n\tWebhookValidationOptions,\n\tWebhookValidationResult,\n} from './types';\n\nimport { createHmac, timingSafeEqual } from './util';\n\nconst DEFAULT_MAX_AGE_SECONDS = 300; // 5 minutes\n\n/**\n * Parse the X-Pierre-Signature header\n * Format: t=<timestamp>,sha256=<signature>\n */\nexport function parseSignatureHeader(header: string): ParsedWebhookSignature | null {\n\tif (!header || typeof header !== 'string') {\n\t\treturn null;\n\t}\n\n\tlet timestamp = '';\n\tlet signature = '';\n\n\t// Split by comma and parse each element\n\tconst elements = header.split(',');\n\tfor (const element of elements) {\n\t\tconst trimmedElement = element.trim();\n\t\tconst parts = trimmedElement.split('=', 2);\n\t\tif (parts.length !== 2) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst [key, value] = parts;\n\t\tswitch (key) {\n\t\t\tcase 't':\n\t\t\t\ttimestamp = value;\n\t\t\t\tbreak;\n\t\t\tcase 'sha256':\n\t\t\t\tsignature = value;\n\t\t\t\tbreak;\n\t\t}\n\t}\n\n\tif (!timestamp || !signature) {\n\t\treturn null;\n\t}\n\n\treturn { timestamp, signature };\n}\n\n/**\n * Validate a webhook signature and timestamp\n *\n * @param payload - The raw webhook payload (request body)\n * @param signatureHeader - The X-Pierre-Signature header value\n * @param secret - The webhook secret for HMAC verification\n * @param options - Validation options\n * @returns Validation result with details\n *\n * @example\n * ```typescript\n * const result = await validateWebhookSignature(\n *   requestBody,\n *   request.headers['x-pierre-signature'],\n *   webhookSecret\n * );\n *\n * if (!result.valid) {\n *   console.error('Invalid webhook:', result.error);\n *   return;\n * }\n * ```\n */\nexport async function validateWebhookSignature(\n\tpayload: string | Buffer,\n\tsignatureHeader: string,\n\tsecret: string,\n\toptions: WebhookValidationOptions = {},\n): Promise<WebhookValidationResult> {\n\tif (!secret || secret.length === 0) {\n\t\treturn {\n\t\t\tvalid: false,\n\t\t\terror: 'Empty secret is not allowed',\n\t\t};\n\t}\n\n\t// Parse the signature header\n\tconst parsed = parseSignatureHeader(signatureHeader);\n\tif (!parsed) {\n\t\treturn {\n\t\t\tvalid: false,\n\t\t\terror: 'Invalid signature header format',\n\t\t};\n\t}\n\n\t// Parse timestamp\n\tconst timestamp = Number.parseInt(parsed.timestamp, 10);\n\tif (isNaN(timestamp)) {\n\t\treturn {\n\t\t\tvalid: false,\n\t\t\terror: 'Invalid timestamp in signature',\n\t\t};\n\t}\n\n\t// Validate timestamp age (prevent replay attacks)\n\tconst maxAge = options.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS;\n\tif (maxAge > 0) {\n\t\tconst now = Math.floor(Date.now() / 1000);\n\t\tconst age = now - timestamp;\n\n\t\tif (age > maxAge) {\n\t\t\treturn {\n\t\t\t\tvalid: false,\n\t\t\t\terror: `Webhook timestamp too old (${age} seconds)`,\n\t\t\t\ttimestamp,\n\t\t\t};\n\t\t}\n\n\t\t// Also reject timestamps from the future (clock skew tolerance of 60 seconds)\n\t\tif (age < -60) {\n\t\t\treturn {\n\t\t\t\tvalid: false,\n\t\t\t\terror: 'Webhook timestamp is in the future',\n\t\t\t\ttimestamp,\n\t\t\t};\n\t\t}\n\t}\n\n\t// Convert payload to string if it's a Buffer\n\tconst payloadStr = typeof payload === 'string' ? payload : payload.toString('utf8');\n\n\t// Compute expected signature\n\t// Format: HMAC-SHA256(secret, timestamp + \".