repo-sdk 0.2.2 → 0.3.0

package/README.md

@@ -98,16 +98,16 @@ export async function POST(request: Request): Promise<Response> {
 
 ## API at a glance
 
-| Namespace    | Methods                                                        |
-| ------------ | -------------------------------------------------------------- |
-| `users`      | `me`                                                           |
-| `namespaces` | `list` · `listAll`                                             |
-| `repos`      | `list` · `listAll` · `get` · `downloadArchive` · `getCloneUrl` |
-| `commits`    | `list` · `listAll` · `get`                                     |
-| `branches`   | `list` · `listAll` · `get`                                     |
-| `tags`       | `list` · `listAll` · `get`                                     |
-| `refs`       | `resolve` · `search`                                           |
-| `webhooks`   | `create` · `list` · `get` · `update` · `delete`                |
+| Namespace    | Methods                                                                                |
+| ------------ | -------------------------------------------------------------------------------------- |
+| `users`      | `me`                                                                                   |
+| `namespaces` | `list` · `listAll`                                                                     |
+| `repos`      | `list` · `listAll` · `get` · `downloadArchive` · `getCloneCredentials` · `getCloneUrl` |
+| `commits`    | `list` · `listAll` · `get`                                                             |
+| `branches`   | `list` · `listAll` · `get`                                                             |
+| `tags`       | `list` · `listAll` · `get`                                                             |
+| `refs`       | `resolve` · `search`                                                                   |
+| `webhooks`   | `create` · `list` · `get` · `update` · `delete`                                        |
 
 Every list returns an opaque cursor and has a `listAll` async generator that walks the pages for you. Cursors are provider-tagged and origin-checked, so a forged one cannot redirect an authenticated request. Every method accepts a `signal` for cancellation. Rate-limited requests are retried once when the provider's `Retry-After` fits the budget (10 seconds by default, configurable via `retry`).
 
@@ -162,7 +162,7 @@ try {
 }
 ```
 
-Errors also carry `provider`, `status`, `retryAfter` and `retryable`; `cause` is the underlying JS `Error`. Token values are redacted from every message, so a leaked stack trace cannot leak a credential. The one deliberate exception is `repos.getCloneUrl`, which returns a URL with the credential embedded because that is what `git clone` needs — treat it as a secret.
+Errors also carry `provider`, `status`, `retryAfter` and `retryable`; `cause` is the underlying JS `Error`. Token values are redacted from every message, so a leaked stack trace cannot leak a credential. The deliberate exceptions are `repos.getCloneUrl`, which returns a URL with the credential embedded because that is what `git clone` needs, and `repos.getCloneCredentials`, which returns that credential next to a credential-free URL for a git credential helper — treat both as secrets.
 
 ## Runtime support
 

package/dist/azure-devops.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, H as TokenProvider, L as RepoProvider, b as IncomingWebhookRequest } from "./types-E47xhSNA.js";
 import { t as VerifyWebhookParams$1 } from "./verify-p6JsExms.js";
 //#region src/providers/azure-devops/auth.d.ts
 /**

package/dist/azure-devops.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor } from "./pagination-CWWHSu8I.js";
-import { a as filenameFromContentDisposition, o as isRecord, r as commitWebUrlBuilder, t as HttpClient } from "./http-C3hAQeY0.js";
+import { a as isRecord, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, s as toCloneUrl, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/azure-devops/auth.ts
 /**
@@ -215,6 +215,25 @@ function azureDevOps(options) {
 		});
