@cursor/bdk 0.2.9 → 0.2.10

package/dist/channels/gitlab/gitlab-webhook.js

@@ -1,30 +1,48 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { timingSafeEqual } from "node:crypto";
 import { acknowledgeTask, isTaskDispatch, skipped, turnStarted, } from "../../internal/channel-dispatch.js";
 import { continuationSource } from "../../internal/continuation-identity.js";
 import { bindLocalIngressSend } from "../../internal/local-ingress.js";
+import { resolveWebhookSecretValue } from "../../internal/named-webhook-secret.js";
+import { isSecretRef, } from "../../types.js";
 import { asNonEmptyString, asPositiveInt, asRecord, buildGitLabBinding, gitlabMergeRequestFromRecord, gitlabMergeRequestUrl, gitlabProjectFromPayload, gitlabSender, gitlabUser, normalizeGitLabNoteableType, } from "./binding.js";
 import { defaultGitLabMergeRequestDispatch, defaultGitLabMergeRequestMessage, defaultGitLabTitle, } from "./defaults.js";
 import { GITLAB_CHANNEL_KIND } from "./events.js";
 import { gitlabChannelStateForEvent } from "./state.js";
+/** Env var / deployment secret an omitted `webhookSecret` falls back to. */
+export const GITLAB_WEBHOOK_SECRET_ENV = "GITLAB_WEBHOOK_SECRET";
+/** Header GitLab sends the hook secret in, verbatim. */
+export const GITLAB_TOKEN_HEADER = "x-gitlab-token";
 /** `GITLAB_WEBHOOK_SECRET` fallback for {@link GitLabChannelOptions.webhookSecret}. */
 export function envGitLabWebhookSecret() {
-    var _a;
-    const value = (_a = process.env.GITLAB_WEBHOOK_SECRET) === null || _a === void 0 ? void 0 : _a.trim();
+    const value = process.env[GITLAB_WEBHOOK_SECRET_ENV]?.trim();
     return value === undefined || value === "" ? undefined : value;
 }
+/**
+ * The secret's value for the handler's own token compare. A named secret
+ * resolves from the environment (locally the shell's, hosted the bound
+ * deployment secrets); an unset field falls back to `GITLAB_WEBHOOK_SECRET`.
+ */
 export function resolveGitLabWebhookSecret(options) {
-    const authored = typeof options.webhookSecret === "function" ? options.webhookSecret() : options.webhookSecret;
-    const trimmed = authored === null || authored === void 0 ? void 0 : authored.trim();
-    return trimmed === undefined || trimmed === "" ? envGitLabWebhookSecret() : trimmed;
+    return resolveWebhookSecretValue(options.webhookSecret) ?? envGitLabWebhookSecret();
+}
+/**
+ * Authenticators that already compared `X-Gitlab-Token` against the named
+ * secret before the handler ran: the local {@link sharedSecretAuth} route
+ * policy, and the control plane on a hosted catch. Unlike an HMAC, the
+ * header *is* the secret, so the control plane strips it before the request
+ * is claim-checked and replayed; the handler cannot re-compare and must
+ * trust that termination. Only a named secret (the manifest-declared
+ * policy) is trusted this way — a literal or getter stays handler-checked.
+ */
+const TOKEN_TERMINATING_AUTHENTICATORS = new Set([
+    "shared-secret",
+    "control-plane-catch",
+]);
+function tokenAlreadyTerminated(options, auth) {
+    return (isSecretRef(options.webhookSecret) &&
+        auth !== null &&
+        auth !== undefined &&
+        TOKEN_TERMINATING_AUTHENTICATORS.has(auth.authenticator));
 }
 /**
  * GitLab sends the hook's secret verbatim in `X-Gitlab-Token` (no HMAC).