\" + payload)\n\tconst signedData = `${parsed.timestamp}.${payloadStr}`;\n\tconst expectedSignature = await createHmac('sha256', secret, signedData);\n\n\t// Compare signatures using constant-time comparison\n\tconst expectedBuffer = Buffer.from(expectedSignature);\n\tconst actualBuffer = Buffer.from(parsed.signature);\n\n\t// Ensure both buffers are the same length for timing-safe comparison\n\tif (expectedBuffer.length !== actualBuffer.length) {\n\t\treturn {\n\t\t\tvalid: false,\n\t\t\terror: 'Invalid signature',\n\t\t\ttimestamp,\n\t\t};\n\t}\n\n\tconst signaturesMatch = timingSafeEqual(expectedBuffer, actualBuffer);\n\tif (!signaturesMatch) {\n\t\treturn {\n\t\t\tvalid: false,\n\t\t\terror: 'Invalid signature',\n\t\t\ttimestamp,\n\t\t};\n\t}\n\n\treturn {\n\t\tvalid: true,\n\t\ttimestamp,\n\t};\n}\n\n/**\n * Validate a webhook request\n *\n * This is a convenience function that validates the signature and parses the payload.\n *\n * @param payload - The raw webhook payload (request body)\n * @param headers - The request headers (must include x-pierre-signature and x-pierre-event)\n * @param secret - The webhook secret for HMAC verification\n * @param options - Validation options\n * @returns The parsed webhook payload if valid, or validation error\n *\n * @example\n * ```typescript\n * const result = await validateWebhook(\n *   request.body,\n *   request.headers,\n *   process.env.WEBHOOK_SECRET\n * );\n *\n * if (!result.valid) {\n *   return new Response('Invalid webhook', { status: 401 });\n * }\n *\n * // Type-safe access to the webhook payload\n * console.log('Push event:', result.payload);\n * ```\n */\nexport async function validateWebhook(\n\tpayload: string | Buffer,\n\theaders: Record<string, string | string[] | undefined>,\n\tsecret: string,\n\toptions: WebhookValidationOptions = {},\n): Promise<WebhookValidationResult & { payload?: WebhookEventPayload }> {\n\t// Get signature header\n\tconst signatureHeader = headers['x-pierre-signature'] || headers['X-Pierre-Signature'];\n\tif (!signatureHeader || Array.isArray(signatureHeader)) {\n\t\treturn {\n\t\t\tvalid: false,\n\t\t\terror: 'Missing or invalid X-Pierre-Signature header',\n\t\t};\n\t}\n\n\t// Get event type header\n\tconst eventType = headers['x-pierre-event'] || headers['X-Pierre-Event'];\n\tif (!eventType || Array.isArray(eventType)) {\n\t\treturn {\n\t\t\tvalid: false,\n\t\t\terror: 'Missing or invalid X-Pierre-Event header',\n\t\t};\n\t}\n\n\t// Validate signature\n\tconst validationResult = await validateWebhookSignature(\n\t\tpayload,\n\t\tsignatureHeader,\n\t\tsecret,\n\t\toptions,\n\t);\n\n\tif (!validationResult.valid) {\n\t\treturn validationResult;\n\t}\n\n\t// Parse payload\n\tconst payloadStr = typeof payload === 'string' ? payload : payload.toString('utf8');\n\tlet parsedPayload: WebhookEventPayload;\n\ttry {\n\t\tparsedPayload = JSON.parse(payloadStr);\n\t} catch {\n\t\treturn {\n\t\t\tvalid: false,\n\t\t\terror: 'Invalid JSON payload',\n\t\t\ttimestamp: validationResult.timestamp,\n\t\t};\n\t}\n\n\treturn {\n\t\tvalid: true,\n\t\teventType,\n\t\ttimestamp: validationResult.timestamp,\n\t\tpayload: parsedPayload,\n\t};\n}\n","/**\n * Pierre Git Storage SDK\n *\n * A