repo-sdk 0.1.0 → 0.1.2

package/README.md

@@ -4,7 +4,7 @@
 [![npm downloads](https://img.shields.io/npm/dm/repo-sdk)](https://www.npmjs.com/package/repo-sdk)
 [![license](https://img.shields.io/npm/l/repo-sdk)](https://github.com/capawesome-team/repo-sdk/blob/main/LICENSE)
 
-A unified, normalized, zero-dependency, edge-compatible TypeScript SDK over GitHub, GitLab, Bitbucket Cloud, Azure DevOps, and Gitea. Write your discovery, commit, tag, download, and webhook logic once against one normalized API — built on raw `fetch` and Web Crypto, so it runs on Node, Cloudflare Workers, and other Web-standard runtimes.
+A unified, normalized, zero-dependency, edge-compatible TypeScript SDK over GitHub, GitLab, Bitbucket Cloud, Azure DevOps, and Gitea — plus generic git smart-HTTP remotes. Write your discovery, commit, tag, download, and webhook logic once against one normalized API — built on raw `fetch` and Web Crypto, so it runs on Node, Cloudflare Workers, and other Web-standard runtimes.
 
 ## Installation
 
@@ -47,13 +47,14 @@ Full documentation lives at **[repo-sdk.dev](https://repo-sdk.dev)** ([docs](htt
 
 ## Providers
 
-| Provider     | Import                  | Notes                              |
-| ------------ | ----------------------- | ---------------------------------- |
-| GitHub       | `repo-sdk/github`       | Token and GitHub App auth          |
-| GitLab       | `repo-sdk/gitlab`       | PAT, group/project, or OAuth token |
-| Bitbucket    | `repo-sdk/bitbucket`    | Bitbucket Cloud                    |
-| Azure DevOps | `repo-sdk/azure-devops` | PAT or Entra ID                    |
-| Gitea        | `repo-sdk/gitea`        | Gitea ≥ 1.20 and Forgejo           |
+| Provider     | Import                  | Notes                                                            |
+| ------------ | ----------------------- | ---------------------------------------------------------------- |
+| GitHub       | `repo-sdk/github`       | Token and GitHub App auth                                        |
+| GitLab       | `repo-sdk/gitlab`       | PAT, group/project, or OAuth token                               |
+| Bitbucket    | `repo-sdk/bitbucket`    | Bitbucket Cloud                                                  |
+| Azure DevOps | `repo-sdk/azure-devops` | PAT or Entra ID                                                  |
+| Gitea        | `repo-sdk/gitea`        | Gitea ≥ 1.20 and Forgejo                                         |
+| Generic git  | `repo-sdk/git-http`     | Any git smart-HTTP remote (read-only ref discovery + clone URLs) |
 
 Self-hosted deployments — GitHub Enterprise Server, GitLab self-managed, Azure DevOps Server, and Gitea/Forgejo instances — are supported via `baseUrl`.
 

package/dist/azure-devops.d.ts

@@ -1,4 +1,4 @@
-import { E as ParsedWebhookEvent, I as TokenProvider, M as RepoProvider, g as IncomingWebhookRequest } from "./types-CwXDjAbE.js";
+import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-DfiRluvJ.js";
 import { t as VerifyWebhookParams$1 } from "./verify-p6JsExms.js";
 //#region src/providers/azure-devops/auth.d.ts
 /**

package/dist/azure-devops.js

@@ -1,6 +1,7 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor } from "./pagination-1KJe54LW.js";
-import { a as headShaOrUndefined, f as HttpClient, l as filenameFromContentDisposition, n as timingSafeEqual, r as toIncomingWebhook, s as commitWebUrlBuilder, u as isRecord } from "./verify-CRVfL8D9.js";
+import { n as decodeCursor, r as encodeCursor } from "./pagination-CWWHSu8I.js";
+import { a as isRecord, i as filenameFromContentDisposition, n as commitWebUrlBuilder, s as HttpClient } from "./shared-CuiOaaLD.js";
+import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/azure-devops/auth.ts
 /**
 * Username the SDK registers for a service hook's HTTP Basic auth (the secret is
@@ -198,6 +199,22 @@ function azureDevOps(options) {
 		}
 		return cached;
 	}
+	async function getExactRef(repo, fullName, peelTags, signal) {
+		const { data } = await jsonApi(`${repoBasePath(repo)}/refs`, {
+			query: {
+				filter: fullName,
+				...peelTags ? { peelTags: true } : {},
+				$top: 100
+			},
+			signal
+		});
+		const ref = data.value.find((candidate) => candidate.name === `refs/${fullName}`);
+		if (!ref) throw new RepoError(`Ref "refs/${fullName}" not found`, {
+			code: "not_found",
+			provider: "azure-devops"
+		});
+		return ref;
+	}
 	return {
 		name: "azure-devops",
 		capabilities: CAPABILITIES,
@@ -321,6 +338,12 @@ function azureDevOps(options) {
 				cursor: token ? encodeCursor("azure-devops", { token }) : void 0
 			};
 		},
+		async getBranch(params) {
+			return toBranch(await getExactRef(params.repo, `heads/${params.name}`, false, params.signal));
+		},
+		async getTag(params) {
+			return toTag(await getExactRef(params.repo, `tags/${params.name}`, true, params.signal));
+		},
 		async searchRefs(params) {
 			const refsPath = `${repoBasePath(params.repo)}/refs`;
 			return (await Promise.all(["branch", "tag"].filter((type) => params.types.includes(type)).map(async (type) => {

package/dist/bitbucket.d.ts

@@ -1,4 +1,4 @@
-import { E as ParsedWebhookEvent, I as TokenProvider, M as RepoProvider, g as IncomingWebhookRequest } from "./types-CwXDjAbE.js";
+import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-DfiRluvJ.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/bitbucket/index.d.ts
 interface BitbucketProviderOptions {

package/dist/bitbucket.js

@@ -1,6 +1,7 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-1KJe54LW.js";
-import { a as headShaOrUndefined, f as HttpClient, i as verifyHmacSignature, l as filenameFromContentDisposition, o as clampPerPage, r as toIncomingWebhook, s as commitWebUrlBuilder, u as isRecord } from "./verify-CRVfL8D9.js";
+import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
+import { a as isRecord, i as filenameFromContentDisposition, n as commitWebUrlBuilder, s as HttpClient, t as clampPerPage } from "./shared-CuiOaaLD.js";
+import { a as headShaOrUndefined, i as verifyHmacSignature, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/bitbucket/index.ts
 const BASE_URL = "https://api.bitbucket.org/2.0";
 const GIT_HOST = "bitbucket.org";
@@ -304,6 +305,14 @@ function bitbucket(options) {
 				cursor: nextCursor(data)
 			};
 		},
+		async getBranch(params) {
+			const { data } = await http.json(`${repoPath(params.repo)}/refs/branches/${encodeURIComponent(params.name)}`, { signal: params.signal });
+			return toBranch(data);
+		},
+		async getTag(params) {
+			const { data } = await http.json(`${repoPath(params.repo)}/refs/tags/${encodeURIComponent(params.name)}`, { signal: params.signal });
+			return toTag(data);
+		},
 		async searchRefs(params) {
 			const endpoints = {
 				branch: "branches",