@@ -47,7 +65,7 @@ export function parseGitLabWebhookPayload(payload, eventType) {
     if (record === undefined) {
         return null;
     }
-    const kind = (eventType === null || eventType === void 0 ? void 0 : eventType.trim()) || asNonEmptyString(record.object_kind);
+    const kind = eventType?.trim() || asNonEmptyString(record.object_kind);
     if (kind === undefined || kind === "") {
         return null;
     }
@@ -70,44 +88,49 @@ function configuredProjectAllowlist(options) {
     return normalized.length === 0 ? undefined : new Set(normalized);
 }
 function mergeRequestIidForEvent(eventType, payload) {
-    var _a, _b, _c, _d;
     switch (eventType) {
         case "merge_request":
-            return asPositiveInt((_a = asRecord(payload.object_attributes)) === null || _a === void 0 ? void 0 : _a.iid);
+            return asPositiveInt(asRecord(payload.object_attributes)?.iid);
         case "note":
-            return normalizeGitLabNoteableType((_b = asRecord(payload.object_attributes)) === null || _b === void 0 ? void 0 : _b.noteable_type) ===
+            return normalizeGitLabNoteableType(asRecord(payload.object_attributes)?.noteable_type) ===
                 "merge_request"
-                ? asPositiveInt((_c = asRecord(payload.merge_request)) === null || _c === void 0 ? void 0 : _c.iid)
+                ? asPositiveInt(asRecord(payload.merge_request)?.iid)
                 : undefined;
         case "pipeline":
-            return asPositiveInt((_d = asRecord(payload.merge_request)) === null || _d === void 0 ? void 0 : _d.iid);
+            return asPositiveInt(asRecord(payload.merge_request)?.iid);
         default:
             return undefined;
     }
 }
 export function parseGitLabEventContext(delivery) {
-    var _a;
     const project = gitlabProjectFromPayload(delivery.payload);
     if (project === undefined) {
         return null;
     }
     const mergeRequestIid = mergeRequestIidForEvent(delivery.eventType, delivery.payload);
-    const mergeRequestRecord = (_a = asRecord(delivery.payload.merge_request)) !== null && _a !== void 0 ? _a : (delivery.eventType === "merge_request"
-        ? asRecord(delivery.payload.object_attributes)
-        : undefined);
-    return Object.assign(Object.assign({ deliveryId: delivery.deliveryId, eventType: delivery.eventType, project }, (mergeRequestIid === undefined
-        ? {}
-        : {
-            mergeRequestIid,
-            mergeRequestUrl: gitlabMergeRequestUrl(project, mergeRequestIid, asNonEmptyString(mergeRequestRecord === null || mergeRequestRecord === void 0 ? void 0 : mergeRequestRecord.url)),
-        })), { payload: delivery.payload, sender: gitlabSender(delivery.payload) });
+    const mergeRequestRecord = asRecord(delivery.payload.merge_request) ??
+        (delivery.eventType === "merge_request"
+            ? asRecord(delivery.payload.object_attributes)
+            : undefined);
+    return {
+        deliveryId: delivery.deliveryId,
+        eventType: delivery.eventType,
+        project,
+        ...(mergeRequestIid === undefined
+            ? {}
+            : {
+                mergeRequestIid,
+                mergeRequestUrl: gitlabMergeRequestUrl(project, mergeRequestIid, asNonEmptyString(mergeRequestRecord?.url)),
+            }),
+        payload: delivery.payload,
+        sender: gitlabSender(delivery.payload),
+    };
 }
 function parseNote(payload) {
-    var _a;
     const attributes = asRecord(payload.object_attributes);
-    const id = asPositiveInt(attributes === null || attributes === void 0 ? void 0 : attributes.id);
-    const body = typeof (attributes === null || attributes === void 0 ? void 0 : attributes.note) === "string" ? attributes.note : undefined;