 		return ref;
 	}
+	async function getCloneCredentials(params) {
+		const { project, repository } = splitRepo(params.repo);
+		const url = `https://${new URL(baseUrl).host}/${enc(options.organization)}/${enc(project)}/_git/${enc(repository)}`;
+		if ("pat" in auth) return {
+			password: auth.pat,
+			url,
+			username: "pat"
+		};
+		if ("accessToken" in auth) return {
+			password: auth.accessToken,
+			url,
+			username: "oauth2"
+		};
+		return {
+			password: await auth.tokenProvider({ forceRefresh: false }),
+			url,
+			username: "oauth2"
+		};
+	}
 	return {
 		name: "azure-devops",
 		capabilities: CAPABILITIES,
@@ -393,14 +412,9 @@ function azureDevOps(options) {
 				filename: filenameFromContentDisposition(response.headers.get("content-disposition"))
 			};
 		},
+		getCloneCredentials,
 		async getCloneUrl(params) {
-			const { project, repository } = splitRepo(params.repo);
-			const host = new URL(baseUrl).host;
-			const repoPath = `${enc(options.organization)}/${enc(project)}/_git/${enc(repository)}`;
-			if ("pat" in auth) return { url: `https://pat:${encodeURIComponent(auth.pat)}@${host}/${repoPath}` };
-			if ("accessToken" in auth) return { url: `https://oauth2:${encodeURIComponent(auth.accessToken)}@${host}/${repoPath}` };
-			const token = await auth.tokenProvider({ forceRefresh: false });
-			return { url: `https://oauth2:${encodeURIComponent(token)}@${host}/${repoPath}` };
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook(params) {
 			if (!params.events.includes("push") || !params.events.includes("tag_push")) throw new RepoError("Azure DevOps delivers branch and tag pushes together via a single 'git.push' subscription and cannot filter to a subset; request both 'push' and 'tag_push'", {

package/dist/bitbucket.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, H as TokenProvider, L as RepoProvider, b as IncomingWebhookRequest } from "./types-E47xhSNA.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/bitbucket/index.d.ts
 interface BitbucketProviderOptions {

package/dist/bitbucket.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
-import { a as filenameFromContentDisposition, n as clampPerPage, o as isRecord, r as commitWebUrlBuilder, t as HttpClient } from "./http-C3hAQeY0.js";
+import { a as isRecord, c as assertSameOriginUrl, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 import { a as headShaOrUndefined, i as verifyHmacSignature, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/bitbucket/index.ts
 const BASE_URL = "https://api.bitbucket.org/2.0";
@@ -167,6 +167,19 @@ function bitbucket(options) {
 	function hookPath(repo, id) {
 		return `${repoPath(repo)}/hooks/${encodeURIComponent(id)}`;
 	}
+	async function getCloneCredentials(params) {
+		const url = `https://${GIT_HOST}/${params.repo}.git`;
+		if (isApiTokenAuth(auth)) return {
+			password: auth.apiToken,
+			url,
+			username: "x-bitbucket-api-token-auth"
+		};
+		return {
+			password: await currentToken(false),
+			url,
+			username: "x-token-auth"
+		};
+	}
 	return {
 		name: "bitbucket",
 		capabilities: CAPABILITIES,
@@ -338,10 +351,9 @@ function bitbucket(options) {
 				filename: filenameFromContentDisposition(response.headers.get("content-disposition"))
 			};
 		},
+		getCloneCredentials,
 		async getCloneUrl(params) {
-			if (isApiTokenAuth(auth)) return { url: `https://x-bitbucket-api-token-auth:${encodeURIComponent(auth.apiToken)}@${GIT_HOST}/${params.repo}.git` };
-			const token = await currentToken(false);
-			return { url: `https://x-token-auth:${encodeURIComponent(token)}@${GIT_HOST}/${params.repo}.git` };
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook(params) {
 			const { data } = await http.json(`${repoPath(params.repo)}/hooks`, {

package/dist/git-http.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, F as RepoProvider } from "./types-B9oMHTeP.js";
+import { H as TokenProvider, L as RepoProvider } from "./types-E47xhSNA.js";
 //#region src/providers/git-http/index.d.ts
 interface GitHttpProviderOptions {
   /**

package/dist/git-http.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { a as stringToBase64, n as decodeCursor, r as encodeCursor } from "./pagination-CWWHSu8I.js";
