@cursor/july 0.1.101 → 0.1.103

package/dist/channels/gitlab/gitlab-webhook.d.ts

@@ -0,0 +1,45 @@
+import type { ChannelHandlerArgs } from "../../types.js";
+import type { GitLabProxyTransport } from "./api.js";
+import type { GitLabChannelOptions, GitLabEventContext, GitLabWebhookDelivery } from "./types.js";
+/** `GITLAB_WEBHOOK_SECRET` fallback for {@link GitLabChannelOptions.webhookSecret}. */
+export declare function envGitLabWebhookSecret(): string | undefined;
+export declare function resolveGitLabWebhookSecret(options: Pick<GitLabChannelOptions, "webhookSecret">): string | undefined;
+/**
+ * GitLab sends the hook's secret verbatim in `X-Gitlab-Token` (no HMAC).
+ * Constant-time compare so a reachable URL leaks nothing about the secret.
+ */
+export declare function verifyGitLabWebhookToken(headerValue: string | null | undefined, secret: string): boolean;
+/**
+ * Accept a raw GitLab payload. `object_kind` is the event discriminator;
+ * hosted admission passes the envelope's event type, which wins when set.
+ */
+export declare function parseGitLabWebhookPayload(payload: unknown, eventType?: string): GitLabWebhookDelivery | null;
+export declare function parseGitLabEventContext(delivery: GitLabWebhookDelivery): Omit<GitLabEventContext, "host" | "artifacts" | "gitlab" | "send"> | null;
+/**
+ * Run the authored hooks for one GitLab delivery and `send()` the turn.
+ * Callers own delivery auth: the HTTP route compares `X-Gitlab-Token`;
+ * hosted admission arrives verified. The v2 mailbox is stamped upstream
+ * (local CP or hosted ingress), never here.
+ */
+export declare function dispatchGitLabWebhook(input: {
+    options: GitLabChannelOptions;
+    delivery: GitLabWebhookDelivery;
+    args: ChannelHandlerArgs;
+    /** Host-bound SCM-proxy transport (`cursorAccount` + `--cursor-scm-proxy`). */
+    proxy?: () => GitLabProxyTransport | undefined;
+}): Promise<Response>;
+/**
+ * HTTP entry for a single agent's GitLab channel: `X-Gitlab-Token` compare
+ * when a secret is configured, then {@link dispatchGitLabWebhook}. Without
+ * a secret the route auth owns admission (`serve --dev` admits loopback
+ * only; production stays loopback-strict).
+ */
+export declare function handleGitLabWebhookRequest(input: {
+    options: GitLabChannelOptions;
+    request: Request;
+    args: ChannelHandlerArgs;
+    /** When true, skip the token compare even if a secret is configured. */
+    skipSignatureVerification?: boolean;
+    proxy?: () => GitLabProxyTransport | undefined;
+}): Promise<Response>;
+//# sourceMappingURL=gitlab-webhook.d.ts.map

package/dist/channels/gitlab/gitlab-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab-webhook.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/gitlab-webhook.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAEV,kBAAkB,EAEnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAuBrD,OAAO,KAAK,EACV,oBAAoB,EAEpB,kBAAkB,EAOlB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAEpB,uFAAuF;AACvF,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAG3D;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,GACnD,MAAM,GAAG,SAAS,CASpB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAST;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,qBAAqB,GAAG,IAAI,CAU9B;AA2CD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,qBAAqB,GAC9B,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,CAAC,GAAG,IAAI,CA+B3E;AAiKD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,IAAI,EAAE,kBAAkB,CAAC;IACzB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,oBAAoB,GAAG,SAAS,CAAC;CAChD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkJpB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,wEAAwE;IACxE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,oBAAoB,GAAG,SAAS,CAAC;CAChD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCpB"}

package/dist/channels/gitlab/gitlab-webhook.js

@@ -0,0 +1,397 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { timingSafeEqual } from "node:crypto";
+import { acknowledgeTask, isTaskDispatch, skipped, turnStarted, } from "../../internal/channel-dispatch.js";
+import { continuationSource } from "../../internal/continuation-identity.js";
+import { bindLocalIngressSend } from "../../internal/local-ingress.js";
+import { asNonEmptyString, asPositiveInt, asRecord, buildGitLabBinding, gitlabMergeRequestFromRecord, gitlabMergeRequestUrl, gitlabProjectFromPayload, gitlabSender, gitlabUser, normalizeGitLabNoteableType, } from "./binding.js";
