@shipfox/api-integration-gitea 2.0.0

package/.turbo/turbo-build.log

@@ -0,0 +1,2 @@
+$ shipfox-swc
+Successfully compiled: 17 files with swc (153.24ms)

package/.turbo/turbo-type$colon$emit.log

@@ -0,0 +1 @@
+$ shipfox-tsc-emit

package/.turbo/turbo-type.log

@@ -0,0 +1 @@
+$ shipfox-tsc-check

package/CHANGELOG.md

@@ -0,0 +1,96 @@
+# @shipfox/api-integration-gitea
+
+## 2.0.0
+
+### Minor Changes
+
+- 1b0d344: Publishes the complete API runtime closure with packed-consumer-safe internal imports and records its exact package set in application releases.
+
+### Patch Changes
+
+- Updated dependencies [1b0d344]
+- Updated dependencies [521e006]
+  - @shipfox/api-auth-context@2.0.0
+  - @shipfox/api-integration-core-dto@2.0.0
+  - @shipfox/api-integration-gitea-dto@2.0.0
+  - @shipfox/config@1.2.1
+  - @shipfox/node-drizzle@0.2.1
+  - @shipfox/node-fastify@0.2.1
+  - @shipfox/node-opentelemetry@0.5.0
+  - @shipfox/node-postgres@0.4.1
+
+## 0.0.2
+
+### Patch Changes
+
+- Updated dependencies [ec75cd5]
+- Updated dependencies [6a1fb54]
+  - @shipfox/node-drizzle@0.2.0
+  - @shipfox/node-postgres@0.4.0
+
+## 0.0.1
+
+### Patch Changes
+
+- 58f51bd: Scaffold an empty `gitea` integration provider that mirrors the `github` package structure, ahead of any behavior.
+  - New `@shipfox/api-integration-gitea` + `@shipfox/api-integration-gitea-dto` packages: `createGiteaIntegrationProvider()` returns an empty provider (`{provider: 'gitea', displayName: 'Gitea', adapters: {}, routes: []}`), plus a `src/config.ts` documenting the self-hoster variables (`GITEA_BASE_URL`, `GITEA_SERVICE_USERNAME`, `GITEA_SERVICE_TOKEN`, `GITEA_WEBHOOK_SECRET`, `GITEA_WEBHOOK_TARGET_URL`, `GITEA_CHECKOUT_TTL_SECONDS`) and an empty provider database wired with the stable migrations table `__drizzle_migrations_integrations_gitea`.
+  - `@shipfox/api-integration-core`: register the Gitea provider behind `INTEGRATIONS_ENABLE_GITEA_PROVIDER` (default false). With the flag enabled, `gitea` appears in `GET /integration-providers`. Dormant scaffold; no runtime behavior yet.
+
+- 75f2cc8: Implement the Gitea API client and source-control adapter so the `gitea` provider can read repositories and mint checkout credentials.
+  - `GiteaApiClient`: calls `GITEA_BASE_URL` with service-account Basic auth to list org repositories, get a repository, resolve a ref to a commit sha, list a recursive tree, and read base64 file content, under a bounded request timeout. Gitea failures map to a `GiteaIntegrationProviderError` carrying a `reason` (`access-denied`, `repository-not-found`, `file-not-found`, `rate-limited` with `retryAfterSeconds`, `content-too-large`, `malformed-provider-response`, `timeout`, `provider-unavailable`).
+  - `GiteaSourceControlProvider`: implements all five `SourceControlProvider` methods over the `gitea:<owner>/<repo>` external id scheme, scoping every request to the connection's own account because the service token is instance-wide. `listFiles` filters the tree by prefix and rejects a truncated tree as `too-many-files`; `fetchFile` enforces `MAX_REPOSITORY_FILE_BYTES`; `createCheckoutSpec` returns the repository's credential-free clone URL with service credentials carried separately.
+  - `createGiteaIntegrationProvider()` now exposes the adapter at `adapters.source_control`.
+
+- 570ac69: Add the Gitea connection flow so a workspace member can link a Gitea org with a single authenticated request (no OAuth, no redirect).
+  - `@shipfox/api-integration-gitea-dto`: `createGiteaConnectionBodySchema` (`{workspace_id, org}`); the response reuses the shared `integrationConnectionDtoSchema`.
+  - `@shipfox/api-integration-gitea`: `POST /integrations/gitea/connections` (`AUTH_USER`, workspace membership) canonicalizes the org to lower case (Gitea routes org names case-insensitively, so this keeps the case-sensitive ownership lookup and unique indexes from being bypassed by a case variant), validates the org via the API, rejects an org already linked to another workspace (409), registers an org-level push webhook (`POST /orgs/{org}/hooks` with `GITEA_WEBHOOK_SECRET`/`GITEA_WEBHOOK_TARGET_URL`), and in one transaction upserts the core connection (`provider: 'gitea'`, `externalAccountId: org`) and a new `integrations_gitea_connections` row (`connection_id`/`org` unique, stored `webhook_id`). Re-connecting an already-active org is idempotent and skips a second webhook. Webhook registration itself is idempotent (an existing org hook for the target URL is reused) and compensated (a hook created before a transaction that then rolls back is deleted), so concurrent or retried connects do not leave orphaned hooks. The `GiteaApiClient` gains `organizationExists`, `createOrgPushWebhook`, and `deleteOrgWebhook`, and the provider exposes `connectionExternalUrl` pointing at the org on the Gitea instance.
+  - `@shipfox/api-integration-core`: wire the Gitea connect closure (`connectGiteaConnection`) and the cross-tenant lookup (`getExistingGiteaConnection`) into the provider, mirroring `connectGithubInstallation`.
+
+  Connecting an org creates an active connection visible in `GET /integration-connections` and registers a Gitea webhook whose id is stored.
+
+- 857fd73: Receive Gitea push webhooks and trigger runs through the existing source-push pipeline.
+  - `@shipfox/api-integration-gitea-dto`: `giteaPushPayloadSchema` (`{ref, after, repository: {name, full_name, default_branch, owner: {username}}}`).
+  - `@shipfox/api-integration-gitea`: `POST /webhooks/integrations/gitea` (`auth: []`, `rawBodyPlugin`, standard webhook body limit). It verifies the `X-Gitea-Signature` header as hex HMAC-SHA256 of the raw body keyed by `GITEA_WEBHOOK_SECRET` (401 on mismatch), records non-`push` events for delivery dedup and returns 204, and on a `push` resolves the org (`repository.owner.username`, lower-cased to match the stored org) to its connection, drops branch deletions and unknown orgs, and publishes a normalized `SourcePushPayload` (`externalRepositoryId: gitea:<owner>/<repo>` built from `owner.username`/`repository.name` to match the source-control adapter, `refs/heads/` stripped, `headCommitSha: after`, `isDefaultBranch`). `getGiteaConnectionByOrg` gains an optional transaction executor so the lookup runs inside the publishing transaction. The webhook is registered out of band by the Gitea instance admin, so the connect flow registers nothing.
+  - `@shipfox/api-integration-core`: wire `publishSourcePush`, `recordDeliveryOnly`, `getIntegrationConnectionById`, and the core database into the Gitea provider, mirroring GitHub.
+  - `@shipfox/node-fastify`: add a shared `verifyHexHmacSignature` helper for hex HMAC-SHA256 webhook signatures.
+  - `@shipfox/api-integration-sentry`: `verifySentrySignature` now delegates to the shared helper.
+
+  A push to a connected org's repo creates a workflow run through the existing pipeline. Duplicate POSTs of the same delivery are deduped via `X-Gitea-Delivery`; note that a manual "Redeliver" in Gitea mints a new delivery id and intentionally produces a fresh run (unlike GitHub, whose redelivery reuses the original id and is suppressed).
+
+- 0667cce: Skip publishing source pushes for non-active integration connections. Both the GitHub and Gitea push webhook handlers now treat a connection whose `lifecycleStatus` is not `active` (disabled/error) like an unknown one: the delivery is recorded for dedup but no source-push event is published, so a disabled connection no longer triggers workflow runs.
+- 82d22e4: Make the workspace-membership gate stateless. `requireWorkspaceAccess` now lives in `@shipfox/api-auth-context` and authorizes a request purely from the verified session-token claims, replacing the `requireMembership` gate in `@shipfox/api-workspaces` that read the workspace row from the database on every workspace-scoped request. Membership and role already travel in the token, so the check needs no database access.
+
+  This removes the per-request database read and severs the runtime dependency on `@shipfox/api-workspaces` from feature modules that only needed the membership gate (integration providers, secrets, projects, agent, runners). Workspace existence and `active`-status enforcement, which no code path currently exercises, moves off the hot path; enforce it at token issuance when workspace suspension is introduced.
+
+- Updated dependencies [34ba284]
+- Updated dependencies [5707d6d]
+- Updated dependencies [b9c3f32]
+- Updated dependencies [a81b68c]
+- Updated dependencies [115655e]
+- Updated dependencies [c0a883c]
+- Updated dependencies [72ce351]
+- Updated dependencies [e47f8da]
+- Updated dependencies [ce062a9]
+- Updated dependencies [7b175f5]
+- Updated dependencies [f3614ae]
+- Updated dependencies [f92122b]
+- Updated dependencies [f8f339a]
+- Updated dependencies [58f51bd]
+- Updated dependencies [570ac69]
+- Updated dependencies [857fd73]
+- Updated dependencies [b8e49ff]
+- Updated dependencies [d6d4862]
+- Updated dependencies [c0a883c]
+- Updated dependencies [6077301]
+- Updated dependencies [82d22e4]
+- Updated dependencies [01be723]
+- Updated dependencies [2933c33]
+- Updated dependencies [6181819]
+  - @shipfox/node-fastify@0.2.0
+  - @shipfox/node-drizzle@0.1.0
+  - @shipfox/api-auth-context@0.1.0
+  - @shipfox/api-integration-core-dto@0.1.0
+  - @shipfox/node-opentelemetry@0.4.2
+  - @shipfox/node-postgres@0.3.2
+  - @shipfox/api-integration-gitea-dto@0.0.1
+  - @shipfox/config@1.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shipfox
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,61 @@
+# Shipfox API Integration Gitea
+
+Shipfox API Integration Gitea connects a Gitea organization to a Shipfox
+workspace, receives organization push webhooks, and lets workflow runners check
+out repositories through Gitea's git HTTP endpoint.
+
+## Setup
+
+Configure the provider in the API environment:
+
+```sh
+GITEA_BASE_URL=https://gitea.example.com
+GITEA_SERVICE_USERNAME=shipfox-bot
+GITEA_SERVICE_TOKEN=
+GITEA_WEBHOOK_SECRET=
+GITEA_CHECKOUT_TTL_SECONDS=300
+```
+
+`GITEA_BASE_URL` is the URL the API uses for Gitea REST calls and webhook
+setup.
+
+`GITEA_SERVICE_USERNAME` and `GITEA_SERVICE_TOKEN` are handed to runners as
+checkout credentials. The checkout spec keeps these credentials separate from
+the repository URL.
+
+`GITEA_WEBHOOK_SECRET` must match the secret configured on the Gitea
+organization webhook.
+
+## Clone URL Override
+
+By default, checkout uses the clone URL reported by Gitea for each repository.
+Set `GITEA_CLONE_BASE_URL` when runners reach Gitea through a different scheme,
+host, or port than the API does:
+
+```sh
+GITEA_BASE_URL=http://localhost:3000
+GITEA_CLONE_BASE_URL=http://gitea:3000
+```
+
+When set, the provider rewrites only the clone URL origin and keeps the
+repository path reported by Gitea. Repository listing, `htmlUrl`, REST API calls,
+and webhooks continue to use `GITEA_BASE_URL`.
+
+## Development
+
+Run checks for this package:
+
+```sh
+turbo check --filter=@shipfox/api-integration-gitea
+turbo type --filter=@shipfox/api-integration-gitea
+turbo test --filter=@shipfox/api-integration-gitea
+```
+
+Tests use Vitest and a real PostgreSQL database. Start local services before
+running the test suite:
+
+```sh
+docker compose up -d
+```
+
+The test environment uses the `api_test` database, set in `test/env.ts`.

