@cat-factory/gitlab 0.1.2 → 0.1.3

package/dist/index.js

@@ -0,0 +1,32 @@
+import { registerVcsProvider } from '@cat-factory/kernel';
+import { FetchGitLabClient } from './FetchGitLabClient.js';
+import { GitLabProvisioningClient } from './provisioning.js';
+import { GitLabWebhookMapper, GitLabWebhookVerifier } from './webhook.js';
+// ---------------------------------------------------------------------------
+// The GitLab VCS provider, authored entirely through the public VCS-registry seam
+// (`registerVcsProvider`) — depending only on @cat-factory/kernel + @cat-factory/contracts,
+// never on the engine or a runtime facade. A deployment that wants GitLab support calls
+// `registerGitLab(...)` once at startup; any caller holding a `gitlab` VcsConnectionRef then
+// resolves this bundle via `resolveVcsProvider(ref)`.
+// ---------------------------------------------------------------------------
+export { FetchGitLabClient, GitLabApiError } from './FetchGitLabClient.js';
+export { GitLabProvisioningClient } from './provisioning.js';
+export { GitLabWebhookMapper, GitLabWebhookVerifier } from './webhook.js';
+export { StaticGitLabTokenSource, GITLAB_PUBLIC_API_BASE, } from './tokenSource.js';
+export * as gitlabProjection from './projection.js';
+/**
+ * Register the GitLab provider bundle (client + webhook verifier/mapper + provisioning)
+ * in the process-wide VCS registry. Call once at startup. Idempotent — a later call
+ * replaces the earlier registration.
+ */
+export function registerGitLab(options) {
+    const { tokenSource, clock, webhookSecret, fetchImpl, logger } = options;
+    registerVcsProvider({
+        provider: 'gitlab',
+        client: new FetchGitLabClient({ tokenSource, clock, fetchImpl, logger }),
+        webhookMapper: new GitLabWebhookMapper(clock),
+        webhookVerifier: webhookSecret ? new GitLabWebhookVerifier(webhookSecret) : undefined,
+        provisioning: new GitLabProvisioningClient({ tokenSource, fetchImpl }),
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAc,MAAM,qBAAqB,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAGzE,8EAA8E;AAC9E,kFAAkF;AAClF,4FAA4F;AAC5F,wFAAwF;AACxF,6FAA6F;AAC7F,sDAAsD;AACtD,8EAA8E;AAE9E,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACzE,OAAO,EAEL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,gBAAgB,MAAM,iBAAiB,CAAA;AAanD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACxE,mBAAmB,CAAC;QAClB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACxE,aAAa,EAAE,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAC7C,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;QACrF,YAAY,EAAE,IAAI,wBAAwB,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;KACvE,CAAC,CAAA;AACJ,CAAC"}