TypeScript SDK for interacting with Pierre's git storage system\n */\n\nimport { importPKCS8, SignJWT } from 'jose';\nimport snakecaseKeys from 'snakecase-keys';\nimport { ApiFetcher } from './fetch';\nimport type {\n\tCreateRepoOptions,\n\tFindOneOptions,\n\tGetBranchDiffOptions,\n\tGetBranchDiffResponse,\n\tGetCommitDiffOptions,\n\tGetCommitDiffResponse,\n\tGetCommitOptions,\n\tGetCommitResponse,\n\tGetFileOptions,\n\tGetFileResponse,\n\tGetRemoteURLOptions,\n\tGitStorageOptions,\n\tListBranchesOptions,\n\tListBranchesResponse,\n\tListCommitsOptions,\n\tListCommitsResponse,\n\tListFilesOptions,\n\tListFilesResponse,\n\tOverrideableGitStorageOptions,\n\tRepo,\n\tRepullOptions,\n\tValidAPIVersion,\n} from './types';\n\n/**\n * Type definitions for Pierre Git Storage SDK\n */\n\n// Import additional types from types.ts\nexport * from './types';\n\n// Export webhook validation utilities\nexport { parseSignatureHeader, validateWebhook, validateWebhookSignature } from './webhook';\n\n/**\n * Git Storage API\n */\n\ndeclare const __STORAGE_BASE_URL__: string;\ndeclare const __API_BASE_URL__: string;\n\nconst API_BASE_URL = __API_BASE_URL__;\nconst STORAGE_BASE_URL = __STORAGE_BASE_URL__;\nconst API_VERSION: ValidAPIVersion = 1;\n\nconst apiInstanceMap = new Map<string, ApiFetcher>();\n\nfunction getApiInstance(baseUrl: string, version: ValidAPIVersion) {\n\tif (!apiInstanceMap.has(`${baseUrl}--${version}`)) {\n\t\tapiInstanceMap.set(`${baseUrl}--${version}`, new ApiFetcher(baseUrl, version));\n\t}\n\treturn apiInstanceMap.get(`${baseUrl}--${version}`)!;\n}\n\n/**\n * Implementation of the Repo interface\n */\nclass RepoImpl implements Repo {\n\tprivate readonly api: ApiFetcher;\n\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tprivate readonly options: GitStorageOptions,\n\t\tprivate readonly generateJWT: (\n\t\t\trepoId: string,\n\t\t\toptions?: GetRemoteURLOptions,\n\t\t) => Promise<string>,\n\t) {\n\t\tthis.api = getApiInstance(\n\t\t\tthis.options.apiBaseUrl ?? API_BASE_URL,\n\t\t\tthis.options.apiVersion ?? API_VERSION,\n\t\t);\n\t}\n\n\tasync getRemoteURL(urlOptions?: GetRemoteURLOptions): Promise<string> {\n\t\tconst storageBaseUrl = this.options.storageBaseUrl ?? STORAGE_BASE_URL;\n\t\tconst url = new URL(`https://${this.options.name}.${storageBaseUrl}/${this.id}.git`);\n\t\turl.username = `t`;\n\t\turl.password = await this.generateJWT(this.id, urlOptions);\n\t\treturn url.toString();\n\t}\n\n\tasync getFile(options: GetFileOptions): Promise<GetFileResponse> {\n\t\tconst jwt = await this.generateJWT(this.id, {\n\t\t\tpermissions: ['git:read'],\n\t\t\tttl: options?.ttl ?? 1 * 60 * 60, // 1hr in seconds\n\t\t});\n\n\t\tconst params: Record<string, string> = {\n\t\t\tpath: options.path,\n\t\t};\n\n\t\tif (options.ref) {\n\t\t\tparams.ref = options.ref;\n\t\t}\n\n\t\tconst response = await this.api.get({ path: 'repos/file', params }, jwt);\n\n\t\treturn (await response.json()) as GetFileResponse;\n\t}\n\n\tasync listFiles(options?: ListFilesOptions): Promise<ListFilesResponse> {\n\t\tconst jwt = await this.generateJWT(this.id, {\n\t\t\tpermissions: ['git:read'],\n\t\t\tttl: options?.ttl ?? 