package/dist/git-http.d.ts

@@ -0,0 +1,23 @@
+import { B as TokenProvider, F as RepoProvider } from "./types-DfiRluvJ.js";
+//#region src/providers/git-http/index.d.ts
+interface GitHttpProviderOptions {
+  /**
+   * Basic-auth credentials sent only after the remote answers an anonymous
+   * request with a 401 — the same flow the git CLI uses. `username` defaults
+   * to `git`; most hosts accept any non-empty username with a token as the
+   * password (Bitbucket app passwords require the real username). A
+   * `tokenProvider` mints the password per request instead (retried once on
+   * a 401).
+   */
+  auth?: {
+    username?: string;
+    password: string;
+  } | {
+    username?: string;
+    tokenProvider: TokenProvider;
+  };
+  fetch?: typeof fetch;
+}
+declare function gitHttp(options?: GitHttpProviderOptions): RepoProvider;
+//#endregion
+export { type GitHttpProviderOptions, gitHttp };

package/dist/git-http.js

@@ -0,0 +1,317 @@
+import { t as RepoError } from "./errors-Cxq_CqYv.js";
+import { a as stringToBase64, n as decodeCursor, r as encodeCursor } from "./pagination-CWWHSu8I.js";
+import { s as HttpClient, t as clampPerPage } from "./shared-CuiOaaLD.js";
+//#region src/providers/git-http/index.ts
+const CAPABILITIES = {
+	userProfile: false,
+	tagDates: false,
+	repoSearch: false,
+	ownedRepoFilter: false,
+	commitUserRef: false,
+	refSearch: true,
+	webhookEvents: [],
+	webhookVerification: "none",
+	archiveFormats: []
+};
+const DEFAULT_USERNAME = "git";
+const ZERO_SHA = "0".repeat(40);
+const ADVERTISEMENT_CONTENT_TYPE = "application/x-git-upload-pack-advertisement";
+const BRANCH_PREFIX = "refs/heads/";
+const TAG_PREFIX = "refs/tags/";
+function fail(code, message) {
+	throw new RepoError(message, {
+		code,
+		provider: "git-http"
+	});
+}
+function unsupported(feature) {
+	return new RepoError(`git-http remotes do not support ${feature}`, {
+		code: "unsupported",
+		provider: "git-http"
+	});
+}
+/**
+* Validates and normalizes a remote URL: absolute http(s), no embedded
+* credentials, no trailing slashes. The `repo` parameter of every method is
+* such a URL — a generic git remote has no owner/name coordinates.
+*/
+function normalizeRepoUrl(repo) {
+	if (/^[^/?#]+@/.test(repo) || /^(ssh|git):\/\//i.test(repo)) fail("validation", "SSH and git-protocol remotes are not supported; pass an http(s) remote URL");
+	let url;
+	try {
+		url = new URL(repo);
+	} catch {
+		fail("validation", `Invalid repository URL: expected an absolute http(s) URL`);
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") fail("validation", `Unsupported URL protocol "${url.protocol}"; use http(s)`);
+	if (url.username || url.password) fail("validation", "Pass credentials via the auth option, not embedded in the repository URL");
+	url.hash = "";
+	url.pathname = url.pathname.replace(/\/+$/, "");
+	return url.toString();
+}
+/**
+* Splits a smart-HTTP response into pkt-line payloads. Lengths are byte
+* counts, so the buffer is sliced before decoding — a string-based parse
+* would break on multi-byte ref names.
+*/
+function parsePktLines(bytes) {
+	const decoder = new TextDecoder();
+	const lines = [];
+	let offset = 0;
+	while (offset + 4 <= bytes.length) {
+		const header = decoder.decode(bytes.subarray(offset, offset + 4));
+		if (!/^[0-9a-f]{4}$/i.test(header)) fail("provider_error", "Malformed pkt-line in git-upload-pack advertisement");
+		const length = Number.parseInt(header, 16);
+		if (length === 0) {
+			offset += 4;
+			continue;
+		}
+		if (length < 4 || offset + length > bytes.length) fail("provider_error", "Truncated pkt-line in git-upload-pack advertisement");
+		let payload = bytes.subarray(offset + 4, offset + length);
+		if (payload.at(-1) === 10) payload = payload.subarray(0, payload.length - 1);
+		lines.push(decoder.decode(payload));
+		offset += length;
+	}
+	return lines;
+}
+function parseAdvertisement(lines) {
+	if (lines[0] !== "# service=git-upload-pack") fail("provider_error", "Remote did not return a git-upload-pack advertisement");
+	const refs = [];
+	const peeled = /* @__PURE__ */ new Map();
+	const symrefs = /* @__PURE__ */ new Map();
+	let capabilities = [];
+	for (const line of lines.slice(1)) {
+		if (line === "") continue;
+		const nulIndex = line.indexOf("\0");
+		const record = nulIndex === -1 ? line : line.slice(0, nulIndex);
+		if (nulIndex !== -1) {
+			capabilities = line.slice(nulIndex + 1).split(" ").filter(Boolean);
+			for (const capability of capabilities) if (capability.startsWith("symref=")) {
+				const separator = capability.indexOf(":");
+				if (separator > 7) symrefs.set(capability.slice(7, separator), capability.slice(separator + 1));
+			}
+		}
+		const space = record.indexOf(" ");
+		if (space === -1) continue;
+		const sha = record.slice(0, space);
+		const name = record.slice(space + 1);
+		if (sha === ZERO_SHA && name === "capabilities^{}") continue;
+		if (name.endsWith("^{}")) {
+			peeled.set(name.slice(0, -3), sha);
+			continue;
+		}
+		refs.push({
+			name,
+			sha
+		});
+	}
+	return {
+		refs,
+		peeled,
+		symrefs,
+		capabilities
+	};
+}
+function branchesOf(advertisement) {
+	return advertisement.refs.filter((ref) => ref.name.startsWith(BRANCH_PREFIX)).map((ref) => ({
+		name: ref.name.slice(11),
+		sha: ref.sha,
+		raw: ref
+	}));
+}
+function tagsOf(advertisement) {
+	return advertisement.refs.filter((ref) => ref.name.startsWith(TAG_PREFIX)).map((ref) => {
+		const peeledSha = advertisement.peeled.get(ref.name);
+		return {
+			name: ref.name.slice(10),
+			sha: peeledSha ?? ref.sha,
+			isAnnotated: peeledSha !== void 0,
+			raw: peeledSha === void 0 ? ref : {
+				...ref,
+				peeledSha
+			}
+		};
+	});
+}
+function mapError(_status, body) {
+	const text = typeof body === "string" ? body.trim() : "";
+	return { message: text && text.length <= 200 ? `git-http request failed: ${text}` : void 0 };
+}
+function gitHttp(options = {}) {
+	const fetchImpl = options.fetch ?? fetch;
+	const auth = options.auth;
+	const username = auth?.username || DEFAULT_USERNAME;
+	const authRequired = /* @__PURE__ */ new Set();
+	let lastSecret = auth && "password" in auth ? auth.password : void 0;
+	async function currentSecret(forceRefresh) {
+		if (auth === void 0 || "password" in auth) return lastSecret ?? "";