-import { n as clampPerPage, t as HttpClient } from "./http-C3hAQeY0.js";
+import { f as stringToBase64, l as decodeCursor, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 //#region src/providers/git-http/index.ts
 const CAPABILITIES = {
 	userProfile: false,
@@ -192,6 +192,19 @@ function gitHttp(options = {}) {
 			}) : void 0
 		};
 	}
+	async function getCloneCredentials(params) {
+		const url = normalizeRepoUrl(params.repo);
+		if (!auth) return {
+			password: null,
+			url,
+			username: null
+		};
+		return {
+			password: await currentSecret(false),
+			url,
+			username
+		};
+	}
 	return {
 		name: "git-http",
 		capabilities: CAPABILITIES,
@@ -288,13 +301,9 @@ function gitHttp(options = {}) {
 		async downloadArchive() {
 			throw unsupported("archive downloads");
 		},
+		getCloneCredentials,
 		async getCloneUrl(params) {
-			const repoUrl = normalizeRepoUrl(params.repo);
-			if (!auth) return { url: repoUrl };
-			const url = new URL(repoUrl);
-			url.username = username;
-			url.password = await currentSecret(false);
-			return { url: url.toString() };
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook() {
 			throw unsupported("webhooks");

package/dist/gitea.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, H as TokenProvider, L as RepoProvider, b as IncomingWebhookRequest } from "./types-E47xhSNA.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/gitea/index.d.ts
 interface GiteaProviderOptions {

package/dist/gitea.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
-import { a as filenameFromContentDisposition, i as encodeRefPath, n as clampPerPage, o as isRecord, r as commitWebUrlBuilder, s as parseLinkNext, t as HttpClient } from "./http-C3hAQeY0.js";
+import { a as isRecord, c as assertSameOriginUrl, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, o as parseLinkNext, r as encodeRefPath, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook, t as hmacSha256Hex } from "./verify-BBMVxz8q.js";
 //#region src/providers/gitea/index.ts
 const DEFAULT_BASE_URL = "https://gitea.com/api/v1";
@@ -189,6 +189,13 @@ function gitea(options) {
 	function repoPath(repo) {
 		return `/repos/${repo}`;
 	}
+	async function getCloneCredentials(params) {
+		return {
+			password: null,
+			url: `https://${new URL(baseUrl).host}/${params.repo}.git`,
+			username: await currentToken(false)
+		};
+	}
 	return {
 		name: "gitea",
 		capabilities: CAPABILITIES,
@@ -400,10 +407,9 @@ function gitea(options) {
 				filename: filenameFromContentDisposition(response.headers.get("content-disposition"))
 			};
 		},
+		getCloneCredentials,
 		async getCloneUrl(params) {
-			const host = new URL(baseUrl).host;
-			const token = await currentToken(false);
-			return { url: `https://${encodeURIComponent(token)}@${host}/${params.repo}.git` };
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook(params) {
 			const { data } = await http.json(`${repoPath(params.repo)}/hooks`, {

package/dist/github.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, D as Page, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, H as TokenProvider, L as RepoProvider, b as IncomingWebhookRequest, k as Page } from "./types-E47xhSNA.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/github/app-auth.d.ts
 interface InstallationToken {

package/dist/github.js

@@ -1,6 +1,6 @@
 import { n as codeFromStatus, t as RepoError } from "./errors-Cxq_CqYv.js";
-import { i as bytesToBase64Url, n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
-import { a as filenameFromContentDisposition, i as encodeRefPath, n as clampPerPage, o as isRecord, r as commitWebUrlBuilder, s as parseLinkNext, t as HttpClient } from "./http-C3hAQeY0.js";
+import { a as isRecord, c as assertSameOriginUrl, d as bytesToBase64Url, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, o as parseLinkNext, r as encodeRefPath, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 import { a as headShaOrUndefined, i as verifyHmacSignature, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/github/app-auth.ts
 const RSA_ALGORITHM_IDENTIFIER = [
