@openma/matter-gitlab 0.0.0-stage → 0.1.0

package/dist/bond/index.js

@@ -0,0 +1,638 @@
+import { ProviderError } from "@openma/matter/bond";
+import { Effect } from "effect";
+//#region src/bond/http.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* Normalizes a GitLab instance URL to its canonical https origin. Rejects
+* plain http except for loopback hosts, and rejects paths, credentials,
+* queries, and fragments.
+*/
+const canonicalOrigin = (input) => {
+	const url = new URL(input);
+	const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) throw new Error("GitLab instance URL must use https");
+	if (url.username || url.password || url.search || url.hash) throw new Error("GitLab instance URL must not carry credentials, query, or fragment");
+	if (url.pathname !== "/" && url.pathname !== "") throw new Error("GitLab instance URL must be an origin without a path");
+	return url.origin.toLowerCase();
+};
+/** One JSON request. Never follows redirects: a redirect is an error. */
+const requestJson = (fetchImpl, url, init) => Effect.tryPromise({
+	try: async () => {
+		const response = await fetchImpl(url, {
+			...init,
+			redirect: "manual"
+		});
+		const text = await response.text();
+		let body = void 0;
+		if (text.length > 0) try {
+			body = JSON.parse(text);
+		} catch {
+			body = void 0;
+		}
+		return {
+			status: response.status,
+			body
+		};
+	},
+	catch: (cause) => new ProviderError({
+		message: `GitLab request failed: ${new URL(url).pathname}`,
+		rejected: false,
+		cause
+	})
+});
+const bearer = (token) => ({ authorization: `Bearer ${token}` });
+/**
+* Maps a non-2xx GitLab response to a ProviderError without echoing bodies.
+* Only OAuth `invalid_grant` is a rejection, the one answer that means the
+* grant itself is gone. `invalid_client`, other 4xx, and 5xx are
+* configuration or transport problems and must not end a link.
+*/
+const statusError = (what, response) => {
+	const error = isRecord(response.body) && typeof response.body.error === "string" ? response.body.error : void 0;
+	return new ProviderError({
+		message: `${what} failed with HTTP ${response.status}${error === void 0 ? "" : ` (${error})`}`,
+		rejected: error === "invalid_grant",
+		status: response.status
+	});
+};
+//#endregion
+//#region src/bond/oauth.ts
+const base64url = (bytes) => {
+	let binary = "";
+	for (const b of bytes) binary += String.fromCharCode(b);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+/**
+* Reads OIDC discovery and requires authorization code with PKCE S256 and
+* refresh tokens, and an issuer equal to the instance origin. Device flow is
+* recorded when present; GitLab can disable it per instance.
+*/
+const discoverInstance = (origin, fetchImpl = globalThis.fetch) => Effect.gen(function* () {
+	const canonical = yield* Effect.try({
+		try: () => canonicalOrigin(origin),
+		catch: (cause) => new ProviderError({
+			message: cause instanceof Error ? cause.message : "Invalid origin",
+			rejected: true,
+			cause
+		})
+	});
+	const response = yield* requestJson(fetchImpl, `${canonical}/.well-known/openid-configuration`, {
+		method: "GET",
+		headers: { accept: "application/json" }
+	});
+	if (response.status !== 200 || !isRecord(response.body)) return yield* Effect.fail(statusError("OIDC discovery", response));
+	const d = response.body;
+	const list = (key) => Array.isArray(d[key]) ? d[key].filter((v) => typeof v === "string") : [];
+	const problems = [];
+	if (typeof d.issuer !== "string" || d.issuer.replace(/\/$/, "").toLowerCase() !== canonical) problems.push("issuer does not match the instance origin");
+	if (!list("code_challenge_methods_supported").includes("S256")) problems.push("PKCE S256 is not supported");