+		lastSecret = await auth.tokenProvider({ forceRefresh });
+		return lastSecret;
+	}
+	function httpFor(repoUrl) {
+		return new HttpClient({
+			provider: "git-http",
+			baseUrl: repoUrl,
+			fetchImpl,
+			authHeaders: async ({ forceRefresh }) => {
+				if (!auth) return {};
+				const hadAuth = authRequired.has(repoUrl);
+				if (!forceRefresh && !hadAuth) return {};
+				authRequired.add(repoUrl);
+				const secret = await currentSecret(forceRefresh && hadAuth);
+				return { Authorization: `Basic ${stringToBase64(`${username}:${secret}`)}` };
+			},
+			mapError,
+			secrets: () => lastSecret === void 0 ? [] : [lastSecret],
+			retryUnauthorized: auth !== void 0
+		});
+	}
+	async function fetchAdvertisement(repoUrl, signal) {
+		const response = await httpFor(repoUrl).raw(`${repoUrl}/info/refs`, {
+			query: { service: "git-upload-pack" },
+			signal
+		});
+		if (!(response.headers.get("content-type") ?? "").startsWith(ADVERTISEMENT_CONTENT_TYPE)) fail("provider_error", "Remote is not a git smart-HTTP endpoint (unexpected info/refs content type)");
+		return parseAdvertisement(parsePktLines(new Uint8Array(await response.arrayBuffer())));
+	}
+	function paginate(repoUrl, items, params) {
+		let offset = 0;
+		if (params.cursor !== void 0) {
+			const state = decodeCursor("git-http", params.cursor);
+			if (state.u !== repoUrl) fail("validation", "Pagination cursor belongs to a different repository");
+			offset = state.o;
+		}
+		const limit = clampPerPage(params.limit);
+		const data = limit === void 0 ? items.slice(offset) : items.slice(offset, offset + limit);
+		const nextOffset = offset + data.length;
+		return {
+			data,
+			cursor: nextOffset < items.length ? encodeCursor("git-http", {
+				u: repoUrl,
+				o: nextOffset
+			}) : void 0
+		};
+	}
+	return {
+		name: "git-http",
+		capabilities: CAPABILITIES,
+		async getAuthenticatedUser() {
+			throw unsupported("resolving the authenticated user");
+		},
+		async listNamespaces() {
+			throw unsupported("namespace discovery");
+		},
+		async listRepositories() {
+			throw unsupported("repository discovery");
+		},
+		async getRepository(params) {
+			const repoUrl = normalizeRepoUrl(params.repo);
+			const advertisement = await fetchAdvertisement(repoUrl, params.signal);
+			const url = new URL(repoUrl);
+			const path = url.pathname.replace(/^\/+/, "").replace(/\.git$/, "");
+			const segments = path.split("/").filter(Boolean);
+			const head = advertisement.symrefs.get("HEAD");
+			let defaultBranch = head?.startsWith(BRANCH_PREFIX) ? head.slice(11) : void 0;
+			if (defaultBranch === void 0) {
+				const headSha = advertisement.refs.find((ref) => ref.name === "HEAD")?.sha;
+				const matches = branchesOf(advertisement).filter((branch) => branch.sha === headSha);
+				if (headSha !== void 0 && matches.length === 1) defaultBranch = matches[0].name;
+			}
+			return {
+				id: repoUrl,
+				name: segments.at(-1) ?? url.host,
+				path,
+				namespace: segments.slice(0, -1).join("/"),
+				defaultBranch,
+				private: authRequired.has(repoUrl),
+				urls: {
+					web: repoUrl.replace(/\.git$/, ""),
+					cloneHttp: repoUrl
+				},
+				raw: {
+					refs: advertisement.refs,
+					peeled: Object.fromEntries(advertisement.peeled),
+					capabilities: advertisement.capabilities
+				}
+			};
+		},
+		async listCommits() {
+			throw unsupported("commit history");
+		},
+		async getCommit() {
+			throw unsupported("commit lookup");
+		},
+		async listTags(params) {
+			const repoUrl = normalizeRepoUrl(params.repo);
+			return paginate(repoUrl, tagsOf(await fetchAdvertisement(repoUrl, params.signal)), params);
+		},
+		async listBranches(params) {
+			const repoUrl = normalizeRepoUrl(params.repo);
+			return paginate(repoUrl, branchesOf(await fetchAdvertisement(repoUrl, params.signal)), params);
+		},
+		async getBranch(params) {
+			const branch = branchesOf(await fetchAdvertisement(normalizeRepoUrl(params.repo), params.signal)).find((candidate) => candidate.name === params.name);
+			if (branch === void 0) throw new RepoError(`Branch "${params.name}" not found`, {
+				code: "not_found",
+				provider: "git-http"
+			});
+			return branch;
+		},
+		async getTag(params) {
+			const tag = tagsOf(await fetchAdvertisement(normalizeRepoUrl(params.repo), params.signal)).find((candidate) => candidate.name === params.name);
+			if (tag === void 0) throw new RepoError(`Tag "${params.name}" not found`, {
+				code: "not_found",
+				provider: "git-http"
+			});
+			return tag;
+		},
+		async searchRefs(params) {
+			const advertisement = await fetchAdvertisement(normalizeRepoUrl(params.repo), params.signal);
+			const matches = [];
+			for (const type of ["branch", "tag"]) {
+				if (!params.types.includes(type)) continue;
+				const prefix = type === "branch" ? BRANCH_PREFIX : TAG_PREFIX;
+				for (const ref of advertisement.refs) {
+					if (!ref.name.startsWith(prefix)) continue;
+					const name = ref.name.slice(prefix.length);
+					if (!name.startsWith(params.query)) continue;
+					matches.push({
+						type,
+						name,
+						sha: ref.sha,
+						raw: ref
+					});
+				}
+			}
+			return matches.slice(0, params.limit);
+		},
+		async downloadArchive() {
+			throw unsupported("archive downloads");
+		},
+		async getCloneUrl(params) {
+			const repoUrl = normalizeRepoUrl(params.repo);
+			if (!auth) return { url: repoUrl };
+			const url = new URL(repoUrl);
+			url.username = username;
+			url.password = await currentSecret(false);
+			return { url: url.toString() };
+		},
+		async createWebhook() {
+			throw unsupported("webhooks");
+		},
+		async listWebhooks() {
+			throw unsupported("webhooks");
+		},
+		async getWebhook() {
+			throw unsupported("webhooks");
+		},
+		async updateWebhook() {
+			throw unsupported("webhooks");
+		},
+		async deleteWebhook() {
+			throw unsupported("webhooks");
+		}
+	};
+}
+//#endregion
+export { gitHttp };

package/dist/gitea.d.ts

@@ -1,4 +1,4 @@
-import { E as ParsedWebhookEvent, I as TokenProvider, M as RepoProvider, g as IncomingWebhookRequest } from "./types-CwXDjAbE.js";
+import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-DfiRluvJ.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/gitea/index.d.ts
 interface GiteaProviderOptions {