@@ -501,6 +501,15 @@ function github(options) {
 			raw: owner
 		}] };
 	}
+	function getCloneCredentials(params) {
+		const host = gitHostFromBaseUrl(baseUrl);
+		return tokenSource.getTokenWithExpiry().then(({ token, expiresAt }) => ({
+			expiresAt,
+			password: token,
+			url: `https://${host}/${params.repo}.git`,
+			username: "x-access-token"
+		}));
+	}
 	return {
 		name: "github",
 		capabilities: {
@@ -805,12 +814,9 @@ function github(options) {
 				filename: filenameFromContentDisposition(archiveResponse.headers.get("content-disposition"))
 			};
 		},
-		getCloneUrl(params) {
-			const host = gitHostFromBaseUrl(baseUrl);
-			return tokenSource.getTokenWithExpiry().then(({ token, expiresAt }) => ({
-				url: `https://x-access-token:${token}@${host}/${params.repo}.git`,
-				expiresAt
-			}));
+		getCloneCredentials,
+		async getCloneUrl(params) {
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook(params) {
 			const { data } = await http.json(`${repoPath(params.repo)}/hooks`, {

package/dist/gitlab.d.ts

@@ -1,4 +1,4 @@
-import { B as TokenProvider, F as RepoProvider, O as ParsedWebhookEvent, v as IncomingWebhookRequest } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, H as TokenProvider, L as RepoProvider, b as IncomingWebhookRequest } from "./types-E47xhSNA.js";
 import { t as VerifyWebhookParams } from "./verify-p6JsExms.js";
 //#region src/providers/gitlab/index.d.ts
 interface GitLabProviderOptions {

package/dist/gitlab.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor, t as assertSameOriginUrl } from "./pagination-CWWHSu8I.js";
-import { a as filenameFromContentDisposition, n as clampPerPage, o as isRecord, r as commitWebUrlBuilder, s as parseLinkNext, t as HttpClient } from "./http-C3hAQeY0.js";
+import { a as isRecord, c as assertSameOriginUrl, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, o as parseLinkNext, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
+import { t as HttpClient } from "./http-BcC1vIan.js";
 import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/gitlab/index.ts
 const DEFAULT_BASE_URL = "https://gitlab.com/api/v4";
@@ -161,9 +161,6 @@ function assertActiveSupported(active) {
 		provider: "gitlab"
 	});
 }
-function injectCredentials(cloneUrl, token) {
-	return cloneUrl.replace("://", `://oauth2:${encodeURIComponent(token)}@`);
-}
 function gitHostFromBaseUrl(baseUrl) {
 	return new URL(baseUrl).host;
 }
@@ -205,6 +202,22 @@ function gitlab(options) {
 	function hooksPath(repo) {
 		return `/projects/${projectId(repo)}/hooks`;
 	}
+	async function getCloneCredentials(params) {
+		const password = await tokenSource.getToken();
+		if (isNumericId(params.repo)) {
+			const { data } = await http.json(`/projects/${params.repo}`, { signal: params.signal });
+			return {
+				password,
+				url: data.http_url_to_repo,
+				username: "oauth2"
+			};
+		}
+		return {
+			password,
+			url: `https://${gitHostFromBaseUrl(baseUrl)}/${params.repo}.git`,
+			username: "oauth2"
+		};
+	}
 	return {
 		name: "gitlab",
 		capabilities: CAPABILITIES,
@@ -433,14 +446,9 @@ function gitlab(options) {
 				filename: filenameFromContentDisposition(response.headers.get("content-disposition"))
 			};
 		},
+		getCloneCredentials,
 		async getCloneUrl(params) {
-			const token = await tokenSource.getToken();
-			if (isNumericId(params.repo)) {
-				const { data } = await http.json(`/projects/${params.repo}`, { signal: params.signal });
-				return { url: injectCredentials(data.http_url_to_repo, token) };
-			}
-			const host = gitHostFromBaseUrl(baseUrl);
-			return { url: `https://oauth2:${encodeURIComponent(token)}@${host}/${params.repo}.git` };
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		async createWebhook(params) {
 			assertActiveSupported(params.active);

package/dist/{http-C3hAQeY0.js → http-BcC1vIan.js}

@@ -1,35 +1,4 @@
 import { n as codeFromStatus, r as parseRetryAfter, t as RepoError } from "./errors-Cxq_CqYv.js";
-//#region src/providers/shared.ts
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
-function clampPerPage(limit, max = 100) {
-	if (limit === void 0) return void 0;
-	return Math.min(Math.max(1, Math.trunc(limit)), max);