1 * 60 * 60, // 1hr in seconds\n\t\t});\n\n\t\tconst params: Record<string, string> | undefined = options?.ref\n\t\t\t? { ref: options.ref }\n\t\t\t: undefined;\n\t\tconst response = await this.api.get({ path: 'repos/files', params }, jwt);\n\n\t\treturn (await response.json()) as ListFilesResponse;\n\t}\n\n\tasync listBranches(options?: ListBranchesOptions): Promise<ListBranchesResponse> {\n\t\tconst jwt = await this.generateJWT(this.id, {\n\t\t\tpermissions: ['git:read'],\n\t\t\tttl: options?.ttl ?? 1 * 60 * 60, // 1hr in seconds\n\t\t});\n\n\t\tlet params: Record<string, string> | undefined;\n\n\t\tif (options?.cursor || !options?.limit) {\n\t\t\tparams = {};\n\t\t\tif (options?.cursor) {\n\t\t\t\tparams.cursor = options.cursor;\n\t\t\t}\n\t\t\tif (typeof options?.limit == 'number') {\n\t\t\t\tparams.limit = options.limit.toString();\n\t\t\t}\n\t\t}\n\n\t\tconst response = await this.api.get({ path: 'repos/branches', params }, jwt);\n\n\t\treturn (await response.json()) as ListBranchesResponse;\n\t}\n\n\tasync listCommits(options?: ListCommitsOptions): Promise<ListCommitsResponse> {\n\t\tconst jwt = await this.generateJWT(this.id, {\n\t\t\tpermissions: ['git:read'],\n\t\t\tttl: options?.ttl ?? 1 * 60 * 60, // 1hr in seconds\n\t\t});\n\n\t\tlet params: Record<string, string> | undefined;\n\n\t\tif (options?.branch || options?.cursor || options?.limit) {\n\t\t\tparams = {};\n\t\t\tif (options?.branch) {\n\t\t\t\tparams.branch = options.branch;\n\t\t\t}\n\t\t\tif (options?.cursor) {\n\t\t\t\tparams.cursor = options.cursor;\n\t\t\t}\n\t\t\tif (typeof options?.limit == 'number') {\n\t\t\t\tparams.limit = options.limit.toString();\n\t\t\t}\n\t\t}\n\n\t\tconst response = await this.api.get({ path: 'repos/commits', params }, jwt);\n\n\t\treturn (await response.json()) as ListCommitsResponse;\n\t}\n\n\tasync getBranchDiff(options: GetBranchDiffOptions): Promise<GetBranchDiffResponse> {\n\t\tconst jwt = await this.generateJWT(this.id, {\n\t\t\tpermissions: ['git:read'],\n\t\t\tttl: options?.ttl ?? 1 * 60 * 60, // 1hr in seconds\n\t\t});\n\n\t\tconst params: Record<string, string> = {\n\t\t\tbranch: options.branch,\n\t\t};\n\n\t\tif (options.base) {\n\t\t\tparams.base = options.base;\n\t\t}\n\n\t\tconst response = await this.api.get({ path: 'repos/branches/diff', params }, jwt);\n\n\t\treturn (await response.json()) as GetBranchDiffResponse;\n\t}\n\n\tasync getCommitDiff(options: GetCommitDiffOptions): Promise<GetCommitDiffResponse> {\n\t\tconst jwt = await this.generateJWT(this.id, {\n\t\t\tpermissions: ['git:read'],\n\t\t\tttl: options?.ttl ?? 1 * 60 * 60, // 1hr in seconds\n\t\t});\n\n\t\tconst params: Record<string, string> = {\n\t\t\tsha: options.sha,\n\t\t};\n\n\t\tconst response = await this.api.get({ path: 'repos/diff', params }, jwt);\n\n\t\treturn (await response.json()) as GetCommitDiffResponse;\n\t}\n\n\tasync getCommit(options: GetCommitOptions): Promise<GetCommitResponse> {\n\t\tconst jwt = await this.generateJWT(this.id, {\n\t\t\tpermissions: ['git:read'],\n\t\t\tttl: options?.ttl ?? 1 * 60 * 60, // 1hr in seconds\n\t\t});\n\n\t\tconst params: Record<string, string> = {\n\t\t\trepo: this.id,\n\t\t\tsha: options.sha,\n\t\t};\n\t\tconst response = await this.api.get({ path: 'commit', params }, jwt);\n\n\t\treturn (await response.json()) as GetCommitResponse;\n\t}\n\n\tasync repull(options: RepullOptions): Promise<void> {\n\t\tconst jwt = await this.generateJWT(this.id, {\n\t\t\tpermissions: ['git:write'],\n\t\t\tttl: options?.ttl ?? 