@cursor/july 0.1.101 → 0.1.103

package/dist/channels/gitlab/checks.d.ts

@@ -0,0 +1,110 @@
+/**
+ * GitLab commit statuses — the GitLab {@link CiCheckWriter} behind the shared
+ * check lifecycle in `../checks.js`.
+ *
+ * GitLab has no Checks API; the merge-request widget shows **commit
+ * statuses** (`POST /projects/:id/statuses/:sha`, one row per `name`). The
+ * writer maps the shared status / conclusion pair onto GitLab's state set
+ * and re-posts the full desired state on every write, so `resumeGitLabCheck`
+ * needs only `(project, sha, name)` to rebuild a handle after a restart.
+ *
+ * Posting needs a token with `api` scope (Developer role or above); through
+ * the SCM proxy that is the tenant's project / host credential.
+ */
+import { type CiCheck, type CiCheckConcludeInput, type CiCheckConclusion, type CiCheckCreateInput, type CiCheckOutput, type CiCheckRef, type CiCheckStatus, type CiChecksClient, type CiCheckUpdateInput } from "../checks.js";
+import { type GitLabApiMethod } from "./api.js";
+/** Any client that can call the GitLab REST API. */
+export interface GitLabCheckClient {
+    request<T = unknown>(input: {
+        method: GitLabApiMethod;
+        path: string;
+        body?: unknown;
+    }): Promise<T>;
+}
+/** GitLab commit status `state` values. */
+export type GitLabCommitStatusState = "pending" | "running" | "success" | "failed" | "canceled";
+export interface GitLabCommitStatusInput {
+    /** Numeric project id or `group/project` path. */
+    project: number | string;
+    sha: string;
+    state: GitLabCommitStatusState;
+    /** Status name shown in the MR widget, e.g. `cursor/security-review`. */
+    name: string;
+    /** "Details" link. */
+    targetUrl?: string;
+    /** Short description (GitLab truncates long values). */
+    description?: string;
+    /** Attach the status to a specific pipeline instead of the latest one. */
+    pipelineId?: number;
+}
+/** Response subset of `POST /projects/:id/statuses/:sha`. */
+export interface GitLabCommitStatus {
+    id?: number;
+    status?: string;
+    target_url?: string | null;
+    [key: string]: unknown;
+}
+/** Post one commit status. Throws `GitLabApiError` on API failure. */
+export declare function setGitLabCommitStatus(gitlab: GitLabCheckClient, input: GitLabCommitStatusInput): Promise<GitLabCommitStatus>;
+/** Shared check status / conclusion → GitLab commit status state. */
+export declare function gitlabCommitStatusState(input: {
+    status: CiCheckStatus;
+    conclusion?: CiCheckConclusion;
+}): GitLabCommitStatusState;
+export type GitLabCheckOutput = CiCheckOutput;
+export type GitLabCheckUpdateInput = CiCheckUpdateInput;
+export type GitLabCheckConcludeInput = CiCheckConcludeInput;
+/** A created commit status. All methods throw `GitLabApiError` on failure. */
+export type GitLabCheck = CiCheck & CiCheckRef;
+export interface GitLabCheckIdentityInput {
+    /** Client used for every API call on the returned handle. */
+    gitlab: GitLabCheckClient;
+    /** Numeric project id or `group/project` path. */
+    project: number | string;
+    /** Status name shown in the MR widget, e.g. `"cursor/security-review"`. */
+    name: string;
+    /** Commit the status attaches to (usually the MR head SHA). */
+    sha: string;
+    /** Pin the status to one pipeline. */
+    pipelineId?: number;
+}
+export interface GitLabCheckCreateInput extends GitLabCheckIdentityInput, CiCheckCreateInput {
+}
+/**
+ * Open a commit status on `sha` and return a handle for later updates.
+ *
+ * ```ts
+ * const check = await createGitLabCheck({
+ *   gitlab: ctx.gitlab,
+ *   project: ctx.project.id,
+ *   name: "cursor/security-review",
+ *   sha: mergeRequest.headSha,
+ *   detailsUrl: sessionUrl,
+ *   output: { title: "Running…", summary: "" },
+ * });
+ * await check.conclude({ conclusion: "success", output: { title: "Clean", summary: "" } });
+ * ```
+ */
+export declare function createGitLabCheck(input: GitLabCheckCreateInput): Promise<GitLabCheck>;
+/**
+ * Rebuild a {@link GitLabCheck} handle for an existing status row from its
+ * identity. No API call is made until the first update.
+ */
+export declare function resumeGitLabCheck(input: GitLabCheckIdentityInput & {
+    /** Last known status; defaults to `"in_progress"`. */
+    status?: CiCheckStatus;
+    /** Last known details link, kept on writes that omit `detailsUrl`. */
+    url?: string;
+    /** Last known title, kept on writes that omit `output`. */
+    title?: string;
+    id?: number;
+}): GitLabCheck;
+/**
+ * Project-bound checks adapter satisfying the shared {@link CiChecksClient}
+ * contract for forge-agnostic check code.
+ */
+export declare function bindGitLabChecks(input: {
+    gitlab: GitLabCheckClient;
+    project: number | string;
+}): CiChecksClient;
+//# sourceMappingURL=checks.d.ts.map