+import { defaultGitLabMergeRequestDispatch, defaultGitLabMergeRequestMessage, defaultGitLabTitle, } from "./defaults.js";
+import { GITLAB_CHANNEL_KIND } from "./events.js";
+import { gitlabChannelStateForEvent, } from "./state.js";
+/** `GITLAB_WEBHOOK_SECRET` fallback for {@link GitLabChannelOptions.webhookSecret}. */
+export function envGitLabWebhookSecret() {
+    var _a;
+    const value = (_a = process.env.GITLAB_WEBHOOK_SECRET) === null || _a === void 0 ? void 0 : _a.trim();
+    return value === undefined || value === "" ? undefined : value;
+}
+export function resolveGitLabWebhookSecret(options) {
+    const authored = typeof options.webhookSecret === "function"
+        ? options.webhookSecret()
+        : options.webhookSecret;
+    const trimmed = authored === null || authored === void 0 ? void 0 : authored.trim();
+    return trimmed === undefined || trimmed === ""
+        ? envGitLabWebhookSecret()
+        : trimmed;
+}
+/**
+ * GitLab sends the hook's secret verbatim in `X-Gitlab-Token` (no HMAC).
+ * Constant-time compare so a reachable URL leaks nothing about the secret.
+ */
+export function verifyGitLabWebhookToken(headerValue, secret) {
+    if (headerValue === null || headerValue === undefined) {
+        return false;
+    }
+    const received = Buffer.from(headerValue, "utf8");
+    const expected = Buffer.from(secret, "utf8");
+    return (received.length === expected.length && timingSafeEqual(received, expected));
+}
+/**
+ * Accept a raw GitLab payload. `object_kind` is the event discriminator;
+ * hosted admission passes the envelope's event type, which wins when set.
+ */
+export function parseGitLabWebhookPayload(payload, eventType) {
+    const record = asRecord(payload);
+    if (record === undefined) {
+        return null;
+    }
+    const kind = (eventType === null || eventType === void 0 ? void 0 : eventType.trim()) || asNonEmptyString(record.object_kind);
+    if (kind === undefined || kind === "") {
+        return null;
+    }
+    return { eventType: kind, payload: record };
+}
+function configuredProjectAllowlist(options) {
+    const projects = [];
+    if (options.projects !== undefined) {
+        projects.push(...options.projects);
+    }
+    if (typeof options.cursorAccount === "object") {
+        projects.push(...options.cursorAccount.projects);
+    }
+    const normalized = projects
+        .map((project) => project
+        .trim()
+        .replace(/^\/+|\/+$/g, "")
+        .toLowerCase())
+        .filter(Boolean);
+    return normalized.length === 0 ? undefined : new Set(normalized);
+}
+function mergeRequestIidForEvent(eventType, payload) {
+    var _a, _b, _c, _d;
+    switch (eventType) {
+        case "merge_request":
+            return asPositiveInt((_a = asRecord(payload.object_attributes)) === null || _a === void 0 ? void 0 : _a.iid);
+        case "note":
+            return normalizeGitLabNoteableType((_b = asRecord(payload.object_attributes)) === null || _b === void 0 ? void 0 : _b.noteable_type) === "merge_request"
+                ? asPositiveInt((_c = asRecord(payload.merge_request)) === null || _c === void 0 ? void 0 : _c.iid)
+                : undefined;
+        case "pipeline":
+            return asPositiveInt((_d = asRecord(payload.merge_request)) === null || _d === void 0 ? void 0 : _d.iid);
+        default:
+            return undefined;
+    }
+}
+export function parseGitLabEventContext(delivery) {
+    var _a;
+    const project = gitlabProjectFromPayload(delivery.payload);
+    if (project === undefined) {
+        return null;
+    }
+    const mergeRequestIid = mergeRequestIidForEvent(delivery.eventType, delivery.payload);
+    const mergeRequestRecord = (_a = asRecord(delivery.payload.merge_request)) !== null && _a !== void 0 ? _a : (delivery.eventType === "merge_request"
+        ? asRecord(delivery.payload.object_attributes)
+        : undefined);
+    return Object.assign(Object.assign({ deliveryId: delivery.deliveryId, eventType: delivery.eventType, project }, (mergeRequestIid === undefined
+        ? {}
+        : {
+            mergeRequestIid,
+            mergeRequestUrl: gitlabMergeRequestUrl(project, mergeRequestIid, asNonEmptyString(mergeRequestRecord === null || mergeRequestRecord === void 0 ? void 0 : mergeRequestRecord.url)),
+        })), { payload: delivery.payload, sender: gitlabSender(delivery.payload) });
+}
+function parseNote(payload) {
+    var _a;
