repo-sdk 0.2.1 → 0.3.0

package/README.md

@@ -4,7 +4,16 @@
 [![npm downloads](https://img.shields.io/npm/dm/repo-sdk)](https://www.npmjs.com/package/repo-sdk)
 [![license](https://img.shields.io/npm/l/repo-sdk)](https://github.com/capawesome-team/repo-sdk/blob/main/LICENSE)
 
-A unified, normalized, zero-dependency, edge-compatible TypeScript SDK over GitHub, GitLab, Bitbucket Cloud, Azure DevOps, and Gitea — plus generic git smart-HTTP remotes. Write your discovery, commit, tag, download, and webhook logic once against one normalized API — built on raw `fetch` and Web Crypto, so it runs on Node, Cloudflare Workers, and other Web-standard runtimes.
+A unified, normalized, zero-dependency, edge-compatible TypeScript SDK over [GitHub](https://github.com), [GitLab](https://gitlab.com), [Bitbucket Cloud](https://bitbucket.org), [Azure DevOps](https://azure.microsoft.com/products/devops), and [Gitea](https://about.gitea.com) — plus generic git smart-HTTP remotes. Write your repository, commit, branch, tag, ref-resolution, download and webhook logic once against one normalized API — built on raw `fetch` and Web Crypto, so it runs on Node, Cloudflare Workers, and other Web-standard runtimes.
+
+## Features
+
+- **One API, eight namespaces** — users, namespaces, repos, commits, branches, tags, refs, and webhooks behind a single interface.
+- **Capability gating** — providers differ. The client reports what the active provider supports and throws `unsupported` instead of silently dropping an option.
+- **Ref resolution that follows git** — `refs.resolve` accepts a branch, a tag, a fully-qualified `refs/…`, `HEAD`, or an abbreviated SHA and returns one normalized match, with tags shadowing branches exactly like `git rev-parse`.
+- **Webhook verify & parse** — standalone per-provider helpers that take a Web-standard `Request`. No client, no credentials. `detectWebhookProvider` routes a shared endpoint to the right pair.
+- **Zero dependencies** — `fetch` and Web Crypto only. No `node:*` imports, so it runs on Cloudflare Workers without `nodejs_compat` — including RS256 JWT signing for GitHub App auth.
+- **Tree-shakable and typed** — each provider ships on its own subpath, so unused providers never reach your bundle. Every model is normalized (IDs as strings, dates as `Date`, refs fully qualified) and keeps the untouched provider payload on `raw`.
 
 ## Installation
 
@@ -14,6 +23,8 @@ npm install repo-sdk
 
 ## Quickstart
 
+Create a client from the package root and a provider factory from its subpath.
+
 ```ts
 import { createClient } from 'repo-sdk';
 import { github } from 'repo-sdk/github';
@@ -21,42 +32,154 @@ import { github } from 'repo-sdk/github';
 const client = createClient({
   provider: github({ auth: { token: process.env.GITHUB_TOKEN! } }),
 });
+```
+
+Resolve a ref — a branch, tag, SHA, or `HEAD` — to a single commit, and page through history.
 
-// Resolve a ref (branch, tag, or SHA) to a single commit.
+```ts
 const head = await client.commits.get({ repo: 'capawesome-team/repo-sdk', ref: 'main' });
 console.log(head.sha, head.message);
 
-// List commits on a branch.
-const { data: commits } = await client.commits.list({
+const { data: commits, cursor } = await client.commits.list({
   repo: 'capawesome-team/repo-sdk',
   ref: 'main',
   limit: 20,
 });
 ```
 
-Switching providers means swapping the `provider` — the rest of your code stays the same.
+Find out what a user-supplied ref actually is before you act on it.
 
-## Documentation
+```ts
+const match = await client.refs.resolve({ repo: 'capawesome-team/repo-sdk', ref: 'v1.0.0' });
+match.type; // 'branch' | 'tag' | 'commit'
+match.ref; // 'refs/tags/v1.0.0'
+match.sha; // peeled to the commit SHA for annotated tags
+```
 
-Full documentation lives at **[repo-sdk.dev](https://repo-sdk.dev)** ([docs](https://repo-sdk.dev/docs)):
+Download the code at that ref, as a stream or as a credential-bearing clone URL for the `git` CLI.
 
-- [Quickstart](https://repo-sdk.dev/docs/quickstart)
-- [Authentication](https://repo-sdk.dev/docs/authentication)
-- [Guides](https://repo-sdk.dev/docs/guides)
-- [API Reference](https://repo-sdk.dev/docs/reference)
+```ts
+const archive = await client.repos.downloadArchive({
+  repo: 'capawesome-team/repo-sdk',
+  ref: match.sha,
+  format: 'tar.gz',
+});
+await new Response(archive.stream).arrayBuffer();
+
+const { url } = await client.repos.getCloneUrl({ repo: 'capawesome-team/repo-sdk' });
+```
+
+Verify and handle the webhook. The helpers take the `Request` itself — no client, no credentials.
+
+```ts
+import { parseWebhookEvent, verifyWebhook } from 'repo-sdk/github';
+
+export async function POST(request: Request): Promise<Response> {
+  if (!(await verifyWebhook({ request, secret: process.env.WEBHOOK_SECRET! }))) {
+    return new Response('invalid signature', { status: 401 });
+  }
+
+  const event = await parseWebhookEvent(request);
+
+  switch (event.type) {
+    case 'push':
+      // event.headCommitSha is undefined when the push deleted the ref.
+      break;
+    case 'tag_push':
+      // event.ref is always fully qualified — refs/tags/v1.0.0.
+      break;
+    case 'release':
+      break;
+  }
+
+  return new Response(null, { status: 204 });
+}
+```
+
+## API at a glance
+
+| Namespace    | Methods                                                                                |
+| ------------ | -------------------------------------------------------------------------------------- |
+| `users`      | `me`                                                                                   |
+| `namespaces` | `list` · `listAll`                                                                     |
+| `repos`      | `list` · `listAll` · `get` · `downloadArchive` · `getCloneCredentials` · `getCloneUrl` |
+| `commits`    | `list` · `listAll` · `get`                                                             |
+| `branches`   | `list` · `listAll` · `get`                                                             |
+| `tags`       | `list` · `listAll` · `get`                                                             |
+| `refs`       | `resolve` · `search`                                                                   |
+| `webhooks`   | `create` · `list` · `get` · `update` · `delete`                                        |
+
+Every list returns an opaque cursor and has a `listAll` async generator that walks the pages for you. Cursors are provider-tagged and origin-checked, so a forged one cannot redirect an authenticated request. Every method accepts a `signal` for cancellation. Rate-limited requests are retried once when the provider's `Retry-After` fits the budget (10 seconds by default, configurable via `retry`).
+
+Webhook payload helpers — `verifyWebhook` and `parseWebhookEvent` — are exported from the provider subpaths and take no credential beyond the shared secret, so they run in a handler with no client at all. `detectWebhookProvider` from the core entry identifies the sender when one endpoint serves several providers.
 