package/dist/channels/gitlab/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAIxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,eAAe,EAA4B,MAAM,UAAU,CAAC;AAE1E,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE;QAC1B,MAAM,EAAE,eAAe,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChB;AAED,2CAA2C;AAC3C,MAAM,MAAM,uBAAuB,GAC/B,SAAS,GACT,SAAS,GACT,SAAS,GACT,QAAQ,GACR,UAAU,CAAC;AAEf,MAAM,WAAW,uBAAuB;IACtC,kDAAkD;IAClD,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,uBAAuB,CAAC;IAC/B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,sEAAsE;AACtE,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAgB7B;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC,GAAG,uBAAuB,CAoB1B;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC9C,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AACxD,MAAM,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,MAAM,EAAE,iBAAiB,CAAC;IAC1B,kDAAkD;IAClD,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBACf,SAAQ,wBAAwB,EAC9B,kBAAkB;CAAG;AA0CzB;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,WAAW,CAAC,CAEtB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,wBAAwB,GAAG;IAChC,sDAAsD;IACtD,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,GACA,WAAW,CAKb;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B,GAAG,cAAc,CASjB"}

package/dist/channels/gitlab/checks.js

@@ -0,0 +1,126 @@
+/**
+ * GitLab commit statuses — the GitLab {@link CiCheckWriter} behind the shared
+ * check lifecycle in `../checks.js`.
+ *
+ * GitLab has no Checks API; the merge-request widget shows **commit
+ * statuses** (`POST /projects/:id/statuses/:sha`, one row per `name`). The
+ * writer maps the shared status / conclusion pair onto GitLab's state set
+ * and re-posts the full desired state on every write, so `resumeGitLabCheck`
+ * needs only `(project, sha, name)` to rebuild a handle after a restart.
+ *
+ * Posting needs a token with `api` scope (Developer role or above); through
+ * the SCM proxy that is the tenant's project / host credential.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { openCiCheck, resumeCiCheck, } from "../checks.js";
+import { gitlabProjectPathSegment } from "./api.js";
+const DESCRIPTION_MAX_CHARS = 255;
+/** Post one commit status. Throws `GitLabApiError` on API failure. */
+export function setGitLabCommitStatus(gitlab, input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return yield gitlab.request({
+            method: "POST",
+            path: `/projects/${gitlabProjectPathSegment(input.project)}/statuses/${encodeURIComponent(input.sha)}`,
+            body: Object.assign(Object.assign(Object.assign({ state: input.state, name: input.name }, (input.targetUrl === undefined ? {} : { target_url: input.targetUrl })), (input.description === undefined
+                ? {}
+                : { description: input.description.slice(0, DESCRIPTION_MAX_CHARS) })), (input.pipelineId === undefined
+                ? {}
+                : { pipeline_id: input.pipelineId })),
+        });
+    });
+}
+/** Shared check status / conclusion → GitLab commit status state. */
+export function gitlabCommitStatusState(input) {
+    if (input.status === "queued") {
+        return "pending";
+    }
