repo-sdk 0.0.0 → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Robin Genz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1 +1,92 @@
 # repo-sdk
+
+[![npm version](https://img.shields.io/npm/v/repo-sdk)](https://www.npmjs.com/package/repo-sdk)
+[![npm downloads](https://img.shields.io/npm/dm/repo-sdk)](https://www.npmjs.com/package/repo-sdk)
+[![license](https://img.shields.io/npm/l/repo-sdk)](https://github.com/capawesome-team/repo-sdk/blob/main/LICENSE)
+
+A unified, normalized, zero-dependency, edge-compatible TypeScript SDK over GitHub, GitLab, Bitbucket Cloud, Azure DevOps, and Gitea — plus generic git smart-HTTP remotes. Write your discovery, commit, tag, download, and webhook logic once against one normalized API — built on raw `fetch` and Web Crypto, so it runs on Node, Cloudflare Workers, and other Web-standard runtimes.
+
+## Installation
+
+```bash
+npm install repo-sdk
+```
+
+## Quickstart
+
+```ts
+import { createClient } from 'repo-sdk';
+import { github } from 'repo-sdk/github';
+
+const client = createClient({
+  provider: github({ auth: { token: process.env.GITHUB_TOKEN! } }),
+});
+
+// Resolve a ref (branch, tag, or SHA) to a single commit.
+const head = await client.commits.get({ repo: 'capawesome-team/repo-sdk', ref: 'main' });
+console.log(head.sha, head.message);
+
+// List commits on a branch.
+const { data: commits } = await client.commits.list({
+  repo: 'capawesome-team/repo-sdk',
+  ref: 'main',
+  limit: 20,
+});
+```
+
+Switching providers means swapping the `provider` — the rest of your code stays the same.
+
+## Documentation
+
+Full documentation lives at **[repo-sdk.dev](https://repo-sdk.dev)** ([docs](https://repo-sdk.dev/docs)):
+
+- [Quickstart](https://repo-sdk.dev/docs/quickstart)
+- [Authentication](https://repo-sdk.dev/docs/authentication)
+- [Guides](https://repo-sdk.dev/docs/guides)
+- [API Reference](https://repo-sdk.dev/docs/reference)
+
+## Providers
+
+| Provider     | Import                  | Notes                                                            |
+| ------------ | ----------------------- | ---------------------------------------------------------------- |
+| GitHub       | `repo-sdk/github`       | Token and GitHub App auth                                        |
+| GitLab       | `repo-sdk/gitlab`       | PAT, group/project, or OAuth token                               |
+| Bitbucket    | `repo-sdk/bitbucket`    | Bitbucket Cloud                                                  |
+| Azure DevOps | `repo-sdk/azure-devops` | PAT or Entra ID                                                  |
+| Gitea        | `repo-sdk/gitea`        | Gitea ≥ 1.20 and Forgejo                                         |
+| Generic git  | `repo-sdk/git-http`     | Any git smart-HTTP remote (read-only ref discovery + clone URLs) |
+
+Self-hosted deployments — GitHub Enterprise Server, GitLab self-managed, Azure DevOps Server, and Gitea/Forgejo instances — are supported via `baseUrl`.
+
+## Development
+
+**Prerequisites:** Node >= 20.
+
+```bash
+npm install
+```
+
+| Script               | Description                                                     |
+| -------------------- | --------------------------------------------------------------- |
+| `npm run build`      | Build with tsdown                                               |
+| `npm test`           | Run the unit + contract test suite                              |
+| `npm run test:watch` | Run tests in watch mode                                         |
+| `npm run test:live`  | Gated live provider tests (env vars documented in CONTRIBUTING) |
+| `npm run typecheck`  | Type-check without emitting                                     |
+| `npm run lint`       | Lint the codebase                                               |
+| `npm run format`     | Format with prettier                                            |
+
+Docs site:
+
+- `npm run docs:dev` — run the docs dev server
+- `npm run docs:build` — build the static site to `.blume-dist/`
+
+Releases are automated with [release-please](https://github.com/googleapis/release-please), driven by [Conventional Commits](https://www.conventionalcommits.org/). While pre-`1.0.0`, breaking changes bump the minor version and features bump the patch version. Merging the release pull request publishes to npm. See [CONTRIBUTING.md](./CONTRIBUTING.md) for details.