1 * 60 * 60, // 1hr in seconds\n\t\t});\n\n\t\tconst body: Record<string, string> = {};\n\n\t\tif (options.ref) {\n\t\t\tbody.ref = options.ref;\n\t\t}\n\n\t\tconst response = await this.api.post({ path: 'repos/repull', body }, jwt);\n\n\t\tif (response.status !== 202) {\n\t\t\tthrow new Error(`Repull failed: ${response.status} ${await response.text()}`);\n\t\t}\n\n\t\treturn;\n\t}\n}\n\nexport class GitStorage {\n\tprivate static overrides: OverrideableGitStorageOptions = {};\n\tprivate options: GitStorageOptions;\n\tprivate api: ApiFetcher;\n\n\tconstructor(options: GitStorageOptions) {\n\t\tif (\n\t\t\t!options ||\n\t\t\toptions.name === undefined ||\n\t\t\toptions.key === undefined ||\n\t\t\toptions.name === null ||\n\t\t\toptions.key === null\n\t\t) {\n\t\t\tthrow new Error(\n\t\t\t\t'GitStorage requires a name and key. Please check your configuration and try again.',\n\t\t\t);\n\t\t}\n\n\t\tif (typeof options.name !== 'string' || options.name.trim() === '') {\n\t\t\tthrow new Error('GitStorage name must be a non-empty string.');\n\t\t}\n\n\t\tif (typeof options.key !== 'string' || options.key.trim() === '') {\n\t\t\tthrow new Error('GitStorage key must be a non-empty string.');\n\t\t}\n\n\t\tconst resolvedApiBaseUrl =\n\t\t\toptions.apiBaseUrl ?? GitStorage.overrides.apiBaseUrl ?? API_BASE_URL;\n\t\tconst resolvedApiVersion = options.apiVersion ?? GitStorage.overrides.apiVersion ?? API_VERSION;\n\t\tconst resolvedStorageBaseUrl =\n\t\t\toptions.storageBaseUrl ?? GitStorage.overrides.storageBaseUrl ?? STORAGE_BASE_URL;\n\n\t\tthis.api = getApiInstance(resolvedApiBaseUrl, resolvedApiVersion);\n\n\t\tthis.options = {\n\t\t\tkey: options.key,\n\t\t\tname: options.name,\n\t\t\tapiBaseUrl: resolvedApiBaseUrl,\n\t\t\tapiVersion: resolvedApiVersion,\n\t\t\tstorageBaseUrl: resolvedStorageBaseUrl,\n\t\t};\n\t}\n\n\tstatic override(options: OverrideableGitStorageOptions): void {\n\t\tthis.overrides = Object.assign({}, this.overrides, options);\n\t}\n\n\t/**\n\t * Create a new repository\n\t * @returns The created repository\n\t */\n\tasync createRepo(options?: CreateRepoOptions): Promise<Repo> {\n\t\tconst repoId = options?.id || crypto.randomUUID();\n\n\t\tconst jwt = await this.generateJWT(repoId, {\n\t\t\tpermissions: ['repo:write'],\n\t\t\tttl: options?.ttl ?? 1 * 60 * 60, // 1hr in seconds\n\t\t});\n\n\t\tconst baseRepoOptions = options?.baseRepo\n\t\t\t? {\n\t\t\t\t\tprovider: 'github',\n\t\t\t\t\t...snakecaseKeys(options.baseRepo as unknown as Record<string, unknown>),\n\t\t\t\t}\n\t\t\t: null;\n\n\t\tconst createRepoPath = baseRepoOptions\n\t\t\t? {\n\t\t\t\t\tpath: 'repos',\n\t\t\t\t\tbody: {\n\t\t\t\t\t\tbase_repo: baseRepoOptions,\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: 'repos';\n\n\t\t// Allow 409 so we can map it to a clearer error message\n\t\tconst resp = await this.api.post(createRepoPath, jwt, { allowedStatus: [409] });\n\t\tif (resp.status === 409) {\n\t\t\tthrow new Error('Repository already exists');\n\t\t}\n\n\t\treturn new RepoImpl(repoId, this.options, this.generateJWT.bind(this));\n\t}\n\n\t/**\n\t * Find a repository by ID\n\t * @param options The search