-    const noteableType = normalizeGitLabNoteableType(attributes === null || attributes === void 0 ? void 0 : attributes.noteable_type);
+    const id = asPositiveInt(attributes?.id);
+    const body = typeof attributes?.note === "string" ? attributes.note : undefined;
+    const noteableType = normalizeGitLabNoteableType(attributes?.noteable_type);
     if (id === undefined || body === undefined || noteableType === undefined) {
         return undefined;
     }
@@ -115,10 +138,10 @@ function parseNote(payload) {
         id,
         body,
         noteableType,
-        noteableId: asPositiveInt(attributes === null || attributes === void 0 ? void 0 : attributes.noteable_id),
-        url: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.url),
+        noteableId: asPositiveInt(attributes?.noteable_id),
+        url: asNonEmptyString(attributes?.url),
         author: gitlabUser(payload.user),
-        mergeRequestIid: asPositiveInt((_a = asRecord(payload.merge_request)) === null || _a === void 0 ? void 0 : _a.iid),
+        mergeRequestIid: asPositiveInt(asRecord(payload.merge_request)?.iid),
     };
 }
 function parsePush(payload) {
@@ -127,88 +150,94 @@ function parsePush(payload) {
         return undefined;
     }
     const commitCount = typeof payload.total_commits_count === "number" ? payload.total_commits_count : undefined;
-    return Object.assign({ ref, before: asNonEmptyString(payload.before), after: asNonEmptyString(payload.after), checkoutSha: asNonEmptyString(payload.checkout_sha) }, (commitCount === undefined ? {} : { commitCount }));
+    return {
+        ref,
+        before: asNonEmptyString(payload.before),
+        after: asNonEmptyString(payload.after),
+        checkoutSha: asNonEmptyString(payload.checkout_sha),
+        ...(commitCount === undefined ? {} : { commitCount }),
+    };
 }
 function parsePipeline(payload) {
-    var _a;
     const attributes = asRecord(payload.object_attributes);
-    const id = asPositiveInt(attributes === null || attributes === void 0 ? void 0 : attributes.id);
+    const id = asPositiveInt(attributes?.id);
     if (id === undefined) {
         return undefined;
     }
     return {
         id,
-        status: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.status),
-        sha: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.sha),
-        ref: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.ref),
-        source: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.source),
-        url: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.url),
-        mergeRequestIid: asPositiveInt((_a = asRecord(payload.merge_request)) === null || _a === void 0 ? void 0 : _a.iid),
+        status: asNonEmptyString(attributes?.status),
+        sha: asNonEmptyString(attributes?.sha),
+        ref: asNonEmptyString(attributes?.ref),
+        source: asNonEmptyString(attributes?.source),
+        url: asNonEmptyString(attributes?.url),
+        mergeRequestIid: asPositiveInt(asRecord(payload.merge_request)?.iid),
     };
 }
 function invalidPayload(error) {
     return Response.json({ ok: false, error }, { status: 400 });
 }
-function startTurn(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const source = continuationSource(input.options.continuation, "gitlab");
-        const session = yield input.args.send(input.message, Object.assign(Object.assign(Object.assign(Object.assign({ auth: input.dispatch.auth }, (source === "engine" && input.ctx.mergeRequestIid !== undefined
+async function startTurn(input) {
+    const source = continuationSource(input.options.continuation, "gitlab");
+    const session = await input.args.send(input.message, {
+        auth: input.dispatch.auth,
+        // v1 agents (omitted continuation resolves to `none/v1`) keep one
+        // engine-minted conversation per merge request; v2 takes the CP stamp.