-}
-function parseLinkNext(header) {
-	if (!header) return void 0;
-	for (const part of header.split(",")) {
-		const match = part.match(/<([^>]+)>\s*;\s*rel="([^"]+)"/);
-		if (match && match[2] === "next") return match[1];
-	}
-}
-/** Percent-encodes a ref path while keeping its `/` separators intact. */
-function encodeRefPath(ref) {
-	return ref.split("/").map(encodeURIComponent).join("/");
-}
-function commitWebUrlBuilder(pathSegment) {
-	return function commitWebUrl(repoWebUrl, sha) {
-		return `${repoWebUrl.replace(/\/+$/, "")}/${pathSegment}/${sha}`;
-	};
-}
-function filenameFromContentDisposition(header) {
-	if (!header) return void 0;
-	const extended = header.match(/filename\*=(?:UTF-8'')?([^;]+)/i);
-	if (extended?.[1]) return decodeURIComponent(extended[1].trim().replace(/^"|"$/g, ""));
-	return header.match(/filename="?([^";]+)"?/i)?.[1]?.trim();
-}
-//#endregion
 //#region src/http.ts
 const USER_AGENT = "repo-sdk";
 var HttpClient = class {
@@ -104,4 +73,4 @@ var HttpClient = class {
 	}
 };
 //#endregion
-export { filenameFromContentDisposition as a, encodeRefPath as i, clampPerPage as n, isRecord as o, commitWebUrlBuilder as r, parseLinkNext as s, HttpClient as t };
+export { HttpClient as t };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { A as ProviderRefMatch, B as TokenProvider, C as ListTagsParams, D as Page, E as NamespaceKind, F as RepoProvider, G as WebhookVerificationMethod, H as UserRef, I as Repository, L as ResolveRefParams, M as RefMatch, N as RefType, O as ParsedWebhookEvent, P as RepoCapabilities, R as SearchRefsParams, S as ListRepositoriesParams, T as Namespace, U as Webhook, V as UpdateWebhookParams, W as WebhookEventType, _ as GitActor, a as CloneUrl, b as ListCommitsParams, c as DeleteWebhookParams, d as GetBranchParams, f as GetCloneUrlParams, g as GetWebhookParams, h as GetTagParams, i as Branch, j as ProviderSearchRefsParams, k as ProviderName, l as DownloadArchiveParams, m as GetRepositoryParams, n as ArchiveFormat, o as Commit, p as GetCommitParams, r as AuthenticatedUser, s as CreateWebhookParams, t as Archive, u as GetAuthenticatedUserParams, v as IncomingWebhookRequest, w as ListWebhooksParams, x as ListNamespacesParams, y as ListBranchesParams, z as Tag } from "./types-B9oMHTeP.js";
+import { A as ParsedWebhookEvent, B as SearchRefsParams, C as ListNamespacesParams, D as Namespace, E as ListWebhooksParams, F as RefType, G as Webhook, H as TokenProvider, I as RepoCapabilities, K as WebhookEventType, L as RepoProvider, M as ProviderRefMatch, N as ProviderSearchRefsParams, O as NamespaceKind, P as RefMatch, R as Repository, S as ListCommitsParams, T as ListTagsParams, U as UpdateWebhookParams, V as Tag, W as UserRef, _ as GetTagParams, a as CloneCredentials, b as IncomingWebhookRequest, c as CreateWebhookParams, d as GetAuthenticatedUserParams, f as GetBranchParams, g as GetRepositoryParams, h as GetCommitParams, i as Branch, j as ProviderName, k as Page, l as DeleteWebhookParams, m as GetCloneUrlParams, n as ArchiveFormat, o as CloneUrl, p as GetCloneCredentialsParams, q as WebhookVerificationMethod, r as AuthenticatedUser, s as Commit, t as Archive, u as DownloadArchiveParams, v as GetWebhookParams, w as ListRepositoriesParams, x as ListBranchesParams, y as GitActor, z as ResolveRefParams } from "./types-E47xhSNA.js";
 //#region src/client.d.ts
 interface RetryOptions {
   rateLimit?: boolean;
@@ -23,6 +23,7 @@ interface RepoClient {
     listAll(params?: Omit<ListRepositoriesParams, 'cursor'>): AsyncGenerator<Repository, void>;
     get(params: GetRepositoryParams): Promise<Repository>;
     downloadArchive(params: DownloadArchiveParams): Promise<Archive>;
+    getCloneCredentials(params: GetCloneCredentialsParams): Promise<CloneCredentials>;
     getCloneUrl(params: GetCloneUrlParams): Promise<CloneUrl>;
   };
   commits: {
@@ -92,4 +93,4 @@ declare class RepoError extends Error {
   constructor(message: string, options: RepoErrorOptions);
 }
 //#endregion