+    if (input.status === "in_progress") {
+        return "running";
+    }
+    switch (input.conclusion) {
+        case "success":
+        case "neutral":
+        case "skipped":
+            return "success";
+        case "cancelled":
+            return "canceled";
+        case "failure":
+        case "action_required":
+        case "timed_out":
+        case undefined:
+            return "failed";
+    }
+}
+/**
+ * GitLab writer: every write re-posts the status row for `(sha, name)`, and
+ * a commit status has no partial update, so the writer carries the last
+ * status, details link, and title forward when a write omits them.
+ */
+function gitlabCheckWriter(input) {
+    var _a;
+    let lastStatus = (_a = input.status) !== null && _a !== void 0 ? _a : "in_progress";
+    let lastUrl = input.url;
+    let lastTitle = input.title;
+    return (write) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        var _b, _c, _d;
+        const status = (_b = write.status) !== null && _b !== void 0 ? _b : (write.conclusion === undefined ? lastStatus : "completed");
+        lastStatus = status;
+        lastUrl = (_c = write.detailsUrl) !== null && _c !== void 0 ? _c : lastUrl;
+        lastTitle = (_d = (_a = write.output) === null || _a === void 0 ? void 0 : _a.title) !== null && _d !== void 0 ? _d : lastTitle;
+        const posted = yield setGitLabCommitStatus(input.gitlab, {
+            project: input.project,
+            sha: input.sha,
+            name: input.name,
+            state: gitlabCommitStatusState({ status, conclusion: write.conclusion }),
+            targetUrl: lastUrl,
+            description: lastTitle,
+            pipelineId: input.pipelineId,
+        });
+        return Object.assign(Object.assign({}, (typeof (posted === null || posted === void 0 ? void 0 : posted.id) === "number" ? { id: posted.id } : {})), (typeof (posted === null || posted === void 0 ? void 0 : posted.target_url) === "string"
+            ? { url: posted.target_url }
+            : {}));
+    });
+}
+/**
+ * Open a commit status on `sha` and return a handle for later updates.
+ *
+ * ```ts
+ * const check = await createGitLabCheck({
+ *   gitlab: ctx.gitlab,
+ *   project: ctx.project.id,
+ *   name: "cursor/security-review",
+ *   sha: mergeRequest.headSha,
+ *   detailsUrl: sessionUrl,
+ *   output: { title: "Running…", summary: "" },
+ * });
+ * await check.conclude({ conclusion: "success", output: { title: "Clean", summary: "" } });
+ * ```
+ */
+export function createGitLabCheck(input) {
+    return openCiCheck(gitlabCheckWriter(input), input);
+}
+/**
+ * Rebuild a {@link GitLabCheck} handle for an existing status row from its
+ * identity. No API call is made until the first update.
+ */
+export function resumeGitLabCheck(input) {
+    return resumeCiCheck(gitlabCheckWriter(input), input.id === undefined ? undefined : { id: input.id });
+}
+/**
+ * Project-bound checks adapter satisfying the shared {@link CiChecksClient}
+ * contract for forge-agnostic check code.
+ */
+export function bindGitLabChecks(input) {
+    return {
+        createCheck: (check) => createGitLabCheck(Object.assign(Object.assign({}, check), { gitlab: input.gitlab, project: input.project })),
+    };
+}

