@cursor/july 0.1.102 → 0.1.104

package/dist/channels/gitlab/checks.js

@@ -0,0 +1,126 @@
+/**
+ * GitLab commit statuses — the GitLab {@link CiCheckWriter} behind the shared
+ * check lifecycle in `../checks.js`.
+ *
+ * GitLab has no Checks API; the merge-request widget shows **commit
+ * statuses** (`POST /projects/:id/statuses/:sha`, one row per `name`). The
+ * writer maps the shared status / conclusion pair onto GitLab's state set
+ * and re-posts the full desired state on every write, so `resumeGitLabCheck`
+ * needs only `(project, sha, name)` to rebuild a handle after a restart.
+ *
+ * Posting needs a token with `api` scope (Developer role or above); through
+ * the SCM proxy that is the tenant's project / host credential.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { openCiCheck, resumeCiCheck, } from "../checks.js";
+import { gitlabProjectPathSegment } from "./api.js";
+const DESCRIPTION_MAX_CHARS = 255;
+/** Post one commit status. Throws `GitLabApiError` on API failure. */
+export function setGitLabCommitStatus(gitlab, input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return yield gitlab.request({
+            method: "POST",
+            path: `/projects/${gitlabProjectPathSegment(input.project)}/statuses/${encodeURIComponent(input.sha)}`,
+            body: Object.assign(Object.assign(Object.assign({ state: input.state, name: input.name }, (input.targetUrl === undefined ? {} : { target_url: input.targetUrl })), (input.description === undefined
+                ? {}
+                : { description: input.description.slice(0, DESCRIPTION_MAX_CHARS) })), (input.pipelineId === undefined
+                ? {}
+                : { pipeline_id: input.pipelineId })),
+        });
+    });
+}
+/** Shared check status / conclusion → GitLab commit status state. */
+export function gitlabCommitStatusState(input) {
+    if (input.status === "queued") {
+        return "pending";
+    }
+    if (input.status === "in_progress") {
+        return "running";
+    }
+    switch (input.conclusion) {
+        case "success":
+        case "neutral":
+        case "skipped":
+            return "success";
+        case "cancelled":
+            return "canceled";
+        case "failure":
+        case "action_required":
+        case "timed_out":
+        case undefined:
+            return "failed";
+    }
+}
+/**
+ * GitLab writer: every write re-posts the status row for `(sha, name)`, and
+ * a commit status has no partial update, so the writer carries the last
+ * status, details link, and title forward when a write omits them.
+ */
+function gitlabCheckWriter(input) {
+    var _a;
+    let lastStatus = (_a = input.status) !== null && _a !== void 0 ? _a : "in_progress";
+    let lastUrl = input.url;
+    let lastTitle = input.title;
+    return (write) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        var _b, _c, _d;
+        const status = (_b = write.status) !== null && _b !== void 0 ? _b : (write.conclusion === undefined ? lastStatus : "completed");
+        lastStatus = status;
+        lastUrl = (_c = write.detailsUrl) !== null && _c !== void 0 ? _c : lastUrl;
+        lastTitle = (_d = (_a = write.output) === null || _a === void 0 ? void 0 : _a.title) !== null && _d !== void 0 ? _d : lastTitle;
+        const posted = yield setGitLabCommitStatus(input.gitlab, {
+            project: input.project,
+            sha: input.sha,
+            name: input.name,
+            state: gitlabCommitStatusState({ status, conclusion: write.conclusion }),
+            targetUrl: lastUrl,
+            description: lastTitle,
+            pipelineId: input.pipelineId,
+        });
+        return Object.assign(Object.assign({}, (typeof (posted === null || posted === void 0 ? void 0 : posted.id) === "number" ? { id: posted.id } : {})), (typeof (posted === null || posted === void 0 ? void 0 : posted.target_url) === "string"
+            ? { url: posted.target_url }
+            : {}));
+    });
+}
+/**
+ * Open a commit status on `sha` and return a handle for later updates.
+ *
+ * ```ts
+ * const check = await createGitLabCheck({
+ *   gitlab: ctx.gitlab,
+ *   project: ctx.project.id,
+ *   name: "cursor/security-review",
+ *   sha: mergeRequest.headSha,
+ *   detailsUrl: sessionUrl,
+ *   output: { title: "Running…", summary: "" },
+ * });
+ * await check.conclude({ conclusion: "success", output: { title: "Clean", summary: "" } });
+ * ```
+ */
+export function createGitLabCheck(input) {
+    return openCiCheck(gitlabCheckWriter(input), input);
+}
+/**
+ * Rebuild a {@link GitLabCheck} handle for an existing status row from its
+ * identity. No API call is made until the first update.
+ */
+export function resumeGitLabCheck(input) {
+    return resumeCiCheck(gitlabCheckWriter(input), input.id === undefined ? undefined : { id: input.id });
+}
+/**
+ * Project-bound checks adapter satisfying the shared {@link CiChecksClient}
+ * contract for forge-agnostic check code.
+ */
+export function bindGitLabChecks(input) {
+    return {
+        createCheck: (check) => createGitLabCheck(Object.assign(Object.assign({}, check), { gitlab: input.gitlab, project: input.project })),
+    };
+}