 ## Providers
 
 | Provider     | Import                  | Notes                                                            |
 | ------------ | ----------------------- | ---------------------------------------------------------------- |
-| GitHub       | `repo-sdk/github`       | Token and GitHub App auth                                        |
-| GitLab       | `repo-sdk/gitlab`       | PAT, group/project, or OAuth token                               |
-| Bitbucket    | `repo-sdk/bitbucket`    | Bitbucket Cloud                                                  |
-| Azure DevOps | `repo-sdk/azure-devops` | PAT or Entra ID                                                  |
-| Gitea        | `repo-sdk/gitea`        | Gitea ≥ 1.20 and Forgejo                                         |
-| Generic git  | `repo-sdk/git-http`     | Any git smart-HTTP remote (read-only ref discovery + clone URLs) |
+| GitHub       | `repo-sdk/github`       | Personal access token or GitHub App installation auth.           |
+| GitLab       | `repo-sdk/gitlab`       | Personal, group, project, or OAuth token.                        |
+| Bitbucket    | `repo-sdk/bitbucket`    | Bitbucket Cloud. Atlassian API token or access token.            |
+| Azure DevOps | `repo-sdk/azure-devops` | Organization-scoped. PAT or Entra ID token.                      |
+| Gitea        | `repo-sdk/gitea`        | Gitea ≥ 1.20 and Forgejo.                                        |
+| Generic git  | `repo-sdk/git-http`     | Any git smart-HTTP remote. Ref discovery and clone URLs only.    |
+| Testing      | `repo-sdk/testing`      | Seedable in-memory provider for your test suite. No credentials. |
 
-Self-hosted deployments — GitHub Enterprise Server, GitLab self-managed, Azure DevOps Server, and Gitea/Forgejo instances — are supported via `baseUrl`.
+Every factory accepts an injectable `fetch`, and every token can be a static string or a `tokenProvider` that mints one per request and is re-invoked once on a 401. Self-hosted deployments — GitHub Enterprise Server, GitLab self-managed, Azure DevOps Server, and Gitea/Forgejo — are supported via `baseUrl`. Providers do not support the same feature set — `client.capabilities` tells you what the active one can do, and the full breakdown lives in the [capability matrix](https://repo-sdk.dev/docs/reference/capability-matrix).
+
+## Testing
+
+`repo-sdk/testing` ships a seedable in-memory provider you hand to `createClient` like any other — no account, no tokens, no `fetch` stubs, no throwaway repositories.
+
+```ts
+import { createClient } from 'repo-sdk';
+import { createInMemoryProvider } from 'repo-sdk/testing';
+
+const client = createClient({
+  provider: createInMemoryProvider({
+    repositories: { 'acme/app': { name: 'app', namespace: 'acme', defaultBranch: 'main' } },
+    branches: { 'acme/app': [{ name: 'main', sha: 'c1' }] },
+    commits: { 'acme/app': [{ sha: 'c1', message: 'Initial commit' }] },
+  }),
+});
+```
+
+It reports every capability enabled by default, and a second options argument simulates a specific provider's identity and capability gaps — so code that branches on `client.capabilities` is testable. Its page size is deliberately small, so your cursor pagination gets exercised, and `provider.state` exposes the data as plain maps for assertions.
+
+## Errors
+
+Every failure is a `RepoError` with a closed `code` union: `unauthorized`, `forbidden`, `not_found`, `rate_limited`, `validation`, `unsupported`, `provider_error`, `network_error`.
+
+```ts
+import { RepoError } from 'repo-sdk';
+
+try {
+  await client.repos.downloadArchive({ repo: 'acme/app', ref: 'main', format: 'tar.gz' });
+} catch (error) {
+  if (error instanceof RepoError && error.code === 'unsupported') {
+    // Azure DevOps serves zip only — fall back instead of failing the job.
+  }
+}
+```
+
+Errors also carry `provider`, `status`, `retryAfter` and `retryable`; `cause` is the underlying JS `Error`. Token values are redacted from every message, so a leaked stack trace cannot leak a credential. The deliberate exceptions are `repos.getCloneUrl`, which returns a URL with the credential embedded because that is what `git clone` needs, and `repos.getCloneCredentials`, which returns that credential next to a credential-free URL for a git credential helper — treat both as secrets.
+
+## Runtime support
+
+Node.js ≥ 20, Cloudflare Workers (without `nodejs_compat`), Deno, Bun, Vercel Edge, and any other runtime with `fetch`, Web Crypto and `TextEncoder`. ESM only.
+
+## Documentation
+
+Full documentation lives at **[repo-sdk.dev](https://repo-sdk.dev)** ([docs](https://repo-sdk.dev/docs)):
+
+- [Quickstart](https://repo-sdk.dev/docs/quickstart)
+- [Concepts](https://repo-sdk.dev/docs/concepts/client-and-providers) — clients, repositories and namespaces, capabilities, pagination, errors
+- [Authentication](https://repo-sdk.dev/docs/authentication) — tokens, GitHub Apps, Entra ID, and the scopes each provider needs
+- [Guides](https://repo-sdk.dev/docs/guides/resolving-refs) — resolving refs, commits, branches, tags, downloading code, managing and receiving webhooks
+- [Testing](https://repo-sdk.dev/docs/testing)
+- [Capability matrix](https://repo-sdk.dev/docs/reference/capability-matrix)
+- [Provider support](https://repo-sdk.dev/docs/reference/provider-support)
+- [Error codes](https://repo-sdk.dev/docs/reference/error-codes)
 
