repo-sdk 0.3.1 → 0.3.3

package/README.md

@@ -148,7 +148,7 @@ It reports every capability enabled by default, and a second options argument si
 
 ## Errors
 
-Every failure is a `RepoError` with a closed `code` union: `unauthorized`, `forbidden`, `not_found`, `rate_limited`, `validation`, `unsupported`, `provider_error`, `network_error`.
+Every failure is a `RepoError` with a closed `code` union: `unauthorized`, `forbidden`, `not_found`, `rate_limited`, `validation`, `unsupported`, `provider_error`, `invalid_response`, `network_error`.
 
 ```ts
 import { RepoError } from 'repo-sdk';

package/dist/azure-devops.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
 import { a as isRecord, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, s as toCloneUrl, u as encodeCursor } from "./shared-C6m-C4My.js";
-import { t as HttpClient } from "./http-BcC1vIan.js";
+import { t as HttpClient } from "./http-DOXOhL_I.js";
 import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/azure-devops/auth.ts
 /**

package/dist/bitbucket.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
 import { a as isRecord, c as assertSameOriginUrl, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
-import { t as HttpClient } from "./http-BcC1vIan.js";
+import { t as HttpClient } from "./http-DOXOhL_I.js";
 import { a as headShaOrUndefined, i as verifyHmacSignature, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/bitbucket/index.ts
 const BASE_URL = "https://api.bitbucket.org/2.0";

package/dist/git-http.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
 import { f as stringToBase64, l as decodeCursor, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
-import { t as HttpClient } from "./http-BcC1vIan.js";
+import { t as HttpClient } from "./http-DOXOhL_I.js";
 //#region src/providers/git-http/index.ts
 const CAPABILITIES = {
 	userProfile: false,

package/dist/gitea.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
 import { a as isRecord, c as assertSameOriginUrl, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, o as parseLinkNext, r as encodeRefPath, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
-import { t as HttpClient } from "./http-BcC1vIan.js";
+import { t as HttpClient } from "./http-DOXOhL_I.js";
 import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook, t as hmacSha256Hex } from "./verify-BBMVxz8q.js";
 //#region src/providers/gitea/index.ts
 const DEFAULT_BASE_URL = "https://gitea.com/api/v1";

package/dist/github.d.ts

@@ -21,6 +21,12 @@ interface GitHubAppAuth {
    * installation's account. Omitted: every repository the installation can access.
    */
   repositories?: string[];
+  /**
+   * Restrict the minted installation token to these repository ids. Ids survive a
+   * repository rename, so prefer them over `repositories` when the repository is
+   * stored long-term. Mutually exclusive with `repositories`.
+   */
+  repositoryIds?: Array<string | number>;
 }
 interface GitHubTokenProviderAuth {
   /** Mints a bearer token per request; re-invoked with `forceRefresh` after a 401, then retried once. */

package/dist/github.js

@@ -1,6 +1,6 @@
 import { n as codeFromStatus, t as RepoError } from "./errors-Cxq_CqYv.js";
 import { a as isRecord, c as assertSameOriginUrl, d as bytesToBase64Url, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, o as parseLinkNext, r as encodeRefPath, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
-import { t as HttpClient } from "./http-BcC1vIan.js";
+import { t as HttpClient } from "./http-DOXOhL_I.js";
 import { a as headShaOrUndefined, i as verifyHmacSignature, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/github/app-auth.ts
 const RSA_ALGORITHM_IDENTIFIER = [
@@ -125,6 +125,7 @@ var AppTokenSource = class {
 	installationId;
 	owner;
 	repositories;
+	repositoryIds;
 	cached;
 	refresh;
 	constructor(options) {
@@ -132,6 +133,10 @@ var AppTokenSource = class {
 			code: "validation",
 			provider: "github"
 		});
+		if (options.repositories !== void 0 && options.repositoryIds !== void 0) throw new RepoError("GitHub App auth accepts either repositories or repositoryIds, not both", {
+			code: "validation",
+			provider: "github"
+		});
 		this.appId = String(options.appId);
 		this.privateKey = options.privateKey;