+	if (!list("grant_types_supported").includes("refresh_token")) problems.push("refresh_token grant is not supported");
+	if (typeof d.authorization_endpoint !== "string" || typeof d.token_endpoint !== "string") problems.push("authorization or token endpoint is missing");
+	if (problems.length > 0) return yield* Effect.fail(new ProviderError({
+		message: `GitLab instance is not usable: ${problems.join("; ")}`,
+		rejected: true
+	}));
+	return {
+		origin: canonical,
+		deviceFlow: typeof d.device_authorization_endpoint === "string"
+	};
+});
+/** A fresh PKCE verifier and its S256 challenge. Keep the verifier server-side. */
+const createPkce = () => Effect.promise(async () => {
+	const verifier = base64url(globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(48)));
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return {
+		verifier,
+		challenge: base64url(new Uint8Array(digest)),
+		method: "S256"
+	};
+});
+const authorizationUrl = (input) => `${canonicalOrigin(input.origin)}/oauth/authorize?${new URLSearchParams({
+	client_id: input.clientId,
+	redirect_uri: input.redirectUri,
+	response_type: "code",
+	scope: input.scopes.join(" "),
+	state: input.state,
+	code_challenge: input.codeChallenge,
+	code_challenge_method: "S256"
+}).toString()}`;
+const tokenGrant = (body, now) => {
+	if (!isRecord(body) || typeof body.access_token !== "string") return void 0;
+	const createdMs = typeof body.created_at === "number" ? body.created_at * 1e3 : Date.parse(now);
+	return {
+		accessToken: body.access_token,
+		...typeof body.refresh_token === "string" ? { refreshToken: body.refresh_token } : {},
+		...typeof body.expires_in === "number" ? { accessExpiresAt: new Date(createdMs + body.expires_in * 1e3).toISOString() } : {},
+		...typeof body.scope === "string" ? { scopes: body.scope.split(" ").filter(Boolean) } : {}
+	};
+};
+const postToken = (client, what, params) => Effect.gen(function* () {
+	const origin = canonicalOrigin(client.origin);
+	const now = (client.clock ?? (() => (/* @__PURE__ */ new Date()).toISOString()))();
+	const response = yield* requestJson(client.fetch ?? globalThis.fetch, `${origin}/oauth/token`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json"
+		},
+		body: new URLSearchParams({
+			...params,
+			client_id: client.clientId,
+			...client.clientSecret === void 0 ? {} : { client_secret: client.clientSecret }
+		}).toString()
+	});
+	const grant = response.status === 200 ? tokenGrant(response.body, now) : void 0;
+	if (grant === void 0) return yield* Effect.fail(statusError(what, response));
+	return grant;
+});
+/** Exchanges an authorization code. A wrong verifier does not consume the code on GitLab. */
+const exchangeCode = (client, input) => postToken(client, "Authorization code exchange", {
+	grant_type: "authorization_code",
+	code: input.code,
+	redirect_uri: input.redirectUri,
+	code_verifier: input.codeVerifier
+});
+/**
+* Refreshes a user token. GitLab rotates both tokens and invalidates the old
+* access token immediately, and does not detect refresh-token reuse, so the
+* caller must hold the Bond refresh lease.
+*/
+const refreshAccessToken = (client, refreshToken) => postToken(client, "Token refresh", {
+	grant_type: "refresh_token",
+	refresh_token: refreshToken
+});
+/**
+* Revokes one access or refresh token. GitLab (Doorkeeper) stores an access
+* token and its refresh token as one record, so revoking either ends that
+* pair only. Other tokens the same user holds for the same application keep
+* working: on a live instance, revoking the previous token after a relink left
+* the new one valid.