+        ...(source === "engine" && input.ctx.mergeRequestIid !== undefined
             ? {
                 continuationToken: `gitlab-mr:${input.ctx.project.pathWithNamespace.toLowerCase()}!${input.ctx.mergeRequestIid}`,
             }
-            : {})), { title: (_a = input.dispatch.title) !== null && _a !== void 0 ? _a : defaultGitLabTitle(input.ctx) }), (input.cloud === undefined ? {} : { cloud: input.cloud })), { state: input.state, refreshState: input.state }));
-        return turnStarted(session);
+            : {}),
+        title: input.dispatch.title ?? defaultGitLabTitle(input.ctx),
+        ...(input.cloud === undefined ? {} : { cloud: input.cloud }),
+        state: input.state,
+        refreshState: input.state,
     });
+    return turnStarted(session);
 }
-function resolveCloudOptions(cloud, ctx, mergeRequest) {
-    return __awaiter(this, void 0, void 0, function* () {
-        if (cloud === undefined || cloud === false) {
-            return undefined;
-        }
-        if (cloud === true) {
-            return {
-                repos: [
-                    {
-                        url: ctx.project.webUrl,
-                        prUrl: mergeRequest.url,
-                        startingRef: mergeRequest.headSha,
-                    },
-                ],
-            };
-        }
-        if (typeof cloud === "function") {
-            return yield cloud(ctx, mergeRequest);
-        }
-        return cloud;
-    });
+async function resolveCloudOptions(cloud, ctx, mergeRequest) {
+    if (cloud === undefined || cloud === false) {
+        return undefined;
+    }
+    if (cloud === true) {
+        return {
+            repos: [
+                {
+                    url: ctx.project.webUrl,
+                    prUrl: mergeRequest.url,
+                    startingRef: mergeRequest.headSha,
+                },
+            ],
+        };
+    }
+    if (typeof cloud === "function") {
+        return await cloud(ctx, mergeRequest);
+    }
+    return cloud;
 }
-function applyDispatch(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
-        if (input.dispatch === null) {
-            return skipped("not_dispatched", input.extra);
-        }
-        if (isTaskDispatch(input.dispatch)) {
-            return acknowledgeTask(input.args, GITLAB_CHANNEL_KIND, input.dispatch, input.extra);
-        }
-        const message = [(_a = input.dispatch.message) !== null && _a !== void 0 ? _a : input.message, ...((_b = input.dispatch.context) !== null && _b !== void 0 ? _b : [])].join("\n");
-        return startTurn({
-            options: input.options,
-            args: input.args,
-            ctx: input.ctx,
-            message,
-            dispatch: input.dispatch,
-            cloud: input.cloud,
-            state: gitlabChannelStateForEvent({
-                project: input.ctx.project,
-                mergeRequestIid: input.ctx.mergeRequestIid,
-                headSha: input.headSha,
-                deliveryId: input.ctx.deliveryId,
-                eventType: input.ctx.eventType,
-                triggeringNoteId: input.triggeringNoteId,
-            }),
-        });
+async function applyDispatch(input) {
+    if (input.dispatch === null) {
+        return skipped("not_dispatched", input.extra);
+    }
+    if (isTaskDispatch(input.dispatch)) {
+        return acknowledgeTask(input.args, GITLAB_CHANNEL_KIND, input.dispatch, input.extra);
+    }
+    const message = [input.dispatch.message ?? input.message, ...(input.dispatch.context ?? [])].join("\n");
+    return startTurn({
+        options: input.options,
+        args: input.args,
+        ctx: input.ctx,
+        message,
+        dispatch: input.dispatch,
+        cloud: input.cloud,
+        state: gitlabChannelStateForEvent({
+            project: input.ctx.project,
+            mergeRequestIid: input.ctx.mergeRequestIid,
+            headSha: input.headSha,
+            deliveryId: input.ctx.deliveryId,
+            eventType: input.ctx.eventType,
+            triggeringNoteId: input.triggeringNoteId,
+        }),
     });
 }
 const DEFAULT_NOTEABLES = ["merge_request"];
@@ -218,132 +247,137 @@ const DEFAULT_NOTEABLES = ["merge_request"];
  * hosted admission arrives verified. The v2 mailbox is stamped upstream
  * (local CP or hosted ingress), never here.