-export { type Archive, type ArchiveFormat, type AuthenticatedUser, type Branch, type CloneUrl, type Commit, type CreateClientOptions, type CreateWebhookParams, type DeleteWebhookParams, type DetectWebhookProviderInput, type DownloadArchiveParams, type GetAuthenticatedUserParams, type GetBranchParams, type GetCloneUrlParams, type GetCommitParams, type GetRepositoryParams, type GetTagParams, type GetWebhookParams, type GitActor, type IncomingWebhookRequest, type ListBranchesParams, type ListCommitsParams, type ListNamespacesParams, type ListRepositoriesParams, type ListTagsParams, type ListWebhooksParams, type Namespace, type NamespaceKind, type Page, type ParsedWebhookEvent, type ProviderName, type ProviderRefMatch, type ProviderSearchRefsParams, type RefMatch, type RefType, type RepoCapabilities, type RepoClient, RepoError, type RepoErrorCode, type RepoErrorOptions, type RepoProvider, type Repository, type ResolveRefParams, type RetryOptions, type SearchRefsParams, type Tag, type TokenProvider, type UpdateWebhookParams, type UserRef, type Webhook, type WebhookEventType, type WebhookVerificationMethod, createClient, detectWebhookProvider };
+export { type Archive, type ArchiveFormat, type AuthenticatedUser, type Branch, type CloneCredentials, type CloneUrl, type Commit, type CreateClientOptions, type CreateWebhookParams, type DeleteWebhookParams, type DetectWebhookProviderInput, type DownloadArchiveParams, type GetAuthenticatedUserParams, type GetBranchParams, type GetCloneCredentialsParams, type GetCloneUrlParams, type GetCommitParams, type GetRepositoryParams, type GetTagParams, type GetWebhookParams, type GitActor, type IncomingWebhookRequest, type ListBranchesParams, type ListCommitsParams, type ListNamespacesParams, type ListRepositoriesParams, type ListTagsParams, type ListWebhooksParams, type Namespace, type NamespaceKind, type Page, type ParsedWebhookEvent, type ProviderName, type ProviderRefMatch, type ProviderSearchRefsParams, type RefMatch, type RefType, type RepoCapabilities, type RepoClient, RepoError, type RepoErrorCode, type RepoErrorOptions, type RepoProvider, type Repository, type ResolveRefParams, type RetryOptions, type SearchRefsParams, type Tag, type TokenProvider, type UpdateWebhookParams, type UserRef, type Webhook, type WebhookEventType, type WebhookVerificationMethod, createClient, detectWebhookProvider };

package/dist/index.js

@@ -125,6 +125,10 @@ function createClient(options) {
 					format
 				}));
 			},
+			getCloneCredentials: async (params) => {
+				requireNonEmpty(params.repo, "repo");
+				return withRetry(() => provider.getCloneCredentials(params));
+			},
 			getCloneUrl: async (params) => {
 				requireNonEmpty(params.repo, "repo");
 				return withRetry(() => provider.getCloneUrl(params));

package/dist/{pagination-CWWHSu8I.js → shared-C6m-C4My.js}

@@ -70,4 +70,54 @@ function assertSameOriginUrl(provider, baseUrl, url) {
 	return url;
 }
 //#endregion
-export { stringToBase64 as a, bytesToBase64Url as i, decodeCursor as n, encodeCursor as r, assertSameOriginUrl as t };
+//#region src/providers/shared.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function clampPerPage(limit, max = 100) {
+	if (limit === void 0) return void 0;
+	return Math.min(Math.max(1, Math.trunc(limit)), max);
+}
+function parseLinkNext(header) {
+	if (!header) return void 0;
+	for (const part of header.split(",")) {
+		const match = part.match(/<([^>]+)>\s*;\s*rel="([^"]+)"/);
+		if (match && match[2] === "next") return match[1];
+	}
+}
+/** Percent-encodes a ref path while keeping its `/` separators intact. */
+function encodeRefPath(ref) {
+	return ref.split("/").map(encodeURIComponent).join("/");
+}
+function commitWebUrlBuilder(pathSegment) {
+	return function commitWebUrl(repoWebUrl, sha) {
+		return `${repoWebUrl.replace(/\/+$/, "")}/${pathSegment}/${sha}`;
+	};
+}
+function filenameFromContentDisposition(header) {
+	if (!header) return void 0;
+	const extended = header.match(/filename\*=(?:UTF-8'')?([^;]+)/i);
+	if (extended?.[1]) return decodeURIComponent(extended[1].trim().replace(/^"|"$/g, ""));
+	return header.match(/filename="?([^";]+)"?/i)?.[1]?.trim();
+}
+/**
+* Embeds clone credentials into their credential-free URL as percent-encoded
+* userinfo — the single place every provider's tokenized clone URL is built.