 ## Development
 
@@ -69,7 +192,7 @@ npm install
 | Script               | Description                                                     |
 | -------------------- | --------------------------------------------------------------- |
 | `npm run build`      | Build with tsdown                                               |
-| `npm test`           | Run the unit + contract test suite                              |
+| `npm test`           | Run the unit + provider contract test suite                     |
 | `npm run test:watch` | Run tests in watch mode                                         |
 | `npm run test:live`  | Gated live provider tests (env vars documented in CONTRIBUTING) |
 | `npm run typecheck`  | Type-check without emitting                                     |

package/dist/azure-devops.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, H as TokenProvider, L as RepoProvider, b as IncomingWebhookRequest } from "./types-E47xhSNA.js";
 import { t as VerifyWebhookParams$1 } from "./verify-p6JsExms.js";
 //#region src/providers/azure-devops/auth.d.ts
 /**

package/dist/azure-devops.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor } from "./pagination-CWWHSu8I.js";
-import { a as filenameFromContentDisposition, o as isRecord, r as commitWebUrlBuilder, t as HttpClient } from "./http-C3hAQeY0.js";
+import { a as isRecord, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, s as toCloneUrl, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/azure-devops/auth.ts
 /**
@@ -215,6 +215,25 @@ function azureDevOps(options) {
 		});
 		return ref;
 	}
+	async function getCloneCredentials(params) {
+		const { project, repository } = splitRepo(params.repo);
+		const url = `https://${new URL(baseUrl).host}/${enc(options.organization)}/${enc(project)}/_git/${enc(repository)}`;
+		if ("pat" in auth) return {
+			password: auth.pat,
+			url,
+			username: "pat"
+		};
+		if ("accessToken" in auth) return {
+			password: auth.accessToken,
+			url,
+			username: "oauth2"
+		};
+		return {
+			password: await auth.tokenProvider({ forceRefresh: false }),
+			url,
+			username: "oauth2"
+		};
+	}
 	return {
 		name: "azure-devops",
 		capabilities: CAPABILITIES,
@@ -393,14 +412,9 @@ function azureDevOps(options) {
 				filename: filenameFromContentDisposition(response.headers.get("content-disposition"))
 			};
 		},
+		getCloneCredentials,
 		async getCloneUrl(params) {
-			const { project, repository } = splitRepo(params.repo);
-			const host = new URL(baseUrl).host;
-			const repoPath = `${enc(options.organization)}/${enc(project)}/_git/${enc(repository)}`;
-			if ("pat" in auth) return { url: `https://pat:${encodeURIComponent(auth.pat)}@${host}/${repoPath}` };
-			if ("accessToken" in auth) return { url: `https://oauth2:${encodeURIComponent(auth.accessToken)}@${host}/${repoPath}` };
-			const token = await auth.tokenProvider({ forceRefresh: false });
-			return { url: `https://oauth2:${encodeURIComponent(token)}@${host}/${repoPath}` };
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook(params) {
 			if (!params.events.includes("push") || !params.events.includes("tag_push")) throw new RepoError("Azure DevOps delivers branch and tag pushes together via a single 'git.push' subscription and cannot filter to a subset; request both 'push' and 'tag_push'", {

package/dist/bitbucket.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, H as TokenProvider, L as RepoProvider, b as IncomingWebhookRequest } from "./types-E47xhSNA.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/bitbucket/index.d.ts
 interface BitbucketProviderOptions {

package/dist/bitbucket.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
-import { a as filenameFromContentDisposition, n as clampPerPage, o as isRecord, r as commitWebUrlBuilder, t as HttpClient } from "./http-C3hAQeY0.js";
+import { a as isRecord, c as assertSameOriginUrl, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 import { a as headShaOrUndefined, i as verifyHmacSignature, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/bitbucket/index.ts
 const BASE_URL = "https://api.bitbucket.org/2.0";
@@ -167,6 +167,19 @@ function bitbucket(options) {
 	function hookPath(repo, id) {
 		return `${repoPath(repo)}/hooks/${encodeURIComponent(id)}`;
 	}
+	async function getCloneCredentials(params) {
+		const url = `https://${GIT_HOST}/${params.repo}.git`;
+		if (isApiTokenAuth(auth)) return {
+			password: auth.apiToken,
+			url,
+			username: "x-bitbucket-api-token-auth"
+		};
+		return {
+			password: await currentToken(false),
+			url,
+			username: "x-token-auth"
+		};
+	}
 	return {
 		name: "bitbucket",
 		capabilities: CAPABILITIES,
@@ -338,10 +351,9 @@ function bitbucket(options) {
 				filename: filenameFromContentDisposition(response.headers.get("content-disposition"))
 			};
 		},
+		getCloneCredentials,
 		async getCloneUrl(params) {
-			if (isApiTokenAuth(auth)) return { url: `https://x-bitbucket-api-token-auth:${encodeURIComponent(auth.apiToken)}@${GIT_HOST}/${params.repo}.git` };
-			const token = await currentToken(false);
-			return { url: `https://x-token-auth:${encodeURIComponent(token)}@${GIT_HOST}/${params.repo}.git` };
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook(params) {
 			const { data } = await http.json(`${repoPath(params.repo)}/hooks`, {