+*/
+const revokeToken = (client, token) => Effect.gen(function* () {
+	const origin = canonicalOrigin(client.origin);
+	const response = yield* requestJson(client.fetch ?? globalThis.fetch, `${origin}/oauth/revoke`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			token,
+			client_id: client.clientId,
+			...client.clientSecret === void 0 ? {} : { client_secret: client.clientSecret }
+		}).toString()
+	});
+	if (response.status !== 200) return yield* Effect.fail(statusError("Token revocation", response));
+});
+//#endregion
+//#region src/bond/tokens.ts
+const api = (origin, path) => `${canonicalOrigin(origin)}/api/v4${path}`;
+const readUser = (origin, token, fetchImpl = globalThis.fetch) => Effect.gen(function* () {
+	const response = yield* requestJson(fetchImpl, api(origin, "/user"), {
+		method: "GET",
+		headers: {
+			...bearer(token),
+			accept: "application/json"
+		}
+	});
+	const b = response.body;
+	if (response.status !== 200 || !isRecord(b) || typeof b.id !== "number") return yield* Effect.fail(statusError("Reading the GitLab user", response));
+	const identities = Array.isArray(b.identities) ? b.identities.flatMap((i) => isRecord(i) && typeof i.provider === "string" && typeof i.extern_uid === "string" ? [{
+		provider: i.provider,
+		externUid: i.extern_uid
+	}] : []) : [];
+	return {
+		id: String(b.id),
+		username: typeof b.username === "string" ? b.username : "",
+		name: typeof b.name === "string" ? b.name : "",
+		...typeof b.commit_email === "string" && b.commit_email.length > 0 ? { commitEmail: b.commit_email } : {},
+		bot: b.bot === true,
+		identities
+	};
+});
+const readTokenInfo = (origin, token, fetchImpl = globalThis.fetch) => Effect.gen(function* () {
+	const response = yield* requestJson(fetchImpl, api(origin, "/personal_access_tokens/self"), {
+		method: "GET",
+		headers: {
+			...bearer(token),
+			accept: "application/json"
+		}
+	});
+	const b = response.body;
+	if (response.status !== 200 || !isRecord(b) || typeof b.id !== "number") return yield* Effect.fail(statusError("Reading token metadata", response));
+	return {
+		id: String(b.id),
+		name: typeof b.name === "string" ? b.name : "",
+		active: b.active === true,
+		revoked: b.revoked === true,
+		scopes: Array.isArray(b.scopes) ? b.scopes.filter((s) => typeof s === "string") : [],
+		...typeof b.expires_at === "string" ? { expiresAt: b.expires_at } : {},
+		userId: String(b.user_id)
+	};
+});
+/** `DELETE /api/v4/personal_access_tokens/self`: a token revokes itself. */
+const revokeSelfToken = (origin, token, fetchImpl = globalThis.fetch) => Effect.gen(function* () {
+	const response = yield* requestJson(fetchImpl, api(origin, "/personal_access_tokens/self"), {
+		method: "DELETE",
+		headers: bearer(token)
+	});
+	if (response.status !== 204 && response.status !== 200) return yield* Effect.fail(statusError("Token self-revocation", response));
+});
+/** End of the UTC expiry day, which is when GitLab stops accepting the token. */
+const tokenExpiryInstant = (expiresAt) => (/* @__PURE__ */ new Date(`${expiresAt}T23:59:59.999Z`)).toISOString();
+const commonProblems = (info, user, policy) => {
+	const problems = [];
+	if (info.userId !== user.id) problems.push("user_mismatch");
+	if (info.revoked) problems.push("revoked");
+	if (!info.active) problems.push("inactive");
+	if (info.scopes.some((s) => !policy.allowedScopes.includes(s))) problems.push("scope_not_allowed");
+	if (info.expiresAt === void 0) problems.push("no_expiry");
+	else {
+		const end = Date.parse(tokenExpiryInstant(info.expiresAt));
+		const now = Date.parse(policy.now);
+		if (end <= now) problems.push("expired");
+		else if (end - now > (policy.maxLifetimeDays + 1) * 24 * 60 * 6e4) problems.push("lifetime_exceeded");
+	}
+	return problems;
+};
+/**
+* Checks a pasted personal access token: active, scopes within the allowed
+* set, an expiry within the maximum lifetime, and a human owner.
+*/
+const validatePersonalAccessToken = (info, user, policy) => [...commonProblems(info, user, policy), ...user.bot ? ["is_a_bot"] : []];
+/**
+* Checks a bot credential registered as an Installation: the same token
+* checks, plus `bot: true` on its user. A human account's token is never
+* accepted as an app principal.