package/dist/channels/gitlab/cursor-account.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Cursor-account mode for GitLab channels.
+ *
+ * `gitlabChannel({ cursorAccount })` declares that outbound GitLab calls run
+ * through the Cursor SCM proxy (`/v0/gitlab-proxy`) with the tenant's
+ * credential swapped in server-side. The serve host binds the Cursor API key
+ * and the proxy transport at startup when `--cursor-scm-proxy` is set; until
+ * then `ctx.gitlab` falls back to direct `GITLAB_TOKEN` access.
+ */
+import type { GitLabProxyTransport } from "./api.js";
+import type { GitLabChannelOptions } from "./types.js";
+export declare const CURSOR_GITLAB_MAX_PROJECTS = 20;
+export interface CursorGitLabProjectScope {
+    /** Lowercased `group/project` paths. */
+    projects: readonly string[];
+}
+/** Host-bound credential: Cursor API key + proxy transport, bound at serve. */
+export interface PendingCursorGitLabCredentials {
+    bind(getApiKey: () => Promise<string>): void;
+    bindProxyTransport(transport: Omit<GitLabProxyTransport, "getApiKey">): void;
+    /** The full proxy transport once both halves are bound. */
+    getProxyTransport(): GitLabProxyTransport | undefined;
+}
+export interface GitLabCursorAccountRuntime {
+    /** Authored channel options (not rewritten). */
+    options: GitLabChannelOptions;
+    credentials: PendingCursorGitLabCredentials;
+    scope: CursorGitLabProjectScope | undefined;
+}
+export declare function parseCursorGitLabProjectScope(values: readonly string[]): CursorGitLabProjectScope;
+export declare function createPendingCursorGitLabCredentials(): PendingCursorGitLabCredentials;
+/** GitLab-proxy base URL (`/v0/gitlab-proxy`, `AGENT_SERVE_GITLAB_PROXY_URL`). */
+export declare function resolveCursorGitLabProxyUrl(backendBaseUrl: string): string;
+export declare function registerGitLabCursorAccountRuntime(definition: object, runtime: GitLabCursorAccountRuntime): void;
+export declare function getGitLabCursorAccountRuntime(definition: object): GitLabCursorAccountRuntime | undefined;
+//# sourceMappingURL=cursor-account.d.ts.map

package/dist/channels/gitlab/cursor-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-account.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/cursor-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAI7C,MAAM,WAAW,wBAAwB;IACvC,wCAAwC;IACxC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,+EAA+E;AAC/E,MAAM,WAAW,8BAA8B;IAC7C,IAAI,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7C,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;IAC7E,2DAA2D;IAC3D,iBAAiB,IAAI,oBAAoB,GAAG,SAAS,CAAC;CACvD;AAED,MAAM,WAAW,0BAA0B;IACzC,gDAAgD;IAChD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,WAAW,EAAE,8BAA8B,CAAC;IAC5C,KAAK,EAAE,wBAAwB,GAAG,SAAS,CAAC;CAC7C;AAID,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,wBAAwB,CAkC1B;AAED,wBAAgB,oCAAoC,IAAI,8BAA8B,CAiBrF;AAED,kFAAkF;AAClF,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,GAClC,IAAI,CAEN;AAED,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,GACjB,0BAA0B,GAAG,SAAS,CAExC"}