options\n\t * @returns The found repository\n\t */\n\tasync findOne(options: FindOneOptions): Promise<Repo | null> {\n\t\tconst jwt = await this.generateJWT(options.id, {\n\t\t\tpermissions: ['git:read'],\n\t\t\tttl: 1 * 60 * 60,\n\t\t});\n\n\t\t// Allow 404 to indicate \"not found\" without throwing\n\t\tconst resp = await this.api.get('repo', jwt, { allowedStatus: [404] });\n\t\tif (resp.status === 404) {\n\t\t\treturn null;\n\t\t}\n\t\t// On 200, we could validate response, but RepoImpl only needs the repo URL/id\n\t\t// const body = await resp.json(); // not required for now\n\t\treturn new RepoImpl(options.id, this.options, this.generateJWT.bind(this));\n\t}\n\n\t/**\n\t * Get the current configuration\n\t * @returns The client configuration\n\t */\n\tgetConfig(): GitStorageOptions {\n\t\treturn { ...this.options };\n\t}\n\n\t/**\n\t * Generate a JWT token for git storage URL authentication\n\t * @private\n\t */\n\tprivate async generateJWT(repoId: string, options?: GetRemoteURLOptions): Promise<string> {\n\t\t// Default permissions and TTL\n\t\tconst permissions = options?.permissions || ['git:write', 'git:read'];\n\t\tconst ttl = options?.ttl || 365 * 24 * 60 * 60; // 1 year in seconds\n\n\t\t// Create the JWT payload\n\t\tconst now = Math.floor(Date.now() / 1000);\n\t\tconst payload = {\n\t\t\tiss: this.options.name,\n\t\t\tsub: '@pierre/storage',\n\t\t\trepo: repoId,\n\t\t\tscopes: permissions,\n\t\t\tiat: now,\n\t\t\texp: now + ttl,\n\t\t};\n\n\t\t// Sign the JWT with the key as the secret\n\t\t// Using HS256 for symmetric signing with the key\n\t\tconst key = await importPKCS8(this.options.key, 'ES256');\n\t\t// Sign the JWT with the key as the secret\n\t\tconst jwt = await new SignJWT(payload)\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT' })\n\t\t\t.sign(key);\n\n\t\treturn jwt;\n\t}\n}\n\n// Export a default client factory\nexport function createClient(options: GitStorageOptions): GitStorage {\n\treturn new GitStorage(options);\n}\n\n// Type alias for backward compatibility\nexport type StorageOptions = GitStorageOptions;\n"]}

package/package.json

@@ -1,38 +1,38 @@
 {
-	"name": "@pierre/storage",
-	"version": "0.0.3",
-	"description": "Pierre Git Storage SDK",
-	"license": "MIT",
-	"type": "module",
-	"main": "./dist/index.cjs",
-	"module": "./dist/index.js",
-	"types": "./dist/index.d.ts",
-	"exports": {
-		".": {
-			"types": "./dist/index.d.ts",
-			"import": "./dist/index.js",
-			"require": "./dist/index.cjs",
-			"default": "./dist/index.js"
-		}
-	},
-	"files": [
-		"dist",
-		"src"
-	],
-	"scripts": {
-		"build": "tsup",
-		"dev": "tsup --watch",
-		"prepublishOnly": "BUILD_ENV=production pnpm build"
-	},
-	"dependencies": {
-		"jose": "^5.10.0"
-	},
-	"devDependencies": {
-		"tsup": "8.5.0",
-		"typescript": "5.8.3",
-		"vitest": "3.2.4"
-	},
-	"publishConfig": {
-		"access": "public"
-	}
-}
+  "name": "@pierre/storage",
+  "version": "0.0.6",
+  "description": "Pierre Git Storage SDK",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "dependencies": {
+    "jose": "^5.10.0",
+    "snakecase-keys": "^9.0.2"
+  },
+  "devDependencies": {
+    "tsup": "8.5.0",
+    "typescript": "5.8.3",
+    "vitest": "3.2.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch"
+  }
+}