+*/
+const validateBotCredential = (info, user, policy) => [...commonProblems(info, user, policy), ...user.bot ? [] : ["not_a_bot"]];
+//#endregion
+//#region src/bond/classify.ts
+const deny = (reason) => ({
+	allow: false,
+	reason
+});
+const normalizePath = (raw) => {
+	let decoded;
+	try {
+		decoded = decodeURIComponent(raw);
+	} catch {
+		return;
+	}
+	const path = decoded.replace(/\.git$/i, "").replace(/^\/+|\/+$/g, "").toLowerCase();
+	const segments = path.split("/");
+	if (segments.length < 2 || segments.some((s) => s === "" || s === "." || s === ".." || !/^[\w.-]+$/.test(s))) return;
+	return path;
+};
+const projectRefOf = (raw) => /^\d+$/.test(raw) ? {
+	kind: "id",
+	id: Number(raw)
+} : (() => {
+	const path = normalizePath(raw);
+	return path === void 0 ? void 0 : {
+		kind: "path",
+		path
+	};
+})();
+/**
+* REST reads, by exact shape. A branch name may carry encoded slashes
+* (`feature%2Fx`), and nothing else is percent-encoded.
+*/
+const READ_TAILS = [
+	/^$/,
+	/^\/merge_requests$/,
+	/^\/merge_requests\/\d+(\/(notes|commits|changes|diffs|approvals))?$/,
+	/^\/repository\/branches$/,
+	/^\/repository\/branches\/([\w.-]|%2[fF])+$/,
+	/^\/repository\/commits$/,
+	/^\/repository\/commits\/[0-9a-f]{7,64}$/
+];
+const GIT_ROUTE = /^\/(.+?)(?:\.git)?\/(info\/refs|git-upload-pack|git-receive-pack)$/i;
+/**
+* Classifies one request in GitLab's own URL shape. Allows git smart HTTP
+* fetch and push, REST reads of a project, merge request creation, and
+* merge request notes. Denies GraphQL, LFS, archives, raw files, and every
+* other route.
+*/
+const classifyGitLabRequest = (method, url) => {
+	const u = typeof url === "string" ? new URL(url, "https://gitlab.invalid") : url;
+	const verb = method.toUpperCase();
+	const path = u.pathname;
+	if (path.includes("/../") || path.endsWith("/..")) return deny("path traversal");
+	if (/%2e|%5c/i.test(path)) return deny("encoded traversal characters");
+	if (/^\/api\/graphql\/?$/i.test(path)) return deny("GraphQL is not proxied");
+	if (/\/info\/lfs(\/|$)/i.test(path)) return deny("LFS is not proxied");
+	const git = path.match(GIT_ROUTE);
+	if (git !== null && !/^\/api\//i.test(path)) {
+		const [, rawProject, endpoint] = git;
+		const ref = rawProject === void 0 ? void 0 : normalizePath(rawProject);
+		if (ref === void 0) return deny("invalid project path");
+		const service = endpoint?.toLowerCase() === "info/refs" ? u.searchParams.get("service") : endpoint?.toLowerCase();
+		const operation = service === "git-upload-pack" ? "fetch" : service === "git-receive-pack" ? "push" : void 0;
+		if (operation === void 0) return deny("git service not allowed");
+		if (verb !== (endpoint?.toLowerCase() === "info/refs" ? "GET" : "POST")) return deny(`method ${verb} not allowed`);
+		return {
+			allow: true,
+			projectRef: {
+				kind: "path",
+				path: ref
+			},
+			operation,
+			surface: "git"
+		};
+	}
+	const rest = path.match(/^\/api\/v4\/projects\/([^/]+)(\/.*)?$/i);
+	if (rest !== null) {
+		const [, rawProject, rest2] = rest;
+		const projectRef = rawProject === void 0 ? void 0 : projectRefOf(rawProject);
+		if (projectRef === void 0) return deny("invalid project reference");
+		const tail = (rest2 ?? "").replace(/\/$/, "");
+		if (tail.includes("..")) return deny("path traversal");
+		const allow = (operation) => ({
+			allow: true,
+			projectRef,
+			operation,
+			surface: "rest",
+			restTail: tail
+		});
+		if (verb === "GET" && READ_TAILS.some((re) => re.test(tail))) return allow("read");
+		if (verb === "POST") {
+			if (u.search !== "") return deny("query parameters on a write");
+			if (tail === "/merge_requests") return allow("open_mr");
+			if (/^\/merge_requests\/\d+\/notes$/.test(tail)) return allow("comment_mr");
+		}
+		return deny("REST route not allowed");
+	}
+	return deny("route not allowed");
+};
+/**
+* GitLab lets `POST /projects/:id/merge_requests` name another project in
+* `target_project_id`, so the URL alone does not bound where the merge
+* request opens. Returns the reason to deny, or undefined when the body
+* targets the classified project.