package/dist/channels/gitlab/cursor-account.js

@@ -0,0 +1,65 @@
+/**
+ * Cursor-account mode for GitLab channels.
+ *
+ * `gitlabChannel({ cursorAccount })` declares that outbound GitLab calls run
+ * through the Cursor SCM proxy (`/v0/gitlab-proxy`) with the tenant's
+ * credential swapped in server-side. The serve host binds the Cursor API key
+ * and the proxy transport at startup when `--cursor-scm-proxy` is set; until
+ * then `ctx.gitlab` falls back to direct `GITLAB_TOKEN` access.
+ */
+import { resolveCursorScmProxyUrl } from "../github/cursor-account.js";
+export const CURSOR_GITLAB_MAX_PROJECTS = 20;
+/** `group/project`, with nested groups (`group/sub/project`). */
+const CURSOR_GITLAB_PROJECT_PATTERN = /^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)+$/;
+const runtimeByDefinition = new WeakMap();
+export function parseCursorGitLabProjectScope(values) {
+    const projects = [
+        ...new Set(values
+            .map((project) => project
+            .trim()
+            .replace(/^\/+|\/+$/g, "")
+            .toLowerCase())
+            .filter(Boolean)),
+    ];
+    if (projects.length === 0) {
+        throw new Error("gitlabChannel({ cursorAccount }) requires at least one project.");
+    }
+    if (projects.length > CURSOR_GITLAB_MAX_PROJECTS) {
+        throw new Error(`gitlabChannel({ cursorAccount }) supports at most ${CURSOR_GITLAB_MAX_PROJECTS} projects.`);
+    }
+    for (const project of projects) {
+        if (!CURSOR_GITLAB_PROJECT_PATTERN.test(project) ||
+            project.includes("..")) {
+            throw new Error(`Invalid GitLab project "${project}"; expected group/project.`);
+        }
+    }
+    return { projects };
+}
+export function createPendingCursorGitLabCredentials() {
+    let getApiKey;
+    let transport;
+    return {
+        bind(next) {
+            getApiKey = next;
+        },
+        bindProxyTransport(next) {
+            transport = next;
+        },
+        getProxyTransport() {
+            if (getApiKey === undefined || transport === undefined) {
+                return undefined;
+            }
+            return Object.assign(Object.assign({}, transport), { getApiKey });
+        },
+    };
+}
+/** GitLab-proxy base URL (`/v0/gitlab-proxy`, `AGENT_SERVE_GITLAB_PROXY_URL`). */
+export function resolveCursorGitLabProxyUrl(backendBaseUrl) {
+    return resolveCursorScmProxyUrl("gitlab", backendBaseUrl);
+}
+export function registerGitLabCursorAccountRuntime(definition, runtime) {
+    runtimeByDefinition.set(definition, runtime);
+}
+export function getGitLabCursorAccountRuntime(definition) {
+    return runtimeByDefinition.get(definition);
+}

package/dist/channels/gitlab/defaults.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Default dispatch decisions for the GitLab channel: turn auth derived from
+ * the delivery's actor, the title / message a turn starts with, and which
+ * merge-request actions dispatch when no `onMergeRequest` hook is declared.
+ */
+import type { AuthContext } from "../../types.js";
+import type { GitLabEventContext, GitLabMergeRequestEvent, GitLabTurnDispatch } from "./types.js";
+type DispatchContext = Omit<GitLabEventContext, "host" | "artifacts" | "gitlab" | "send">;
+/**
+ * Derive the turn's auth from the actor that triggered the delivery — the
+ * standard `{ auth: defaultGitLabAuth(ctx) }` dispatch from an inbound hook.
+ * The subscriber's Cursor identity is not the turn principal (same pattern
+ * as `defaultGitHubAuth` / `defaultOriginAuth`).
+ */
+export declare function defaultGitLabAuth(ctx: DispatchContext): AuthContext;
+export declare function defaultGitLabTitle(ctx: Pick<GitLabEventContext, "project" | "mergeRequestIid" | "eventType">): string;
+export declare function defaultGitLabMergeRequestMessage(ctx: DispatchContext, mergeRequest: GitLabMergeRequestEvent): string;
+/**
+ * Default gate when no `onMergeRequest` hook is declared: a new or reopened
+ * merge request, or an `update` that pushed commits (`oldrev` present —
+ * title / label edits carry no `oldrev`), starts a turn as the actor.
+ */
+export declare function defaultGitLabMergeRequestDispatch(ctx: DispatchContext, mergeRequest: GitLabMergeRequestEvent): GitLabTurnDispatch | null;
+export {};
+//# sourceMappingURL=defaults.d.ts.map