package/dist/gitea.js

@@ -1,6 +1,7 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-1KJe54LW.js";
-import { a as headShaOrUndefined, c as encodeRefPath, d as parseLinkNext, f as HttpClient, l as filenameFromContentDisposition, n as timingSafeEqual, o as clampPerPage, r as toIncomingWebhook, s as commitWebUrlBuilder, t as hmacSha256Hex, u as isRecord } from "./verify-CRVfL8D9.js";
+import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
+import { a as isRecord, i as filenameFromContentDisposition, n as commitWebUrlBuilder, o as parseLinkNext, r as encodeRefPath, s as HttpClient, t as clampPerPage } from "./shared-CuiOaaLD.js";
+import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook, t as hmacSha256Hex } from "./verify-BBMVxz8q.js";
 //#region src/providers/gitea/index.ts
 const DEFAULT_BASE_URL = "https://gitea.com/api/v1";
 const CAPABILITIES = {
@@ -354,6 +355,14 @@ function gitea(options) {
 				cursor: nextCursor(response)
 			};
 		},
+		async getBranch(params) {
+			const { data } = await http.json(`${repoPath(params.repo)}/branches/${encodeRefPath(params.name)}`, { signal: params.signal });
+			return toBranch(data);
+		},
+		async getTag(params) {
+			const { data } = await http.json(`${repoPath(params.repo)}/tags/${encodeRefPath(params.name)}`, { signal: params.signal });
+			return toTag(data);
+		},
 		async searchRefs(params) {
 			const namespaces = {
 				branch: "heads",

package/dist/github.d.ts

@@ -1,4 +1,4 @@
-import { E as ParsedWebhookEvent, I as TokenProvider, M as RepoProvider, g as IncomingWebhookRequest } from "./types-CwXDjAbE.js";
+import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-DfiRluvJ.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/github/app-auth.d.ts
 interface InstallationToken {

package/dist/github.js

@@ -1,6 +1,7 @@
 import { n as codeFromStatus, t as RepoError } from "./errors-Cxq_CqYv.js";
-import { i as bytesToBase64Url, n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-1KJe54LW.js";
-import { a as headShaOrUndefined, c as encodeRefPath, d as parseLinkNext, f as HttpClient, i as verifyHmacSignature, l as filenameFromContentDisposition, o as clampPerPage, r as toIncomingWebhook, s as commitWebUrlBuilder, u as isRecord } from "./verify-CRVfL8D9.js";
+import { i as bytesToBase64Url, n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
+import { a as isRecord, i as filenameFromContentDisposition, n as commitWebUrlBuilder, o as parseLinkNext, r as encodeRefPath, s as HttpClient, t as clampPerPage } from "./shared-CuiOaaLD.js";
+import { a as headShaOrUndefined, i as verifyHmacSignature, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/github/app-auth.ts
 const RSA_ALGORITHM_IDENTIFIER = [
 	48,
@@ -695,6 +696,37 @@ function github(options) {
 				cursor: nextCursor(response)
 			};
 		},
+		async getBranch(params) {
+			const { data } = await http.json(`${repoPath(params.repo)}/branches/${encodeRefPath(params.name)}`, { signal: params.signal });
+			return toBranch(data);
+		},
+		async getTag(params) {
+			const { data: ref } = await http.json(`${repoPath(params.repo)}/git/ref/tags/${encodeRefPath(params.name)}`, { signal: params.signal });
+			const name = ref.ref.replace(/^refs\/tags\//, "");
+			if (ref.object.type !== "tag") return {
+				name,
+				sha: ref.object.sha,
+				isAnnotated: false,
+				raw: ref
+			};
+			let sha = ref.object.sha;
+			for (let hops = 0; hops < 5; hops++) {
+				const { data } = await http.json(`${repoPath(params.repo)}/git/tags/${sha}`, { signal: params.signal });
+				sha = data.object.sha;
+				if (data.object.type !== "tag") return {
+					name,
+					sha,
+					message: data.message ?? void 0,
+					date: data.tagger?.date ? new Date(data.tagger.date) : void 0,
+					isAnnotated: true,
+					raw: data
+				};
+			}
+			throw new RepoError(`Tag ${name} points at a tag chain deeper than 5 objects`, {
+				code: "provider_error",
+				provider: "github"
+			});
+		},
 		async searchRefs(params) {
 			const namespaces = {
 				branch: "heads",

package/dist/gitlab.d.ts

@@ -1,4 +1,4 @@
-import { E as ParsedWebhookEvent, I as TokenProvider, M as RepoProvider, g as IncomingWebhookRequest } from "./types-CwXDjAbE.js";
+import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-DfiRluvJ.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/gitlab/index.d.ts
 interface GitLabProviderOptions {

package/dist/gitlab.js

@@ -1,6 +1,7 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-1KJe54LW.js";
-import { a as headShaOrUndefined, d as parseLinkNext, f as HttpClient, l as filenameFromContentDisposition, n as timingSafeEqual, o as clampPerPage, r as toIncomingWebhook, s as commitWebUrlBuilder, u as isRecord } from "./verify-CRVfL8D9.js";
+import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
+import { a as isRecord, i as filenameFromContentDisposition, n as commitWebUrlBuilder, o as parseLinkNext, s as HttpClient, t as clampPerPage } from "./shared-CuiOaaLD.js";
+import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/gitlab/index.ts
 const DEFAULT_BASE_URL = "https://gitlab.com/api/v4";
 const CAPABILITIES = {
@@ -377,6 +378,14 @@ function gitlab(options) {
 				cursor: nextCursor(reqUrl(path, query), response)
 			};
 		},
+		async getBranch(params) {
+			const { data } = await http.json(`/projects/${projectId(params.repo)}/repository/branches/${encodeURIComponent(params.name)}`, { signal: params.signal });
+			return toBranch(data);
+		},
+		async getTag(params) {
+			const { data } = await http.json(`/projects/${projectId(params.repo)}/repository/tags/${encodeURIComponent(params.name)}`, { signal: params.signal });
+			return toTag(data);
+		},
 		async searchRefs(params) {
 			const base = `/projects/${projectId(params.repo)}/repository`;
 			const query = {