package/dist/api/client.d.ts

@@ -0,0 +1,58 @@
+export interface GiteaRepository {
+    ownerLogin: string;
+    name: string;
+    fullName: string;
+    defaultBranch: string;
+    private: boolean;
+    cloneUrl: string;
+    htmlUrl: string;
+}
+export interface GiteaRepositoryPage {
+    repositories: GiteaRepository[];
+    nextCursor: string | null;
+}
+export interface GiteaTreeBlob {
+    path: string;
+    size: number | null;
+}
+export interface GiteaTree {
+    blobs: GiteaTreeBlob[];
+    truncated: boolean;
+}
+export interface GiteaFileContent {
+    path: string;
+    content: string;
+    size: number;
+}
+export interface GiteaApiClient {
+    listOrgRepositories(input: {
+        org: string;
+        limit: number;
+        cursor?: string | undefined;
+    }): Promise<GiteaRepositoryPage>;
+    getRepository(input: {
+        owner: string;
+        repo: string;
+    }): Promise<GiteaRepository>;
+    resolveRef(input: {
+        owner: string;
+        repo: string;
+        ref: string;
+    }): Promise<string>;
+    listTree(input: {
+        owner: string;
+        repo: string;
+        sha: string;
+    }): Promise<GiteaTree>;
+    fetchFileContent(input: {
+        owner: string;
+        repo: string;
+        path: string;
+        ref: string;
+    }): Promise<GiteaFileContent>;
+    organizationExists(input: {
+        org: string;
+    }): Promise<boolean>;
+}
+export declare function createGiteaApiClient(): GiteaApiClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/api/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,mBAAmB,CAAC,KAAK,EAAE;QACzB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjC,aAAa,CAAC,KAAK,EAAE;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/E,QAAQ,CAAC,KAAK,EAAE;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChF,gBAAgB,CAAC,KAAK,EAAE;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9B,kBAAkB,CAAC,KAAK,EAAE;QAAC,GAAG,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5D;AAED,wBAAgB,oBAAoB,IAAI,cAAc,CAErD"}