package/dist/channels/gitlab/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/defaults.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,KAAK,eAAe,GAAG,IAAI,CACzB,kBAAkB,EAClB,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,CACzC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,WAAW,CAmBnE;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,GAAG,iBAAiB,GAAG,WAAW,CAAC,GACzE,MAAM,CAIR;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,eAAe,EACpB,YAAY,EAAE,uBAAuB,GACpC,MAAM,CAgBR;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,eAAe,EACpB,YAAY,EAAE,uBAAuB,GACpC,kBAAkB,GAAG,IAAI,CAU3B"}

package/dist/channels/gitlab/defaults.js

@@ -0,0 +1,60 @@
+/**
+ * Default dispatch decisions for the GitLab channel: turn auth derived from
+ * the delivery's actor, the title / message a turn starts with, and which
+ * merge-request actions dispatch when no `onMergeRequest` hook is declared.
+ */
+/**
+ * Derive the turn's auth from the actor that triggered the delivery — the
+ * standard `{ auth: defaultGitLabAuth(ctx) }` dispatch from an inbound hook.
+ * The subscriber's Cursor identity is not the turn principal (same pattern
+ * as `defaultGitHubAuth` / `defaultOriginAuth`).
+ */
+export function defaultGitLabAuth(ctx) {
+    const sender = ctx.sender;
+    const host = new URL(ctx.project.webUrl).host;
+    return {
+        authenticator: "gitlab-webhook",
+        principalId: sender === undefined ? "gitlab" : String(sender.id),
+        principalType: "user",
+        attributes: Object.assign(Object.assign(Object.assign({ conversation_kind: ctx.mergeRequestIid === undefined ? ctx.eventType : "merge_request", project: ctx.project.pathWithNamespace, project_id: String(ctx.project.id) }, (ctx.deliveryId === undefined ? {} : { delivery_id: ctx.deliveryId })), (sender === undefined
+            ? {}
+            : { subject: String(sender.id), username: sender.username })), { issuer: `gitlab:${host}` }),
+    };
+}
+export function defaultGitLabTitle(ctx) {
+    return ctx.mergeRequestIid === undefined
+        ? `GitLab ${ctx.project.pathWithNamespace} ${ctx.eventType}`
+        : `GitLab ${ctx.project.pathWithNamespace}!${ctx.mergeRequestIid}`;
+}
+export function defaultGitLabMergeRequestMessage(ctx, mergeRequest) {
+    var _a;
+    const head = mergeRequest.sourceBranch !== undefined &&
+        mergeRequest.headSha !== undefined
+        ? `Head: ${mergeRequest.sourceBranch} (${mergeRequest.headSha})`
+        : undefined;
+    return [
+        `GitLab merge request trigger: ${ctx.project.pathWithNamespace}!${mergeRequest.iid}`,
+        `Action: ${(_a = mergeRequest.action) !== null && _a !== void 0 ? _a : "unknown"}`,
+        `URL: ${mergeRequest.url}`,
+        ...(mergeRequest.title === undefined
+            ? []
+            : [`Title: ${mergeRequest.title}`]),
+        ...(head === undefined ? [] : [head]),
+        "Handle this merge request event.",
+    ].join("\n");
+}
+/**
+ * Default gate when no `onMergeRequest` hook is declared: a new or reopened
+ * merge request, or an `update` that pushed commits (`oldrev` present —
+ * title / label edits carry no `oldrev`), starts a turn as the actor.
+ */
+export function defaultGitLabMergeRequestDispatch(ctx, mergeRequest) {
+    const action = mergeRequest.action;
+    const dispatches = action === "open" ||
+        action === "reopen" ||
+        (action === "update" && mergeRequest.oldrev !== undefined);
+    if (!dispatches) {
+        return null;
+    }
+    return { auth: defaultGitLabAuth(ctx) };
+}

package/dist/channels/gitlab/events.d.ts

@@ -0,0 +1,12 @@
+/** {@link ChannelMeta.kind} value used by {@link gitlabChannel}. */
+export declare const GITLAB_CHANNEL_KIND = "gitlab";
+export interface GitLabWebhookEventOptions {
+    webhookEvents?: readonly string[];
+    onMergeRequest?: unknown;
+    onNote?: unknown;
+    onPush?: unknown;
+    onPipeline?: unknown;
+    onTagPush?: unknown;
+}
+export declare function deriveGitLabWebhookEvents(options: GitLabWebhookEventOptions): string[];
+//# sourceMappingURL=events.d.ts.map