package/dist/channels/gitlab/cursor-account.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Cursor-account mode for GitLab channels.
+ *
+ * `gitlabChannel({ cursorAccount })` declares that outbound GitLab calls run
+ * through the Cursor SCM proxy (`/v0/gitlab-proxy`) with the tenant's
+ * credential swapped in server-side. The serve host binds the Cursor API key
+ * and the proxy transport at startup when `--cursor-scm-proxy` is set; until
+ * then `ctx.gitlab` falls back to direct `GITLAB_TOKEN` access.
+ */
+import type { GitLabProxyTransport } from "./api.js";
+import type { GitLabChannelOptions } from "./types.js";
+export declare const CURSOR_GITLAB_MAX_PROJECTS = 20;
+export interface CursorGitLabProjectScope {
+    /** Lowercased `group/project` paths. */
+    projects: readonly string[];
+}
+/** Host-bound credential: Cursor API key + proxy transport, bound at serve. */
+export interface PendingCursorGitLabCredentials {
+    bind(getApiKey: () => Promise<string>): void;
+    bindProxyTransport(transport: Omit<GitLabProxyTransport, "getApiKey">): void;
+    /** The full proxy transport once both halves are bound. */
+    getProxyTransport(): GitLabProxyTransport | undefined;
+}
+export interface GitLabCursorAccountRuntime {
+    /** Authored channel options (not rewritten). */
+    options: GitLabChannelOptions;
+    credentials: PendingCursorGitLabCredentials;
+    scope: CursorGitLabProjectScope | undefined;
+}
+export declare function parseCursorGitLabProjectScope(values: readonly string[]): CursorGitLabProjectScope;
+export declare function createPendingCursorGitLabCredentials(): PendingCursorGitLabCredentials;
+/** GitLab-proxy base URL (`/v0/gitlab-proxy`, `AGENT_SERVE_GITLAB_PROXY_URL`). */
+export declare function resolveCursorGitLabProxyUrl(backendBaseUrl: string): string;
+export declare function registerGitLabCursorAccountRuntime(definition: object, runtime: GitLabCursorAccountRuntime): void;
+export declare function getGitLabCursorAccountRuntime(definition: object): GitLabCursorAccountRuntime | undefined;
+//# sourceMappingURL=cursor-account.d.ts.map

package/dist/channels/gitlab/cursor-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-account.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/cursor-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAI7C,MAAM,WAAW,wBAAwB;IACvC,wCAAwC;IACxC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,+EAA+E;AAC/E,MAAM,WAAW,8BAA8B;IAC7C,IAAI,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7C,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;IAC7E,2DAA2D;IAC3D,iBAAiB,IAAI,oBAAoB,GAAG,SAAS,CAAC;CACvD;AAED,MAAM,WAAW,0BAA0B;IACzC,gDAAgD;IAChD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,WAAW,EAAE,8BAA8B,CAAC;IAC5C,KAAK,EAAE,wBAAwB,GAAG,SAAS,CAAC;CAC7C;AAID,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,wBAAwB,CAkC1B;AAED,wBAAgB,oCAAoC,IAAI,8BAA8B,CAiBrF;AAED,kFAAkF;AAClF,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,GAClC,IAAI,CAEN;AAED,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,GACjB,0BAA0B,GAAG,SAAS,CAExC"}

package/dist/channels/gitlab/cursor-account.js

@@ -0,0 +1,65 @@
+/**
+ * Cursor-account mode for GitLab channels.
+ *
+ * `gitlabChannel({ cursorAccount })` declares that outbound GitLab calls run
+ * through the Cursor SCM proxy (`/v0/gitlab-proxy`) with the tenant's
+ * credential swapped in server-side. The serve host binds the Cursor API key
+ * and the proxy transport at startup when `--cursor-scm-proxy` is set; until
+ * then `ctx.gitlab` falls back to direct `GITLAB_TOKEN` access.
+ */
+import { resolveCursorScmProxyUrl } from "../github/cursor-account.js";
+export const CURSOR_GITLAB_MAX_PROJECTS = 20;
+/** `group/project`, with nested groups (`group/sub/project`). */
+const CURSOR_GITLAB_PROJECT_PATTERN = /^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)+$/;
+const runtimeByDefinition = new WeakMap();
+export function parseCursorGitLabProjectScope(values) {
+    const projects = [
+        ...new Set(values
+            .map((project) => project
+            .trim()
+            .replace(/^\/+|\/+$/g, "")
+            .toLowerCase())
+            .filter(Boolean)),
+    ];
+    if (projects.length === 0) {
+        throw new Error("gitlabChannel({ cursorAccount }) requires at least one project.");
+    }
+    if (projects.length > CURSOR_GITLAB_MAX_PROJECTS) {
+        throw new Error(`gitlabChannel({ cursorAccount }) supports at most ${CURSOR_GITLAB_MAX_PROJECTS} projects.`);
+    }
+    for (const project of projects) {
+        if (!CURSOR_GITLAB_PROJECT_PATTERN.test(project) ||
+            project.includes("..")) {
+            throw new Error(`Invalid GitLab project "${project}"; expected group/project.`);
+        }
+    }
+    return { projects };
+}
+export function createPendingCursorGitLabCredentials() {
+    let getApiKey;
+    let transport;
+    return {
+        bind(next) {
+            getApiKey = next;
+        },
+        bindProxyTransport(next) {
+            transport = next;
+        },
+        getProxyTransport() {
+            if (getApiKey === undefined || transport === undefined) {
+                return undefined;
+            }
+            return Object.assign(Object.assign({}, transport), { getApiKey });
+        },
+    };
+}
+/** GitLab-proxy base URL (`/v0/gitlab-proxy`, `AGENT_SERVE_GITLAB_PROXY_URL`). */
+export function resolveCursorGitLabProxyUrl(backendBaseUrl) {
+    return resolveCursorScmProxyUrl("gitlab", backendBaseUrl);
+}
+export function registerGitLabCursorAccountRuntime(definition, runtime) {
+    runtimeByDefinition.set(definition, runtime);
+}
+export function getGitLabCursorAccountRuntime(definition) {
+    return runtimeByDefinition.get(definition);
+}

