@agentconnect.md/setup 1.44.0-rc.61 → 1.44.0-rc.62

package/dist/index.js

@@ -56542,6 +56542,30 @@ const SECRET_ENVELOPE_PREFIX = "acv1:";
 function effectiveOrgKeyPrefix(transitKey, configured) {
 	return configured ?? `${transitKey}-org-`;
 }
+//#endregion
+//#region ../control-plane/dist/gitlab/config.js
+/** The default value of the host axis: an unset base URL means GitLab.com (§24.1). */
+const GITLAB_DEFAULT_BASE_URL = "https://gitlab.com";
+/** The public callback path, in its gateway form (deploy-public-url-prefix decision). */
+const GITLAB_OAUTH_CALLBACK_PATH = "/v1/gitlab/oauth/callback";
+/** The one normalization of the host axis (§24.1); downstream sees only its
+*  result. HTTPS, no userinfo/query/fragment, lower-cased host, explicit
+*  non-default port kept, no trailing slash, and a path prefix preserved —
+*  a relative URL root is a first-class install shape. */
+function normalizeGitlabBaseUrl(raw) {
+	const trimmed = raw.trim();
+	let url;
+	try {
+		url = new URL(trimmed);
+	} catch {
+		throw new Error("gitlab base url must be an absolute URL");
+	}
+	if (url.protocol !== "https:") throw new Error("gitlab base url must use https");
+	if (url.username !== "" || url.password !== "") throw new Error("gitlab base url must not carry userinfo");
+	if (url.search !== "") throw new Error("gitlab base url must not carry a query");
+	if (url.hash !== "") throw new Error("gitlab base url must not carry a fragment");
+	return `https://${url.host}${url.pathname.replace(/\/+$/, "")}`;
+}
 const HttpUrlSchema = string().url().superRefine((value, ctx) => {
 	const url = new URL(value);
 	if (url.protocol !== "http:" && url.protocol !== "https:") ctx.addIssue({
@@ -56605,7 +56629,20 @@ const GithubAppSchema = preprocess(withoutProviderUrlSnapshot, strictObject({
 	/** Whether Relay should accept GitHub webhook delivery for this App. Omitted means enabled. */
 	webhookEnabled: boolean().optional()
 }));
-const GitlabAppSchema = preprocess(withoutProviderUrlSnapshot, strictObject({ clientId: string().trim().min(1) }));
+const GitlabBaseUrlSchema = string().trim().min(1).superRefine((value, ctx) => {
+	try {
+		normalizeGitlabBaseUrl(value);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error.message
+		});
+	}
+});
+const GitlabAppSchema = preprocess(withoutProviderUrlSnapshot, strictObject({
+	clientId: string().trim().min(1),
+	baseUrl: GitlabBaseUrlSchema.nullable().optional()
+}));
 const SlackAppSchema = preprocess(withoutProviderUrlSnapshot, strictObject({
 	appId: string().trim().min(1),
 	clientId: string().trim().min(1)
@@ -56713,6 +56750,27 @@ var DeploymentConfigSecretRefreshRequiredError = class extends Error {
 		this.name = "DeploymentConfigSecretRefreshRequiredError";
 	}
 };
+/** The named reason a GitLab base-URL change is refused (gitlab-com-integration.md §24.1). */
+const GITLAB_BASE_URL_LOCKED_REASON = "gitlab_base_url_locked";
+/** Retargeting would send the old host's credentials and host-relative numeric
+*  ids to a new one, because no GitLab row carries instance provenance (§24.1):
+*  the axis is immutable while any GitLab state exists. */
+var DeploymentConfigGitlabBaseUrlLockedError = class extends Error {
+	currentBaseUrl;
+	requestedBaseUrl;
+	code = GITLAB_BASE_URL_LOCKED_REASON;
+	constructor(currentBaseUrl, requestedBaseUrl) {
+		super(`the GitLab instance base URL is locked while GitLab state exists (${currentBaseUrl} → ${requestedBaseUrl}); disconnect every GitLab project first`);
+		this.currentBaseUrl = currentBaseUrl;
+		this.requestedBaseUrl = requestedBaseUrl;
+		this.name = "DeploymentConfigGitlabBaseUrlLockedError";
+	}
+};
+/** The instance a document's GitLab entry selects; absent means GitLab.com (§24.1). */
+function effectiveGitlabBaseUrl(values) {
+	const configured = values.gitlab?.baseUrl;