package/dist/projection.d.ts

@@ -0,0 +1,102 @@
+import type { GitHubBranch, GitHubCheckRun, GitHubCommit, GitHubIssue, GitHubPullRequest, GitHubRepo } from '@cat-factory/kernel';
+export interface GlProjectPayload {
+    id?: number;
+    path?: string;
+    path_with_namespace?: string;
+    name?: string;
+    default_branch?: string | null;
+    visibility?: string;
+    namespace?: {
+        path?: string;
+        full_path?: string;
+    };
+}
+export interface GlBranchPayload {
+    name?: string;
+    protected?: boolean;
+    commit?: {
+        id?: string;
+    };
+}
+export interface GlMergeRequestPayload {
+    id?: number;
+    iid?: number;
+    title?: string;
+    state?: string;
+    source_branch?: string | null;
+    target_branch?: string | null;
+    sha?: string | null;
+    author?: {
+        username?: string;
+    } | null;
+    updated_at?: string | null;
+}
+export interface GlIssuePayload {
+    id?: number;
+    iid?: number;
+    title?: string;
+    state?: string;
+    author?: {
+        username?: string;
+    } | null;
+    labels?: Array<string | {
+        name?: string;
+    }>;
+    updated_at?: string | null;
+}
+export interface GlCommitPayload {
+    id?: string;
+    message?: string;
+    author_name?: string | null;
+    authored_date?: string | null;
+}
+export interface GlCommitStatusPayload {
+    id?: number;
+    sha?: string;
+    name?: string;
+    status?: string;
+    target_url?: string | null;
+}
+/** Owner (namespace) + name for a GitLab project, used to fill the neutral ref. */
+export declare function projectOwnerName(p: GlProjectPayload): {
+    owner: string;
+    name: string;
+};
+export declare function toRepoProjection(p: GlProjectPayload, connectionNumericId: number, syncedAt: number): GitHubRepo;
+export declare function toBranchProjection(b: GlBranchPayload, repoId: number, syncedAt: number): GitHubBranch;
+/** Map GitLab's MR `state` to the neutral open/closed + merged flag. */
+export declare function mrState(state: string | undefined): {
+    state: 'open' | 'closed';
+    merged: boolean;
+};
+export declare function toMergeRequestProjection(mr: GlMergeRequestPayload, repoId: number, syncedAt: number): GitHubPullRequest;
+export declare function toIssueProjection(i: GlIssuePayload, repoId: number, syncedAt: number): GitHubIssue;
+export declare function toCommitProjection(c: GlCommitPayload, repoId: number, syncedAt: number): GitHubCommit;
+/**
+ * Map a GitLab commit status / pipeline-job state to a GitHub-style check run so the
+ * shared CI gate (`aggregateCi`) reduces it correctly. GitHub semantics: terminal
+ * states are `status: 'completed'` with a `conclusion`; in-flight states are
+ * `status: 'in_progress'` with a null conclusion.
+ */
+export declare function toCheckRunProjection(s: GlCommitStatusPayload, repoId: number, syncedAt: number): GitHubCheckRun;
+/** GitLab pipeline/commit-status state → GitHub check `status` + `conclusion`. */
+export declare function checkState(state: string | undefined): {
+    status: string;
+    conclusion: string | null;
+};
+/**
+ * GitLab mergeability → the neutral triplet the conflicts gate normalises. Prefers
+ * GitLab 15.6+ `detailed_merge_status` (precise) over the deprecated `merge_status`.
+ *
+ * Only a genuine textual `conflict` maps to GitHub's `dirty` state — the single signal
+ * the `conflicts` gate escalates a conflict-resolver on. Every OTHER non-mergeable reason
+ * (CI pending, unresolved discussions, behind target, draft, not open) is reported as
+ * not-mergeable-but-not-`dirty`, so `classifyMergeability` returns `mergeable` (nothing to
+ * resolve) and the gate advances instead of spuriously spawning a conflict-resolver.
+ * `checking`/`unchecked` stay `mergeable: null` so the gate re-polls.
+ */
+export declare function mergeabilityFromStatus(detailedStatus: string | undefined, legacyStatus?: string | undefined): {
+    mergeable: boolean | null;
+    mergeableState: string;
+};
+//# sourceMappingURL=projection.d.ts.map

package/dist/projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.d.ts","sourceRoot":"","sources":["../src/projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,UAAU,EACX,MAAM,qBAAqB,CAAA;AAc5B,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,MAAM,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACrC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACrC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,gBAAgB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAQrF;AAED,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,gBAAgB,EACnB,mBAAmB,EAAE,MAAM,EAC3B,QAAQ,EAAE,MAAM,GACf,UAAU,CAYZ;AAED,wBAAgB,kBAAkB,CAChC,CAAC,EAAE,eAAe,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,YAAY,CAQd;AAED,wEAAwE;AACxE,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAKhG;AAED,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,qBAAqB,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,iBAAiB,CAgBnB;AAED,wBAAgB,iBAAiB,CAC/B,CAAC,EAAE,cAAc,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,WAAW,CAeb;AAED,wBAAgB,kBAAkB,CAChC,CAAC,EAAE,eAAe,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,YAAY,CASd;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,qBAAqB,EACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,cAAc,CAYhB;AAED,kFAAkF;AAClF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG;IACrD,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B,CAkBA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,GAChC;IACD,SAAS,EAAE,OAAO,GAAG,IAAI,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;CACvB,CA+BA"}