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { A as RefType, B as WebhookEventType, C as Namespace, D as ProviderName, E as ParsedWebhookEvent, F as Tag, I as TokenProvider, L as UpdateWebhookParams, M as RepoProvider, N as Repository, O as ProviderSearchRefsParams, P as SearchRefsParams, R as UserRef, S as ListWebhooksParams, T as Page, V as WebhookVerificationMethod, _ as ListBranchesParams, a as CloneUrl, b as ListRepositoriesParams, c as DeleteWebhookParams, d as GetCloneUrlParams, f as GetCommitParams, g as IncomingWebhookRequest, h as GitActor, i as Branch, j as RepoCapabilities, k as RefMatch, l as DownloadArchiveParams, m as GetWebhookParams, n as ArchiveFormat, o as Commit, p as GetRepositoryParams, r as AuthenticatedUser, s as CreateWebhookParams, t as Archive, u as GetAuthenticatedUserParams, v as ListCommitsParams, w as NamespaceKind, x as ListTagsParams, y as ListNamespacesParams, z as Webhook } from "./types-CwXDjAbE.js";
+import { A as ProviderRefMatch, B as TokenProvider, C as ListTagsParams, D as Page, E as NamespaceKind, F as RepoProvider, G as WebhookVerificationMethod, H as UserRef, I as Repository, L as ResolveRefParams, M as RefMatch, N as RefType, O as ParsedWebhookEvent, P as RepoCapabilities, R as SearchRefsParams, S as ListRepositoriesParams, T as Namespace, U as Webhook, V as UpdateWebhookParams, W as WebhookEventType, _ as GitActor, a as CloneUrl, b as ListCommitsParams, c as DeleteWebhookParams, d as GetBranchParams, f as GetCloneUrlParams, g as GetWebhookParams, h as GetTagParams, i as Branch, j as ProviderSearchRefsParams, k as ProviderName, l as DownloadArchiveParams, m as GetRepositoryParams, n as ArchiveFormat, o as Commit, p as GetCommitParams, r as AuthenticatedUser, s as CreateWebhookParams, t as Archive, u as GetAuthenticatedUserParams, v as IncomingWebhookRequest, w as ListWebhooksParams, x as ListNamespacesParams, y as ListBranchesParams, z as Tag } from "./types-DfiRluvJ.js";
 //#region src/client.d.ts
 interface RetryOptions {
   rateLimit?: boolean;
@@ -33,13 +33,16 @@ interface RepoClient {
   tags: {
     list(params: ListTagsParams): Promise<Page<Tag>>;
     listAll(params: Omit<ListTagsParams, 'cursor'>): AsyncGenerator<Tag, void>;
+    get(params: GetTagParams): Promise<Tag>;
   };
   branches: {
     list(params: ListBranchesParams): Promise<Page<Branch>>;
     listAll(params: Omit<ListBranchesParams, 'cursor'>): AsyncGenerator<Branch, void>;
+    get(params: GetBranchParams): Promise<Branch>;
   };
   refs: {
     search(params: SearchRefsParams): Promise<RefMatch[]>;
+    resolve(params: ResolveRefParams): Promise<RefMatch>;
   };
   webhooks: {
     create(params: CreateWebhookParams): Promise<Webhook>;
@@ -89,4 +92,4 @@ declare class RepoError extends Error {
   constructor(message: string, options: RepoErrorOptions);
 }
 //#endregion
-export { type Archive, type ArchiveFormat, type AuthenticatedUser, type Branch, type CloneUrl, type Commit, type CreateClientOptions, type CreateWebhookParams, type DeleteWebhookParams, type DetectWebhookProviderInput, type DownloadArchiveParams, type GetAuthenticatedUserParams, type GetCloneUrlParams, type GetCommitParams, type GetRepositoryParams, type GetWebhookParams, type GitActor, type IncomingWebhookRequest, type ListBranchesParams, type ListCommitsParams, type ListNamespacesParams, type ListRepositoriesParams, type ListTagsParams, type ListWebhooksParams, type Namespace, type NamespaceKind, type Page, type ParsedWebhookEvent, type ProviderName, type ProviderSearchRefsParams, type RefMatch, type RefType, type RepoCapabilities, type RepoClient, RepoError, type RepoErrorCode, type RepoErrorOptions, type RepoProvider, type Repository, type RetryOptions, type SearchRefsParams, type Tag, type TokenProvider, type UpdateWebhookParams, type UserRef, type Webhook, type WebhookEventType, type WebhookVerificationMethod, createClient, detectWebhookProvider };
+export { type Archive, type ArchiveFormat, type AuthenticatedUser, type Branch, type CloneUrl, type Commit, type CreateClientOptions, type CreateWebhookParams, type DeleteWebhookParams, type DetectWebhookProviderInput, type DownloadArchiveParams, type GetAuthenticatedUserParams, type GetBranchParams, type GetCloneUrlParams, type GetCommitParams, type GetRepositoryParams, type GetTagParams, type GetWebhookParams, type GitActor, type IncomingWebhookRequest, type ListBranchesParams, type ListCommitsParams, type ListNamespacesParams, type ListRepositoriesParams, type ListTagsParams, type ListWebhooksParams, type Namespace, type NamespaceKind, type Page, type ParsedWebhookEvent, type ProviderName, type ProviderRefMatch, type ProviderSearchRefsParams, type RefMatch, type RefType, type RepoCapabilities, type RepoClient, RepoError, type RepoErrorCode, type RepoErrorOptions, type RepoProvider, type Repository, type ResolveRefParams, type RetryOptions, type SearchRefsParams, type Tag, type TokenProvider, type UpdateWebhookParams, type UserRef, type Webhook, type WebhookEventType, type WebhookVerificationMethod, createClient, detectWebhookProvider };