package/dist/git-http.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, F as RepoProvider } from "./types-B9oMHTeP.js";
+import { H as TokenProvider, L as RepoProvider } from "./types-E47xhSNA.js";
 //#region src/providers/git-http/index.d.ts
 interface GitHttpProviderOptions {
   /**

package/dist/git-http.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { a as stringToBase64, n as decodeCursor, r as encodeCursor } from "./pagination-CWWHSu8I.js";
-import { n as clampPerPage, t as HttpClient } from "./http-C3hAQeY0.js";
+import { f as stringToBase64, l as decodeCursor, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 //#region src/providers/git-http/index.ts
 const CAPABILITIES = {
 	userProfile: false,
@@ -192,6 +192,19 @@ function gitHttp(options = {}) {
 			}) : void 0
 		};
 	}
+	async function getCloneCredentials(params) {
+		const url = normalizeRepoUrl(params.repo);
+		if (!auth) return {
+			password: null,
+			url,
+			username: null
+		};
+		return {
+			password: await currentSecret(false),
+			url,
+			username
+		};
+	}
 	return {
 		name: "git-http",
 		capabilities: CAPABILITIES,
@@ -288,13 +301,9 @@ function gitHttp(options = {}) {
 		async downloadArchive() {
 			throw unsupported("archive downloads");
 		},
+		getCloneCredentials,
 		async getCloneUrl(params) {
-			const repoUrl = normalizeRepoUrl(params.repo);
-			if (!auth) return { url: repoUrl };
-			const url = new URL(repoUrl);
-			url.username = username;
-			url.password = await currentSecret(false);
-			return { url: url.toString() };
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook() {
 			throw unsupported("webhooks");

package/dist/gitea.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, H as TokenProvider, L as RepoProvider, b as IncomingWebhookRequest } from "./types-E47xhSNA.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/gitea/index.d.ts
 interface GiteaProviderOptions {

package/dist/gitea.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
-import { a as filenameFromContentDisposition, i as encodeRefPath, n as clampPerPage, o as isRecord, r as commitWebUrlBuilder, s as parseLinkNext, t as HttpClient } from "./http-C3hAQeY0.js";
+import { a as isRecord, c as assertSameOriginUrl, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, o as parseLinkNext, r as encodeRefPath, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook, t as hmacSha256Hex } from "./verify-BBMVxz8q.js";
 //#region src/providers/gitea/index.ts
 const DEFAULT_BASE_URL = "https://gitea.com/api/v1";
@@ -189,6 +189,13 @@ function gitea(options) {
 	function repoPath(repo) {
 		return `/repos/${repo}`;
 	}
+	async function getCloneCredentials(params) {
+		return {
+			password: null,
+			url: `https://${new URL(baseUrl).host}/${params.repo}.git`,
+			username: await currentToken(false)
+		};
+	}
 	return {
 		name: "gitea",
 		capabilities: CAPABILITIES,
@@ -400,10 +407,9 @@ function gitea(options) {
 				filename: filenameFromContentDisposition(response.headers.get("content-disposition"))
 			};
 		},
+		getCloneCredentials,
 		async getCloneUrl(params) {
-			const host = new URL(baseUrl).host;
-			const token = await currentToken(false);
-			return { url: `https://${encodeURIComponent(token)}@${host}/${params.repo}.git` };
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook(params) {
 			const { data } = await http.json(`${repoPath(params.repo)}/hooks`, {

package/dist/github.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, D as Page, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, H as TokenProvider, L as RepoProvider, b as IncomingWebhookRequest, k as Page } from "./types-E47xhSNA.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/github/app-auth.d.ts
 interface InstallationToken {