package/dist/channels/gitlab/defaults.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Default dispatch decisions for the GitLab channel: turn auth derived from
+ * the delivery's actor, the title / message a turn starts with, and which
+ * merge-request actions dispatch when no `onMergeRequest` hook is declared.
+ */
+import type { AuthContext } from "../../types.js";
+import type { GitLabEventContext, GitLabMergeRequestEvent, GitLabTurnDispatch } from "./types.js";
+type DispatchContext = Omit<GitLabEventContext, "host" | "artifacts" | "gitlab" | "send">;
+/**
+ * Derive the turn's auth from the actor that triggered the delivery — the
+ * standard `{ auth: defaultGitLabAuth(ctx) }` dispatch from an inbound hook.
+ * The subscriber's Cursor identity is not the turn principal (same pattern
+ * as `defaultGitHubAuth` / `defaultOriginAuth`).
+ */
+export declare function defaultGitLabAuth(ctx: DispatchContext): AuthContext;
+export declare function defaultGitLabTitle(ctx: Pick<GitLabEventContext, "project" | "mergeRequestIid" | "eventType">): string;
+export declare function defaultGitLabMergeRequestMessage(ctx: DispatchContext, mergeRequest: GitLabMergeRequestEvent): string;
+/**
+ * Default gate when no `onMergeRequest` hook is declared: a new or reopened
+ * merge request, or an `update` that pushed commits (`oldrev` present —
+ * title / label edits carry no `oldrev`), starts a turn as the actor.
+ */
+export declare function defaultGitLabMergeRequestDispatch(ctx: DispatchContext, mergeRequest: GitLabMergeRequestEvent): GitLabTurnDispatch | null;
+export {};
+//# sourceMappingURL=defaults.d.ts.map

package/dist/channels/gitlab/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/defaults.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,KAAK,eAAe,GAAG,IAAI,CACzB,kBAAkB,EAClB,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,CACzC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,WAAW,CAmBnE;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,GAAG,iBAAiB,GAAG,WAAW,CAAC,GACzE,MAAM,CAIR;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,eAAe,EACpB,YAAY,EAAE,uBAAuB,GACpC,MAAM,CAgBR;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,eAAe,EACpB,YAAY,EAAE,uBAAuB,GACpC,kBAAkB,GAAG,IAAI,CAU3B"}