package/dist/projection.js

@@ -0,0 +1,173 @@
+/** Owner (namespace) + name for a GitLab project, used to fill the neutral ref. */
+export function projectOwnerName(p) {
+    const name = p.path ?? p.name ?? '';
+    // `path_with_namespace` is `group/sub/project`; the owner is everything before the
+    // final segment. Fall back to the namespace path.
+    if (p.path_with_namespace && p.path_with_namespace.includes('/')) {
+        return { owner: p.path_with_namespace.slice(0, p.path_with_namespace.lastIndexOf('/')), name };
+    }
+    return { owner: p.namespace?.full_path ?? p.namespace?.path ?? '', name };
+}
+export function toRepoProjection(p, connectionNumericId, syncedAt) {
+    const { owner, name } = projectOwnerName(p);
+    return {
+        githubId: p.id ?? 0,
+        installationId: connectionNumericId,
+        owner,
+        name,
+        defaultBranch: p.default_branch ?? null,
+        private: p.visibility !== 'public',
+        blockId: null,
+        syncedAt,
+    };
+}
+export function toBranchProjection(b, repoId, syncedAt) {
+    return {
+        repoGithubId: repoId,
+        name: b.name ?? '',
+        headSha: b.commit?.id ?? '',
+        protected: b.protected ?? false,
+        syncedAt,
+    };
+}
+/** Map GitLab's MR `state` to the neutral open/closed + merged flag. */
+export function mrState(state) {
+    if (state === 'opened')
+        return { state: 'open', merged: false };
+    if (state === 'merged')
+        return { state: 'closed', merged: true };
+    // 'closed' | 'locked' | anything else
+    return { state: 'closed', merged: false };
+}
+export function toMergeRequestProjection(mr, repoId, syncedAt) {
+    const { state, merged } = mrState(mr.state);
+    return {
+        repoGithubId: repoId,
+        number: mr.iid ?? 0,
+        githubId: mr.id ?? 0,
+        title: mr.title ?? '',
+        state,
+        headRef: mr.source_branch ?? null,
+        baseRef: mr.target_branch ?? null,
+        headSha: mr.sha ?? null,
+        merged,
+        author: mr.author?.username ?? null,
+        updatedAt: parseTime(mr.updated_at),
+        syncedAt,
+    };
+}
+export function toIssueProjection(i, repoId, syncedAt) {
+    return {
+        repoGithubId: repoId,
+        number: i.iid ?? 0,
+        githubId: i.id ?? 0,
+        title: i.title ?? '',
+        // GitLab issues are 'opened'/'closed'.
+        state: i.state === 'opened' ? 'open' : 'closed',
+        author: i.author?.username ?? null,
+        labels: (i.labels ?? [])
+            .map((l) => (typeof l === 'string' ? l : (l?.name ?? '')))
+            .filter(Boolean),
+        updatedAt: parseTime(i.updated_at),
+        syncedAt,
+    };
+}
+export function toCommitProjection(c, repoId, syncedAt) {
+    return {
+        repoGithubId: repoId,
+        sha: c.id ?? '',
+        message: c.message ?? '',
+        author: c.author_name ?? null,
+        authoredAt: parseTime(c.authored_date),
+        syncedAt,
+    };
+}
+/**
+ * Map a GitLab commit status / pipeline-job state to a GitHub-style check run so the
+ * shared CI gate (`aggregateCi`) reduces it correctly. GitHub semantics: terminal
+ * states are `status: 'completed'` with a `conclusion`; in-flight states are
+ * `status: 'in_progress'` with a null conclusion.
+ */
+export function toCheckRunProjection(s, repoId, syncedAt) {
+    const { status, conclusion } = checkState(s.status);
+    return {
+        repoGithubId: repoId,
+        githubId: s.id ?? 0,
+        headSha: s.sha ?? '',
+        name: s.name ?? '',
+        status,
+        conclusion,
+        htmlUrl: s.target_url ?? null,
+        syncedAt,
+    };
+}
+/** GitLab pipeline/commit-status state → GitHub check `status` + `conclusion`. */
+export function checkState(state) {
+    switch (state) {
+        case 'success':
+            return { status: 'completed', conclusion: 'success' };
+        case 'failed':
+            return { status: 'completed', conclusion: 'failure' };
+        case 'canceled':
+        case 'cancelled':
+            return { status: 'completed', conclusion: 'cancelled' };
+        case 'skipped':
+            return { status: 'completed', conclusion: 'skipped' };
+        case 'manual':
+            // Awaiting a manual action — neutral (don't block the gate on an optional job).
+            return { status: 'completed', conclusion: 'neutral' };
+        default:
+            // created / waiting_for_resource / preparing / pending / running / scheduled
+            return { status: 'in_progress', conclusion: null };
+    }
+}
+/**
+ * GitLab mergeability → the neutral triplet the conflicts gate normalises. Prefers
+ * GitLab 15.6+ `detailed_merge_status` (precise) over the deprecated `merge_status`.
+ *
+ * Only a genuine textual `conflict` maps to GitHub's `dirty` state — the single signal
+ * the `conflicts` gate escalates a conflict-resolver on. Every OTHER non-mergeable reason
+ * (CI pending, unresolved discussions, behind target, draft, not open) is reported as
+ * not-mergeable-but-not-`dirty`, so `classifyMergeability` returns `mergeable` (nothing to
+ * resolve) and the gate advances instead of spuriously spawning a conflict-resolver.
+ * `checking`/`unchecked` stay `mergeable: null` so the gate re-polls.
+ */
+export function mergeabilityFromStatus(detailedStatus, legacyStatus) {
+    if (detailedStatus) {
+        switch (detailedStatus) {
+            case 'mergeable':
+                return { mergeable: true, mergeableState: 'clean' };
+            case 'conflict':
+                return { mergeable: false, mergeableState: 'dirty' };
+            case 'checking':
+            case 'unchecked':
+                return { mergeable: null, mergeableState: detailedStatus };
+            default:
+                // not_open | draft_status | discussions_not_resolved | ci_must_pass |
+                // ci_still_running | need_rebase | broken_status | commits_status | …
+                return { mergeable: false, mergeableState: 'blocked' };
+        }
+    }
+    switch (legacyStatus) {
+        case 'can_be_merged':
+            return { mergeable: true, mergeableState: 'clean' };
+        case 'cannot_be_merged':
+            // Ambiguous on the legacy field (a real conflict OR merely CI/discussions/draft).
+            // Report not-mergeable WITHOUT the `dirty` conflict signal so the gate does not
+            // escalate on a non-conflict block; `detailed_merge_status` (above) disambiguates.
+            return { mergeable: false, mergeableState: 'blocked' };
+        case 'checking':
+        case 'unchecked':
+        case 'cannot_be_merged_recheck':
+            return { mergeable: null, mergeableState: legacyStatus };
+        default:
+            return { mergeable: null, mergeableState: legacyStatus ?? 'unknown' };
+    }
+}
+function parseTime(value) {
+    if (!value)
+        return null;
+    const ms = Date.parse(value);
+    return Number.isFinite(ms) ? ms : null;
+}
+//# sourceMappingURL=projection.js.map