package/dist/channels/gitlab/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/events.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAgB5C,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,yBAAyB,GACjC,MAAM,EAAE,CAeV"}

package/dist/channels/gitlab/events.js

@@ -0,0 +1,28 @@
+/** {@link ChannelMeta.kind} value used by {@link gitlabChannel}. */
+export const GITLAB_CHANNEL_KIND = "gitlab";
+/**
+ * GitLab `object_kind` values (the `X-Gitlab-Event` payload discriminator)
+ * each authored hook subscribes to. `merge_request` is always declared: it
+ * is the default dispatch when no `onMergeRequest` hook exists.
+ */
+const HOOK_EVENTS = [
+    ["onMergeRequest", "merge_request"],
+    ["onNote", "note"],
+    ["onPush", "push"],
+    ["onPipeline", "pipeline"],
+    ["onTagPush", "tag_push"],
+];
+export function deriveGitLabWebhookEvents(options) {
+    if (options.webhookEvents !== undefined) {
+        return [
+            ...new Set(options.webhookEvents.map((event) => event.trim()).filter(Boolean)),
+        ];
+    }
+    const events = ["merge_request"];
+    for (const [hook, objectKind] of HOOK_EVENTS) {
+        if (options[hook] !== undefined) {
+            events.push(objectKind);
+        }
+    }
+    return [...new Set(events)];
+}

package/dist/channels/gitlab/gitlab-channel.d.ts

@@ -0,0 +1,33 @@
+import type { ChannelDefinition } from "../../types.js";
+import { type GitLabChannelState } from "./state.js";
+import type { GitLabChannelOptions } from "./types.js";
+export declare function getGitLabChannelOptions(definition: object): GitLabChannelOptions | undefined;
+export declare function gitlabChannel(options?: GitLabChannelOptions): ChannelDefinition<GitLabChannelState>;
+/** Minimal mount shape shared by `serve` / the `gitlab` CLI. */
+export interface GitLabAgentMountLike {
+    slug: string;
+    project: {
+        channels: Array<{
+            id: string;
+            definition: {
+                meta?: {
+                    kind?: string;
+                    gitlabWebhookEvents?: readonly string[];
+                };
+                routes?: ReadonlyArray<{
+                    method: string;
+                    path: string;
+                }>;
+            };
+        }>;
+    };
+}
+export interface GitLabChannelTarget {
+    slug: string;
+    channelId: string;
+    /** Route path under the channel (default `/`). */
+    routePath: string;
+    events: string[];
+}
+export declare function findGitLabChannelTargets(mounts: ReadonlyArray<GitLabAgentMountLike>): GitLabChannelTarget[];
+//# sourceMappingURL=gitlab-channel.d.ts.map

package/dist/channels/gitlab/gitlab-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/gitlab-channel.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAaxD,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAOvD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,GACjB,oBAAoB,GAAG,SAAS,CAElC;AAED,wBAAgB,aAAa,CAC3B,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAAC,kBAAkB,CAAC,CAwFvC;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE;QACP,QAAQ,EAAE,KAAK,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,UAAU,EAAE;gBACV,IAAI,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;iBAAE,CAAC;gBAClE,MAAM,CAAC,EAAE,aAAa,CAAC;oBAAE,MAAM,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE,CAAC,CAAC;aAC1D,CAAC;SACH,CAAC,CAAC;KACJ,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,CAAC,oBAAoB,CAAC,GAC1C,mBAAmB,EAAE,CAoBvB"}