+*
+* Pass the parsed JSON object or form body and the numeric ID the URL's
+* project reference resolved to, then forward the body you checked
+* (re-serialized), never the raw bytes: parsers disagree on repeated keys.
+* For the same reason a form that repeats `target_project_id`, or uses a
+* variant such as `target_project_id[]`, is denied.
+*/
+const mergeRequestBodyProblem = (body, resolvedProjectId) => {
+	let target;
+	if (body instanceof URLSearchParams) {
+		const keys = [...body.keys()].filter((k) => k.startsWith("target_project_id"));
+		if (keys.some((k) => k !== "target_project_id")) return "target_project_id has an unsupported form";
+		if (keys.length > 1) return "target_project_id appears more than once";
+		target = body.get("target_project_id") ?? void 0;
+	} else if (typeof body === "object" && body !== null && !Array.isArray(body)) {
+		const record = body;
+		if (Object.keys(record).some((k) => k.startsWith("target_project_id") && k !== "target_project_id")) return "target_project_id has an unsupported form";
+		target = record.target_project_id;
+	} else if (body === void 0 || body === null) target = void 0;
+	else return "merge request body is not an object";
+	if (target === void 0 || target === "") return void 0;
+	const id = typeof target === "number" ? target : typeof target === "string" && /^\d+$/.test(target) ? Number(target) : NaN;
+	if (!Number.isSafeInteger(id)) return "target_project_id is not a project ID";
+	return id === resolvedProjectId ? void 0 : "target_project_id names another project";
+};
+//#endregion
+//#region src/bond/receive-pack.ts
+const ZERO_OID = "0".repeat(40);
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const OID = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+/**
+* A strict subset of `git check-ref-format`: a full `refs/` name with no
+* control characters, no characters git forbids, no empty, dot-leading, or
+* `.lock` components, no `..`, and no `@{`.
+*/
+const isValidRefName = (ref) => {
+	if (!ref.startsWith("refs/") || ref.length > 1024) return false;
+	if (/[\x00-\x20\x7f~^:?*[\\]/.test(ref)) return false;
+	if (ref.includes("..") || ref.includes("@{") || ref.endsWith(".")) return false;
+	return ref.split("/").every((c) => c !== "" && !c.startsWith(".") && !c.endsWith(".lock"));
+};
+const concat = (a, b) => {
+	if (a.length === 0) return b;
+	const out = new Uint8Array(a.length + b.length);
+	out.set(a, 0);
+	out.set(b, a.length);
+	return out;
+};
+/**
+* Incremental receive-pack head parser. Each byte is examined once, and only
+* an unfinished pkt-line is buffered, so a head fed in many small chunks
+* costs linear time. Capabilities are the union over every command line, as
+* in git's `read_head`: a client cannot hide `push-options` behind a later
+* line without them.