  */
-export function dispatchGitLabWebhook(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
-        var _d, _e;
-        const { eventType, payload } = input.delivery;
-        const parsed = parseGitLabEventContext(input.delivery);
-        if (parsed === null) {
-            return invalidPayload("invalid_gitlab_payload");
-        }
-        const args = input.args;
-        const ctx = Object.assign(Object.assign({}, parsed), { gitlab: buildGitLabBinding({
-                project: parsed.project,
-                proxy: (_a = input.proxy) === null || _a === void 0 ? void 0 : _a.call(input),
-                token: input.options.token,
-                apiBaseUrl: input.options.apiBaseUrl,
-            }), host: args.host, artifacts: args.artifacts, send: args.send });
-        const allowlist = configuredProjectAllowlist(input.options);
-        if (allowlist !== undefined && !allowlist.has(ctx.project.pathWithNamespace.toLowerCase())) {
-            return skipped("project_not_allowed", {
-                project: ctx.project.pathWithNamespace,
+export async function dispatchGitLabWebhook(input) {
+    const { eventType, payload } = input.delivery;
+    const parsed = parseGitLabEventContext(input.delivery);
+    if (parsed === null) {
+        return invalidPayload("invalid_gitlab_payload");
+    }
+    const args = input.args;
+    const ctx = {
+        ...parsed,
+        gitlab: buildGitLabBinding({
+            project: parsed.project,
+            proxy: input.proxy?.(),
+            token: input.options.token,
+            apiBaseUrl: input.options.apiBaseUrl,
+        }),
+        host: args.host,
+        artifacts: args.artifacts,
+        send: args.send,
+    };
+    const allowlist = configuredProjectAllowlist(input.options);
+    if (allowlist !== undefined && !allowlist.has(ctx.project.pathWithNamespace.toLowerCase())) {
+        return skipped("project_not_allowed", {
+            project: ctx.project.pathWithNamespace,
+        });
+    }
+    const extra = { event: eventType };
+    switch (eventType) {
+        case "merge_request": {
+            const mergeRequest = gitlabMergeRequestFromRecord(ctx.project, asRecord(payload.object_attributes));
+            if (mergeRequest === undefined) {
+                return invalidPayload("invalid_gitlab_merge_request_payload");
+            }
+            const dispatch = input.options.onMergeRequest === undefined
+                ? defaultGitLabMergeRequestDispatch(ctx, mergeRequest)
+                : await input.options.onMergeRequest(ctx, mergeRequest);
+            return applyDispatch({
+                options: input.options,
+                args,
+                ctx,
+                dispatch,
+                extra: { ...extra, action: mergeRequest.action },
+                message: defaultGitLabMergeRequestMessage(ctx, mergeRequest),
+                cloud: await resolveCloudOptions(input.options.cloud, ctx, mergeRequest),
+                headSha: mergeRequest.headSha,
             });
         }
-        const extra = { event: eventType };
-        switch (eventType) {
-            case "merge_request": {
-                const mergeRequest = gitlabMergeRequestFromRecord(ctx.project, asRecord(payload.object_attributes));
-                if (mergeRequest === undefined) {
-                    return invalidPayload("invalid_gitlab_merge_request_payload");
-                }
-                const dispatch = input.options.onMergeRequest === undefined
-                    ? defaultGitLabMergeRequestDispatch(ctx, mergeRequest)
-                    : yield input.options.onMergeRequest(ctx, mergeRequest);
-                return applyDispatch({
-                    options: input.options,
-                    args,
-                    ctx,
-                    dispatch,
-                    extra: Object.assign(Object.assign({}, extra), { action: mergeRequest.action }),
-                    message: defaultGitLabMergeRequestMessage(ctx, mergeRequest),
-                    cloud: yield resolveCloudOptions(input.options.cloud, ctx, mergeRequest),
-                    headSha: mergeRequest.headSha,
-                });
+        case "note": {
+            if (input.options.onNote === undefined) {
+                return skipped("no_handler", extra);
             }
-            case "note": {
-                if (input.options.onNote === undefined) {
-                    return skipped("no_handler", extra);
-                }
-                const note = parseNote(payload);
-                if (note === undefined) {
-                    return invalidPayload("invalid_gitlab_note_payload");
-                }
-                const noteables = (_d = input.options.noteables) !== null && _d !== void 0 ? _d : DEFAULT_NOTEABLES;