+* A `null` password yields a bare `user@host` (Gitea puts the token in the
+* username slot); anonymous credentials return the URL untouched.
+*/
+function toCloneUrl(credentials) {
+	const { expiresAt, password, url, username } = credentials;
+	if (username === null && password === null) return {
+		url,
+		expiresAt
+	};
+	const user = username === null ? "" : encodeURIComponent(username);
+	const userinfo = password === null ? user : `${user}:${encodeURIComponent(password)}`;
+	return {
+		url: url.replace("://", `://${userinfo}@`),
+		expiresAt
+	};
+}
+//#endregion
+export { isRecord as a, assertSameOriginUrl as c, bytesToBase64Url as d, stringToBase64 as f, filenameFromContentDisposition as i, decodeCursor as l, commitWebUrlBuilder as n, parseLinkNext as o, encodeRefPath as r, toCloneUrl as s, clampPerPage as t, encodeCursor as u };

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { E as NamespaceKind, F as RepoProvider, I as Repository, P as RepoCapabilities, T as Namespace, U as Webhook, W as WebhookEventType, i as Branch, k as ProviderName, o as Commit, z as Tag } from "./types-B9oMHTeP.js";
+import { D as Namespace, G as Webhook, I as RepoCapabilities, K as WebhookEventType, L as RepoProvider, O as NamespaceKind, R as Repository, V as Tag, i as Branch, j as ProviderName, s as Commit } from "./types-E47xhSNA.js";
 //#region src/providers/testing/index.d.ts
 interface InMemoryNamespaceSeed {
   id: string;

package/dist/testing.js

@@ -1,5 +1,5 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
-import { n as decodeCursor, r as encodeCursor } from "./pagination-CWWHSu8I.js";
+import { l as decodeCursor, s as toCloneUrl, u as encodeCursor } from "./shared-C6m-C4My.js";
 //#region src/providers/testing/index.ts
 /**
 * Small on purpose so that consumers exercise cursor-based pagination.
@@ -149,6 +149,14 @@ function createInMemoryProvider(seed = {}, options = {}) {
 		if (!repository) throw notFound(`Unknown repository: ${repo}`);
 		return repository;
 	}
+	function getCloneCredentials(params) {
+		requireRepository(params.repo);
+		return Promise.resolve({
+			password: "test",
+			url: `https://in-memory.invalid/${params.repo}.git`,
+			username: "x-token"
+		});
+	}
 	return {
 		name,
 		capabilities,
@@ -262,9 +270,9 @@ function createInMemoryProvider(seed = {}, options = {}) {
 				filename: `${repository.name}-${params.ref}.${extension}`
 			});
 		},
-		getCloneUrl(params) {
-			requireRepository(params.repo);
-			return Promise.resolve({ url: `https://x-token:test@in-memory.invalid/${params.repo}.git` });
+		getCloneCredentials,
+		async getCloneUrl(params) {
+			return toCloneUrl(await getCloneCredentials(params));
 		},
 		createWebhook(params) {
 			requireRepository(params.repo);

package/dist/{types-B9oMHTeP.d.ts → types-E47xhSNA.d.ts}

@@ -45,6 +45,20 @@ interface CloneUrl {
   url: string;
   expiresAt?: Date;
 }
+/**
+ * Clone credentials kept separate from the URL, for handing to a git credential
+ * helper instead of persisting a tokenized remote in `.git/config`. Both
+ * components are raw, never percent-encoded.