package/dist/index.js

@@ -10,6 +10,40 @@ const ALL_REF_TYPES = [
 	"commit"
 ];
 const COMMIT_SHA_PATTERN = /^[0-9a-f]{4,40}$/i;
+const FULL_COMMIT_SHA_PATTERN = /^[0-9a-f]{40}$/i;
+const BRANCH_REF_PREFIX = "refs/heads/";
+const TAG_REF_PREFIX = "refs/tags/";
+function qualifyRef(match) {
+	const ref = match.type === "branch" ? `${BRANCH_REF_PREFIX}${match.name}` : match.type === "tag" ? `${TAG_REF_PREFIX}${match.name}` : match.sha;
+	return {
+		...match,
+		ref
+	};
+}
+function branchMatch(branch) {
+	return qualifyRef({
+		type: "branch",
+		name: branch.name,
+		sha: branch.sha,
+		raw: branch.raw
+	});
+}
+function tagMatch(tag) {
+	return qualifyRef({
+		type: "tag",
+		name: tag.name,
+		sha: tag.sha,
+		raw: tag.raw
+	});
+}
+function commitMatch(commit) {
+	return qualifyRef({
+		type: "commit",
+		name: commit.sha,
+		sha: commit.sha,
+		raw: commit.raw
+	});
+}
 function createClient(options) {
 	const { provider } = options;
 	const retryRateLimit = options.retry?.rateLimit ?? true;
@@ -112,6 +146,11 @@ function createClient(options) {
 			}
 		},
 		tags: {
+			get: async (params) => {
+				requireNonEmpty(params.repo, "repo");
+				requireNonEmpty(params.name, "name");
+				return withRetry(() => provider.getTag(params));
+			},
 			list: async (params) => {
 				requireNonEmpty(params.repo, "repo");
 				return withRetry(() => provider.listTags(params));
@@ -122,6 +161,11 @@ function createClient(options) {
 			})
 		},
 		branches: {
+			get: async (params) => {
+				requireNonEmpty(params.repo, "repo");
+				requireNonEmpty(params.name, "name");
+				return withRetry(() => provider.getBranch(params));
+			},
 			list: async (params) => {
 				requireNonEmpty(params.repo, "repo");
 				return withRetry(() => provider.listBranches(params));
@@ -131,57 +175,116 @@ function createClient(options) {
 				return provider.listBranches(p);
 			})
 		},
-		refs: { search: async (params) => {
-			requireNonEmpty(params.repo, "repo");
-			if (!provider.capabilities.refSearch) fail("unsupported", `${provider.name} does not support ref search`);
-			const types = params.types ?? ALL_REF_TYPES;
-			if (types.length === 0) fail("validation", "At least one ref type is required");
-			const { repo, query, signal } = params;
-			const limit = params.limit ?? DEFAULT_REF_SEARCH_LIMIT;
-			if (query === "") {
-				const [branches, tags] = await Promise.all([types.includes("branch") ? withRetry(() => provider.listBranches({
+		refs: {
+			search: async (params) => {
+				requireNonEmpty(params.repo, "repo");
+				if (!provider.capabilities.refSearch) fail("unsupported", `${provider.name} does not support ref search`);
+				const types = params.types ?? ALL_REF_TYPES;
+				if (types.length === 0) fail("validation", "At least one ref type is required");
+				const { repo, query, signal } = params;
+				const limit = params.limit ?? DEFAULT_REF_SEARCH_LIMIT;
+				if (query === "") {
+					const [branches, tags] = await Promise.all([types.includes("branch") ? withRetry(() => provider.listBranches({
+						repo,
+						limit,
+						signal
+					})) : { data: [] }, types.includes("tag") ? withRetry(() => provider.listTags({
+						repo,
+						limit,
+						signal
+					})) : { data: [] }]);
+					return [...branches.data.map(branchMatch), ...tags.data.map(tagMatch)].slice(0, limit);
+				}
+				const refTypes = types.filter((t) => t !== "commit");
+				const [refMatches, commitMatches] = await Promise.all([refTypes.length > 0 ? withRetry(() => provider.searchRefs({
 					repo,
+					query,
+					types: refTypes,
 					limit,
 					signal
-				})) : { data: [] }, types.includes("tag") ? withRetry(() => provider.listTags({
+				})).then((matches) => matches.map(qualifyRef)) : [], types.includes("commit") && COMMIT_SHA_PATTERN.test(query) ? withRetry(() => provider.getCommit({
 					repo,
-					limit,
+					ref: query,
+					signal
+				})).then((commit) => [commitMatch(commit)], (error) => {
+					if (error instanceof RepoError && (error.code === "not_found" || error.code === "validation" || error.code === "unsupported")) return [];
+					throw error;
+				}) : []]);
+				return [...refMatches, ...commitMatches].slice(0, limit);
+			},
+			resolve: async (params) => {
+				requireNonEmpty(params.repo, "repo");
+				requireNonEmpty(params.ref, "ref");
+				const { repo, signal } = params;
+				let { ref, type } = params;
+				const impliedType = ref.startsWith(BRANCH_REF_PREFIX) ? "branch" : ref.startsWith(TAG_REF_PREFIX) ? "tag" : void 0;
+				if (impliedType !== void 0) {
+					if (type !== void 0 && type !== impliedType) fail("validation", `Fully-qualified ref '${ref}' contradicts type '${type}'`);
+					type = impliedType;
+					ref = ref.slice(impliedType === "branch" ? 11 : 10);
+					requireNonEmpty(ref, "ref");
+				}
+				if (impliedType === void 0 && ref === "HEAD" && (type === void 0 || type === "branch")) {
+					const defaultBranch = (await withRetry(() => provider.getRepository({
+						repo,
+						signal
+					}))).defaultBranch;
+					if (defaultBranch === void 0) throw new RepoError("Cannot resolve HEAD: repository has no default branch", {
+						code: "not_found",
+						provider: provider.name
+					});
+					return branchMatch(await withRetry(() => provider.getBranch({
+						repo,
+						name: defaultBranch,
+						signal
+					})));
+				}
+				if (type === "commit") return commitMatch(await withRetry(() => provider.getCommit({
+					repo,
+					ref,
 					signal
-				})) : { data: [] }]);
-				return [...branches.data.map((b) => ({
-					type: "branch",
-					name: b.name,
-					sha: b.sha,
-					raw: b.raw
-				})), ...tags.data.map((t) => ({
-					type: "tag",
-					name: t.name,
-					sha: t.sha,
-					raw: t.raw
-				}))].slice(0, limit);
+				})));
+				let commitProbeError;
+				if (type === void 0 && FULL_COMMIT_SHA_PATTERN.test(ref)) try {
+					return commitMatch(await withRetry(() => provider.getCommit({
+						repo,
+						ref,
+						signal
+					})));
+				} catch (error) {
+					if (error instanceof RepoError && (error.code === "not_found" || error.code === "validation" || error.code === "unsupported")) commitProbeError = error;
+					else throw error;
+				}
+				const [tagResult, branchResult] = await Promise.allSettled([type === "branch" ? void 0 : withRetry(() => provider.getTag({
+					repo,
+					name: ref,
+					signal
+				})), type === "tag" ? void 0 : withRetry(() => provider.getBranch({
+					repo,
+					name: ref,
+					signal
+				}))]);
+				const isMiss = (result) => result.status === "rejected" && result.reason instanceof RepoError && result.reason.code === "not_found";
+				if (tagResult.status === "fulfilled") {
+					if (tagResult.value !== void 0) return tagMatch(tagResult.value);
+				} else if (!isMiss(tagResult)) throw tagResult.reason;
+				if (branchResult.status === "fulfilled") {
+					if (branchResult.value !== void 0) return branchMatch(branchResult.value);
+				} else if (!isMiss(branchResult)) throw branchResult.reason;
+				if (type === void 0 && COMMIT_SHA_PATTERN.test(ref)) {
+					if (commitProbeError !== void 0) throw commitProbeError;
+					return commitMatch(await withRetry(() => provider.getCommit({
+						repo,
+						ref,
+						signal
+					})));
+				}
+				throw new RepoError(`Ref not found: ${ref}`, {
+					code: "not_found",
+					provider: provider.name
+				});
 			}
-			const refTypes = types.filter((t) => t !== "commit");
-			const [refMatches, commitMatches] = await Promise.all([refTypes.length > 0 ? withRetry(() => provider.searchRefs({
-				repo,
-				query,
-				types: refTypes,
-				limit,
-				signal
-			})) : [], types.includes("commit") && COMMIT_SHA_PATTERN.test(query) ? withRetry(() => provider.getCommit({
-				repo,
-				ref: query,
-				signal
-			})).then((commit) => [{
-				type: "commit",
-				name: commit.sha,
-				sha: commit.sha,
-				raw: commit.raw
-			}], (error) => {
-				if (error instanceof RepoError && (error.code === "not_found" || error.code === "validation")) return [];
-				throw error;
-			}) : []]);
-			return [...refMatches, ...commitMatches].slice(0, limit);
-		} },
+		},
 		webhooks: {
 			create: async (params) => {
 				requireNonEmpty(params.repo, "repo");

package/dist/{pagination-1KJe54LW.js → pagination-CWWHSu8I.js}

@@ -1,9 +1,15 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
 //#region src/base64.ts
-function bytesToBase64Url(bytes) {
+function bytesToBase64(bytes) {
 	let binary = "";
 	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+	return btoa(binary);
+}
+function bytesToBase64Url(bytes) {
+	return bytesToBase64(bytes).replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function stringToBase64(text) {
+	return bytesToBase64(new TextEncoder().encode(text));
 }
 function stringToBase64Url(text) {
 	return bytesToBase64Url(new TextEncoder().encode(text));
@@ -64,4 +70,4 @@ function assertSameOriginUrl(provider, baseUrl, url) {
 	return url;
 }
 //#endregion
-export { bytesToBase64Url as i, decodeCursor as n, encodeCursor as r, assertSameOriginUrl as t };
+export { stringToBase64 as a, bytesToBase64Url as i, decodeCursor as n, encodeCursor as r, assertSameOriginUrl as t };