package/dist/projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.js","sourceRoot":"","sources":["../src/projection.ts"],"names":[],"mappings":"AA0EA,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,CAAmB;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;IACnC,mFAAmF;IACnF,kDAAkD;IAClD,IAAI,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAChG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,CAAmB,EACnB,mBAA2B,EAC3B,QAAgB;IAEhB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;IAC3C,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC;QACnB,cAAc,EAAE,mBAAmB;QACnC,KAAK;QACL,IAAI;QACJ,aAAa,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;QACvC,OAAO,EAAE,CAAC,CAAC,UAAU,KAAK,QAAQ;QAClC,OAAO,EAAE,IAAI;QACb,QAAQ;KACT,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,CAAkB,EAClB,MAAc,EACd,QAAgB;IAEhB,OAAO;QACL,YAAY,EAAE,MAAM;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE;QAC3B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,KAAK;QAC/B,QAAQ;KACT,CAAA;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,OAAO,CAAC,KAAyB;IAC/C,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC/D,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAChE,sCAAsC;IACtC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,EAAyB,EACzB,MAAc,EACd,QAAgB;IAEhB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAA;IAC3C,OAAO;QACL,YAAY,EAAE,MAAM;QACpB,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;QACnB,QAAQ,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QACpB,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,KAAK;QACL,OAAO,EAAE,EAAE,CAAC,aAAa,IAAI,IAAI;QACjC,OAAO,EAAE,EAAE,CAAC,aAAa,IAAI,IAAI;QACjC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI;QACvB,MAAM;QACN,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI;QACnC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC;QACnC,QAAQ;KACT,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,CAAiB,EACjB,MAAc,EACd,QAAgB;IAEhB,OAAO;QACL,YAAY,EAAE,MAAM;QACpB,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;QAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;QACpB,uCAAuC;QACvC,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI;QAClC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;aACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;aACzD,MAAM,CAAC,OAAO,CAAC;QAClB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QAClC,QAAQ;KACT,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,CAAkB,EAClB,MAAc,EACd,QAAgB;IAEhB,OAAO;QACL,YAAY,EAAE,MAAM;QACpB,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;QACf,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;QACxB,MAAM,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QAC7B,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QACtC,QAAQ;KACT,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,CAAwB,EACxB,MAAc,EACd,QAAgB;IAEhB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACnD,OAAO;QACL,YAAY,EAAE,MAAM;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC;QACnB,OAAO,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QAClB,MAAM;QACN,UAAU;QACV,OAAO,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAC7B,QAAQ;KACT,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,UAAU,CAAC,KAAyB;IAIlD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;QACvD,KAAK,QAAQ;YACX,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;QACvD,KAAK,UAAU,CAAC;QAChB,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;QACzD,KAAK,SAAS;YACZ,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;QACvD,KAAK,QAAQ;YACX,gFAAgF;YAChF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;QACvD;YACE,6EAA6E;YAC7E,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IACtD,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,cAAkC,EAClC,YAAiC;IAKjC,IAAI,cAAc,EAAE,CAAC;QACnB,QAAQ,cAAc,EAAE,CAAC;YACvB,KAAK,WAAW;gBACd,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAA;YACrD,KAAK,UAAU;gBACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAA;YACtD,KAAK,UAAU,CAAC;YAChB,KAAK,WAAW;gBACd,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE,CAAA;YAC5D;gBACE,sEAAsE;gBACtE,sEAAsE;gBACtE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAA;QAC1D,CAAC;IACH,CAAC;IACD,QAAQ,YAAY,EAAE,CAAC;QACrB,KAAK,eAAe;YAClB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAA;QACrD,KAAK,kBAAkB;YACrB,kFAAkF;YAClF,gFAAgF;YAChF,mFAAmF;YACnF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAA;QACxD,KAAK,UAAU,CAAC;QAChB,KAAK,WAAW,CAAC;QACjB,KAAK,0BAA0B;YAC7B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,CAAA;QAC1D;YACE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,IAAI,SAAS,EAAE,CAAA;IACzE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAgC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACxC,CAAC"}