+    const attributes = asRecord(payload.object_attributes);
+    const id = asPositiveInt(attributes === null || attributes === void 0 ? void 0 : attributes.id);
+    const body = typeof (attributes === null || attributes === void 0 ? void 0 : attributes.note) === "string" ? attributes.note : undefined;
+    const noteableType = normalizeGitLabNoteableType(attributes === null || attributes === void 0 ? void 0 : attributes.noteable_type);
+    if (id === undefined || body === undefined || noteableType === undefined) {
+        return undefined;
+    }
+    return {
+        id,
+        body,
+        noteableType,
+        noteableId: asPositiveInt(attributes === null || attributes === void 0 ? void 0 : attributes.noteable_id),
+        url: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.url),
+        author: gitlabUser(payload.user),
+        mergeRequestIid: asPositiveInt((_a = asRecord(payload.merge_request)) === null || _a === void 0 ? void 0 : _a.iid),
+    };
+}
+function parsePush(payload) {
+    const ref = asNonEmptyString(payload.ref);
+    if (ref === undefined) {
+        return undefined;
+    }
+    const commitCount = typeof payload.total_commits_count === "number"
+        ? payload.total_commits_count
+        : undefined;
+    return Object.assign({ ref, before: asNonEmptyString(payload.before), after: asNonEmptyString(payload.after), checkoutSha: asNonEmptyString(payload.checkout_sha) }, (commitCount === undefined ? {} : { commitCount }));
+}
+function parsePipeline(payload) {
+    var _a;
+    const attributes = asRecord(payload.object_attributes);
+    const id = asPositiveInt(attributes === null || attributes === void 0 ? void 0 : attributes.id);
+    if (id === undefined) {
+        return undefined;
+    }
+    return {
+        id,
+        status: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.status),
+        sha: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.sha),
+        ref: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.ref),
+        source: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.source),
+        url: asNonEmptyString(attributes === null || attributes === void 0 ? void 0 : attributes.url),
+        mergeRequestIid: asPositiveInt((_a = asRecord(payload.merge_request)) === null || _a === void 0 ? void 0 : _a.iid),
+    };
+}
+function invalidPayload(error) {
+    return Response.json({ ok: false, error }, { status: 400 });
+}
+function startTurn(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const source = continuationSource(input.options.continuation, "gitlab");
+        const session = yield input.args.send(input.message, Object.assign(Object.assign(Object.assign(Object.assign({ auth: input.dispatch.auth }, (source === "engine" && input.ctx.mergeRequestIid !== undefined
+            ? {
+                continuationToken: `gitlab-mr:${input.ctx.project.pathWithNamespace.toLowerCase()}!${input.ctx.mergeRequestIid}`,
+            }
+            : {})), { title: (_a = input.dispatch.title) !== null && _a !== void 0 ? _a : defaultGitLabTitle(input.ctx) }), (input.cloud === undefined ? {} : { cloud: input.cloud })), { state: input.state, refreshState: input.state }));
+        return turnStarted(session);
+    });
+}
+function resolveCloudOptions(cloud, ctx, mergeRequest) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (cloud === undefined || cloud === false) {
+            return undefined;
+        }
+        if (cloud === true) {
+            return {
+                repos: [
+                    {
+                        url: ctx.project.webUrl,
+                        prUrl: mergeRequest.url,
+                        startingRef: mergeRequest.headSha,
+                    },
+                ],
+            };
+        }
+        if (typeof cloud === "function") {
+            return yield cloud(ctx, mergeRequest);
+        }
+        return cloud;
+    });
+}
+function applyDispatch(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        if (input.dispatch === null) {
+            return skipped("not_dispatched", input.extra);
+        }
+        if (isTaskDispatch(input.dispatch)) {
+            return acknowledgeTask(input.args, GITLAB_CHANNEL_KIND, input.dispatch, input.extra);
+        }
+        const message = [
+            (_a = input.dispatch.message) !== null && _a !== void 0 ? _a : input.message,
+            ...((_b = input.dispatch.context) !== null && _b !== void 0 ? _b : []),
+        ].join("\n");
+        return startTurn({