-                if (!noteables.includes(note.noteableType)) {
-                    return skipped("noteable_not_subscribed", Object.assign(Object.assign({}, extra), { noteable: note.noteableType }));
-                }
-                const dispatch = yield input.options.onNote(ctx, note);
-                return applyDispatch({
-                    options: input.options,
-                    args,
-                    ctx,
-                    dispatch,
-                    extra,
-                    message: ctx.mergeRequestIid === undefined
-                        ? `GitLab ${note.noteableType} note on ${ctx.project.pathWithNamespace}`
-                        : `GitLab note on ${ctx.project.pathWithNamespace}!${ctx.mergeRequestIid}`,
-                    headSha: asNonEmptyString((_c = asRecord((_b = asRecord(payload.merge_request)) === null || _b === void 0 ? void 0 : _b.last_commit)) === null || _c === void 0 ? void 0 : _c.id),
-                    triggeringNoteId: note.id,
-                });
+            const note = parseNote(payload);
+            if (note === undefined) {
+                return invalidPayload("invalid_gitlab_note_payload");
             }
-            case "push": {
-                if (input.options.onPush === undefined) {
-                    return skipped("no_handler", extra);
-                }
-                const push = parsePush(payload);
-                if (push === undefined) {
-                    return invalidPayload("invalid_gitlab_push_payload");
-                }
-                const dispatch = yield input.options.onPush(ctx, push);
-                return applyDispatch({
-                    options: input.options,
-                    args,
-                    ctx,
-                    dispatch,
-                    extra,
-                    message: `GitLab push to ${ctx.project.pathWithNamespace} ${push.ref}`,
-                    headSha: push.after,
+            const noteables = input.options.noteables ?? DEFAULT_NOTEABLES;
+            if (!noteables.includes(note.noteableType)) {
+                return skipped("noteable_not_subscribed", {
+                    ...extra,
+                    noteable: note.noteableType,
                 });
             }
-            case "pipeline": {
-                if (input.options.onPipeline === undefined) {
-                    return skipped("no_handler", extra);
-                }
-                const pipeline = parsePipeline(payload);
-                if (pipeline === undefined) {
-                    return invalidPayload("invalid_gitlab_pipeline_payload");
-                }
-                const dispatch = yield input.options.onPipeline(ctx, pipeline);
-                return applyDispatch({
-                    options: input.options,
-                    args,
-                    ctx,
-                    dispatch,
-                    extra: Object.assign(Object.assign({}, extra), { status: pipeline.status }),
-                    message: `GitLab pipeline ${(_e = pipeline.status) !== null && _e !== void 0 ? _e : "event"} on ${ctx.project.pathWithNamespace}`,
-                    headSha: pipeline.sha,
-                });
+            const dispatch = await input.options.onNote(ctx, note);
+            return applyDispatch({
+                options: input.options,
+                args,
+                ctx,
+                dispatch,
+                extra,
+                message: ctx.mergeRequestIid === undefined
+                    ? `GitLab ${note.noteableType} note on ${ctx.project.pathWithNamespace}`
+                    : `GitLab note on ${ctx.project.pathWithNamespace}!${ctx.mergeRequestIid}`,
+                headSha: asNonEmptyString(asRecord(asRecord(payload.merge_request)?.last_commit)?.id),
+                triggeringNoteId: note.id,
+            });
+        }
+        case "push": {
+            if (input.options.onPush === undefined) {
+                return skipped("no_handler", extra);
             }
-            default: {
-                if (input.options.onEvent === undefined) {
-                    return skipped("unsupported_event", extra);
-                }
-                const dispatch = yield input.options.onEvent(ctx, {
-                    eventType,
-                    payload,
-                });
-                return applyDispatch({
-                    options: input.options,
-                    args,
-                    ctx,
-                    dispatch,
-                    extra,
-                    message: `GitLab ${eventType} event on ${ctx.project.pathWithNamespace}`,
-                });
+            const push = parsePush(payload);
+            if (push === undefined) {
+                return invalidPayload("invalid_gitlab_push_payload");
             }