package/dist/provisioning.d.ts

@@ -0,0 +1,16 @@
+import type { CreateRepoInput, InstallationPermissions, ProvisionedRepo, VcsConnectionRef, VcsProvisioningClient } from '@cat-factory/kernel';
+import type { GitLabTokenSource } from './tokenSource.js';
+export interface GitLabProvisioningDependencies {
+    tokenSource: GitLabTokenSource;
+    fetchImpl?: typeof fetch;
+}
+export declare class GitLabProvisioningClient implements VcsProvisioningClient {
+    private readonly deps;
+    constructor(deps: GitLabProvisioningDependencies);
+    getGrantedPermissions(connection: VcsConnectionRef): Promise<InstallationPermissions>;
+    createRepoInOrg(connection: VcsConnectionRef, input: CreateRepoInput): Promise<ProvisionedRepo>;
+    /** Resolve a group/namespace full-path to its numeric id, or null for a user namespace. */
+    private resolveNamespaceId;
+    private request;
+}
+//# sourceMappingURL=provisioning.d.ts.map

package/dist/provisioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.d.ts","sourceRoot":"","sources":["../src/provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AASzD,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,iBAAiB,CAAA;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,qBAAa,wBAAyB,YAAW,qBAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,8BAA8B,EAAI;IAE/D,qBAAqB,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAO1F;IAEK,eAAe,CACnB,UAAU,EAAE,gBAAgB,EAC5B,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,eAAe,CAAC,CAyB1B;IAED,2FAA2F;YAC7E,kBAAkB;YAgBlB,OAAO;CA6BtB"}