package/dist/channels/gitlab/defaults.js

@@ -0,0 +1,60 @@
+/**
+ * Default dispatch decisions for the GitLab channel: turn auth derived from
+ * the delivery's actor, the title / message a turn starts with, and which
+ * merge-request actions dispatch when no `onMergeRequest` hook is declared.
+ */
+/**
+ * Derive the turn's auth from the actor that triggered the delivery — the
+ * standard `{ auth: defaultGitLabAuth(ctx) }` dispatch from an inbound hook.
+ * The subscriber's Cursor identity is not the turn principal (same pattern
+ * as `defaultGitHubAuth` / `defaultOriginAuth`).
+ */
+export function defaultGitLabAuth(ctx) {
+    const sender = ctx.sender;
+    const host = new URL(ctx.project.webUrl).host;
+    return {
+        authenticator: "gitlab-webhook",
+        principalId: sender === undefined ? "gitlab" : String(sender.id),
+        principalType: "user",
+        attributes: Object.assign(Object.assign(Object.assign({ conversation_kind: ctx.mergeRequestIid === undefined ? ctx.eventType : "merge_request", project: ctx.project.pathWithNamespace, project_id: String(ctx.project.id) }, (ctx.deliveryId === undefined ? {} : { delivery_id: ctx.deliveryId })), (sender === undefined
+            ? {}
+            : { subject: String(sender.id), username: sender.username })), { issuer: `gitlab:${host}` }),
+    };
+}
+export function defaultGitLabTitle(ctx) {
+    return ctx.mergeRequestIid === undefined
+        ? `GitLab ${ctx.project.pathWithNamespace} ${ctx.eventType}`
+        : `GitLab ${ctx.project.pathWithNamespace}!${ctx.mergeRequestIid}`;
+}
+export function defaultGitLabMergeRequestMessage(ctx, mergeRequest) {
+    var _a;
+    const head = mergeRequest.sourceBranch !== undefined &&
+        mergeRequest.headSha !== undefined
+        ? `Head: ${mergeRequest.sourceBranch} (${mergeRequest.headSha})`
+        : undefined;
+    return [
+        `GitLab merge request trigger: ${ctx.project.pathWithNamespace}!${mergeRequest.iid}`,
+        `Action: ${(_a = mergeRequest.action) !== null && _a !== void 0 ? _a : "unknown"}`,
+        `URL: ${mergeRequest.url}`,
+        ...(mergeRequest.title === undefined
+            ? []
+            : [`Title: ${mergeRequest.title}`]),
+        ...(head === undefined ? [] : [head]),
+        "Handle this merge request event.",
+    ].join("\n");
+}
+/**
+ * Default gate when no `onMergeRequest` hook is declared: a new or reopened
+ * merge request, or an `update` that pushed commits (`oldrev` present —
+ * title / label edits carry no `oldrev`), starts a turn as the actor.
+ */
+export function defaultGitLabMergeRequestDispatch(ctx, mergeRequest) {
+    const action = mergeRequest.action;
+    const dispatches = action === "open" ||
+        action === "reopen" ||
+        (action === "update" && mergeRequest.oldrev !== undefined);
+    if (!dispatches) {
+        return null;
+    }
+    return { auth: defaultGitLabAuth(ctx) };
+}

package/dist/channels/gitlab/events.d.ts

@@ -0,0 +1,12 @@
+/** {@link ChannelMeta.kind} value used by {@link gitlabChannel}. */
+export declare const GITLAB_CHANNEL_KIND = "gitlab";
+export interface GitLabWebhookEventOptions {
+    webhookEvents?: readonly string[];
+    onMergeRequest?: unknown;
+    onNote?: unknown;
+    onPush?: unknown;
+    onPipeline?: unknown;
+    onTagPush?: unknown;
+}
+export declare function deriveGitLabWebhookEvents(options: GitLabWebhookEventOptions): string[];
+//# sourceMappingURL=events.d.ts.map

package/dist/channels/gitlab/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/events.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAgB5C,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,yBAAyB,GACjC,MAAM,EAAE,CAeV"}

package/dist/channels/gitlab/events.js

@@ -0,0 +1,28 @@
+/** {@link ChannelMeta.kind} value used by {@link gitlabChannel}. */
+export const GITLAB_CHANNEL_KIND = "gitlab";
+/**
+ * GitLab `object_kind` values (the `X-Gitlab-Event` payload discriminator)
+ * each authored hook subscribes to. `merge_request` is always declared: it
+ * is the default dispatch when no `onMergeRequest` hook exists.
+ */
+const HOOK_EVENTS = [
+    ["onMergeRequest", "merge_request"],
+    ["onNote", "note"],
+    ["onPush", "push"],
+    ["onPipeline", "pipeline"],
+    ["onTagPush", "tag_push"],
+];
+export function deriveGitLabWebhookEvents(options) {
+    if (options.webhookEvents !== undefined) {
+        return [
+            ...new Set(options.webhookEvents.map((event) => event.trim()).filter(Boolean)),
+        ];
+    }
+    const events = ["merge_request"];
+    for (const [hook, objectKind] of HOOK_EVENTS) {
+        if (options[hook] !== undefined) {
+            events.push(objectKind);
+        }
+    }
+    return [...new Set(events)];
+}