package/dist/channels/gitlab/gitlab-channel.js

@@ -0,0 +1,120 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { z } from "zod";
+import { allowAll, defineChannel, localDevStrict, loopbackOnly, POST, } from "../../channels.js";
+import { withPropagatingBackgroundErrors } from "../../internal/channel-dispatch.js";
+import { normalizeIdentity } from "../../internal/continuation-identity.js";
+import { isDevMode } from "../../internal/dev-mode.js";
+import { attachHostedAdmissionAdapter } from "../../internal/hosted-admission-adapter.js";
+import { createPendingCursorGitLabCredentials, parseCursorGitLabProjectScope, registerGitLabCursorAccountRuntime, } from "./cursor-account.js";
+import { deriveGitLabWebhookEvents, GITLAB_CHANNEL_KIND } from "./events.js";
+import { dispatchGitLabWebhook, handleGitLabWebhookRequest, parseGitLabWebhookPayload, resolveGitLabWebhookSecret, } from "./gitlab-webhook.js";
+import { emptyGitLabChannelState } from "./state.js";
+const gitlabChannelOptionsByDefinition = new WeakMap();
+export function getGitLabChannelOptions(definition) {
+    return gitlabChannelOptionsByDefinition.get(definition);
+}
+export function gitlabChannel(options = {}) {
+    var _a, _b, _c;
+    const routePath = (_a = options.path) !== null && _a !== void 0 ? _a : "/";
+    // With a hook secret the `X-Gitlab-Token` compare is the request auth
+    // (allowAll), matching GitHub HMAC + webhookSecret. Without one, prod stays
+    // loopback-strict; `--dev` admits loopback only. `isDevMode()` and the
+    // secret are read per request: channel modules construct at import time.
+    const auth = (_b = options.auth) !== null && _b !== void 0 ? _b : [
+        (request, info) => (resolveGitLabWebhookSecret(options) !== undefined
+            ? allowAll()
+            : isDevMode()
+                ? loopbackOnly()
+                : localDevStrict())(request, info),
+    ];
+    const channelOptions = Object.assign({}, options);
+    if (channelOptions.continuation !== undefined) {
+        channelOptions.continuation = normalizeIdentity(channelOptions.continuation, GITLAB_CHANNEL_KIND);
+    }
+    // `cursorAccount` routes `ctx.gitlab` through the SCM proxy once the serve
+    // host binds the Cursor API key + transport (`--cursor-scm-proxy`).
+    const cursorAccount = options.cursorAccount === undefined || options.cursorAccount === false
+        ? undefined
+        : {
+            credentials: createPendingCursorGitLabCredentials(),
+            scope: typeof options.cursorAccount === "object"
+                ? parseCursorGitLabProjectScope(options.cursorAccount.projects)
+                : undefined,
+        };
+    const proxy = () => cursorAccount === null || cursorAccount === void 0 ? void 0 : cursorAccount.credentials.getProxyTransport();
+    const definition = defineChannel({
+        auth,
+        state: emptyGitLabChannelState(),
+        events: (_c = options.events) !== null && _c !== void 0 ? _c : {},
+        onStart: options.onStart,
+        onStop: options.onStop,
+        meta: {
+            kind: GITLAB_CHANNEL_KIND,
+            gitlabWebhookEvents: deriveGitLabWebhookEvents(channelOptions),
+        },
+        routes: [
+            POST(routePath, {
+                bodySchema: z.unknown(),
+                description: "GitLab webhook ingress",
+                handler: (request, args) => __awaiter(this, void 0, void 0, function* () {
+                    return handleGitLabWebhookRequest({
+                        options: channelOptions,
+                        request,
+                        args,
+                        proxy,
+                    });
+                }),
+            }),
+        ],
+    });
+    gitlabChannelOptionsByDefinition.set(definition, channelOptions);
+    if (cursorAccount !== undefined) {
+        registerGitLabCursorAccountRuntime(definition, Object.assign({ options: channelOptions }, cursorAccount));
+    }
+    attachHostedAdmissionAdapter(definition, {
+        kind: GITLAB_CHANNEL_KIND,
+        prepareArgs: withPropagatingBackgroundErrors,
+        dispatch: (_a) => __awaiter(this, [_a], void 0, function* ({ eventType, payload, deliveryId, args }) {
+            const delivery = parseGitLabWebhookPayload(payload, eventType);
+            if (delivery === null) {
+                return Response.json({ ok: false, error: "invalid_gitlab_payload" }, { status: 400 });
+            }
+            delivery.deliveryId = deliveryId;
+            return dispatchGitLabWebhook({
+                options: channelOptions,
+                delivery,
+                args,
+                proxy,
+            });
+        }),
+    });
+    return definition;
+}
+export function findGitLabChannelTargets(mounts) {
+    var _a, _b, _c;
+    const targets = [];
+    for (const { slug, project } of mounts) {
+        for (const channel of project.channels) {
+            const meta = channel.definition.meta;
+            if ((meta === null || meta === void 0 ? void 0 : meta.kind) !== GITLAB_CHANNEL_KIND) {
+                continue;
+            }
+            const postRoute = ((_a = channel.definition.routes) !== null && _a !== void 0 ? _a : []).find((route) => route.method === "POST");
+            targets.push({
+                slug,
+                channelId: channel.id,
+                routePath: (_b = postRoute === null || postRoute === void 0 ? void 0 : postRoute.path) !== null && _b !== void 0 ? _b : "/",
+                events: [...((_c = meta.gitlabWebhookEvents) !== null && _c !== void 0 ? _c : [])],
+            });
+        }
+    }
+    return targets;
+}