package/dist/api/client.js

@@ -0,0 +1,225 @@
+import { Buffer } from 'node:buffer';
+import { MAX_REPOSITORY_FILE_BYTES } from '@shipfox/api-integration-core-dto';
+import { config } from '#config.js';
+import { GiteaIntegrationProviderError } from '#core/errors.js';
+const TRAILING_SLASHES_RE = /\/+$/;
+const NEXT_PAGE_RE = /[?&]page=(\d+)/;
+// Recursive tree listing is a single call; a tree larger than this is reported as
+// truncated by Gitea and surfaced to the adapter as `too-many-files`.
+const TREE_PAGE_SIZE = 1000;
+export function createGiteaApiClient() {
+    return new HttpGiteaApiClient();
+}
+let HttpGiteaApiClient = class HttpGiteaApiClient {
+    async listOrgRepositories(input) {
+        const response = await this.request(`orgs/${encodeURIComponent(input.org)}/repos`, {
+            page: String(cursorToPage(input.cursor)),
+            limit: String(input.limit)
+        });
+        const data = await response.json();
+        if (!Array.isArray(data)) {
+            throw new GiteaIntegrationProviderError('malformed-provider-response', 'Gitea repository list response was not an array');
+        }
+        return {
+            repositories: data.map(toGiteaRepository),
+            nextCursor: nextCursorFromLink(response.headers.get('link'))
+        };
+    }
+    async getRepository(input) {
+        const response = await this.request(`repos/${encodeURIComponent(input.owner)}/${encodeURIComponent(input.repo)}`);
+        return toGiteaRepository(await response.json());
+    }
+    async resolveRef(input) {
+        const response = await this.request(`repos/${encodeURIComponent(input.owner)}/${encodeURIComponent(input.repo)}/commits`, {
+            sha: input.ref,
+            limit: '1',
+            stat: 'false',
+            verification: 'false',
+            files: 'false'
+        });
+        const data = await response.json();
+        const head = Array.isArray(data) ? data[0] : undefined;
+        if (!isRecord(head) || typeof head.sha !== 'string') {
+            throw new GiteaIntegrationProviderError('repository-not-found', `Gitea ref ${input.ref} did not resolve to a commit`);
+        }
+        return head.sha;
+    }
+    async listTree(input) {
+        const response = await this.request(`repos/${encodeURIComponent(input.owner)}/${encodeURIComponent(input.repo)}/git/trees/${encodeURIComponent(input.sha)}`, {
+            recursive: 'true',
+            per_page: String(TREE_PAGE_SIZE)
+        });
+        const data = await response.json();
+        if (!isRecord(data)) {
+            throw new GiteaIntegrationProviderError('malformed-provider-response', 'Gitea tree response was not an object');
+        }
+        const entries = Array.isArray(data.tree) ? data.tree : [];
+        const blobs = [];
+        for (const entry of entries){
+            if (isRecord(entry) && entry.type === 'blob' && typeof entry.path === 'string') {
+                blobs.push({
+                    path: entry.path,
+                    size: typeof entry.size === 'number' ? entry.size : null
+                });
+            }
+        }
+        return {
+            blobs,
+            truncated: data.truncated === true
+        };
+    }
+    async fetchFileContent(input) {
+        const response = await this.request(`repos/${encodeURIComponent(input.owner)}/${encodeURIComponent(input.repo)}/contents/${encodePath(input.path)}`, {
+            ref: input.ref
+        }, {
+            notFoundReason: 'file-not-found'
+        });
+        const data = await response.json();
+        // Gitea returns an array for a directory path and an object for a single file;
+        // a non-file response means the requested path is not a readable file.
+        if (!isRecord(data) || Array.isArray(data) || data.type !== 'file') {
+            throw new GiteaIntegrationProviderError('file-not-found', `Gitea path ${input.path} is not a file`);
+        }
+        // A well-formed Gitea file response always carries a numeric size; coercing a
+        // missing size to 0 would skip the limit guard below and decode unbounded content.
+        if (typeof data.size !== 'number') {
+            throw new GiteaIntegrationProviderError('malformed-provider-response', 'Gitea file response did not include a numeric size');
+        }
+        const size = data.size;
+        if (size > MAX_REPOSITORY_FILE_BYTES) {
+            throw new GiteaIntegrationProviderError('content-too-large', 'Gitea file content is larger than the supported limit');
+        }
+        if (typeof data.content !== 'string' || data.encoding !== 'base64') {
+            throw new GiteaIntegrationProviderError('malformed-provider-response', 'Gitea file response did not include base64 content');
+        }
+        return {
+            path: typeof data.path === 'string' ? data.path : input.path,
+            size,
+            content: Buffer.from(data.content, 'base64').toString('utf8')
+        };
+    }
+    async organizationExists(input) {
+        const response = await this.requestRaw(`orgs/${encodeURIComponent(input.org)}`);
+        if (response.ok) return true;
+        if (response.status === 404) return false;
+        throw giteaHttpError(response);
+    }
+    async request(path, searchParams = {}, options = {}) {
+        const response = await this.requestRaw(path, {
+            searchParams
+        });
+        if (!response.ok) throw giteaHttpError(response, options.notFoundReason ?? 'repository-not-found');
+        return response;
+    }
+    async requestRaw(path, options = {}) {
+        const url = new URL(`${this.baseApiUrl()}/${path}`);
+        for (const [key, value] of Object.entries(options.searchParams ?? {})){
+            url.searchParams.set(key, value);
+        }
+        const headers = {
+            authorization: this.authHeader(),
+            accept: 'application/json'
+        };
+        const init = {
+            method: options.method ?? 'GET',
+            headers,
+            signal: AbortSignal.timeout(config.GITEA_REQUEST_TIMEOUT_MS)
+        };
+        if (options.body !== undefined) {
+            headers['content-type'] = 'application/json';
+            init.body = JSON.stringify(options.body);
+        }
+        try {
+            return await fetch(url, init);
+        } catch (error) {
+            // A bare `fetch` has no request timeout, so an unresponsive Gitea would
+            // otherwise hold the worker open indefinitely; the AbortSignal.timeout
+            // above surfaces as a fast `timeout` (503) instead of stalling.
+            if (error instanceof Error && (error.name === 'TimeoutError' || error.name === 'AbortError')) {
+                throw new GiteaIntegrationProviderError('timeout', 'Gitea request timed out');
+            }
+            throw new GiteaIntegrationProviderError('provider-unavailable', `Gitea request failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    baseApiUrl() {
+        if (!this.cachedBaseApiUrl) {
+            this.cachedBaseApiUrl = `${config.GITEA_BASE_URL.replace(TRAILING_SLASHES_RE, '')}/api/v1`;
+        }
+        return this.cachedBaseApiUrl;
+    }
+    authHeader() {
+        if (!this.cachedAuthHeader) {
+            const credentials = `${config.GITEA_SERVICE_USERNAME}:${config.GITEA_SERVICE_TOKEN}`;
+            this.cachedAuthHeader = `Basic ${Buffer.from(credentials).toString('base64')}`;
+        }
+        return this.cachedAuthHeader;
+    }
+};
+function giteaHttpError(response, notFoundReason = 'repository-not-found') {
+    const status = response.status;
+    if (status === 404) {
+        return new GiteaIntegrationProviderError(notFoundReason, `Gitea responded ${status}`);
+    }
+    if (isRateLimited(response)) {
+        return new GiteaIntegrationProviderError('rate-limited', `Gitea responded ${status}`, retryAfterSeconds(response));
+    }
+    if (status === 401 || status === 403) {
+        return new GiteaIntegrationProviderError('access-denied', `Gitea responded ${status}`);
+    }
+    // Server errors and any other unexpected status mean the provider could not
+    // serve the request; surface it as unavailable rather than leaking a raw error.
+    return new GiteaIntegrationProviderError('provider-unavailable', `Gitea responded ${status}`);
+}
+function isRateLimited(response) {
+    if (response.status === 429) return true;
+    return response.status === 403 && response.headers.get('x-ratelimit-remaining') === '0';
+}
+function retryAfterSeconds(response) {
+    const retryAfter = response.headers.get('retry-after');
+    if (!retryAfter) return undefined;
+    const parsed = Number.parseInt(retryAfter, 10);
+    return Number.isNaN(parsed) ? undefined : parsed;
+}
+function cursorToPage(cursor) {
+    if (!cursor) return 1;
+    const page = Number.parseInt(cursor, 10);
+    return Number.isNaN(page) || page < 1 ? 1 : page;
+}
+function nextCursorFromLink(link) {
+    if (!link) return null;
+    const next = link.split(',').find((part)=>part.includes('rel="next"'));
+    if (!next) return null;
+    const match = next.match(NEXT_PAGE_RE);
+    return match?.[1] ?? null;
+}
+function encodePath(path) {
+    const segments = path.split('/');
+    // `..`/`.`/empty segments survive encodeURIComponent and would let `new URL`
+    // normalize the request path out of `/contents/` and hit other authenticated
+    // Gitea endpoints, so reject them before building the URL.
+    for (const segment of segments){
+        if (segment === '' || segment === '.' || segment === '..') {
+            throw new GiteaIntegrationProviderError('file-not-found', `Gitea path contains an invalid segment: ${path}`);
+        }
+    }
+    return segments.map(encodeURIComponent).join('/');
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function toGiteaRepository(raw) {
+    if (!isRecord(raw) || !isRecord(raw.owner) || typeof raw.owner.login !== 'string' || typeof raw.name !== 'string' || typeof raw.full_name !== 'string' || typeof raw.default_branch !== 'string' || typeof raw.clone_url !== 'string' || typeof raw.html_url !== 'string') {
+        throw new GiteaIntegrationProviderError('malformed-provider-response', 'Gitea repository response is missing required fields');
+    }
+    return {
+        ownerLogin: raw.owner.login,
+        name: raw.name,
+        fullName: raw.full_name,
+        defaultBranch: raw.default_branch,
+        private: raw.private === true,
+        cloneUrl: raw.clone_url,
+        htmlUrl: raw.html_url
+    };
+}
+
+//# sourceMappingURL=client.js.map