+	return configured ? normalizeGitlabBaseUrl(configured) : GITLAB_DEFAULT_BASE_URL;
+}
 function parseDeploymentConfigValues(schemaVersion, values) {
 	if (schemaVersion !== 1) throw new Error(`unsupported deployment configuration schema version: ${schemaVersion}`);
 	return DeploymentConfigValuesV1Schema.parse(values);
@@ -56721,7 +56779,7 @@ function deploymentSecretsRequiringRefresh(previous, next) {
 	const githubAppChanged = next.github && previous?.github?.appId !== next.github.appId;
 	const githubClientChanged = next.github !== null && next.github.clientId !== null && previous?.github?.clientId !== next.github.clientId;
 	const githubWebhookEnabled = next.github !== null && next.github.webhookEnabled !== false;
-	const gitlabClientChanged = next.gitlab != null && previous?.gitlab?.clientId !== next.gitlab.clientId;
+	const gitlabClientChanged = next.gitlab != null && (previous?.gitlab?.clientId !== next.gitlab.clientId || previous != null && effectiveGitlabBaseUrl(previous) !== effectiveGitlabBaseUrl(next));
 	const slackIdentityChanged = next.slack && (previous?.slack?.appId !== next.slack.appId || previous?.slack?.clientId !== next.slack.clientId);
 	const feishuIdentityChanged = next.feishu && previous?.feishu?.loginAppId !== next.feishu.loginAppId;
 	const larkIdentityChanged = next.lark && previous?.lark?.loginAppId !== next.lark.loginAppId;
@@ -56845,17 +56903,26 @@ var DeploymentConfigService = class {
 	}
 };
 //#endregion
-//#region ../control-plane/dist/persistence/repositories/deployment-config.repo.js
+//#region ../control-plane/dist/persistence/repositories/gitlab-axis.js
 /**
-* PostgreSQL persistence for the deployment-wide singleton configuration.
+* The deployment-wide GitLab host-axis fence (gitlab-com-integration.md §24.1).
 *
-* Admin reads deliberately omit `deployment_secret.value`; the separate
-* runtime read is the only query in this repository that selects ciphertext.
-* Replacement locks one deployment-global advisory key and commits the typed
-* JSON document, monotonic revision, and secret patch in one transaction.
+* No GitLab row carries instance provenance, so the axis may only change while
+* no GitLab state exists. That is a two-sided invariant, and one advisory key
+* carries both sides: the deployment-config writer takes it EXCLUSIVELY around
+* its state count, and every transaction that creates first-of-its-kind GitLab
+* state takes it SHARED and then proves the persisted axis still matches the
+* base its in-flight operation was composed against. Without the shared side a
+* count of zero and a concurrent connect could both commit, leaving one host's
+* credentials to be presented to another after the next restart.
 */
-const DEPLOYMENT_CONFIG_ID = 1;
 const DEPLOYMENT_CONFIG_LOCK_KEY = "agentconnect:deployment-config";
+/** The config writer's side: nothing else may commit GitLab state alongside it. */
+async function lockAxisExclusive(tx) {
+	await tx.$queryRaw(sql`SELECT pg_advisory_xact_lock(hashtextextended(${DEPLOYMENT_CONFIG_LOCK_KEY}, 0)) IS NULL AS "locked"`);
+}
+//#endregion
+//#region ../control-plane/dist/persistence/repositories/deployment-config.repo.js
 const adminSelect = {
 	schemaVersion: true,
 	revision: true,
@@ -56908,30 +56975,50 @@ function toRuntime(row) {
 		updatedAt: row.updatedAt
 	};
 }
+/** Does any GitLab state still bind this deployment to its instance (§24.1)? A
+*  `disconnected` connection is credential-free history and does not; a binding
+*  (`cleanup_pending` included), an account, a hook, or a claim carrying a
+*  tombstone or an unfinished cleanup obligation does. */
+async function gitlabStateExists(tx) {
+	const [connections, bindings, accounts, hooks, claims] = await Promise.all([
+		tx.gitlabConnection.count({ where: { NOT: { state: "disconnected" } } }),