+            options: input.options,
+            args: input.args,
+            ctx: input.ctx,
+            message,
+            dispatch: input.dispatch,
+            cloud: input.cloud,
+            state: gitlabChannelStateForEvent({
+                project: input.ctx.project,
+                mergeRequestIid: input.ctx.mergeRequestIid,
+                headSha: input.headSha,
+                deliveryId: input.ctx.deliveryId,
+                eventType: input.ctx.eventType,
+                triggeringNoteId: input.triggeringNoteId,
+            }),
+        });
+    });
+}
+const DEFAULT_NOTEABLES = ["merge_request"];
+/**
+ * Run the authored hooks for one GitLab delivery and `send()` the turn.
+ * Callers own delivery auth: the HTTP route compares `X-Gitlab-Token`;
+ * hosted admission arrives verified. The v2 mailbox is stamped upstream
+ * (local CP or hosted ingress), never here.
+ */
+export function dispatchGitLabWebhook(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        var _d, _e;
+        const { eventType, payload } = input.delivery;
+        const parsed = parseGitLabEventContext(input.delivery);
+        if (parsed === null) {
+            return invalidPayload("invalid_gitlab_payload");
+        }
+        const args = input.args;
+        const ctx = Object.assign(Object.assign({}, parsed), { gitlab: buildGitLabBinding({
+                project: parsed.project,
+                proxy: (_a = input.proxy) === null || _a === void 0 ? void 0 : _a.call(input),
+                token: input.options.token,
+                apiBaseUrl: input.options.apiBaseUrl,
+            }), host: args.host, artifacts: args.artifacts, send: args.send });
+        const allowlist = configuredProjectAllowlist(input.options);
+        if (allowlist !== undefined &&
+            !allowlist.has(ctx.project.pathWithNamespace.toLowerCase())) {
+            return skipped("project_not_allowed", {
+                project: ctx.project.pathWithNamespace,
+            });
+        }
+        const extra = { event: eventType };
+        switch (eventType) {
+            case "merge_request": {
+                const mergeRequest = gitlabMergeRequestFromRecord(ctx.project, asRecord(payload.object_attributes));
+                if (mergeRequest === undefined) {
+                    return invalidPayload("invalid_gitlab_merge_request_payload");
+                }
+                const dispatch = input.options.onMergeRequest === undefined
+                    ? defaultGitLabMergeRequestDispatch(ctx, mergeRequest)
+                    : yield input.options.onMergeRequest(ctx, mergeRequest);
+                return applyDispatch({
+                    options: input.options,
+                    args,
+                    ctx,
+                    dispatch,
+                    extra: Object.assign(Object.assign({}, extra), { action: mergeRequest.action }),
+                    message: defaultGitLabMergeRequestMessage(ctx, mergeRequest),
+                    cloud: yield resolveCloudOptions(input.options.cloud, ctx, mergeRequest),
+                    headSha: mergeRequest.headSha,
+                });
+            }
+            case "note": {
+                if (input.options.onNote === undefined) {
+                    return skipped("no_handler", extra);
+                }
+                const note = parseNote(payload);
+                if (note === undefined) {
+                    return invalidPayload("invalid_gitlab_note_payload");
+                }
+                const noteables = (_d = input.options.noteables) !== null && _d !== void 0 ? _d : DEFAULT_NOTEABLES;
+                if (!noteables.includes(note.noteableType)) {
+                    return skipped("noteable_not_subscribed", Object.assign(Object.assign({}, extra), { noteable: note.noteableType }));
+                }
+                const dispatch = yield input.options.onNote(ctx, note);
+                return applyDispatch({
+                    options: input.options,
+                    args,
+                    ctx,
+                    dispatch,
+                    extra,
+                    message: ctx.mergeRequestIid === undefined
+                        ? `GitLab ${note.noteableType} note on ${ctx.project.pathWithNamespace}`
+                        : `GitLab note on ${ctx.project.pathWithNamespace}!${ctx.mergeRequestIid}`,