package/dist/github.js

@@ -1,6 +1,6 @@
 import { n as codeFromStatus, t as RepoError } from "./errors-Cxq_CqYv.js";
-import { i as bytesToBase64Url, n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
-import { a as filenameFromContentDisposition, i as encodeRefPath, n as clampPerPage, o as isRecord, r as commitWebUrlBuilder, s as parseLinkNext, t as HttpClient } from "./http-C3hAQeY0.js";
+import { a as isRecord, c as assertSameOriginUrl, d as bytesToBase64Url, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, o as parseLinkNext, r as encodeRefPath, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 import { a as headShaOrUndefined, i as verifyHmacSignature, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/github/app-auth.ts
 const RSA_ALGORITHM_IDENTIFIER = [
@@ -501,6 +501,15 @@ function github(options) {
 			raw: owner
 		}] };
 	}
+	function getCloneCredentials(params) {
+		const host = gitHostFromBaseUrl(baseUrl);
+		return tokenSource.getTokenWithExpiry().then(({ token, expiresAt }) => ({
+			expiresAt,
+			password: token,
+			url: `https://${host}/${params.repo}.git`,
+			username: "x-access-token"
+		}));
+	}
 	return {
 		name: "github",
 		capabilities: {
@@ -580,6 +589,17 @@ function github(options) {
 				};
 			}
 			if (params.namespace) {
+				if (tokenSource.kind === "app") {
+					const namespaceLower = params.namespace.toLowerCase();
+					const { data, response } = await http.json("/installation/repositories", {
+						query: { per_page: perPage },
+						signal: params.signal
+					});
+					return {
+						data: reposFromBody(data).filter((repo) => repo.owner.login.toLowerCase() === namespaceLower).map(mapRepository),
+						cursor: nextCursor(response)
+					};
+				}
 				try {
 					const { data, response } = await http.json(`/orgs/${encodeURIComponent(params.namespace)}/repos`, {
 						query: { per_page: perPage },
@@ -592,21 +612,18 @@ function github(options) {
 				} catch (error) {
 					if (!(error instanceof RepoError && error.code === "not_found")) throw error;
 				}
-				if (tokenSource.kind === "token") {
-					const login = await getLogin(params.signal);
-					if (params.namespace.toLowerCase() === login.toLowerCase()) {
-						const { data, response } = await http.json("/user/repos", {
-							query: {
-								affiliation: "owner",
-								per_page: perPage
-							},
-							signal: params.signal
-						});
-						return {
-							data: data.map(mapRepository),
-							cursor: nextCursor(response)
-						};
-					}
+				if ((await getLogin(params.signal)).toLowerCase() === params.namespace.toLowerCase()) {
+					const { data, response } = await http.json("/user/repos", {
+						query: {
+							affiliation: "owner",
+							per_page: perPage
+						},
+						signal: params.signal
+					});
+					return {
+						data: data.map(mapRepository),
+						cursor: nextCursor(response)
+					};
 				}
 				const { data, response } = await http.json(`/users/${encodeURIComponent(params.namespace)}/repos`, {
 					query: { per_page: perPage },
@@ -797,12 +814,9 @@ function github(options) {
 				filename: filenameFromContentDisposition(archiveResponse.headers.get("content-disposition"))
 			};
 		},
-		getCloneUrl(params) {
-			const host = gitHostFromBaseUrl(baseUrl);
-			return tokenSource.getTokenWithExpiry().then(({ token, expiresAt }) => ({
-				url: `https://x-access-token:${token}@${host}/${params.repo}.git`,
-				expiresAt
-			}));
+		getCloneCredentials,
+		async getCloneUrl(params) {
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook(params) {
 			const { data } = await http.json(`${repoPath(params.repo)}/hooks`, {

package/dist/gitlab.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, H as TokenProvider, L as RepoProvider, b as IncomingWebhookRequest } from "./types-E47xhSNA.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/gitlab/index.d.ts
 interface GitLabProviderOptions {

package/dist/gitlab.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
-import { a as filenameFromContentDisposition, n as clampPerPage, o as isRecord, r as commitWebUrlBuilder, s as parseLinkNext, t as HttpClient } from "./http-C3hAQeY0.js";
+import { a as isRecord, c as assertSameOriginUrl, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, o as parseLinkNext, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/gitlab/index.ts
 const DEFAULT_BASE_URL = "https://gitlab.com/api/v4";
@@ -161,9 +161,6 @@ function assertActiveSupported(active) {
 		provider: "gitlab"
 	});
 }
-function injectCredentials(cloneUrl, token) {
-	return cloneUrl.replace("://", `://oauth2:${encodeURIComponent(token)}@`);
-}
 function gitHostFromBaseUrl(baseUrl) {
 	return new URL(baseUrl).host;
 }
@@ -205,6 +202,22 @@ function gitlab(options) {
 	function hooksPath(repo) {
 		return `/projects/${projectId(repo)}/hooks`;
 	}
+	async function getCloneCredentials(params) {
+		const password = await tokenSource.getToken();
+		if (isNumericId(params.repo)) {
+			const { data } = await http.json(`/projects/${params.repo}`, { signal: params.signal });
+			return {
+				password,
+				url: data.http_url_to_repo,
+				username: "oauth2"
+			};
+		}
+		return {
+			password,
+			url: `https://${gitHostFromBaseUrl(baseUrl)}/${params.repo}.git`,
+			username: "oauth2"
+		};
+	}
 	return {
 		name: "gitlab",
 		capabilities: CAPABILITIES,
@@ -433,14 +446,9 @@ function gitlab(options) {
 				filename: filenameFromContentDisposition(response.headers.get("content-disposition"))
 			};
 		},
+		getCloneCredentials,
 		async getCloneUrl(params) {
-			const token = await tokenSource.getToken();
-			if (isNumericId(params.repo)) {
-				const { data } = await http.json(`/projects/${params.repo}`, { signal: params.signal });
-				return { url: injectCredentials(data.http_url_to_repo, token) };
-			}
-			const host = gitHostFromBaseUrl(baseUrl);
-			return { url: `https://oauth2:${encodeURIComponent(token)}@${host}/${params.repo}.git` };
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook(params) {
 			assertActiveSupported(params.active);