package/dist/channels/gitlab/gitlab-webhook.d.ts

@@ -0,0 +1,45 @@
+import type { ChannelHandlerArgs } from "../../types.js";
+import type { GitLabProxyTransport } from "./api.js";
+import type { GitLabChannelOptions, GitLabEventContext, GitLabWebhookDelivery } from "./types.js";
+/** `GITLAB_WEBHOOK_SECRET` fallback for {@link GitLabChannelOptions.webhookSecret}. */
+export declare function envGitLabWebhookSecret(): string | undefined;
+export declare function resolveGitLabWebhookSecret(options: Pick<GitLabChannelOptions, "webhookSecret">): string | undefined;
+/**
+ * GitLab sends the hook's secret verbatim in `X-Gitlab-Token` (no HMAC).
+ * Constant-time compare so a reachable URL leaks nothing about the secret.
+ */
+export declare function verifyGitLabWebhookToken(headerValue: string | null | undefined, secret: string): boolean;
+/**
+ * Accept a raw GitLab payload. `object_kind` is the event discriminator;
+ * hosted admission passes the envelope's event type, which wins when set.
+ */
+export declare function parseGitLabWebhookPayload(payload: unknown, eventType?: string): GitLabWebhookDelivery | null;
+export declare function parseGitLabEventContext(delivery: GitLabWebhookDelivery): Omit<GitLabEventContext, "host" | "artifacts" | "gitlab" | "send"> | null;
+/**
+ * Run the authored hooks for one GitLab delivery and `send()` the turn.
+ * Callers own delivery auth: the HTTP route compares `X-Gitlab-Token`;
+ * hosted admission arrives verified. The v2 mailbox is stamped upstream
+ * (local CP or hosted ingress), never here.
+ */
+export declare function dispatchGitLabWebhook(input: {
+    options: GitLabChannelOptions;
+    delivery: GitLabWebhookDelivery;
+    args: ChannelHandlerArgs;
+    /** Host-bound SCM-proxy transport (`cursorAccount` + `--cursor-scm-proxy`). */
+    proxy?: () => GitLabProxyTransport | undefined;
+}): Promise<Response>;
+/**
+ * HTTP entry for a single agent's GitLab channel: `X-Gitlab-Token` compare
+ * when a secret is configured, then {@link dispatchGitLabWebhook}. Without
+ * a secret the route auth owns admission (`serve --dev` admits loopback
+ * only; production stays loopback-strict).
+ */
+export declare function handleGitLabWebhookRequest(input: {
+    options: GitLabChannelOptions;
+    request: Request;
+    args: ChannelHandlerArgs;
+    /** When true, skip the token compare even if a secret is configured. */
+    skipSignatureVerification?: boolean;
+    proxy?: () => GitLabProxyTransport | undefined;
+}): Promise<Response>;
+//# sourceMappingURL=gitlab-webhook.d.ts.map

package/dist/channels/gitlab/gitlab-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab-webhook.d.ts","sourceRoot":"","sources":["../../../src/channels/gitlab/gitlab-webhook.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAEV,kBAAkB,EAEnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAuBrD,OAAO,KAAK,EACV,oBAAoB,EAEpB,kBAAkB,EAOlB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAEpB,uFAAuF;AACvF,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAG3D;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,GACnD,MAAM,GAAG,SAAS,CASpB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAST;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,qBAAqB,GAAG,IAAI,CAU9B;AA2CD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,qBAAqB,GAC9B,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,CAAC,GAAG,IAAI,CA+B3E;AAiKD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,IAAI,EAAE,kBAAkB,CAAC;IACzB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,oBAAoB,GAAG,SAAS,CAAC;CAChD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkJpB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,wEAAwE;IACxE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,oBAAoB,GAAG,SAAS,CAAC;CAChD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCpB"}