package/dist/provisioning.js

@@ -0,0 +1,73 @@
+import { GitLabApiError } from './FetchGitLabClient.js';
+export class GitLabProvisioningClient {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async getGrantedPermissions(connection) {
+        // GitLab token scopes (e.g. `api`) aren't readable from a permission endpoint the way a
+        // GitHub installation token reports its granted set. A token that can hit the API can
+        // generally create projects in a namespace it owns; the actual create surfaces a 403
+        // otherwise. Report the optimistic grant so the provisioner attempts the create.
+        void connection;
+        return { administration: 'write', contents: 'write' };
+    }
+    async createRepoInOrg(connection, input) {
+        const namespaceId = await this.resolveNamespaceId(connection, input.org);
+        const body = {
+            name: input.name,
+            path: input.name,
+            visibility: input.private === false ? 'public' : 'private',
+            ...(namespaceId !== null ? { namespace_id: namespaceId } : {}),
+            ...(input.description ? { description: input.description } : {}),
+            ...(input.autoInit ? { initialize_with_readme: true } : {}),
+        };
+        const json = await this.request(connection, '/projects', 'POST', body);
+        const p = (json ?? {});
+        return {
+            githubId: p.id ?? 0,
+            owner: input.org,
+            name: p.path ?? input.name,
+            defaultBranch: p.default_branch ?? null,
+            private: p.visibility !== 'public',
+        };
+    }
+    /** Resolve a group/namespace full-path to its numeric id, or null for a user namespace. */
+    async resolveNamespaceId(connection, org) {
+        try {
+            const json = await this.request(connection, `/namespaces/${encodeURIComponent(org)}`, 'GET');
+            const id = json.id;
+            return typeof id === 'number' ? id : null;
+        }
+        catch (err) {
+            // No matching namespace (or no access) → let the create default to the token user's
+            // own namespace rather than failing the resolution step.
+            if (err instanceof GitLabApiError && err.status === 404)
+                return null;
+            throw err;
+        }
+    }
+    async request(connection, path, method, body) {
+        const apiBase = this.deps.tokenSource.apiBase(connection);
+        const token = await this.deps.tokenSource.token(connection);
+        const headers = {
+            'private-token': token,
+            accept: 'application/json',
+            'user-agent': 'cat-factory',
+        };
+        if (body !== undefined)
+            headers['content-type'] = 'application/json';
+        const fetchImpl = this.deps.fetchImpl ?? fetch;
+        const res = await fetchImpl(`${apiBase}${path}`, {
+            method,
+            headers,
+            body: body !== undefined ? JSON.stringify(body) : undefined,
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new GitLabApiError(res.status, `GitLab ${method} ${path} → ${res.status}: ${text.slice(0, 300)}`);
+        }
+        return res.status === 204 ? null : await res.json().catch(() => null);
+    }
+}
+//# sourceMappingURL=provisioning.js.map

package/dist/provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../src/provisioning.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAavD,MAAM,OAAO,wBAAwB;IACN,IAAI;IAAjC,YAA6B,IAAoC;oBAApC,IAAI;IAAmC,CAAC;IAErE,KAAK,CAAC,qBAAqB,CAAC,UAA4B;QACtD,wFAAwF;QACxF,sFAAsF;QACtF,qFAAqF;QACrF,iFAAiF;QACjF,KAAK,UAAU,CAAA;QACf,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,UAA4B,EAC5B,KAAsB;QAEtB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACxE,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC1D,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QACtE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAMpB,CAAA;QACD,OAAO;YACL,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC;YACnB,KAAK,EAAE,KAAK,CAAC,GAAG;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;YAC1B,aAAa,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;YACvC,OAAO,EAAE,CAAC,CAAC,UAAU,KAAK,QAAQ;SACnC,CAAA;IACH,CAAC;IAED,2FAA2F;IACnF,KAAK,CAAC,kBAAkB,CAC9B,UAA4B,EAC5B,GAAW;QAEX,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YAC5F,MAAM,EAAE,GAAI,IAAwB,CAAC,EAAE,CAAA;YACvC,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oFAAoF;YACpF,yDAAyD;YACzD,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAA;YACpE,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,UAA4B,EAC5B,IAAY,EACZ,MAAc,EACd,IAAc;QAEd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAC3D,MAAM,OAAO,GAA2B;YACtC,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,aAAa;SAC5B,CAAA;QACD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;QAC9C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YAC/C,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC7C,MAAM,IAAI,cAAc,CACtB,GAAG,CAAC,MAAM,EACV,UAAU,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAClE,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACvE,CAAC;CACF"}