package/dist/channels/gitlab/gitlab-channel.d.ts

@@ -0,0 +1,33 @@
+import type { ChannelDefinition } from "../../types.js";
+import { type GitLabChannelState } from "./state.js";
+import type { GitLabChannelOptions } from "./types.js";
+export declare function getGitLabChannelOptions(definition: object): GitLabChannelOptions | undefined;
+export declare function gitlabChannel(options?: GitLabChannelOptions): ChannelDefinition<GitLabChannelState>;
+/** Minimal mount shape shared by `serve` / the `gitlab` CLI. */
+export interface GitLabAgentMountLike {
+    slug: string;
+    project: {
+        channels: Array<{
+            id: string;
+            definition: {
+                meta?: {
+                    kind?: string;
+                    gitlabWebhookEvents?: readonly string[];
+                };
+                routes?: ReadonlyArray<{
+                    method: string;
+                    path: string;
+                }>;
+            };
+        }>;
+    };
+}
+export interface GitLabChannelTarget {
+    slug: string;
+    channelId: string;
+    /** Route path under the channel (default `/`). */
+    routePath: string;
+    events: string[];
+}
+export declare function findGitLabChannelTargets(mounts: ReadonlyArray<GitLabAgentMountLike>): GitLabChannelTarget[];
+//# sourceMappingURL=gitlab-channel.d.ts.map

package/dist/channels/gitlab/gitlab-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/gitlab-channel.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAaxD,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAOvD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,GACjB,oBAAoB,GAAG,SAAS,CAElC;AAED,wBAAgB,aAAa,CAC3B,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAAC,kBAAkB,CAAC,CAwFvC;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE;QACP,QAAQ,EAAE,KAAK,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,UAAU,EAAE;gBACV,IAAI,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;iBAAE,CAAC;gBAClE,MAAM,CAAC,EAAE,aAAa,CAAC;oBAAE,MAAM,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE,CAAC,CAAC;aAC1D,CAAC;SACH,CAAC,CAAC;KACJ,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,CAAC,oBAAoB,CAAC,GAC1C,mBAAmB,EAAE,CAoBvB"}