+		tx.gitlabProjectBinding.count(),
+		tx.gitlabAgentAccount.count(),
+		tx.hookDef.count({ where: { kind: "gitlab" } }),
+		tx.codeHostRepositoryClaim.count({ where: { provider: "gitlab" } })
+	]);
+	return connections + bindings + accounts + hooks + claims > 0;
+}
 var PgDeploymentConfigRepository = class {
 	prisma;
-	constructor(prisma) {
+	/** The axis the process-level fallback selects, for the FIRST persisted
+	*  document: with no row, `GITLAB_BASE_URL` is what the running deployment
+	*  already serves, so it — not GitLab.com — is what a first write must match. */
+	envGitlabBaseUrl;
+	constructor(prisma, envGitlabBaseUrl) {
 		this.prisma = prisma;
+		const raw = envGitlabBaseUrl?.trim();
+		this.envGitlabBaseUrl = raw ? normalizeGitlabBaseUrl(raw) : GITLAB_DEFAULT_BASE_URL;
 	}
 	async readAdmin() {
 		const row = await this.prisma.deploymentConfig.findUnique({
-			where: { id: DEPLOYMENT_CONFIG_ID },
+			where: { id: 1 },
 			select: adminSelect
 		});
 		return row ? toAdmin(row) : null;
 	}
 	async readRuntime() {
 		const row = await this.prisma.deploymentConfig.findUnique({
-			where: { id: DEPLOYMENT_CONFIG_ID },
+			where: { id: 1 },
 			select: runtimeSelect
 		});
 		return row ? toRuntime(row) : null;
 	}
 	async replace(input) {
 		return withTx(this.prisma, async (tx) => {
-			await tx.$queryRaw(sql`SELECT pg_advisory_xact_lock(hashtextextended(${DEPLOYMENT_CONFIG_LOCK_KEY}, 0)) IS NULL AS "locked"`);
+			await lockAxisExclusive(tx);
 			const current = await tx.deploymentConfig.findUnique({
-				where: { id: DEPLOYMENT_CONFIG_ID },
+				where: { id: 1 },
 				select: {
 					revision: true,
 					schemaVersion: true,
@@ -56941,10 +57028,13 @@ var PgDeploymentConfigRepository = class {
 			const actualRevision = current?.revision ?? 0;
 			if (actualRevision !== input.expectedRevision) throw new DeploymentConfigConflictError(input.expectedRevision, actualRevision);
 			const previousValues = current ? parseDeploymentConfigValues(current.schemaVersion, current.values) : null;
+			const previousBaseUrl = previousValues ? effectiveGitlabBaseUrl(previousValues) : this.envGitlabBaseUrl;
+			const nextBaseUrl = effectiveGitlabBaseUrl(input.values);
+			if (previousBaseUrl !== nextBaseUrl && await gitlabStateExists(tx)) throw new DeploymentConfigGitlabBaseUrlLockedError(previousBaseUrl, nextBaseUrl);
 			const missingRefresh = (previousValues ? deploymentSecretsRequiringRefresh(previousValues, input.values) : []).filter((key) => !input.secrets[key]);
 			if (missingRefresh.length > 0) throw new DeploymentConfigSecretRefreshRequiredError(missingRefresh);
 			const currentSecrets = await tx.deploymentSecret.findMany({
-				where: { deploymentConfigId: DEPLOYMENT_CONFIG_ID },
+				where: { deploymentConfigId: 1 },
 				select: { key: true }
 			});
 			const effective = new Set(currentSecrets.map(({ key }) => key));
@@ -56953,9 +57043,9 @@ var PgDeploymentConfigRepository = class {
 			const missing = input.requiredSecretKeys.filter((key) => !effective.has(key));
 			if (missing.length > 0) throw new DeploymentConfigMissingSecretsError(missing);
 			await tx.deploymentConfig.upsert({
-				where: { id: DEPLOYMENT_CONFIG_ID },
+				where: { id: 1 },
 				create: {
-					id: DEPLOYMENT_CONFIG_ID,
+					id: 1,
 					schemaVersion: input.schemaVersion,
 					values: input.values,
 					revision: 1
@@ -56970,18 +57060,18 @@ var PgDeploymentConfigRepository = class {
 				const key = rawKey;
 				if (prepared === null) {
 					await tx.deploymentSecret.deleteMany({ where: {
-						deploymentConfigId: DEPLOYMENT_CONFIG_ID,
+						deploymentConfigId: 1,
 						key
 					} });
 					continue;
 				}
 				await tx.deploymentSecret.upsert({
 					where: { deploymentConfigId_key: {
-						deploymentConfigId: DEPLOYMENT_CONFIG_ID,
