akm-cli 0.9.16-alpha.1 → 0.9.16

package/dist/registry/resolve.js

@@ -11,6 +11,29 @@ import { NotFoundError, UsageError } from "../core/errors.js";
 import { asRecord, asString, GITHUB_API_BASE, githubHeaders } from "../integrations/github.js";
 import { cancelRegistryResponse, fetchRegistryResponse } from "./network.js";
 import { isExactSemver, isSemverRange, maxSatisfying } from "./semver.js";
+/**
+ * Pass an HTTPS bearer credential to Git without placing it in the remote URL
+ * or argv. The value exists only in the child-process environment and is never
+ * persisted or included in diagnostics.
+ */
+export function gitCredentialEnvironment(credential) {
+    if (!credential)
+        return { ...process.env };
+    if (/[\r\n\0]/.test(credential)) {
+        throw new UsageError("Git credential contains an invalid control character.");
+    }
+    const configuredCount = process.env.GIT_CONFIG_COUNT;
+    const nextIndex = configuredCount === undefined ? 0 : Number(configuredCount);
+    if (!Number.isSafeInteger(nextIndex) || nextIndex < 0) {
+        throw new UsageError("GIT_CONFIG_COUNT must be a non-negative integer before a Git credential can be added.");
+    }
+    return {
+        ...process.env,
+        GIT_CONFIG_COUNT: String(nextIndex + 1),
+        [`GIT_CONFIG_KEY_${nextIndex}`]: "http.extraHeader",
+        [`GIT_CONFIG_VALUE_${nextIndex}`]: `Authorization: Bearer ${credential}`,
+    };
+}
 /**
  * Validate that a URL is safe to pass to git.
  * Allowlists https:, http:, ssh:, git: schemes and git@ SSH shorthand.
@@ -122,16 +145,16 @@ function detectRegistrySearchId(ref) {
     lines.push("Or search for the installable ref:", `  akm search "${segments.length > 2 ? segments[segments.length - 1] : rest}" --from registry`, "Then install using the installRef value from the result:", "  akm bundle add github:owner/repo", "  akm bundle add npm:package-name");
     return lines.join("\n");
 }
-export async function resolveRegistryArtifact(parsed) {
+export async function resolveRegistryArtifact(parsed, options) {
     switch (parsed.source) {
         case "npm":
             return resolveNpmArtifact(parsed);
         case "local":
             return resolveLocalArtifact(parsed);
         case "git":
-            return resolveGitArtifact(parsed);
+            return resolveGitArtifact(parsed, options?.gitCredential);
         case "github":
-            return resolveGithubArtifact(parsed);
+            return resolveGithubArtifact(parsed, options?.gitCredential);
     }
 }
 function parseNpmRef(input, originalRef) {
@@ -427,12 +450,12 @@ async function resolveNpmArtifact(parsed) {
         allowPrivateRegistryOrigin: npmPolicy.allowPrivateRegistryOrigin,
     };
 }
-async function resolveGithubArtifact(parsed) {
+async function resolveGithubArtifact(parsed, credential) {
     const gitUrl = `https://github.com/${encodeURIComponent(parsed.owner)}/${encodeURIComponent(parsed.repo)}.git`;
     const repoBase = `${GITHUB_API_BASE}/repos/${encodeURIComponent(parsed.owner)}/${encodeURIComponent(parsed.repo)}`;
     // Prefer git-backed installs so private GitHub repos work with the user's
     // normal git credential helper rather than requiring API-specific auth.
-    const gitResolvedRevision = resolveGitRevisionFromRemote(gitUrl, parsed.requestedRef);
+    const gitResolvedRevision = resolveGitRevisionFromRemote(gitUrl, parsed.requestedRef, credential);
     if (gitResolvedRevision) {
         return {
             id: parsed.id,
@@ -443,7 +466,7 @@ async function resolveGithubArtifact(parsed) {
             resolvedRevision: gitResolvedRevision,
         };
     }
-    const headers = githubHeaders();
+    const headers = { ...githubHeaders(), ...(credential ? { Authorization: `Bearer ${credential}` } : {}) };
     if (parsed.requestedRef) {
         const commit = await tryFetchJson(`${repoBase}/commits/${encodeURIComponent(parsed.requestedRef)}`, headers, GITHUB_API_POLICY);
         const resolvedRevision = asString(commit?.sha) ?? parsed.requestedRef;
@@ -485,19 +508,23 @@ async function resolveGithubArtifact(parsed) {
         resolvedRevision: asString(commit?.sha) ?? defaultBranch,
     };
 }
-function resolveGitRevisionFromRemote(url, requestedRef) {
+function resolveGitRevisionFromRemote(url, requestedRef, credential) {
     validateGitUrl(url);
     const ref = requestedRef ?? "HEAD";
     if (requestedRef)
         validateGitRef(requestedRef);
-    const result = spawnSync("git", ["ls-remote", url, ref], { encoding: "utf8", timeout: 30_000 });
+    const result = spawnSync("git", ["ls-remote", url, ref], {
+        encoding: "utf8",
+        timeout: 30_000,
+        env: gitCredentialEnvironment(credential),
+    });
     if (result.status !== 0)
         return undefined;
     const firstLine = result.stdout.trim().split(/\r?\n/)[0];
     return firstLine?.split(/\s/)[0] || undefined;
 }
-async function resolveGitArtifact(parsed) {
-    const resolvedRevision = resolveGitRevisionFromRemote(parsed.url, parsed.requestedRef);
+async function resolveGitArtifact(parsed, credential) {
+    const resolvedRevision = resolveGitRevisionFromRemote(parsed.url, parsed.requestedRef, credential);
     if (!resolvedRevision) {
         // Unlike the GitHub path (which falls back to the REST API on a failed
         // `git ls-remote`), a plain git source has no fallback resolver — an