package/dist/{http-C3hAQeY0.js → http-BcC1vIan.js}

@@ -1,35 +1,4 @@
 import { n as codeFromStatus, r as parseRetryAfter, t as RepoError } from "./errors-Cxq_CqYv.js";
-//#region src/providers/shared.ts
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
-function clampPerPage(limit, max = 100) {
-	if (limit === void 0) return void 0;
-	return Math.min(Math.max(1, Math.trunc(limit)), max);
-}
-function parseLinkNext(header) {
-	if (!header) return void 0;
-	for (const part of header.split(",")) {
-		const match = part.match(/<([^>]+)>\s*;\s*rel="([^"]+)"/);
-		if (match && match[2] === "next") return match[1];
-	}
-}
-/** Percent-encodes a ref path while keeping its `/` separators intact. */
-function encodeRefPath(ref) {
-	return ref.split("/").map(encodeURIComponent).join("/");
-}
-function commitWebUrlBuilder(pathSegment) {
-	return function commitWebUrl(repoWebUrl, sha) {
-		return `${repoWebUrl.replace(/\/+$/, "")}/${pathSegment}/${sha}`;
-	};
-}
-function filenameFromContentDisposition(header) {
-	if (!header) return void 0;
-	const extended = header.match(/filename\*=(?:UTF-8'')?([^;]+)/i);
-	if (extended?.[1]) return decodeURIComponent(extended[1].trim().replace(/^"|"$/g, ""));
-	return header.match(/filename="?([^";]+)"?/i)?.[1]?.trim();
-}
-//#endregion
 //#region src/http.ts
 const USER_AGENT = "repo-sdk";
 var HttpClient = class {
@@ -104,4 +73,4 @@ var HttpClient = class {
 	}
 };
 //#endregion
-export { filenameFromContentDisposition as a, encodeRefPath as i, clampPerPage as n, isRecord as o, commitWebUrlBuilder as r, parseLinkNext as s, HttpClient as t };
+export { HttpClient as t };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { A as ProviderRefMatch, B as TokenProvider, C as ListTagsParams, D as Page, E as NamespaceKind, F as RepoProvider, G as WebhookVerificationMethod, H as UserRef, I as Repository, L as ResolveRefParams, M as RefMatch, N as RefType, O as ParsedWebhookEvent, P as RepoCapabilities, R as SearchRefsParams, S as ListRepositoriesParams, T as Namespace, U as Webhook, V as UpdateWebhookParams, W as WebhookEventType, _ as GitActor, a as CloneUrl, b as ListCommitsParams, c as DeleteWebhookParams, d as GetBranchParams, f as GetCloneUrlParams, g as GetWebhookParams, h as GetTagParams, i as Branch, j as ProviderSearchRefsParams, k as ProviderName, l as DownloadArchiveParams, m as GetRepositoryParams, n as ArchiveFormat, o as Commit, p as GetCommitParams, r as AuthenticatedUser, s as CreateWebhookParams, t as Archive, u as GetAuthenticatedUserParams, v as IncomingWebhookRequest, w as ListWebhooksParams, x as ListNamespacesParams, y as ListBranchesParams, z as Tag } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, B as SearchRefsParams, C as ListNamespacesParams, D as Namespace, E as ListWebhooksParams, F as RefType, G as Webhook, H as TokenProvider, I as RepoCapabilities, K as WebhookEventType, L as RepoProvider, M as ProviderRefMatch, N as ProviderSearchRefsParams, O as NamespaceKind, P as RefMatch, R as Repository, S as ListCommitsParams, T as ListTagsParams, U as UpdateWebhookParams, V as Tag, W as UserRef, _ as GetTagParams, a as CloneCredentials, b as IncomingWebhookRequest, c as CreateWebhookParams, d as GetAuthenticatedUserParams, f as GetBranchParams, g as GetRepositoryParams, h as GetCommitParams, i as Branch, j as ProviderName, k as Page, l as DeleteWebhookParams, m as GetCloneUrlParams, n as ArchiveFormat, o as CloneUrl, p as GetCloneCredentialsParams, q as WebhookVerificationMethod, r as AuthenticatedUser, s as Commit, t as Archive, u as DownloadArchiveParams, v as GetWebhookParams, w as ListRepositoriesParams, x as ListBranchesParams, y as GitActor, z as ResolveRefParams } from "./types-E47xhSNA.js";
 //#region src/client.d.ts
 interface RetryOptions {
   rateLimit?: boolean;
@@ -23,6 +23,7 @@ interface RepoClient {
     listAll(params?: Omit<ListRepositoriesParams, 'cursor'>): AsyncGenerator<Repository, void>;
     get(params: GetRepositoryParams): Promise<Repository>;
     downloadArchive(params: DownloadArchiveParams): Promise<Archive>;
+    getCloneCredentials(params: GetCloneCredentialsParams): Promise<CloneCredentials>;
     getCloneUrl(params: GetCloneUrlParams): Promise<CloneUrl>;
   };
   commits: {
@@ -92,4 +93,4 @@ declare class RepoError extends Error {
   constructor(message: string, options: RepoErrorOptions);
 }
 //#endregion
-export { type Archive, type ArchiveFormat, type AuthenticatedUser, type Branch, type CloneUrl, type Commit, type CreateClientOptions, type CreateWebhookParams, type DeleteWebhookParams, type DetectWebhookProviderInput, type DownloadArchiveParams, type GetAuthenticatedUserParams, type GetBranchParams, type GetCloneUrlParams, type GetCommitParams, type GetRepositoryParams, type GetTagParams, type GetWebhookParams, type GitActor, type IncomingWebhookRequest, type ListBranchesParams, type ListCommitsParams, type ListNamespacesParams, type ListRepositoriesParams, type ListTagsParams, type ListWebhooksParams, type Namespace, type NamespaceKind, type Page, type ParsedWebhookEvent, type ProviderName, type ProviderRefMatch, type ProviderSearchRefsParams, type RefMatch, type RefType, type RepoCapabilities, type RepoClient, RepoError, type RepoErrorCode, type RepoErrorOptions, type RepoProvider, type Repository, type ResolveRefParams, type RetryOptions, type SearchRefsParams, type Tag, type TokenProvider, type UpdateWebhookParams, type UserRef, type Webhook, type WebhookEventType, type WebhookVerificationMethod, createClient, detectWebhookProvider };
+export { type Archive, type ArchiveFormat, type AuthenticatedUser, type Branch, type CloneCredentials, type CloneUrl, type Commit, type CreateClientOptions, type CreateWebhookParams, type DeleteWebhookParams, type DetectWebhookProviderInput, type DownloadArchiveParams, type GetAuthenticatedUserParams, type GetBranchParams, type GetCloneCredentialsParams, type GetCloneUrlParams, type GetCommitParams, type GetRepositoryParams, type GetTagParams, type GetWebhookParams, type GitActor, type IncomingWebhookRequest, type ListBranchesParams, type ListCommitsParams, type ListNamespacesParams, type ListRepositoriesParams, type ListTagsParams, type ListWebhooksParams, type Namespace, type NamespaceKind, type Page, type ParsedWebhookEvent, type ProviderName, type ProviderRefMatch, type ProviderSearchRefsParams, type RefMatch, type RefType, type RepoCapabilities, type RepoClient, RepoError, type RepoErrorCode, type RepoErrorOptions, type RepoProvider, type Repository, type ResolveRefParams, type RetryOptions, type SearchRefsParams, type Tag, type TokenProvider, type UpdateWebhookParams, type UserRef, type Webhook, type WebhookEventType, type WebhookVerificationMethod, createClient, detectWebhookProvider };