+						deploymentConfigId: 1,
 						key
 					} },
 					create: {
-						deploymentConfigId: DEPLOYMENT_CONFIG_ID,
+						deploymentConfigId: 1,
 						key,
 						value: prepared.sealedValue,
 						fingerprint: prepared.fingerprint
@@ -56993,7 +57083,7 @@ var PgDeploymentConfigRepository = class {
 				});
 			}
 			return toAdmin(await tx.deploymentConfig.findUniqueOrThrow({
-				where: { id: DEPLOYMENT_CONFIG_ID },
+				where: { id: 1 },
 				select: adminSelect
 			}));
 		});
@@ -57001,21 +57091,21 @@ var PgDeploymentConfigRepository = class {
 	async markAdminClaimed(expectedRevision, claimedFor) {
 		if ((await this.prisma.deploymentConfig.updateMany({
 			where: {
-				id: DEPLOYMENT_CONFIG_ID,
+				id: 1,
 				revision: expectedRevision
 			},
 			data: { adminClaimedFor: claimedFor }
 		})).count === 1) return;
 		throw new DeploymentConfigConflictError(expectedRevision, (await this.prisma.deploymentConfig.findUnique({
-			where: { id: DEPLOYMENT_CONFIG_ID },
+			where: { id: 1 },
 			select: { revision: true }
 		}))?.revision ?? 0);
 	}
 };
 /** Composition convenience used by the CP container and tests. */
 var PgDeploymentConfigStore = class extends DeploymentConfigService {
-	constructor(prisma, cipher) {
-		super(new PgDeploymentConfigRepository(prisma), cipher);
+	constructor(prisma, cipher, envGitlabBaseUrl) {
+		super(new PgDeploymentConfigRepository(prisma, envGitlabBaseUrl), cipher);
 	}
 };
 //#endregion
@@ -57294,7 +57384,7 @@ function makeSecretCipher(config) {
 /** Open exactly the DB + SecretCipher slice shared by CP and setup tooling. */
 function openDeploymentConfigStore(options) {
 	return {
-		store: new PgDeploymentConfigStore(createPrisma(options.databaseUrl), makeSecretCipher(options)),
+		store: new PgDeploymentConfigStore(createPrisma(options.databaseUrl), makeSecretCipher(options), options.gitlabBaseUrl),
 		close: disconnectPrisma
 	};
 }
@@ -59750,10 +59840,6 @@ async function convertGithubManifest(code, options = {}) {
 	};
 }
 //#endregion
-//#region ../control-plane/dist/gitlab/config.js
-/** The public callback path, in its gateway form (deploy-public-url-prefix decision). */
-const GITLAB_OAUTH_CALLBACK_PATH = "/v1/gitlab/oauth/callback";
-//#endregion
 //#region src/gitlab-app.ts
 /** Exactly the scope set the Control Plane asks GitLab for (gitlab-com-integration.md §9.1). */
 const GITLAB_OAUTH_SCOPES = ["api"];
@@ -62183,6 +62269,7 @@ function buildSetupServer(deps, options = {}) {
 		if (error instanceof DeploymentConfigMissingSecretsError) return problem(reply, 400, error.message, error.code);
 		if (error instanceof DeploymentConfigSecretRefreshRequiredError) return problem(reply, 400, error.message, error.code);
 		if (error instanceof DeploymentConfigConflictError) return problem(reply, 409, error.message, error.code);
+		if (error instanceof DeploymentConfigGitlabBaseUrlLockedError) return problem(reply, 409, error.message, error.code);
 		if (error instanceof LogtoManagementError) return problem(reply, error.code === "LOGTO_UNAVAILABLE" ? 502 : error.code === "SOCIAL_CONNECTOR_UNSUPPORTED" ? 400 : 409, error.message, error.code);
 		request.log.error({ err: error }, "setup-server request failed");
 		return problem(reply, 500, "internal server error");
@@ -63056,6 +63143,7 @@ async function serveSetupServer(env = process.env) {
 	if (!isLoopbackHostname(host) && !config.SETUP_SERVER_ALLOW_CONTAINER_PROXY) throw new Error("Setup Server may bind outside loopback only behind an isolated local port forward");
 	const handle = openDeploymentConfigStore({
 		databaseUrl: config.DATABASE_URL,
+		...env.GITLAB_BASE_URL ? { gitlabBaseUrl: env.GITLAB_BASE_URL } : {},
 		SECRET_CIPHER: config.SECRET_CIPHER,
 		VAULT_TRANSIT_KEY: config.VAULT_TRANSIT_KEY,
 		VAULT_TRANSIT_MOUNT: config.VAULT_TRANSIT_MOUNT,