+                    headSha: asNonEmptyString((_c = asRecord((_b = asRecord(payload.merge_request)) === null || _b === void 0 ? void 0 : _b.last_commit)) === null || _c === void 0 ? void 0 : _c.id),
+                    triggeringNoteId: note.id,
+                });
+            }
+            case "push": {
+                if (input.options.onPush === undefined) {
+                    return skipped("no_handler", extra);
+                }
+                const push = parsePush(payload);
+                if (push === undefined) {
+                    return invalidPayload("invalid_gitlab_push_payload");
+                }
+                const dispatch = yield input.options.onPush(ctx, push);
+                return applyDispatch({
+                    options: input.options,
+                    args,
+                    ctx,
+                    dispatch,
+                    extra,
+                    message: `GitLab push to ${ctx.project.pathWithNamespace} ${push.ref}`,
+                    headSha: push.after,
+                });
+            }
+            case "pipeline": {
+                if (input.options.onPipeline === undefined) {
+                    return skipped("no_handler", extra);
+                }
+                const pipeline = parsePipeline(payload);
+                if (pipeline === undefined) {
+                    return invalidPayload("invalid_gitlab_pipeline_payload");
+                }
+                const dispatch = yield input.options.onPipeline(ctx, pipeline);
+                return applyDispatch({
+                    options: input.options,
+                    args,
+                    ctx,
+                    dispatch,
+                    extra: Object.assign(Object.assign({}, extra), { status: pipeline.status }),
+                    message: `GitLab pipeline ${(_e = pipeline.status) !== null && _e !== void 0 ? _e : "event"} on ${ctx.project.pathWithNamespace}`,
+                    headSha: pipeline.sha,
+                });
+            }
+            default: {
+                if (input.options.onEvent === undefined) {
+                    return skipped("unsupported_event", extra);
+                }
+                const dispatch = yield input.options.onEvent(ctx, {
+                    eventType,
+                    payload,
+                });
+                return applyDispatch({
+                    options: input.options,
+                    args,
+                    ctx,
+                    dispatch,
+                    extra,
+                    message: `GitLab ${eventType} event on ${ctx.project.pathWithNamespace}`,
+                });
+            }
+        }
+    });
+}
+/**
+ * HTTP entry for a single agent's GitLab channel: `X-Gitlab-Token` compare
+ * when a secret is configured, then {@link dispatchGitLabWebhook}. Without
+ * a secret the route auth owns admission (`serve --dev` admits loopback
+ * only; production stays loopback-strict).
+ */
+export function handleGitLabWebhookRequest(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const bodyText = yield input.request.text();
+        const secret = resolveGitLabWebhookSecret(input.options);
+        if (secret !== undefined && input.skipSignatureVerification !== true) {
+            if (!verifyGitLabWebhookToken(input.request.headers.get("x-gitlab-token"), secret)) {
+                return Response.json({ ok: false, error: "invalid_token" }, { status: 401 });
+            }
+        }
+        let payload;
+        try {
+            payload = JSON.parse(bodyText);
+        }
+        catch (_b) {
+            return Response.json({ ok: false, error: "invalid_json" }, { status: 400 });
+        }
+        const delivery = parseGitLabWebhookPayload(payload);
+        if (delivery === null) {
+            return invalidPayload("invalid_gitlab_payload");
+        }
+        delivery.deliveryId = (_a = input.request.headers.get("x-gitlab-event-uuid")) !== null && _a !== void 0 ? _a : undefined;
+        return dispatchGitLabWebhook({
+            options: input.options,
+            delivery,
+            proxy: input.proxy,
+            args: bindLocalIngressSend(input.args, {
+                identity: input.options.continuation,
+                kind: GITLAB_CHANNEL_KIND,
+                eventType: delivery.eventType,
+                payload: delivery.payload,
+            }),
+        });
+    });
+}

package/dist/channels/gitlab/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * GitLab webhook channel pack for agent-serve.