package/dist/index.js

@@ -125,6 +125,10 @@ function createClient(options) {
 					format
 				}));
 			},
+			getCloneCredentials: async (params) => {
+				requireNonEmpty(params.repo, "repo");
+				return withRetry(() => provider.getCloneCredentials(params));
+			},
 			getCloneUrl: async (params) => {
 				requireNonEmpty(params.repo, "repo");
 				return withRetry(() => provider.getCloneUrl(params));

package/dist/{pagination-CWWHSu8I.js → shared-C6m-C4My.js}

@@ -70,4 +70,54 @@ function assertSameOriginUrl(provider, baseUrl, url) {
 	return url;
 }
 //#endregion
-export { stringToBase64 as a, bytesToBase64Url as i, decodeCursor as n, encodeCursor as r, assertSameOriginUrl as t };
+//#region src/providers/shared.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function clampPerPage(limit, max = 100) {
+	if (limit === void 0) return void 0;
+	return Math.min(Math.max(1, Math.trunc(limit)), max);
+}
+function parseLinkNext(header) {
+	if (!header) return void 0;
+	for (const part of header.split(",")) {
+		const match = part.match(/<([^>]+)>\s*;\s*rel="([^"]+)"/);
+		if (match && match[2] === "next") return match[1];
+	}
+}
+/** Percent-encodes a ref path while keeping its `/` separators intact. */
+function encodeRefPath(ref) {
+	return ref.split("/").map(encodeURIComponent).join("/");
+}
+function commitWebUrlBuilder(pathSegment) {
+	return function commitWebUrl(repoWebUrl, sha) {
+		return `${repoWebUrl.replace(/\/+$/, "")}/${pathSegment}/${sha}`;
+	};
+}
+function filenameFromContentDisposition(header) {
+	if (!header) return void 0;
+	const extended = header.match(/filename\*=(?:UTF-8'')?([^;]+)/i);
+	if (extended?.[1]) return decodeURIComponent(extended[1].trim().replace(/^"|"$/g, ""));
+	return header.match(/filename="?([^";]+)"?/i)?.[1]?.trim();
+}
+/**
+* Embeds clone credentials into their credential-free URL as percent-encoded
+* userinfo — the single place every provider's tokenized clone URL is built.
+* A `null` password yields a bare `user@host` (Gitea puts the token in the
+* username slot); anonymous credentials return the URL untouched.
+*/
+function toCloneUrl(credentials) {
+	const { expiresAt, password, url, username } = credentials;
+	if (username === null && password === null) return {
+		url,
+		expiresAt
+	};
+	const user = username === null ? "" : encodeURIComponent(username);
+	const userinfo = password === null ? user : `${user}:${encodeURIComponent(password)}`;
+	return {
+		url: url.replace("://", `://${userinfo}@`),
+		expiresAt
+	};
+}
+//#endregion
+export { isRecord as a, assertSameOriginUrl as c, bytesToBase64Url as d, stringToBase64 as f, filenameFromContentDisposition as i, decodeCursor as l, commitWebUrlBuilder as n, parseLinkNext as o, encodeRefPath as r, toCloneUrl as s, clampPerPage as t, encodeCursor as u };

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { E as NamespaceKind, F as RepoProvider, I as Repository, P as RepoCapabilities, T as Namespace, U as Webhook, W as WebhookEventType, i as Branch, k as ProviderName, o as Commit, z as Tag } from "./types-B9oMHTeP.js";
+import { D as Namespace, G as Webhook, I as RepoCapabilities, K as WebhookEventType, L as RepoProvider, O as NamespaceKind, R as Repository, V as Tag, i as Branch, j as ProviderName, s as Commit } from "./types-E47xhSNA.js";
 //#region src/providers/testing/index.d.ts
 interface InMemoryNamespaceSeed {
   id: string;

package/dist/testing.js

@@ -1,5 +1,5 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor } from "./pagination-CWWHSu8I.js";
+import { l as decodeCursor, s as toCloneUrl, u as encodeCursor } from "./shared-C6m-C4My.js";
 //#region src/providers/testing/index.ts
 /**
 * Small on purpose so that consumers exercise cursor-based pagination.
@@ -149,6 +149,14 @@ function createInMemoryProvider(seed = {}, options = {}) {
 		if (!repository) throw notFound(`Unknown repository: ${repo}`);
 		return repository;
 	}
+	function getCloneCredentials(params) {
+		requireRepository(params.repo);
+		return Promise.resolve({
+			password: "test",
+			url: `https://in-memory.invalid/${params.repo}.git`,
+			username: "x-token"
+		});
+	}
 	return {
 		name,
 		capabilities,
@@ -262,9 +270,9 @@ function createInMemoryProvider(seed = {}, options = {}) {
 				filename: `${repository.name}-${params.ref}.${extension}`
 			});
 		},
-		getCloneUrl(params) {
-			requireRepository(params.repo);
-			return Promise.resolve({ url: `https://x-token:test@in-memory.invalid/${params.repo}.git` });
+		getCloneCredentials,
+		async getCloneUrl(params) {
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		createWebhook(params) {
 			requireRepository(params.repo);

