@begit/core - npm Package Compare versions

Comparing version 0.0.19 to 0.1.0

dist/index.js

@@ -1,47 +0,16 @@
-import { join, dirname } from 'path';
-import { existsSync, createWriteStream } from 'fs';
-import { mkdir, unlink } from 'fs/promises';
-import { Readable } from 'stream';
-import { finished } from 'stream/promises';
-import { tmpdir } from 'os';
+import { fetchLatestCommit, getFileWithHash, cachedir, cacheFileName, fetchTarball, toFile } from './chunk-NFBTOOKH.js';
+import { join } from 'path';
 import { extract } from 'tar/extract';
 import { list } from 'tar/list';
+import { mkdir, unlink } from 'fs/promises';
 
-// src/index.ts
-var begitDir = () => {
-  const dir = process.env.XDG_CACHE_HOME ?? tmpdir();
-  return join(dir, ".begit");
-};
-var cachedir = () => {
-  return join(begitDir(), "cache");
-};
-var fetchTarball = async (owner, repo, ref) => {
-  ref = ref ?? "HEAD";
-  const res = await fetch(`https://github.com/${owner}/${repo}/tarball/${ref}`);
-  return {
-    body: res.body,
-    name: res.url.split("/").pop()
-  };
-};
-var toFile = async (path, tarball) => {
-  await mkdir(dirname(path.toString()), { recursive: true });
-  const stream = createWriteStream(path);
-  await finished(Readable.fromWeb(tarball.body).pipe(stream));
-};
-var fetchLatestCommit = async (owner, repo) => {
-  const auth = process.env["BEGIT_GH_API_KEY"];
-  const res = await fetch(
-    `https://api.github.com/repos/${owner}/${repo}/commits?per_page=1`,
-    auth ? {
-      headers: { "Authorization": `Bearer ${auth}` }
-    } : void 0
-  );
-  const json = await res.json();
-  return json[0].sha;
-};
 var downloadToFile = async (repo) => {
   const { owner, name, branch } = repo;
-  const hash = await fetchLatestCommit(owner, name);
-  const location = join(cachedir(), `${owner}-${name}-${hash}.tar.gz`);
-  if (existsSync(location)) return location;
+  let hash = repo.hash;
+  if (!hash) {
+    hash = await fetchLatestCommit(owner, name);
+  }
+  const cached = await getFileWithHash(owner, name, hash);
+  if (cached) return join(cachedir(), cached);
+  const location = join(cachedir(), cacheFileName(owner, name, hash, Date.now()));
   const tarball = await fetchTarball(owner, name, branch);
@@ -77,3 +46,3 @@ await toFile(location, tarball);
     },
-    dir ? [dir] : void 0
+    dir ? [dir] : undefined
   );
@@ -80,0 +49,0 @@ };

package.json

 {
   "name": "@begit/core",
-  "version": "0.0.19",
+  "version": "0.1.0",
   "description": "Blazingly fast tool for cloning git repositories, with no reliance on local `git`, or `tar` installs",
@@ -22,2 +22,7 @@ "author": "Thomas Beer",
       "default": "./dist/index.js"
+    },
+    "./utils": {
+      "types": "./types/utils.d.ts",
+      "import": "./dist/utils.js",
+      "default": "./dist/utils.js"
     }
@@ -31,10 +36,10 @@ },
   "devDependencies": {
-    "@types/node": "^20.14.11",
+    "@types/node": "^22.10.7",
     "@types/tar": "^6.1.13",
-    "tsup": "^8.1.2",
-    "typescript": "^5.5.3",
-    "vitest": "^2.0.3"
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.3",
+    "vitest": "^3.0.2"
   },
   "dependencies": {
-    "tar": "^7.4.0"
+    "tar": "^7.4.3"
   },
@@ -41,0 +46,0 @@ "publishConfig": {

types/index.d.ts

@@ -5,2 +5,3 @@ export type Repository = {
     branch?: string;
+    hash?: string;
 };
@@ -7,0 +8,0 @@ export type Installable = Repository & {

types/utils.d.ts

@@ -12,2 +12,3 @@ import { type PathLike } from "fs";
 export declare const toFile: (path: PathLike, tarball: Tarball) => Promise<void>;
+export declare const cacheFileName: (owner: string, name: string, hash: string, timestamp: number) => string;
 export type CommitData = {
@@ -17,1 +18,6 @@ sha: string;
 export declare const fetchLatestCommit: (owner: string, repo: string) => Promise<string>;
+export declare const getFileWithHash: (repoOwner: string, repoName: string, hash: string) => Promise<string>;
+export declare const getMostRecentCachedCommit: (repoOwner: string, repoName: string) => Promise<{
+    hash: string;
+    timestamp: number;
+} | undefined>;

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

22067

increased by29.62%

Number of package files

11

increased by57.14%

Lines of code

196

increased by27.27%

Worsened metrics

Number of low supply chain risk alerts

6

increased by50%

Dependency changes

• Updatedtar@^7.4.3