+ *
+ * ```ts
+ * import { defaultGitLabAuth, gitlabChannel } from "@cursor/july/channels/gitlab";
+ *
+ * export default gitlabChannel({
+ *   webhookSecret: () => process.env.GITLAB_WEBHOOK_SECRET,
+ *   onMergeRequest: (ctx) => ({ auth: defaultGitLabAuth(ctx) }),
+ *   onNote: (ctx) => ({ auth: defaultGitLabAuth(ctx) }),
+ * });
+ * ```
+ *
+ * Direct webhook mode compares the project hook's `X-Gitlab-Token` against
+ * {@link GitLabChannelOptions.webhookSecret} (or `GITLAB_WEBHOOK_SECRET`).
+ * Hosted deployments receive deliveries the Cursor backend already
+ * verified. The turn principal is `gitlab-webhook` plus the GitLab actor —
+ * not the Cursor subscriber — matching GitHub's `github-webhook` pattern.
+ */
+export * from "./api.js";
+export { buildGitLabBinding, type GitLabHandle, gitlabMergeRequestFromRecord, gitlabMergeRequestUrl, gitlabProjectFromPayload, normalizeGitLabNoteableType, } from "./binding.js";
+export * from "./checks.js";
+export { CURSOR_GITLAB_MAX_PROJECTS, type CursorGitLabProjectScope, parseCursorGitLabProjectScope, resolveCursorGitLabProxyUrl, } from "./cursor-account.js";
+export * from "./defaults.js";
+export * from "./events.js";
+export * from "./gitlab-channel.js";
+export * from "./gitlab-webhook.js";
+export * from "./replay.js";
+export * from "./state.js";
+export * from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/channels/gitlab/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,KAAK,YAAY,EACjB,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AACtB,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,0BAA0B,EAC1B,KAAK,wBAAwB,EAC7B,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/channels/gitlab/index.js

@@ -0,0 +1,30 @@
+/**
+ * GitLab webhook channel pack for agent-serve.
+ *
+ * ```ts
+ * import { defaultGitLabAuth, gitlabChannel } from "@cursor/july/channels/gitlab";
+ *
+ * export default gitlabChannel({
+ *   webhookSecret: () => process.env.GITLAB_WEBHOOK_SECRET,
+ *   onMergeRequest: (ctx) => ({ auth: defaultGitLabAuth(ctx) }),
+ *   onNote: (ctx) => ({ auth: defaultGitLabAuth(ctx) }),
+ * });
+ * ```
+ *
+ * Direct webhook mode compares the project hook's `X-Gitlab-Token` against
+ * {@link GitLabChannelOptions.webhookSecret} (or `GITLAB_WEBHOOK_SECRET`).
+ * Hosted deployments receive deliveries the Cursor backend already
+ * verified. The turn principal is `gitlab-webhook` plus the GitLab actor —
+ * not the Cursor subscriber — matching GitHub's `github-webhook` pattern.
+ */
+export * from "./api.js";
+export { buildGitLabBinding, gitlabMergeRequestFromRecord, gitlabMergeRequestUrl, gitlabProjectFromPayload, normalizeGitLabNoteableType, } from "./binding.js";
+export * from "./checks.js";
+export { CURSOR_GITLAB_MAX_PROJECTS, parseCursorGitLabProjectScope, resolveCursorGitLabProxyUrl, } from "./cursor-account.js";
+export * from "./defaults.js";
+export * from "./events.js";
+export * from "./gitlab-channel.js";
+export * from "./gitlab-webhook.js";
+export * from "./replay.js";
+export * from "./state.js";
+export * from "./types.js";

package/dist/channels/gitlab/replay.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Synthesize GitLab webhook payloads from data you can *read* about a merge
+ * request, so `agent-sdk gitlab replay` can exercise a `gitlabChannel()`
+ * without Maintainer access to the project hook and without a tunnel.
+ *
+ * Payloads are shaped to satisfy the channel's parsers (`gitlab-webhook.ts`);
+ * `undefined` fields are dropped by `JSON.stringify` before delivery.