package/dist/{types-B9oMHTeP.d.ts → types-E47xhSNA.d.ts}

@@ -45,6 +45,20 @@ interface CloneUrl {
   url: string;
   expiresAt?: Date;
 }
+/**
+ * Clone credentials kept separate from the URL, for handing to a git credential
+ * helper instead of persisting a tokenized remote in `.git/config`. Both
+ * components are raw, never percent-encoded.
+ */
+interface CloneCredentials {
+  expiresAt?: Date;
+  /** The secret, or `null` when the provider carries the token in `username` (Gitea) or access is anonymous. */
+  password: string | null;
+  /** Clone URL without any embedded credential. */
+  url: string;
+  /** The static username the provider expects, the token itself for Gitea, or `null` for anonymous access. */
+  username: string | null;
+}
 /** The account behind the configured credentials (see the `userProfile` capability). */
 interface AuthenticatedUser {
   id: string;
@@ -215,6 +229,9 @@ interface DownloadArchiveParams extends BaseParams {
   ref: string;
   format?: ArchiveFormat;
 }
+interface GetCloneCredentialsParams extends BaseParams {
+  repo: string;
+}
 interface GetCloneUrlParams extends BaseParams {
   repo: string;
 }
@@ -276,6 +293,8 @@ interface RepoProvider {
   /** Prefix-match refs of the requested types, branches before tags, at most `limit` results. */
   searchRefs(params: ProviderSearchRefsParams): Promise<ProviderRefMatch[]>;
   downloadArchive(params: DownloadArchiveParams): Promise<Archive>;
+  getCloneCredentials(params: GetCloneCredentialsParams): Promise<CloneCredentials>;
+  /** The same credentials embedded in the URL; derived from `getCloneCredentials`. */
   getCloneUrl(params: GetCloneUrlParams): Promise<CloneUrl>;
   createWebhook(params: CreateWebhookParams): Promise<Webhook>;
   listWebhooks(params: ListWebhooksParams): Promise<Page<Webhook>>;
@@ -284,4 +303,4 @@ interface RepoProvider {
   deleteWebhook(params: DeleteWebhookParams): Promise<void>;
 }
 //#endregion
-export { ProviderRefMatch as A, TokenProvider as B, ListTagsParams as C, Page as D, NamespaceKind as E, RepoProvider as F, WebhookVerificationMethod as G, UserRef as H, Repository as I, ResolveRefParams as L, RefMatch as M, RefType as N, ParsedWebhookEvent as O, RepoCapabilities as P, SearchRefsParams as R, ListRepositoriesParams as S, Namespace as T, Webhook as U, UpdateWebhookParams as V, WebhookEventType as W, GitActor as _, CloneUrl as a, ListCommitsParams as b, DeleteWebhookParams as c, GetBranchParams as d, GetCloneUrlParams as f, GetWebhookParams as g, GetTagParams as h, Branch as i, ProviderSearchRefsParams as j, ProviderName as k, DownloadArchiveParams as l, GetRepositoryParams as m, ArchiveFormat as n, Commit as o, GetCommitParams as p, AuthenticatedUser as r, CreateWebhookParams as s, Archive as t, GetAuthenticatedUserParams as u, IncomingWebhookRequest as v, ListWebhooksParams as w, ListNamespacesParams as x, ListBranchesParams as y, Tag as z };
+export { ParsedWebhookEvent as A, SearchRefsParams as B, ListNamespacesParams as C, Namespace as D, ListWebhooksParams as E, RefType as F, Webhook as G, TokenProvider as H, RepoCapabilities as I, WebhookEventType as K, RepoProvider as L, ProviderRefMatch as M, ProviderSearchRefsParams as N, NamespaceKind as O, RefMatch as P, Repository as R, ListCommitsParams as S, ListTagsParams as T, UpdateWebhookParams as U, Tag as V, UserRef as W, GetTagParams as _, CloneCredentials as a, IncomingWebhookRequest as b, CreateWebhookParams as c, GetAuthenticatedUserParams as d, GetBranchParams as f, GetRepositoryParams as g, GetCommitParams as h, Branch as i, ProviderName as j, Page as k, DeleteWebhookParams as l, GetCloneUrlParams as m, ArchiveFormat as n, CloneUrl as o, GetCloneCredentialsParams as p, WebhookVerificationMethod as q, AuthenticatedUser as r, Commit as s, Archive as t, DownloadArchiveParams as u, GetWebhookParams as v, ListRepositoriesParams as w, ListBranchesParams as x, GitActor as y, ResolveRefParams as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-sdk",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Unified TypeScript SDK for git providers — GitHub, GitLab, Bitbucket, Azure DevOps, Gitea",
   "license": "MIT",
   "author": "Robin Genz <mail@robingenz.dev>",
@@ -22,7 +22,7 @@
     "version-control",
     "webhooks"
   ],
-  "homepage": "https://github.com/capawesome-team/repo-sdk",
+  "homepage": "https://repo-sdk.dev",
   "repository": {
     "type": "git",
     "url": "https://github.com/capawesome-team/repo-sdk"