+            const dispatch = await input.options.onPush(ctx, push);
+            return applyDispatch({
+                options: input.options,
+                args,
+                ctx,
+                dispatch,
+                extra,
+                message: `GitLab push to ${ctx.project.pathWithNamespace} ${push.ref}`,
+                headSha: push.after,
+            });
         }
-    });
+        case "pipeline": {
+            if (input.options.onPipeline === undefined) {
+                return skipped("no_handler", extra);
+            }
+            const pipeline = parsePipeline(payload);
+            if (pipeline === undefined) {
+                return invalidPayload("invalid_gitlab_pipeline_payload");
+            }
+            const dispatch = await input.options.onPipeline(ctx, pipeline);
+            return applyDispatch({
+                options: input.options,
+                args,
+                ctx,
+                dispatch,
+                extra: { ...extra, status: pipeline.status },
+                message: `GitLab pipeline ${pipeline.status ?? "event"} on ${ctx.project.pathWithNamespace}`,
+                headSha: pipeline.sha,
+            });
+        }
+        default: {
+            if (input.options.onEvent === undefined) {
+                return skipped("unsupported_event", extra);
+            }
+            const dispatch = await input.options.onEvent(ctx, {
+                eventType,
+                payload,
+            });
+            return applyDispatch({
+                options: input.options,
+                args,
+                ctx,
+                dispatch,
+                extra,
+                message: `GitLab ${eventType} event on ${ctx.project.pathWithNamespace}`,
+            });
+        }
+    }
 }
 /**
  * HTTP entry for a single agent's GitLab channel: `X-Gitlab-Token` compare
@@ -351,38 +385,37 @@ export function dispatchGitLabWebhook(input) {
  * a secret the route auth owns admission (`serve --dev` admits loopback
  * only; production stays loopback-strict).
  */
-export function handleGitLabWebhookRequest(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const bodyText = yield input.request.text();
-        const secret = resolveGitLabWebhookSecret(input.options);
-        if (secret !== undefined && input.skipSignatureVerification !== true) {
-            if (!verifyGitLabWebhookToken(input.request.headers.get("x-gitlab-token"), secret)) {
-                return Response.json({ ok: false, error: "invalid_token" }, { status: 401 });
-            }
-        }
-        let payload;
-        try {
-            payload = JSON.parse(bodyText);
-        }
-        catch (_b) {
-            return Response.json({ ok: false, error: "invalid_json" }, { status: 400 });
+export async function handleGitLabWebhookRequest(input) {
+    const bodyText = await input.request.text();
+    const secret = resolveGitLabWebhookSecret(input.options);
+    if (secret !== undefined &&
+        input.skipSignatureVerification !== true &&
+        !tokenAlreadyTerminated(input.options, input.args.auth)) {
+        if (!verifyGitLabWebhookToken(input.request.headers.get(GITLAB_TOKEN_HEADER), secret)) {
+            return Response.json({ ok: false, error: "invalid_token" }, { status: 401 });
         }
-        const delivery = parseGitLabWebhookPayload(payload);
-        if (delivery === null) {
-            return invalidPayload("invalid_gitlab_payload");
-        }
-        delivery.deliveryId = (_a = input.request.headers.get("x-gitlab-event-uuid")) !== null && _a !== void 0 ? _a : undefined;
-        return dispatchGitLabWebhook({
-            options: input.options,
-            delivery,
-            proxy: input.proxy,
-            args: bindLocalIngressSend(input.args, {
-                identity: input.options.continuation,
-                kind: GITLAB_CHANNEL_KIND,
-                eventType: delivery.eventType,
-                payload: delivery.payload,
-            }),
-        });
+    }
+    let payload;
+    try {
+        payload = JSON.parse(bodyText);
+    }
+    catch {
+        return Response.json({ ok: false, error: "invalid_json" }, { status: 400 });
+    }
+    const delivery = parseGitLabWebhookPayload(payload);
+    if (delivery === null) {
+        return invalidPayload("invalid_gitlab_payload");
+    }
+    delivery.deliveryId = input.request.headers.get("x-gitlab-event-uuid") ?? undefined;
+    return dispatchGitLabWebhook({
+        options: input.options,
+        delivery,
+        proxy: input.proxy,
+        args: bindLocalIngressSend(input.args, {
+            identity: input.options.continuation,
+            kind: GITLAB_CHANNEL_KIND,
+            eventType: delivery.eventType,
+            payload: delivery.payload,
+        }),
     });
 }