+ */
+/** A parsed merge request reference. */
+export interface GitLabMrRef {
+    /** `https://gitlab.com` or the self-managed origin. */
+    origin: string;
+    /** `group/sub/project` as written (GitLab paths keep their case). */
+    projectPath: string;
+    iid: number;
+    /** `<origin>/<projectPath>/-/merge_requests/<iid>`. */
+    url: string;
+    /** `group/project!N`. */
+    label: string;
+}
+/**
+ * Parse an MR URL (`https://<host>/<group>/<project>/-/merge_requests/N`) or
+ * `group/project!N` (defaults to gitlab.com). Returns undefined otherwise.
+ */
+export declare function parseGitLabMrRef(raw: string): GitLabMrRef | undefined;
+export interface ReplayGitLabProject {
+    id: number;
+    name?: string;
+    path_with_namespace: string;
+    web_url: string;
+    default_branch?: string;
+    namespace?: {
+        full_path?: string;
+    };
+}
+export interface ReplayGitLabUser {
+    id: number;
+    username: string;
+    name?: string;
+    avatar_url?: string | null;
+}
+export interface ReplayGitLabMergeRequest {
+    id: number;
+    iid: number;
+    title: string;
+    description?: string | null;
+    state: string;
+    draft?: boolean;
+    work_in_progress?: boolean;
+    web_url: string;
+    source_branch: string;
+    target_branch: string;
+    sha?: string | null;
+    author?: ReplayGitLabUser | null;
+    labels?: string[];
+    source_project_id?: number;
+    target_project_id?: number;
+    diff_refs?: {
+        base_sha?: string;
+        head_sha?: string;
+        start_sha?: string;
+    } | null;
+}
+/** Latest pipeline on the MR head, when one exists. */
+export interface ReplayGitLabPipeline {
+    id: number;
+    status?: string;
+    sha?: string;
+    ref?: string;
+    source?: string;
+    web_url?: string;
+}
+/** Webhook `object_kind`s replay knows how to synthesize. */
+export declare const GITLAB_SYNTHESIZABLE_EVENTS: readonly ["merge_request", "note", "pipeline", "push"];
+export type GitLabSynthesizableEvent = (typeof GITLAB_SYNTHESIZABLE_EVENTS)[number];
+export declare function isGitLabSynthesizableEvent(event: string): event is GitLabSynthesizableEvent;
+export interface SynthesizedGitLabEvent {
+    eventName: GitLabSynthesizableEvent;
+    /** `object_attributes.action` for merge_request events. */
+    action?: string;
+    /** `X-Gitlab-Event` header value for this object kind. */
+    header: string;
+    payload: Record<string, unknown>;
+}
+/** Build one GitLab-shaped payload for `event`. */
+export declare function synthesizeGitLabEvent(input: {
+    event: string;
+    project: ReplayGitLabProject;
+    mergeRequest: ReplayGitLabMergeRequest;
+    /** merge_request action (default `open`). */
+    action?: string;
+    /** note body (default `@cursor please take a look`). */
+    comment?: string;
+    /** pipeline status override (default: the latest pipeline's, else `success`). */
+    status?: string;
+    pipeline?: ReplayGitLabPipeline;
+}): SynthesizedGitLabEvent | {
+    error: string;
+};
+/** Choose events to replay: explicit list, `*` for every declared, else merge_request. */
+export declare function selectGitLabReplayEvents(requested: readonly string[] | undefined, declared: readonly string[]): {
+    events: GitLabSynthesizableEvent[];
+    unsupported: string[];
+};
+//# sourceMappingURL=replay.d.ts.map

package/dist/channels/gitlab/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAqBrE;AAmBD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,IAAI,CAAC;CACV;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,YACtC,eAAe,EACf,MAAM,EACN,UAAU,EACV,MAAM,CACE,CAAC;AAEX,MAAM,MAAM,wBAAwB,GAClC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/C,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,wBAAwB,CAEnC;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,wBAAwB,CAAC;IACpC,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAuDD,mDAAmD;AACnD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,mBAAmB,CAAC;IAC7B,YAAY,EAAE,wBAAwB,CAAC;IACvC,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC,GAAG,sBAAsB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAqH7C;AAED,0FAA0F;AAC1F,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACxC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B;IAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAiB/D"}