+ */
+interface CloneCredentials {
+  expiresAt?: Date;
+  /** The secret, or `null` when the provider carries the token in `username` (Gitea) or access is anonymous. */
+  password: string | null;
+  /** Clone URL without any embedded credential. */
+  url: string;
+  /** The static username the provider expects, the token itself for Gitea, or `null` for anonymous access. */
+  username: string | null;
+}
 /** The account behind the configured credentials (see the `userProfile` capability). */
 interface AuthenticatedUser {
   id: string;
@@ -215,6 +229,9 @@ interface DownloadArchiveParams extends BaseParams {
   ref: string;
   format?: ArchiveFormat;
 }
+interface GetCloneCredentialsParams extends BaseParams {
+  repo: string;
+}
 interface GetCloneUrlParams extends BaseParams {
   repo: string;
 }
@@ -276,6 +293,8 @@ interface RepoProvider {
   /** Prefix-match refs of the requested types, branches before tags, at most `limit` results. */
   searchRefs(params: ProviderSearchRefsParams): Promise<ProviderRefMatch[]>;
   downloadArchive(params: DownloadArchiveParams): Promise<Archive>;
+  getCloneCredentials(params: GetCloneCredentialsParams): Promise<CloneCredentials>;
+  /** The same credentials embedded in the URL; derived from `getCloneCredentials`. */
   getCloneUrl(params: GetCloneUrlParams): Promise<CloneUrl>;
   createWebhook(params: CreateWebhookParams): Promise<Webhook>;
   listWebhooks(params: ListWebhooksParams): Promise<Page<Webhook>>;
@@ -284,4 +303,4 @@ interface RepoProvider {
   deleteWebhook(params: DeleteWebhookParams): Promise<void>;
 }
 //#endregion
-export { ProviderRefMatch as A, TokenProvider as B, ListTagsParams as C, Page as D, NamespaceKind as E, RepoProvider as F, WebhookVerificationMethod as G, UserRef as H, Repository as I, ResolveRefParams as L, RefMatch as M, RefType as N, ParsedWebhookEvent as O, RepoCapabilities as P, SearchRefsParams as R, ListRepositoriesParams as S, Namespace as T, Webhook as U, UpdateWebhookParams as V, WebhookEventType as W, GitActor as _, CloneUrl as a, ListCommitsParams as b, DeleteWebhookParams as c, GetBranchParams as d, GetCloneUrlParams as f, GetWebhookParams as g, GetTagParams as h, Branch as i, ProviderSearchRefsParams as j, ProviderName as k, DownloadArchiveParams as l, GetRepositoryParams as m, ArchiveFormat as n, Commit as o, GetCommitParams as p, AuthenticatedUser as r, CreateWebhookParams as s, Archive as t, GetAuthenticatedUserParams as u, IncomingWebhookRequest as v, ListWebhooksParams as w, ListNamespacesParams as x, ListBranchesParams as y, Tag as z };
+export { ParsedWebhookEvent as A, SearchRefsParams as B, ListNamespacesParams as C, Namespace as D, ListWebhooksParams as E, RefType as F, Webhook as G, TokenProvider as H, RepoCapabilities as I, WebhookEventType as K, RepoProvider as L, ProviderRefMatch as M, ProviderSearchRefsParams as N, NamespaceKind as O, RefMatch as P, Repository as R, ListCommitsParams as S, ListTagsParams as T, UpdateWebhookParams as U, Tag as V, UserRef as W, GetTagParams as _, CloneCredentials as a, IncomingWebhookRequest as b, CreateWebhookParams as c, GetAuthenticatedUserParams as d, GetBranchParams as f, GetRepositoryParams as g, GetCommitParams as h, Branch as i, ProviderName as j, Page as k, DeleteWebhookParams as l, GetCloneUrlParams as m, ArchiveFormat as n, CloneUrl as o, GetCloneCredentialsParams as p, WebhookVerificationMethod as q, AuthenticatedUser as r, Commit as s, Archive as t, DownloadArchiveParams as u, GetWebhookParams as v, ListRepositoriesParams as w, ListBranchesParams as x, GitActor as y, ResolveRefParams as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-sdk",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Unified TypeScript SDK for git providers — GitHub, GitLab, Bitbucket, Azure DevOps, Gitea",
   "license": "MIT",
   "author": "Robin Genz <mail@robingenz.dev>",