package/dist/{verify-CRVfL8D9.js → shared-CuiOaaLD.js}

@@ -102,64 +102,4 @@ function filenameFromContentDisposition(header) {
 	return header.match(/filename="?([^";]+)"?/i)?.[1]?.trim();
 }
 //#endregion
-//#region src/webhooks/parse.ts
-/**
-* A push that deletes its ref reports an all-zero object id; normalize that to
-* undefined so `headCommitSha` is only set when the ref still points at a commit.
-*/
-function headShaOrUndefined(sha) {
-	if (!sha || /^0+$/.test(sha)) return void 0;
-	return sha;
-}
-//#endregion
-//#region src/webhooks/verify.ts
-const encoder = new TextEncoder();
-async function hmacSha256Hex(secret, payload) {
-	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	const data = typeof payload === "string" ? encoder.encode(payload) : payload;
-	const signature = await crypto.subtle.sign("HMAC", key, data);
-	return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function timingSafeEqual(a, b) {
-	const bytesA = encoder.encode(a);
-	const bytesB = encoder.encode(b);
-	const length = Math.max(bytesA.length, bytesB.length);
-	let mismatch = bytesA.length === bytesB.length ? 0 : 1;
-	for (let index = 0; index < length; index++) mismatch |= (bytesA[index] ?? 0) ^ (bytesB[index] ?? 0);
-	return mismatch === 0;
-}
-/**
-* Shared HMAC webhook verification: compares the incoming signature header
-* against `${scheme}=<hmac-sha256(secret, body)>` in constant time. Providers
-* differ only in the header name and (rarely) the scheme prefix.
-*/
-async function verifyHmacSignature(params, options) {
-	if (!params.secret) return false;
-	const incoming = await toIncomingWebhook("request" in params ? params.request : params);
-	const signature = incoming.headers[options.header.toLowerCase()];
-	if (!signature) return false;
-	return timingSafeEqual(signature, `${options.scheme ?? "sha256"}=${await hmacSha256Hex(params.secret, incoming.body)}`);
-}
-async function toIncomingWebhook(input) {
-	if (input instanceof Request) {
-		const headers = {};
-		input.headers.forEach((value, key) => {
-			headers[key.toLowerCase()] = value;
-		});
-		return {
-			headers,
-			body: await input.clone().text()
-		};
-	}
-	const headers = {};
-	for (const [key, value] of Object.entries(input.headers)) headers[key.toLowerCase()] = value;
-	return {
-		headers,
-		body: input.body
-	};
-}
-//#endregion
-export { headShaOrUndefined as a, encodeRefPath as c, parseLinkNext as d, HttpClient as f, verifyHmacSignature as i, filenameFromContentDisposition as l, timingSafeEqual as n, clampPerPage as o, toIncomingWebhook as r, commitWebUrlBuilder as s, hmacSha256Hex as t, isRecord as u };
+export { isRecord as a, filenameFromContentDisposition as i, commitWebUrlBuilder as n, parseLinkNext as o, encodeRefPath as r, HttpClient as s, clampPerPage as t };

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { B as WebhookEventType, C as Namespace, D as ProviderName, F as Tag, M as RepoProvider, N as Repository, i as Branch, j as RepoCapabilities, o as Commit, w as NamespaceKind, z as Webhook } from "./types-CwXDjAbE.js";
+import { E as NamespaceKind, F as RepoProvider, I as Repository, P as RepoCapabilities, T as Namespace, U as Webhook, W as WebhookEventType, i as Branch, k as ProviderName, o as Commit, z as Tag } from "./types-DfiRluvJ.js";
 //#region src/providers/testing/index.d.ts
 interface InMemoryNamespaceSeed {
   id: string;

package/dist/testing.js

@@ -1,5 +1,5 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor } from "./pagination-1KJe54LW.js";
+import { n as decodeCursor, r as encodeCursor } from "./pagination-CWWHSu8I.js";
 //#region src/providers/testing/index.ts
 /**
 * Small on purpose so that consumers exercise cursor-based pagination.
@@ -220,6 +220,18 @@ function createInMemoryProvider(seed = {}, options = {}) {
 			requireRepository(params.repo);
 			return Promise.resolve(paginate(state.branches.get(params.repo) ?? [], params.cursor));
 		},
+		getBranch(params) {
+			requireRepository(params.repo);
+			const branch = (state.branches.get(params.repo) ?? []).find((candidate) => candidate.name === params.name);
+			if (!branch) throw notFound(`Unknown branch "${params.name}" in repository: ${params.repo}`);
+			return Promise.resolve(branch);
+		},
+		getTag(params) {
+			requireRepository(params.repo);
+			const tag = (state.tags.get(params.repo) ?? []).find((candidate) => candidate.name === params.name);
+			if (!tag) throw notFound(`Unknown tag "${params.name}" in repository: ${params.repo}`);
+			return Promise.resolve(tag);
+		},
 		searchRefs(params) {
 			requireRepository(params.repo);
 			const matches = [];