package/dist/api/client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/client.ts"],"sourcesContent":["import {Buffer} from 'node:buffer';\nimport {MAX_REPOSITORY_FILE_BYTES} from '@shipfox/api-integration-core-dto';\nimport {config} from '#config.js';\nimport {GiteaIntegrationProviderError} from '#core/errors.js';\n\nconst TRAILING_SLASHES_RE = /\\/+$/;\nconst NEXT_PAGE_RE = /[?&]page=(\\d+)/;\n\n// Recursive tree listing is a single call; a tree larger than this is reported as\n// truncated by Gitea and surfaced to the adapter as `too-many-files`.\nconst TREE_PAGE_SIZE = 1000;\n\nexport interface GiteaRepository {\n  ownerLogin: string;\n  name: string;\n  fullName: string;\n  defaultBranch: string;\n  private: boolean;\n  cloneUrl: string;\n  htmlUrl: string;\n}\n\nexport interface GiteaRepositoryPage {\n  repositories: GiteaRepository[];\n  nextCursor: string | null;\n}\n\nexport interface GiteaTreeBlob {\n  path: string;\n  size: number | null;\n}\n\nexport interface GiteaTree {\n  blobs: GiteaTreeBlob[];\n  truncated: boolean;\n}\n\nexport interface GiteaFileContent {\n  path: string;\n  content: string;\n  size: number;\n}\n\nexport interface GiteaApiClient {\n  listOrgRepositories(input: {\n    org: string;\n    limit: number;\n    cursor?: string | undefined;\n  }): Promise<GiteaRepositoryPage>;\n  getRepository(input: {owner: string; repo: string}): Promise<GiteaRepository>;\n  resolveRef(input: {owner: string; repo: string; ref: string}): Promise<string>;\n  listTree(input: {owner: string; repo: string; sha: string}): Promise<GiteaTree>;\n  fetchFileContent(input: {\n    owner: string;\n    repo: string;\n    path: string;\n    ref: string;\n  }): Promise<GiteaFileContent>;\n  organizationExists(input: {org: string}): Promise<boolean>;\n}\n\nexport function createGiteaApiClient(): GiteaApiClient {\n  return new HttpGiteaApiClient();\n}\n\nclass HttpGiteaApiClient implements GiteaApiClient {\n  private cachedBaseApiUrl: string | undefined;\n  private cachedAuthHeader: string | undefined;\n\n  async listOrgRepositories(input: {\n    org: string;\n    limit: number;\n    cursor?: string | undefined;\n  }): Promise<GiteaRepositoryPage> {\n    const response = await this.request(`orgs/${encodeURIComponent(input.org)}/repos`, {\n      page: String(cursorToPage(input.cursor)),\n      limit: String(input.limit),\n    });\n    const data = await response.json();\n    if (!Array.isArray(data)) {\n      throw new GiteaIntegrationProviderError(\n        'malformed-provider-response',\n        'Gitea repository list response was not an array',\n      );\n    }\n\n    return {\n      repositories: data.map(toGiteaRepository),\n      nextCursor: nextCursorFromLink(response.headers.get('link')),\n    };\n  }\n\n  async getRepository(input: {owner: string; repo: string}): Promise<GiteaRepository> {\n    const response = await this.request(\n      `repos/${encodeURIComponent(input.owner)}/${encodeURIComponent(input.repo)}`,\n    );\n    return toGiteaRepository(await response.json());\n  }\n\n  async resolveRef(input: {owner: string; repo: string; ref: string}): Promise<string> {\n    const response = await this.request(\n      `repos/${encodeURIComponent(input.owner)}/${encodeURIComponent(input.repo)}/commits`,\n      {sha: input.ref, limit: '1', stat: 'false', verification: 'false', files: 'false'},\n    );\n    const data = await response.json();\n    const head = Array.isArray(data) ? data[0] : undefined;\n    if (!isRecord(head) || typeof head.sha !== 'string') {\n      throw new GiteaIntegrationProviderError(\n        'repository-not-found',\n        `Gitea ref ${input.ref} did not resolve to a commit`,\n      );\n    }\n    return head.sha;\n  }\n\n  async listTree(input: {owner: string; repo: string; sha: string}): Promise<GiteaTree> {\n    const response = await this.request(\n      `repos/${encodeURIComponent(input.owner)}/${encodeURIComponent(input.repo)}/git/trees/${encodeURIComponent(input.sha)}`,\n      {recursive: 'true', per_page: String(TREE_PAGE_SIZE)},\n    );\n    const data = await response.json();\n    if (!isRecord(data)) {\n      throw new GiteaIntegrationProviderError(\n        'malformed-provider-response',\n        'Gitea tree response was not an object',\n      );\n    }\n\n    const entries = Array.isArray(data.tree) ? data.tree : [];\n    const blobs: GiteaTreeBlob[] = [];\n    for (const entry of entries) {\n      if (isRecord(entry) && entry.type === 'blob' && typeof entry.path === 'string') {\n        blobs.push({path: entry.path, size: typeof entry.size === 'number' ? entry.size : null});\n      }\n    }\n\n    return {blobs, truncated: data.truncated === true};\n  }\n\n  async fetchFileContent(input: {\n    owner: string;\n    repo: string;\n    path: string;\n    ref: string;\n  }): Promise<GiteaFileContent> {\n    const response = await this.request(\n      `repos/${encodeURIComponent(input.owner)}/${encodeURIComponent(input.repo)}/contents/${encodePath(input.path)}`,\n      {ref: input.ref},\n      {notFoundReason: 'file-not-found'},\n    );\n    const data = await response.json();\n\n    // Gitea returns an array for a directory path and an object for a single file;\n    // a non-file response means the requested path is not a readable file.