package/dist/tokenSource.d.ts

@@ -0,0 +1,25 @@
+import type { VcsConnectionRef } from '@cat-factory/kernel';
+export interface GitLabTokenSource {
+    /** The access token to send for calls on this connection (`PRIVATE-TOKEN` header). */
+    token(connection: VcsConnectionRef): Promise<string>;
+    /**
+     * The REST API base for this connection, e.g. `https://gitlab.com/api/v4` for
+     * gitlab.com or `https://gitlab.example.com/api/v4` for a self-managed instance.
+     * Per-connection so different connections can target different instances.
+     */
+    apiBase(connection: VcsConnectionRef): string;
+}
+/** The public gitlab.com REST v4 base. */
+export declare const GITLAB_PUBLIC_API_BASE = "https://gitlab.com/api/v4";
+/**
+ * A fixed-token source: every connection uses the same token + base URL. Useful for a
+ * single-token deployment (mirrors local mode's PAT model) and for tests.
+ */
+export declare class StaticGitLabTokenSource implements GitLabTokenSource {
+    private readonly accessToken;
+    private readonly base;
+    constructor(accessToken: string, base?: string);
+    token(): Promise<string>;
+    apiBase(): string;
+}
+//# sourceMappingURL=tokenSource.d.ts.map

package/dist/tokenSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenSource.d.ts","sourceRoot":"","sources":["../src/tokenSource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAU3D,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,KAAK,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpD;;;;OAIG;IACH,OAAO,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,CAAA;CAC9C;AAED,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,8BAA8B,CAAA;AAEjE;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,iBAAiB;IAE7D,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFvB,YACmB,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,MAA+B,EACpD;IAEE,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAE7B;IAED,OAAO,IAAI,MAAM,CAEhB;CACF"}

package/dist/tokenSource.js

@@ -0,0 +1,21 @@
+/** The public gitlab.com REST v4 base. */
+export const GITLAB_PUBLIC_API_BASE = 'https://gitlab.com/api/v4';
+/**
+ * A fixed-token source: every connection uses the same token + base URL. Useful for a
+ * single-token deployment (mirrors local mode's PAT model) and for tests.
+ */
+export class StaticGitLabTokenSource {
+    accessToken;
+    base;
+    constructor(accessToken, base = GITLAB_PUBLIC_API_BASE) {
+        this.accessToken = accessToken;
+        this.base = base;
+    }
+    async token() {
+        return this.accessToken;
+    }
+    apiBase() {
+        return this.base;
+    }
+}
+//# sourceMappingURL=tokenSource.js.map

package/dist/tokenSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenSource.js","sourceRoot":"","sources":["../src/tokenSource.ts"],"names":[],"mappings":"AAqBA,0CAA0C;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAA;AAEjE;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IAEf,WAAW;IACX,IAAI;IAFvB,YACmB,WAAmB,EACnB,IAAI,GAAW,sBAAsB;2BADrC,WAAW;oBACX,IAAI;IACpB,CAAC;IAEJ,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;CACF"}

package/dist/webhook.d.ts

@@ -0,0 +1,17 @@
+import type { Clock, RawWebhookDelivery, VcsConnectionRef, VcsWebhookEvent, VcsWebhookMapper, WebhookVerifier } from '@cat-factory/kernel';
+/**
+ * Verifies the `X-Gitlab-Token` header against the configured secret in constant time.
+ * The `WebhookVerifier` port's `verify(rawBody, signatureHeader)` is reused: GitLab passes
+ * the token header as `signatureHeader` (the body is irrelevant to GitLab verification).
+ */
+export declare class GitLabWebhookVerifier implements WebhookVerifier {
+    private readonly secret;
+    constructor(secret: string);
+    verify(_rawBody: ArrayBuffer, signatureHeader: string | null): Promise<boolean>;
+}
+export declare class GitLabWebhookMapper implements VcsWebhookMapper {
+    private readonly clock;
+    constructor(clock: Clock);
+    map(connection: VcsConnectionRef, delivery: RawWebhookDelivery): VcsWebhookEvent | null;
+}
+//# sourceMappingURL=webhook.d.ts.map

package/dist/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,kBAAkB,EAClB,gBAAgB,EAEhB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAY5B;;;;GAIG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAGpF;CACF;AA2BD,qBAAa,mBAAoB,YAAW,gBAAgB;IAG9C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAlC,YAA6B,KAAK,EAAE,KAAK,EAAI;IAE7C,GAAG,CAAC,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kBAAkB,GAAG,eAAe,GAAG,IAAI,CA8GtF;CACF"}