package/dist/{types-CwXDjAbE.d.ts → types-DfiRluvJ.d.ts}

@@ -1,9 +1,9 @@
 //#region src/types.d.ts
-type ProviderName = 'github' | 'gitlab' | 'bitbucket' | 'azure-devops' | 'gitea';
+type ProviderName = 'github' | 'gitlab' | 'bitbucket' | 'azure-devops' | 'gitea' | 'git-http';
 type WebhookEventType = 'push' | 'tag_push' | 'release';
 type ArchiveFormat = 'zip' | 'tar.gz';
 type NamespaceKind = 'user' | 'organization' | 'group' | 'workspace' | 'project';
-type WebhookVerificationMethod = 'hmac-sha256' | 'shared-token' | 'basic-auth';
+type WebhookVerificationMethod = 'hmac-sha256' | 'shared-token' | 'basic-auth' | 'none';
 /**
  * Mints a bearer token for each request. `forceRefresh` is true only on the
  * single retry after a 401 — bypass any cache and mint a fresh token then.
@@ -93,10 +93,14 @@ type RefType = 'branch' | 'tag' | 'commit';
 interface RefMatch {
   type: RefType;
   name: string;
-  /** SHA the ref points to; the tag object rather than the commit for annotated tags on GitHub and Gitea. */
+  /** Fully-qualified form — `refs/heads/<name>` for branches, `refs/tags/<name>` for tags, the SHA itself for commits. Any `ref` value round-trips through `refs.resolve`. */
+  ref: string;
+  /** SHA the ref points to. In `refs.search` results on GitHub and Gitea, annotated tags carry the tag object SHA rather than the commit; `refs.resolve` and `tags.get` always return the peeled commit SHA. */
   sha: string;
   raw: unknown;
 }
+/** `RefMatch` as produced by provider adapters, before the client derives the fully-qualified `ref`. */
+type ProviderRefMatch = Omit<RefMatch, 'ref'>;
 interface Webhook {
   id: string;
   url: string;
@@ -178,6 +182,21 @@ interface ListBranchesParams extends BaseParams {
   cursor?: string;
   limit?: number;
 }
+interface GetBranchParams extends BaseParams {
+  repo: string;
+  name: string;
+}
+interface GetTagParams extends BaseParams {
+  repo: string;
+  name: string;
+}
+interface ResolveRefParams extends BaseParams {
+  repo: string;
+  /** A branch or tag name, a fully-qualified ref (`refs/heads/…`, `refs/tags/…`), a 4–40 hex commit SHA, or `HEAD`. */
+  ref: string;
+  /** Restrict resolution to one ref type; when omitted, a full 40-hex `ref` is tried as a commit first, then branches and tags (tag wins on collision), then abbreviated commit SHAs. A fully-qualified `ref` implies its type; passing a contradicting `type` throws a validation error. */
+  type?: RefType;
+}
 interface SearchRefsParams extends BaseParams {
   repo: string;
   /** Prefix to match ref names against; an empty string lists the first refs unfiltered. */
@@ -250,8 +269,12 @@ interface RepoProvider {
   getCommit(params: GetCommitParams): Promise<Commit>;
   listTags(params: ListTagsParams): Promise<Page<Tag>>;
   listBranches(params: ListBranchesParams): Promise<Page<Branch>>;
+  /** Exact-match a branch by name; throws `not_found` on a miss. */
+  getBranch(params: GetBranchParams): Promise<Branch>;
+  /** Exact-match a tag by name, peeled to the commit SHA for annotated tags; throws `not_found` on a miss. */
+  getTag(params: GetTagParams): Promise<Tag>;
   /** Prefix-match refs of the requested types, branches before tags, at most `limit` results. */
-  searchRefs(params: ProviderSearchRefsParams): Promise<RefMatch[]>;
+  searchRefs(params: ProviderSearchRefsParams): Promise<ProviderRefMatch[]>;
   downloadArchive(params: DownloadArchiveParams): Promise<Archive>;
   getCloneUrl(params: GetCloneUrlParams): Promise<CloneUrl>;
   createWebhook(params: CreateWebhookParams): Promise<Webhook>;
@@ -261,4 +284,4 @@ interface RepoProvider {
   deleteWebhook(params: DeleteWebhookParams): Promise<void>;
 }
 //#endregion
-export { RefType as A, WebhookEventType as B, Namespace as C, ProviderName as D, ParsedWebhookEvent as E, Tag as F, TokenProvider as I, UpdateWebhookParams as L, RepoProvider as M, Repository as N, ProviderSearchRefsParams as O, SearchRefsParams as P, UserRef as R, ListWebhooksParams as S, Page as T, WebhookVerificationMethod as V, ListBranchesParams as _, CloneUrl as a, ListRepositoriesParams as b, DeleteWebhookParams as c, GetCloneUrlParams as d, GetCommitParams as f, IncomingWebhookRequest as g, GitActor as h, Branch as i, RepoCapabilities as j, RefMatch as k, DownloadArchiveParams as l, GetWebhookParams as m, ArchiveFormat as n, Commit as o, GetRepositoryParams as p, AuthenticatedUser as r, CreateWebhookParams as s, Archive as t, GetAuthenticatedUserParams as u, ListCommitsParams as v, NamespaceKind as w, ListTagsParams as x, ListNamespacesParams as y, Webhook as z };
+export { ProviderRefMatch as A, TokenProvider as B, ListTagsParams as C, Page as D, NamespaceKind as E, RepoProvider as F, WebhookVerificationMethod as G, UserRef as H, Repository as I, ResolveRefParams as L, RefMatch as M, RefType as N, ParsedWebhookEvent as O, RepoCapabilities as P, SearchRefsParams as R, ListRepositoriesParams as S, Namespace as T, Webhook as U, UpdateWebhookParams as V, WebhookEventType as W, GitActor as _, CloneUrl as a, ListCommitsParams as b, DeleteWebhookParams as c, GetBranchParams as d, GetCloneUrlParams as f, GetWebhookParams as g, GetTagParams as h, Branch as i, ProviderSearchRefsParams as j, ProviderName as k, DownloadArchiveParams as l, GetRepositoryParams as m, ArchiveFormat as n, Commit as o, GetCommitParams as p, AuthenticatedUser as r, CreateWebhookParams as s, Archive as t, GetAuthenticatedUserParams as u, IncomingWebhookRequest as v, ListWebhooksParams as w, ListNamespacesParams as x, ListBranchesParams as y, Tag as z };

package/dist/verify-BBMVxz8q.js

@@ -0,0 +1,61 @@
+//#region src/webhooks/parse.ts
+/**
+* A push that deletes its ref reports an all-zero object id; normalize that to
+* undefined so `headCommitSha` is only set when the ref still points at a commit.
+*/
+function headShaOrUndefined(sha) {
+	if (!sha || /^0+$/.test(sha)) return void 0;
+	return sha;
+}
+//#endregion
+//#region src/webhooks/verify.ts
+const encoder = new TextEncoder();
+async function hmacSha256Hex(secret, payload) {
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const data = typeof payload === "string" ? encoder.encode(payload) : payload;
+	const signature = await crypto.subtle.sign("HMAC", key, data);
+	return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function timingSafeEqual(a, b) {
+	const bytesA = encoder.encode(a);
+	const bytesB = encoder.encode(b);
+	const length = Math.max(bytesA.length, bytesB.length);
+	let mismatch = bytesA.length === bytesB.length ? 0 : 1;
+	for (let index = 0; index < length; index++) mismatch |= (bytesA[index] ?? 0) ^ (bytesB[index] ?? 0);
+	return mismatch === 0;
+}
+/**
+* Shared HMAC webhook verification: compares the incoming signature header
+* against `${scheme}=<hmac-sha256(secret, body)>` in constant time. Providers
+* differ only in the header name and (rarely) the scheme prefix.
+*/
+async function verifyHmacSignature(params, options) {
+	if (!params.secret) return false;
+	const incoming = await toIncomingWebhook("request" in params ? params.request : params);
+	const signature = incoming.headers[options.header.toLowerCase()];
+	if (!signature) return false;
+	return timingSafeEqual(signature, `${options.scheme ?? "sha256"}=${await hmacSha256Hex(params.secret, incoming.body)}`);
+}
+async function toIncomingWebhook(input) {
+	if (input instanceof Request) {
+		const headers = {};
+		input.headers.forEach((value, key) => {
+			headers[key.toLowerCase()] = value;
+		});
+		return {
+			headers,
+			body: await input.clone().text()
+		};
+	}
+	const headers = {};
+	for (const [key, value] of Object.entries(input.headers)) headers[key.toLowerCase()] = value;
+	return {
+		headers,
+		body: input.body
+	};
+}
+//#endregion
+export { headShaOrUndefined as a, verifyHmacSignature as i, timingSafeEqual as n, toIncomingWebhook as r, hmacSha256Hex as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-sdk",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Unified TypeScript SDK for git providers — GitHub, GitLab, Bitbucket, Azure DevOps, Gitea",
   "license": "MIT",
   "author": "Robin Genz <mail@robingenz.dev>",
@@ -17,6 +17,7 @@
     "azure-devops",
     "gitea",
     "forgejo",
+    "git-http",
     "sdk",
     "version-control",
     "webhooks"
@@ -54,6 +55,10 @@
       "types": "./dist/gitea.d.ts",
       "default": "./dist/gitea.js"
     },
+    "./git-http": {
+      "types": "./dist/git-http.d.ts",
+      "default": "./dist/git-http.js"
+    },
     "./testing": {
       "types": "./dist/testing.d.ts",
       "default": "./dist/testing.js"