package/dist/channels/gitlab/gitlab-channel.js

@@ -0,0 +1,120 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { z } from "zod";
+import { allowAll, defineChannel, localDevStrict, loopbackOnly, POST, } from "../../channels.js";
+import { withPropagatingBackgroundErrors } from "../../internal/channel-dispatch.js";
+import { normalizeIdentity } from "../../internal/continuation-identity.js";
+import { isDevMode } from "../../internal/dev-mode.js";
+import { attachHostedAdmissionAdapter } from "../../internal/hosted-admission-adapter.js";
+import { createPendingCursorGitLabCredentials, parseCursorGitLabProjectScope, registerGitLabCursorAccountRuntime, } from "./cursor-account.js";
+import { deriveGitLabWebhookEvents, GITLAB_CHANNEL_KIND } from "./events.js";
+import { dispatchGitLabWebhook, handleGitLabWebhookRequest, parseGitLabWebhookPayload, resolveGitLabWebhookSecret, } from "./gitlab-webhook.js";
+import { emptyGitLabChannelState } from "./state.js";
+const gitlabChannelOptionsByDefinition = new WeakMap();
+export function getGitLabChannelOptions(definition) {
+    return gitlabChannelOptionsByDefinition.get(definition);
+}
+export function gitlabChannel(options = {}) {
+    var _a, _b, _c;
+    const routePath = (_a = options.path) !== null && _a !== void 0 ? _a : "/";
+    // With a hook secret the `X-Gitlab-Token` compare is the request auth
+    // (allowAll), matching GitHub HMAC + webhookSecret. Without one, prod stays
+    // loopback-strict; `--dev` admits loopback only. `isDevMode()` and the
+    // secret are read per request: channel modules construct at import time.
+    const auth = (_b = options.auth) !== null && _b !== void 0 ? _b : [
+        (request, info) => (resolveGitLabWebhookSecret(options) !== undefined
+            ? allowAll()
+            : isDevMode()
+                ? loopbackOnly()
+                : localDevStrict())(request, info),
+    ];
+    const channelOptions = Object.assign({}, options);
+    if (channelOptions.continuation !== undefined) {
+        channelOptions.continuation = normalizeIdentity(channelOptions.continuation, GITLAB_CHANNEL_KIND);
+    }
+    // `cursorAccount` routes `ctx.gitlab` through the SCM proxy once the serve
+    // host binds the Cursor API key + transport (`--cursor-scm-proxy`).
+    const cursorAccount = options.cursorAccount === undefined || options.cursorAccount === false
+        ? undefined
+        : {
+            credentials: createPendingCursorGitLabCredentials(),
+            scope: typeof options.cursorAccount === "object"
+                ? parseCursorGitLabProjectScope(options.cursorAccount.projects)
+                : undefined,
+        };
+    const proxy = () => cursorAccount === null || cursorAccount === void 0 ? void 0 : cursorAccount.credentials.getProxyTransport();
+    const definition = defineChannel({
+        auth,
+        state: emptyGitLabChannelState(),
+        events: (_c = options.events) !== null && _c !== void 0 ? _c : {},
+        onStart: options.onStart,
+        onStop: options.onStop,
+        meta: {
+            kind: GITLAB_CHANNEL_KIND,
+            gitlabWebhookEvents: deriveGitLabWebhookEvents(channelOptions),
+        },
+        routes: [
+            POST(routePath, {
+                bodySchema: z.unknown(),
+                description: "GitLab webhook ingress",
+                handler: (request, args) => __awaiter(this, void 0, void 0, function* () {
+                    return handleGitLabWebhookRequest({
+                        options: channelOptions,
+                        request,
+                        args,
+                        proxy,
+                    });
+                }),
+            }),
+        ],
+    });
+    gitlabChannelOptionsByDefinition.set(definition, channelOptions);
+    if (cursorAccount !== undefined) {
+        registerGitLabCursorAccountRuntime(definition, Object.assign({ options: channelOptions }, cursorAccount));
+    }
+    attachHostedAdmissionAdapter(definition, {
+        kind: GITLAB_CHANNEL_KIND,
+        prepareArgs: withPropagatingBackgroundErrors,
+        dispatch: (_a) => __awaiter(this, [_a], void 0, function* ({ eventType, payload, deliveryId, args }) {
+            const delivery = parseGitLabWebhookPayload(payload, eventType);
+            if (delivery === null) {
+                return Response.json({ ok: false, error: "invalid_gitlab_payload" }, { status: 400 });
+            }
+            delivery.deliveryId = deliveryId;
+            return dispatchGitLabWebhook({
+                options: channelOptions,
+                delivery,
+                args,
+                proxy,
+            });
+        }),
+    });
+    return definition;
+}
+export function findGitLabChannelTargets(mounts) {
+    var _a, _b, _c;
+    const targets = [];
+    for (const { slug, project } of mounts) {
+        for (const channel of project.channels) {
+            const meta = channel.definition.meta;
+            if ((meta === null || meta === void 0 ? void 0 : meta.kind) !== GITLAB_CHANNEL_KIND) {
+                continue;
+            }
+            const postRoute = ((_a = channel.definition.routes) !== null && _a !== void 0 ? _a : []).find((route) => route.method === "POST");
+            targets.push({
+                slug,
+                channelId: channel.id,
+                routePath: (_b = postRoute === null || postRoute === void 0 ? void 0 : postRoute.path) !== null && _b !== void 0 ? _b : "/",
+                events: [...((_c = meta.gitlabWebhookEvents) !== null && _c !== void 0 ? _c : [])],
+            });
+        }
+    }
+    return targets;
+}