\n    if (!isRecord(data) || Array.isArray(data) || data.type !== 'file') {\n      throw new GiteaIntegrationProviderError(\n        'file-not-found',\n        `Gitea path ${input.path} is not a file`,\n      );\n    }\n\n    // A well-formed Gitea file response always carries a numeric size; coercing a\n    // missing size to 0 would skip the limit guard below and decode unbounded content.\n    if (typeof data.size !== 'number') {\n      throw new GiteaIntegrationProviderError(\n        'malformed-provider-response',\n        'Gitea file response did not include a numeric size',\n      );\n    }\n    const size = data.size;\n    if (size > MAX_REPOSITORY_FILE_BYTES) {\n      throw new GiteaIntegrationProviderError(\n        'content-too-large',\n        'Gitea file content is larger than the supported limit',\n      );\n    }\n    if (typeof data.content !== 'string' || data.encoding !== 'base64') {\n      throw new GiteaIntegrationProviderError(\n        'malformed-provider-response',\n        'Gitea file response did not include base64 content',\n      );\n    }\n\n    return {\n      path: typeof data.path === 'string' ? data.path : input.path,\n      size,\n      content: Buffer.from(data.content, 'base64').toString('utf8'),\n    };\n  }\n\n  async organizationExists(input: {org: string}): Promise<boolean> {\n    const response = await this.requestRaw(`orgs/${encodeURIComponent(input.org)}`);\n    if (response.ok) return true;\n    if (response.status === 404) return false;\n    throw giteaHttpError(response);\n  }\n\n  private async request(\n    path: string,\n    searchParams: Record<string, string> = {},\n    options: {notFoundReason?: NotFoundReason} = {},\n  ): Promise<Response> {\n    const response = await this.requestRaw(path, {searchParams});\n    if (!response.ok)\n      throw giteaHttpError(response, options.notFoundReason ?? 'repository-not-found');\n    return response;\n  }\n\n  private async requestRaw(\n    path: string,\n    options: {method?: string; searchParams?: Record<string, string>; body?: unknown} = {},\n  ): Promise<Response> {\n    const url = new URL(`${this.baseApiUrl()}/${path}`);\n    for (const [key, value] of Object.entries(options.searchParams ?? {})) {\n      url.searchParams.set(key, value);\n    }\n\n    const headers: Record<string, string> = {\n      authorization: this.authHeader(),\n      accept: 'application/json',\n    };\n    const init: RequestInit = {\n      method: options.method ?? 'GET',\n      headers,\n      signal: AbortSignal.timeout(config.GITEA_REQUEST_TIMEOUT_MS),\n    };\n    if (options.body !== undefined) {\n      headers['content-type'] = 'application/json';\n      init.body = JSON.stringify(options.body);\n    }\n\n    try {\n      return await fetch(url, init);\n    } catch (error) {\n      // A bare `fetch` has no request timeout, so an unresponsive Gitea would\n      // otherwise hold the worker open indefinitely; the AbortSignal.timeout\n      // above surfaces as a fast `timeout` (503) instead of stalling.\n      if (\n        error instanceof Error &&\n        (error.name === 'TimeoutError' || error.name === 'AbortError')\n      ) {\n        throw new GiteaIntegrationProviderError('timeout', 'Gitea request timed out');\n      }\n      throw new GiteaIntegrationProviderError(\n        'provider-unavailable',\n        `Gitea request failed: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n  }\n\n  private baseApiUrl(): string {\n    if (!this.cachedBaseApiUrl) {\n      this.cachedBaseApiUrl = `${config.GITEA_BASE_URL.replace(TRAILING_SLASHES_RE, '')}/api/v1`;\n    }\n    return this.cachedBaseApiUrl;\n  }\n\n  private authHeader(): string {\n    if (!this.cachedAuthHeader) {\n      const credentials = `${config.GITEA_SERVICE_USERNAME}:${config.GITEA_SERVICE_TOKEN}`;\n      this.cachedAuthHeader = `Basic ${Buffer.from(credentials).toString('base64')}`;\n    }\n    return this.cachedAuthHeader;\n  }\n}\n\ntype NotFoundReason = 'repository-not-found' | 'file-not-found';\n\nfunction giteaHttpError(\n  response: Response,\n  notFoundReason: NotFoundReason = 'repository-not-found',\n): GiteaIntegrationProviderError {\n  const status = response.status;\n  if (status === 404) {\n    return new GiteaIntegrationProviderError(notFoundReason, `Gitea responded ${status}`);\n  }\n  if (isRateLimited(response)) {\n    return new GiteaIntegrationProviderError(\n      'rate-limited',\n      `Gitea responded ${status}`,\n      retryAfterSeconds(response),\n    );\n  }\n  if (status === 401 || status === 403) {\n    return new GiteaIntegrationProviderError('access-denied', `Gitea responded ${status}`);\n  }\n  // Server errors and any other unexpected status mean the provider could not\n  // serve the request; surface it as unavailable rather than leaking a raw error.