+
+## About
+
+repo-sdk is developed and maintained by [Genz IT Solutions GmbH](http://genz-its.de/). It powers [Capawesome](https://capawesome.io/), a cloud platform for mobile apps.
+
+## License
+
+[MIT](./LICENSE)

package/dist/azure-devops.d.ts

@@ -0,0 +1,72 @@
+import { O as ParsedWebhookEvent, P as RepoProvider, v as IncomingWebhookRequest, z as TokenProvider } from "./types-CTeiAxMy.js";
+import { t as VerifyWebhookParams$1 } from "./verify-p6JsExms.js";
+//#region src/providers/azure-devops/auth.d.ts
+/**
+ * Azure DevOps supports three credential shapes: a Personal Access Token
+ * (encoded into HTTP Basic auth internally), an OAuth access token (sent as a
+ * bearer token), or a pluggable Entra ID `tokenProvider` that mints short-lived
+ * bearer tokens (re-invoked with `forceRefresh` after a 401, then retried
+ * once). Callers pass whichever they have.
+ */
+type AzureDevOpsAuth = {
+  pat: string;
+} | {
+  accessToken: string;
+} | {
+  tokenProvider: TokenProvider;
+};
+//#endregion
+//#region src/providers/azure-devops/index.d.ts
+interface AzureDevOpsProviderOptions {
+  organization: string;
+  auth: AzureDevOpsAuth;
+  baseUrl?: string;
+  fetch?: typeof fetch;
+  /**
+   * When set, webhooks are registered to deliver the secret verbatim in this
+   * custom HTTP header (via the service hook's `httpHeaders` consumer input)
+   * instead of HTTP Basic auth. Pass the same header name to `verifyWebhook`.
+   */
+  webhookSecretHeader?: string;
+}
+/**
+ * Builds the human-facing web URL for a commit from the repository's web URL
+ * (`Repository.urls.web`) and a commit SHA — no API request needed.
+ */
+declare const commitWebUrl: (repoWebUrl: string, sha: string) => string;
+declare function azureDevOps(options: AzureDevOpsProviderOptions): RepoProvider;
+//#endregion
+//#region src/providers/azure-devops/webhooks.d.ts
+/**
+ * Azure-only extension: `header` names the custom HTTP header carrying the secret
+ * for hooks registered with the provider's `webhookSecretHeader` option.
+ */
+type VerifyWebhookParams = VerifyWebhookParams$1 & {
+  header?: string;
+};
+/**
+ * Azure DevOps service hooks carry no HMAC signature. By default the SDK
+ * registers hooks with HTTP Basic auth (username `repo-sdk`, password = secret),
+ * so verification is a constant-time comparison of the incoming `Authorization`
+ * header. For hooks registered with a `webhookSecretHeader`, pass the same
+ * header name as `header` and the secret is compared against that header instead.
+ */
+declare function verifyWebhook(params: VerifyWebhookParams): Promise<boolean>;
+declare function parseWebhookEvent(input: Request | IncomingWebhookRequest): Promise<ParsedWebhookEvent>;
+//#endregion
+//#region src/providers/azure-devops/organizations.d.ts
+interface Organization {
+  id: string;
+  name: string;
+  url: string;
+}
+/**
+ * Lists the organizations (accounts) the authenticated identity belongs to.
+ * Organizations live on the `app.vssps.visualstudio.com` host — outside the
+ * org-pinned provider — so this ships as a standalone helper.
+ */
+declare function listOrganizations(options: AzureDevOpsAuth, init?: {
+  fetch?: typeof fetch;
+}): Promise<Organization[]>;
+//#endregion
+export { type AzureDevOpsAuth, type AzureDevOpsProviderOptions, type Organization, type VerifyWebhookParams, azureDevOps, commitWebUrl, listOrganizations, parseWebhookEvent, verifyWebhook };