 		this.baseUrl = options.baseUrl;
@@ -141,6 +146,7 @@ var AppTokenSource = class {
 		this.installationId = options.installationId === void 0 ? void 0 : String(options.installationId);
 		this.owner = options.owner;
 		this.repositories = options.repositories;
+		this.repositoryIds = options.repositoryIds?.map(Number);
 	}
 	async getToken() {
 		return (await this.resolveToken()).token;
@@ -176,7 +182,7 @@ var AppTokenSource = class {
 			privateKey: this.privateKey
 		});
 		const installationId = await this.resolveInstallationId(jwt);
-		const data = await this.appRequest(`/app/installations/${installationId}/access_tokens`, "POST", jwt, this.repositories === void 0 ? void 0 : { repositories: this.repositories });
+		const data = await this.appRequest(`/app/installations/${installationId}/access_tokens`, "POST", jwt, this.tokenScope());
 		const token = {
 			token: data.token,
 			expiresAt: new Date(data.expires_at)
@@ -184,6 +190,11 @@ var AppTokenSource = class {
 		this.cached = token;
 		return token;
 	}
+	/** Body of the access-token request; `undefined` mints an unrestricted token. */
+	tokenScope() {
+		if (this.repositoryIds !== void 0) return { repository_ids: this.repositoryIds };
+		if (this.repositories !== void 0) return { repositories: this.repositories };
+	}
 	async resolveInstallationId(jwt) {
 		if (this.installationId !== void 0) return this.installationId;
 		this.installationId = this.owner === void 0 ? await this.lookupSingleInstallation(jwt) : await this.lookupOwnerInstallation(jwt, this.owner);
@@ -325,6 +336,7 @@ function createTokenSource(auth, baseUrl, fetchImpl) {
 		installationId: auth.installationId,
 		owner: auth.owner,
 		repositories: auth.repositories,
+		repositoryIds: auth.repositoryIds,
 		baseUrl,
 		fetchImpl,
 		apiVersion: API_VERSION,

package/dist/gitlab.js

@@ -1,6 +1,6 @@
 import { t as RepoError } from "./errors-Cxq_CqYv.js";
 import { a as isRecord, c as assertSameOriginUrl, i as filenameFromContentDisposition, l as decodeCursor, n as commitWebUrlBuilder, o as parseLinkNext, s as toCloneUrl, t as clampPerPage, u as encodeCursor } from "./shared-C6m-C4My.js";
-import { t as HttpClient } from "./http-BcC1vIan.js";
+import { t as HttpClient } from "./http-DOXOhL_I.js";
 import { a as headShaOrUndefined, n as timingSafeEqual, r as toIncomingWebhook } from "./verify-BBMVxz8q.js";
 //#region src/providers/gitlab/index.ts
 const DEFAULT_BASE_URL = "https://gitlab.com/api/v4";

package/dist/{http-BcC1vIan.js → http-DOXOhL_I.js}

@@ -50,10 +50,26 @@ var HttpClient = class {
 	}
 	async json(path, options = {}) {
 		const response = await this.raw(path, options);
-		return {
-			data: response.status === 204 ? void 0 : await response.json(),
+		if (response.status === 204) return {
+			data: void 0,
 			response
 		};
+		const text = await response.text();
+		try {
+			return {
+				data: JSON.parse(text),
+				response
+			};
+		} catch (error) {
+			const url = this.buildUrl(path, options.query);
+			throw new RepoError(`${this.options.provider} returned a non-JSON response from ${url.origin}${url.pathname}`, {
+				code: "invalid_response",
+				provider: this.options.provider,
+				status: response.status,
+				cause: error,
+				secrets: this.options.secrets?.() ?? []
+			});
+		}
 	}
 	async toError(response) {
 		const text = await response.text().catch(() => "");

package/dist/index.d.ts

@@ -74,7 +74,7 @@ interface DetectWebhookProviderInput {
 declare function detectWebhookProvider(input: Request | DetectWebhookProviderInput): Promise<ProviderName | undefined>;
 //#endregion
 //#region src/errors.d.ts
-type RepoErrorCode = 'unauthorized' | 'forbidden' | 'not_found' | 'rate_limited' | 'validation' | 'unsupported' | 'provider_error' | 'network_error';
+type RepoErrorCode = 'unauthorized' | 'forbidden' | 'not_found' | 'rate_limited' | 'validation' | 'unsupported' | 'provider_error' | 'invalid_response' | 'network_error';
 interface RepoErrorOptions {
   code: RepoErrorCode;
   provider: ProviderName;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-sdk",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Unified TypeScript SDK for git providers — GitHub, GitLab, Bitbucket, Azure DevOps, Gitea",
   "license": "MIT",
   "author": "Robin Genz <mail@robingenz.dev>",