\n  return new GiteaIntegrationProviderError('provider-unavailable', `Gitea responded ${status}`);\n}\n\nfunction isRateLimited(response: Response): boolean {\n  if (response.status === 429) return true;\n  return response.status === 403 && response.headers.get('x-ratelimit-remaining') === '0';\n}\n\nfunction retryAfterSeconds(response: Response): number | undefined {\n  const retryAfter = response.headers.get('retry-after');\n  if (!retryAfter) return undefined;\n  const parsed = Number.parseInt(retryAfter, 10);\n  return Number.isNaN(parsed) ? undefined : parsed;\n}\n\nfunction cursorToPage(cursor: string | undefined): number {\n  if (!cursor) return 1;\n  const page = Number.parseInt(cursor, 10);\n  return Number.isNaN(page) || page < 1 ? 1 : page;\n}\n\nfunction nextCursorFromLink(link: string | null): string | null {\n  if (!link) return null;\n  const next = link.split(',').find((part) => part.includes('rel=\"next\"'));\n  if (!next) return null;\n  const match = next.match(NEXT_PAGE_RE);\n  return match?.[1] ?? null;\n}\n\nfunction encodePath(path: string): string {\n  const segments = path.split('/');\n  // `..`/`.`/empty segments survive encodeURIComponent and would let `new URL`\n  // normalize the request path out of `/contents/` and hit other authenticated\n  // Gitea endpoints, so reject them before building the URL.\n  for (const segment of segments) {\n    if (segment === '' || segment === '.' || segment === '..') {\n      throw new GiteaIntegrationProviderError(\n        'file-not-found',\n        `Gitea path contains an invalid segment: ${path}`,\n      );\n    }\n  }\n  return segments.map(encodeURIComponent).join('/');\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n\nfunction toGiteaRepository(raw: unknown): GiteaRepository {\n  if (\n    !isRecord(raw) ||\n    !isRecord(raw.owner) ||\n    typeof raw.owner.login !== 'string' ||\n    typeof raw.name !== 'string' ||\n    typeof raw.full_name !== 'string' ||\n    typeof raw.default_branch !== 'string' ||\n    typeof raw.clone_url !== 'string' ||\n    typeof raw.html_url !== 'string'\n  ) {\n    throw new GiteaIntegrationProviderError(\n      'malformed-provider-response',\n      'Gitea repository response is missing required fields',\n    );\n  }\n\n  return {\n    ownerLogin: raw.owner.login,\n    name: raw.name,\n    fullName: raw.full_name,\n    defaultBranch: raw.default_branch,\n    private: raw.private === true,\n    cloneUrl: raw.clone_url,\n    htmlUrl: raw.html_url,\n  };\n}\n"],"names":["Buffer","MAX_REPOSITORY_FILE_BYTES","config","GiteaIntegrationProviderError","TRAILING_SLASHES_RE","NEXT_PAGE_RE","TREE_PAGE_SIZE","createGiteaApiClient","HttpGiteaApiClient","listOrgRepositories","input","response","request","encodeURIComponent","org","page","String","cursorToPage","cursor","limit","data","json","Array","isArray","repositories","map","toGiteaRepository","nextCursor","nextCursorFromLink","headers","get","getRepository","owner","repo","resolveRef","sha","ref","stat","verification","files","head","undefined","isRecord","listTree","recursive","per_page","entries","tree","blobs","entry","type","path","push","size","truncated","fetchFileContent","encodePath","notFoundReason","content","encoding","from","toString","organizationExists","requestRaw","ok","status","giteaHttpError","searchParams","options","url","URL","baseApiUrl","key","value","Object","set","authorization","authHeader","accept","init","method","signal","AbortSignal","timeout","GITEA_REQUEST_TIMEOUT_MS","body","JSON","stringify","fetch","error","Error","name","message","cachedBaseApiUrl","GITEA_BASE_URL","replace","cachedAuthHeader","credentials","GITEA_SERVICE_USERNAME","GITEA_SERVICE_TOKEN","isRateLimited","retryAfterSeconds","retryAfter","parsed","Number","parseInt","isNaN","link","next","split","find","part","includes","match","segments","segment","join","raw","login","full_name","default_branch","clone_url","html_url","ownerLogin","fullName","defaultBranch","private","cloneUrl","htmlUrl"],"mappings":"AAAA,SAAQA,MAAM,QAAO,cAAc;AACnC,SAAQC,yBAAyB,QAAO,oCAAoC;AAC5E,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,6BAA6B,QAAO,kBAAkB;AAE9D,MAAMC,sBAAsB;AAC5B,MAAMC,eAAe;AAErB,kFAAkF;AAClF,sEAAsE;AACtE,MAAMC,iBAAiB;AAmDvB,OAAO,SAASC;IACd,OAAO,IAAIC;AACb;AAEA,IAAA,AAAMA,qBAAN,MAAMA;IAIJ,MAAMC,oBAAoBC,KAIzB,EAAgC;QAC/B,MAAMC,WAAW,MAAM,IAAI,CAACC,OAAO,CAAC,CAAC,KAAK,EAAEC,mBAAmBH,MAAMI,GAAG,EAAE,MAAM,CAAC,EAAE;YACjFC,MAAMC,OAAOC,aAAaP,MAAMQ,MAAM;YACtCC,OAAOH,OAAON,MAAMS,KAAK;QAC3B;QACA,MAAMC,OAAO,MAAMT,SAASU,IAAI;QAChC,IAAI,CAACC,MAAMC,OAAO,CAACH,OAAO;YACxB,MAAM,IAAIjB,8BACR,+BACA;QAEJ;QAEA,OAAO;YACLqB,cAAcJ,KAAKK,GAAG,CAACC;YACvBC,YAAYC,mBAAmBjB,SAASkB,OAAO,CAACC,GAAG,CAAC;QACtD;IACF;IAEA,MAAMC,cAAcrB,KAAoC,EAA4B;QAClF,MAAMC,WAAW,MAAM,IAAI,CAACC,OAAO,CACjC,CAAC,MAAM,EAAEC,mBAAmBH,MAAMsB,KAAK,EAAE,CAAC,EAAEnB,mBAAmBH,MAAMuB,IAAI,GAAG;QAE9E,OAAOP,kBAAkB,MAAMf,SAASU,IAAI;IAC9C;IAEA,MAAMa,WAAWxB,KAAiD,EAAmB;QACnF,MAAMC,WAAW,MAAM,IAAI,CAACC,OAAO,CACjC,CAAC,MAAM,EAAEC,mBAAmBH,MAAMsB,KAAK,EAAE,CAAC,EAAEnB,mBAAmBH,MAAMuB,IAAI,EAAE,QAAQ,CAAC,EACpF;YAACE,KAAKzB,MAAM0B,GAAG;YAAEjB,OAAO;YAAKkB,MAAM;YAASC,cAAc;YAASC,OAAO;QAAO;QAEnF,MAAMnB,OAAO,MAAMT,SAASU,IAAI;QAChC,MAAMmB,OAAOlB,MAAMC,OAAO,CAACH,QAAQA,IAAI,CAAC,EAAE,GAAGqB;QAC7C,IAAI,CAACC,SAASF,SAAS,OAAOA,KAAKL,GAAG,KAAK,UAAU;YACnD,MAAM,IAAIhC,8BACR,wBACA,CAAC,UAAU,EAAEO,MAAM0B,GAAG,CAAC,4BAA4B,CAAC;QAExD;QACA,OAAOI,KAAKL,GAAG;IACjB;IAEA,MAAMQ,SAASjC,KAAiD,EAAsB;QACpF,MAAMC,WAAW,MAAM,IAAI,CAACC,OAAO,CACjC,CAAC,MAAM,EAAEC,mBAAmBH,MAAMsB,KAAK,EAAE,CAAC,EAAEnB,mBAAmBH,MAAMuB,IAAI,EAAE,WAAW,EAAEpB,mBAAmBH,MAAMyB,GAAG,GAAG,EACvH;YAACS,WAAW;YAAQC,UAAU7B,OAAOV;QAAe;QAEtD,MAAMc,OAAO,MAAMT,SAASU,IAAI;QAChC,IAAI,CAACqB,SAAStB,OAAO;YACnB,MAAM,IAAIjB,8BACR,+BACA;QAEJ;QAEA,MAAM2C,UAAUxB,MAAMC,OAAO,CAACH,KAAK2B,IAAI,IAAI3B,KAAK2B,IAAI,GAAG,EAAE;QACzD,MAAMC,QAAyB,EAAE;QACjC,KAAK,MAAMC,SAASH,QAAS;YAC3B,IAAIJ,SAASO,UAAUA,MAAMC,IAAI,KAAK,UAAU,OAAOD,MAAME,IAAI,KAAK,UAAU;gBAC9EH,MAAMI,IAAI,CAAC;oBAACD,MAAMF,MAAME,IAAI;oBAAEE,MAAM,OAAOJ,MAAMI,IAAI,KAAK,WAAWJ,MAAMI,IAAI,GAAG;gBAAI;YACxF;QACF;QAEA,OAAO;YAACL;YAAOM,WAAWlC,KAAKkC,SAAS,KAAK;QAAI;IACnD;IAEA,MAAMC,iBAAiB7C,KAKtB,EAA6B;QAC5B,MAAMC,WAAW,MAAM,IAAI,CAACC,OAAO,CACjC,CAAC,MAAM,EAAEC,mBAAmBH,MAAMsB,KAAK,EAAE,CAAC,EAAEnB,mBAAmBH,MAAMuB,IAAI,EAAE,UAAU,EAAEuB,WAAW9C,MAAMyC,IAAI,GAAG,EAC/G;YAACf,KAAK1B,MAAM0B,GAAG;QAAA,GACf;YAACqB,gBAAgB;QAAgB;QAEnC,MAAMrC,OAAO,MAAMT,SAASU,IAAI;QAEhC,+EAA+E;QAC/E,uEAAuE;QACvE,IAAI,CAACqB,SAAStB,SAASE,MAAMC,OAAO,CAACH,SAASA,KAAK8B,IAAI,KAAK,QAAQ;YAClE,MAAM,IAAI/C,8BACR,kBACA,CAAC,WAAW,EAAEO,MAAMyC,IAAI,CAAC,cAAc,CAAC;QAE5C;QAEA,8EAA8E;QAC9E,mFAAmF;QACnF,IAAI,OAAO/B,KAAKiC,IAAI,KAAK,UAAU;YACjC,MAAM,IAAIlD,8BACR,+BACA;QAEJ;QACA,MAAMkD,OAAOjC,KAAKiC,IAAI;QACtB,IAAIA,OAAOpD,2BAA2B;YACpC,MAAM,IAAIE,8BACR,qBACA;QAEJ;QACA,IAAI,OAAOiB,KAAKsC,OAAO,KAAK,YAAYtC,KAAKuC,QAAQ,KAAK,UAAU;YAClE,MAAM,IAAIxD,8BACR,+BACA;QAEJ;QAEA,OAAO;YACLgD,MAAM,OAAO/B,KAAK+B,IAAI,KAAK,WAAW/B,KAAK+B,IAAI,GAAGzC,MAAMyC,IAAI;YAC5DE;YACAK,SAAS1D,OAAO4D,IAAI,CAACxC,KAAKsC,OAAO,EAAE,UAAUG,QAAQ,CAAC;QACxD;IACF;IAEA,MAAMC,mBAAmBpD,KAAoB,EAAoB;QAC/D,MAAMC,WAAW,MAAM,IAAI,CAACoD,UAAU,CAAC,CAAC,KAAK,EAAElD,mBAAmBH,MAAMI,GAAG,GAAG;QAC9E,IAAIH,SAASqD,EAAE,EAAE,OAAO;QACxB,IAAIrD,SAASsD,MAAM,KAAK,KAAK,OAAO;QACpC,MAAMC,eAAevD;IACvB;IAEA,MAAcC,QACZuC,IAAY,EACZgB,eAAuC,CAAC,CAAC,EACzCC,UAA6C,CAAC,CAAC,EAC5B;QACnB,MAAMzD,WAAW,MAAM,IAAI,CAACoD,UAAU,CAACZ,MAAM;YAACgB;QAAY;QAC1D,IAAI,CAACxD,SAASqD,EAAE,EACd,MAAME,eAAevD,UAAUyD,QAAQX,cAAc,IAAI;QAC3D,OAAO9C;IACT;IAEA,MAAcoD,WACZZ,IAAY,EACZiB,UAAoF,CAAC,CAAC,EACnE;QACnB,MAAMC,MAAM,IAAIC,IAAI,GAAG,IAAI,CAACC,UAAU,GAAG,CAAC,EAAEpB,MAAM;QAClD,KAAK,MAAM,CAACqB,KAAKC,MAAM,IAAIC,OAAO5B,OAAO,CAACsB,QAAQD,YAAY,IAAI,CAAC,GAAI;YACrEE,IAAIF,YAAY,CAACQ,GAAG,CAACH,KAAKC;QAC5B;QAEA,MAAM5C,UAAkC;YACtC+C,eAAe,IAAI,CAACC,UAAU;YAC9BC,QAAQ;QACV;QACA,MAAMC,OAAoB;YACxBC,QAAQZ,QAAQY,MAAM,IAAI;YAC1BnD;YACAoD,QAAQC,YAAYC,OAAO,CAACjF,OAAOkF,wBAAwB;QAC7D;QACA,IAAIhB,QAAQiB,IAAI,KAAK5C,WAAW;YAC9BZ,OAAO,CAAC,eAAe,GAAG;YAC1BkD,KAAKM,IAAI,GAAGC,KAAKC,SAAS,CAACnB,QAAQiB,IAAI;QACzC;QAEA,IAAI;YACF,OAAO,MAAMG,MAAMnB,KAAKU;QAC1B,EAAE,OAAOU,OAAO;YACd,wEAAwE;YACxE,uEAAuE;YACvE,gEAAgE;YAChE,IACEA,iBAAiBC,SAChBD,CAAAA,MAAME,IAAI,KAAK,kBAAkBF,MAAME,IAAI,KAAK,YAAW,GAC5D;gBACA,MAAM,IAAIxF,8BAA8B,WAAW;YACrD;YACA,MAAM,IAAIA,8BACR,wBACA,CAAC,sBAAsB,EAAEsF,iBAAiBC,QAAQD,MAAMG,OAAO,GAAG5E,OAAOyE,QAAQ;QAErF;IACF;IAEQlB,aAAqB;QAC3B,IAAI,CAAC,IAAI,CAACsB,gBAAgB,EAAE;YAC1B,IAAI,CAACA,gBAAgB,GAAG,GAAG3F,OAAO4F,cAAc,CAACC,OAAO,CAAC3F,qBAAqB,IAAI,OAAO,CAAC;QAC5F;QACA,OAAO,IAAI,CAACyF,gBAAgB;IAC9B;IAEQhB,aAAqB;QAC3B,IAAI,CAAC,IAAI,CAACmB,gBAAgB,EAAE;YAC1B,MAAMC,cAAc,GAAG/F,OAAOgG,sBAAsB,CAAC,CAAC,EAAEhG,OAAOiG,mBAAmB,EAAE;YACpF,IAAI,CAACH,gBAAgB,GAAG,CAAC,MAAM,EAAEhG,OAAO4D,IAAI,CAACqC,aAAapC,QAAQ,CAAC,WAAW;QAChF;QACA,OAAO,IAAI,CAACmC,gBAAgB;IAC9B;AACF;AAIA,SAAS9B,eACPvD,QAAkB,EAClB8C,iBAAiC,sBAAsB;IAEvD,MAAMQ,SAAStD,SAASsD,MAAM;IAC9B,IAAIA,WAAW,KAAK;QAClB,OAAO,IAAI9D,8BAA8BsD,gBAAgB,CAAC,gBAAgB,EAAEQ,QAAQ;IACtF;IACA,IAAImC,cAAczF,WAAW;QAC3B,OAAO,IAAIR,8BACT,gBACA,CAAC,gBAAgB,EAAE8D,QAAQ,EAC3BoC,kBAAkB1F;IAEtB;IACA,IAAIsD,WAAW,OAAOA,WAAW,KAAK;QACpC,OAAO,IAAI9D,8BAA8B,iBAAiB,CAAC,gBAAgB,EAAE8D,QAAQ;IACvF;IACA,4EAA4E;IAC5E,gFAAgF;IAChF,OAAO,IAAI9D,8BAA8B,wBAAwB,CAAC,gBAAgB,EAAE8D,QAAQ;AAC9F;AAEA,SAASmC,cAAczF,QAAkB;IACvC,IAAIA,SAASsD,MAAM,KAAK,KAAK,OAAO;IACpC,OAAOtD,SAASsD,MAAM,KAAK,OAAOtD,SAASkB,OAAO,CAACC,GAAG,CAAC,6BAA6B;AACtF;AAEA,SAASuE,kBAAkB1F,QAAkB;IAC3C,MAAM2F,aAAa3F,SAASkB,OAAO,CAACC,GAAG,CAAC;IACxC,IAAI,CAACwE,YAAY,OAAO7D;IACxB,MAAM8D,SAASC,OAAOC,QAAQ,CAACH,YAAY;IAC3C,OAAOE,OAAOE,KAAK,CAACH,UAAU9D,YAAY8D;AAC5C;AAEA,SAAStF,aAAaC,MAA0B;IAC9C,IAAI,CAACA,QAAQ,OAAO;IACpB,MAAMH,OAAOyF,OAAOC,QAAQ,CAACvF,QAAQ;IACrC,OAAOsF,OAAOE,KAAK,CAAC3F,SAASA,OAAO,IAAI,IAAIA;AAC9C;AAEA,SAASa,mBAAmB+E,IAAmB;IAC7C,IAAI,CAACA,MAAM,OAAO;IAClB,MAAMC,OAAOD,KAAKE,KAAK,CAAC,KAAKC,IAAI,CAAC,CAACC,OAASA,KAAKC,QAAQ,CAAC;IAC1D,IAAI,CAACJ,MAAM,OAAO;IAClB,MAAMK,QAAQL,KAAKK,KAAK,CAAC5G;IACzB,OAAO4G,OAAO,CAAC,EAAE,IAAI;AACvB;AAEA,SAASzD,WAAWL,IAAY;IAC9B,MAAM+D,WAAW/D,KAAK0D,KAAK,CAAC;IAC5B,6EAA6E;IAC7E,6EAA6E;IAC7E,2DAA2D;IAC3D,KAAK,MAAMM,WAAWD,SAAU;QAC9B,IAAIC,YAAY,MAAMA,YAAY,OAAOA,YAAY,MAAM;YACzD,MAAM,IAAIhH,8BACR,kBACA,CAAC,wCAAwC,EAAEgD,MAAM;QAErD;IACF;IACA,OAAO+D,SAASzF,GAAG,CAACZ,oBAAoBuG,IAAI,CAAC;AAC/C;AAEA,SAAS1E,SAAS+B,KAAc;IAC9B,OAAO,OAAOA,UAAU,YAAYA,UAAU;AAChD;AAEA,SAAS/C,kBAAkB2F,GAAY;IACrC,IACE,CAAC3E,SAAS2E,QACV,CAAC3E,SAAS2E,IAAIrF,KAAK,KACnB,OAAOqF,IAAIrF,KAAK,CAACsF,KAAK,KAAK,YAC3B,OAAOD,IAAI1B,IAAI,KAAK,YACpB,OAAO0B,IAAIE,SAAS,KAAK,YACzB,OAAOF,IAAIG,cAAc,KAAK,YAC9B,OAAOH,IAAII,SAAS,KAAK,YACzB,OAAOJ,IAAIK,QAAQ,KAAK,UACxB;QACA,MAAM,IAAIvH,8BACR,+BACA;IAEJ;IAEA,OAAO;QACLwH,YAAYN,IAAIrF,KAAK,CAACsF,KAAK;QAC3B3B,MAAM0B,IAAI1B,IAAI;QACdiC,UAAUP,IAAIE,SAAS;QACvBM,eAAeR,IAAIG,cAAc;QACjCM,SAAST,IAAIS,OAAO,KAAK;QACzBC,UAAUV,IAAII,SAAS;QACvBO,SAASX,IAAIK,QAAQ;IACvB;AACF"}

package/dist/config.d.ts

@@ -0,0 +1,11 @@
+export declare const config: Readonly<{
+    GITEA_BASE_URL: string;
+    GITEA_CLONE_BASE_URL: string | undefined;
+    GITEA_SERVICE_USERNAME: string;
+    GITEA_SERVICE_TOKEN: string;
+    GITEA_WEBHOOK_SECRET: string;
+    GITEA_CHECKOUT_TTL_SECONDS: number;
+    GITEA_REQUEST_TIMEOUT_MS: number;
+} & import("@shipfox/config").CleanedEnvAccessors>;
+export declare const giteaCloneBaseOrigin: URL | undefined;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,MAAM;;;;;;;;kDAyBjB,CAAC;AAEH,eAAO,MAAM,oBAAoB,iBAAyD,CAAC"}

package/dist/config.js

@@ -0,0 +1,38 @@
+import { createConfig, num, str, url } from '@shipfox/config';
+export const config = createConfig({
+    GITEA_BASE_URL: url({
+        desc: 'Base URL of the Gitea instance the provider connects to, including the scheme (for example https://gitea.example.com). Required.'
+    }),
+    GITEA_CLONE_BASE_URL: str({
+        desc: 'Base URL runners use when cloning Gitea repositories. Leave it unset to use clone URLs reported by Gitea, or set it when runners reach Gitea through a different scheme, host, or port.',
+        default: undefined
+    }),
+    GITEA_SERVICE_USERNAME: str({
+        desc: 'Username of the Gitea service account the provider authenticates as. Required.'
+    }),
+    GITEA_SERVICE_TOKEN: str({
+        desc: 'Access token or bot password of the Gitea service account, used for REST API and git-http basic auth. Required.'
+    }),
+    GITEA_WEBHOOK_SECRET: str({
+        desc: 'Secret used to verify incoming Gitea webhooks. Must match the org webhook secret set by the instance admin. Required.'
+    }),
+    GITEA_CHECKOUT_TTL_SECONDS: num({
+        desc: 'Lifetime in seconds of the checkout credentials handed to the runner. Defaults to 300 (five minutes).',
+        default: 300
+    }),
+    GITEA_REQUEST_TIMEOUT_MS: num({
+        desc: 'How long in milliseconds the provider waits for a Gitea REST API response before giving up. A request that exceeds this fails as a timeout instead of holding an API worker open. Defaults to 10000 (ten seconds).',
+        default: 10_000
+    })
+});
+export const giteaCloneBaseOrigin = parseGiteaCloneBaseOrigin(config.GITEA_CLONE_BASE_URL);
+function parseGiteaCloneBaseOrigin(value) {
+    if (!value) return undefined;
+    try {
+        return new URL(value);
+    } catch  {
+        throw new Error('GITEA_CLONE_BASE_URL must be an absolute URL with a scheme, host, and optional port.');
+    }
+}
+
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {createConfig, num, str, url} from '@shipfox/config';\n\nexport const config = createConfig({\n  GITEA_BASE_URL: url({\n    desc: 'Base URL of the Gitea instance the provider connects to, including the scheme (for example https://gitea.example.com). Required.',\n  }),\n  GITEA_CLONE_BASE_URL: str({\n    desc: 'Base URL runners use when cloning Gitea repositories. Leave it unset to use clone URLs reported by Gitea, or set it when runners reach Gitea through a different scheme, host, or port.',\n    default: undefined,\n  }),\n  GITEA_SERVICE_USERNAME: str({\n    desc: 'Username of the Gitea service account the provider authenticates as. Required.',\n  }),\n  GITEA_SERVICE_TOKEN: str({\n    desc: 'Access token or bot password of the Gitea service account, used for REST API and git-http basic auth. Required.',\n  }),\n  GITEA_WEBHOOK_SECRET: str({\n    desc: 'Secret used to verify incoming Gitea webhooks. Must match the org webhook secret set by the instance admin. Required.',\n  }),\n  GITEA_CHECKOUT_TTL_SECONDS: num({\n    desc: 'Lifetime in seconds of the checkout credentials handed to the runner. Defaults to 300 (five minutes).',\n    default: 300,\n  }),\n  GITEA_REQUEST_TIMEOUT_MS: num({\n    desc: 'How long in milliseconds the provider waits for a Gitea REST API response before giving up. A request that exceeds this fails as a timeout instead of holding an API worker open. Defaults to 10000 (ten seconds).',\n    default: 10_000,\n  }),\n});\n\nexport const giteaCloneBaseOrigin = parseGiteaCloneBaseOrigin(config.GITEA_CLONE_BASE_URL);\n\nfunction parseGiteaCloneBaseOrigin(value: string | undefined): URL | undefined {\n  if (!value) return undefined;\n\n  try {\n    return new URL(value);\n  } catch {\n    throw new Error(\n      'GITEA_CLONE_BASE_URL must be an absolute URL with a scheme, host, and optional port.',\n    );\n  }\n}\n"],"names":["createConfig","num","str","url","config","GITEA_BASE_URL","desc","GITEA_CLONE_BASE_URL","default","undefined","GITEA_SERVICE_USERNAME","GITEA_SERVICE_TOKEN","GITEA_WEBHOOK_SECRET","GITEA_CHECKOUT_TTL_SECONDS","GITEA_REQUEST_TIMEOUT_MS","giteaCloneBaseOrigin","parseGiteaCloneBaseOrigin","value","URL","Error"],"mappings":"AAAA,SAAQA,YAAY,EAAEC,GAAG,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AAE5D,OAAO,MAAMC,SAASJ,aAAa;IACjCK,gBAAgBF,IAAI;QAClBG,MAAM;IACR;IACAC,sBAAsBL,IAAI;QACxBI,MAAM;QACNE,SAASC;IACX;IACAC,wBAAwBR,IAAI;QAC1BI,MAAM;IACR;IACAK,qBAAqBT,IAAI;QACvBI,MAAM;IACR;IACAM,sBAAsBV,IAAI;QACxBI,MAAM;IACR;IACAO,4BAA4BZ,IAAI;QAC9BK,MAAM;QACNE,SAAS;IACX;IACAM,0BAA0Bb,IAAI;QAC5BK,MAAM;QACNE,SAAS;IACX;AACF,GAAG;AAEH,OAAO,MAAMO,uBAAuBC,0BAA0BZ,OAAOG,oBAAoB,EAAE;AAE3F,SAASS,0BAA0BC,KAAyB;IAC1D,IAAI,CAACA,OAAO,OAAOR;IAEnB,IAAI;QACF,OAAO,IAAIS,IAAID;IACjB,EAAE,OAAM;QACN,MAAM,IAAIE,MACR;IAEJ;AACF"}

package/dist/core/connect.d.ts

@@ -0,0 +1,18 @@
+import type { IntegrationConnection } from '@shipfox/api-integration-core-dto';
+import type { GiteaApiClient } from '#api/client.js';
+export interface ConnectGiteaConnectionInput {
+    workspaceId: string;
+    org: string;
+    displayName: string;
+}
+export interface HandleGiteaConnectParams {
+    gitea: GiteaApiClient;
+    workspaceId: string;
+    org: string;
+    getExistingGiteaConnection: (input: {
+        org: string;
+    }) => Promise<IntegrationConnection<'gitea'> | undefined>;
+    connectGiteaConnection: (input: ConnectGiteaConnectionInput) => Promise<IntegrationConnection<'gitea'>>;
+}
+export declare function handleGiteaConnect(params: HandleGiteaConnectParams): Promise<IntegrationConnection<'gitea'>>;
+//# sourceMappingURL=connect.d.ts.map

package/dist/core/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/core/connect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,mCAAmC,CAAC;AAC7E,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,gBAAgB,CAAC;AAGnD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,cAAc,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B,EAAE,CAAC,KAAK,EAAE;QAClC,GAAG,EAAE,MAAM,CAAC;KACb,KAAK,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IAC1D,sBAAsB,EAAE,CACtB,KAAK,EAAE,2BAA2B,KAC/B,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CA2BzC"}