+*/
+const makeReceivePackHeadParser = (limits = {}) => {
+	const maxHeadBytes = limits.maxHeadBytes ?? 1048576;
+	const maxCommands = limits.maxCommands ?? 1e3;
+	const maxOptions = limits.maxOptions ?? 100;
+	let pending = /* @__PURE__ */ new Uint8Array(0);
+	let consumed = 0;
+	let phase = "commands";
+	const commands = [];
+	const capabilities = /* @__PURE__ */ new Set();
+	const options = [];
+	let result = { _tag: "Incomplete" };
+	const malformed = (reason) => {
+		result = {
+			_tag: "Malformed",
+			reason
+		};
+		phase = "done";
+		return result;
+	};
+	const complete = () => {
+		phase = "done";
+		result = {
+			_tag: "Complete",
+			head: {
+				commands,
+				capabilities: [...capabilities],
+				options,
+				headLength: consumed
+			}
+		};
+		return result;
+	};
+	/** One pkt-line: text, null for a flush, undefined when more bytes are needed. */
+	const nextPkt = () => {
+		if (pending.length < 4) return void 0;
+		let lenText;
+		try {
+			lenText = decoder.decode(pending.subarray(0, 4));
+		} catch {
+			return malformed("bad pkt-line length");
+		}
+		if (!/^[0-9a-f]{4}$/i.test(lenText)) return malformed("bad pkt-line length");
+		const len = Number.parseInt(lenText, 16);
+		if (len === 0) {
+			pending = pending.subarray(4);
+			consumed += 4;
+			return null;
+		}
+		if (len < 4) return malformed("bad pkt-line length");
+		if (pending.length < len) return void 0;
+		let line;
+		try {
+			line = decoder.decode(pending.subarray(4, len));
+		} catch {
+			return malformed("pkt-line is not valid UTF-8");
+		}
+		pending = pending.subarray(len);
+		consumed += len;
+		return line.endsWith("\n") ? line.slice(0, -1) : line;
+	};
+	const step = () => {
+		for (;;) {
+			const pkt = nextPkt();
+			if (pkt === void 0) return consumed + pending.length > maxHeadBytes ? malformed("receive-pack head is too large") : result;
+			if (typeof pkt === "object" && pkt !== null) return pkt;
+			if (phase === "commands") {
+				if (pkt === null) {
+					if (commands.length === 0) return malformed("no receive-pack commands");
+					if (!capabilities.has("push-options")) return complete();
+					phase = "options";
+					continue;
+				}
+				if (pkt.startsWith("shallow ")) continue;
+				const nul = pkt.indexOf("\0");
+				const command = nul === -1 ? pkt : pkt.slice(0, nul);
+				if (nul !== -1) {
+					for (const cap of pkt.slice(nul + 1).split(" ")) if (cap !== "") capabilities.add(cap);
+				}
+				const [oldId, newId, ref, extra] = command.split(" ");
+				if (oldId === void 0 || newId === void 0 || ref === void 0 || extra !== void 0 || !OID.test(oldId) || !OID.test(newId)) return malformed("bad receive-pack command");
+				if (!isValidRefName(ref)) return malformed("invalid ref name");
+				if (commands.length >= maxCommands) return malformed("too many receive-pack commands");
+				commands.push({
+					oldId,
+					newId,
+					ref
+				});
+				continue;
+			}
+			if (pkt === null) return complete();
+			if (options.length >= maxOptions) return malformed("too many push options");
+			options.push(pkt);
+		}
+	};
+	return {
+		push: (chunk) => {
+			if (phase === "done") return result;
+			pending = concat(pending, chunk);
+			return step();
+		},
+		remainder: () => phase === "done" ? pending : /* @__PURE__ */ new Uint8Array(0)
+	};
+};
+/**
+* Parses as much of the receive-pack head as `bytes` holds. A convenience
+* for a buffered prefix; streaming proxies should use
+* `makeReceivePackHeadParser` and feed chunks as they arrive.
+*/
+const parseReceivePackHead = (bytes, limits) => makeReceivePackHeadParser(limits).push(bytes);
+const MERGE_REQUEST_OPTIONS = [
+	/^merge_request\.create$/,
+	/^merge_request\.target=[\w./-]{1,255}$/,
+	/^merge_request\.title=.{1,255}$/s,
+	/^merge_request\.description=.{0,10000}$/s,
+	/^merge_request\.label=[\w.:-]{1,100}$/,
+	/^merge_request\.remove_source_branch$/,
+	/^merge_request\.draft$/
+];
+/**
+* Returns the reason a push is denied, or undefined when it is allowed.
+* Denies tags and other non-branch refs, deletions, the default branch, and
+* any push option outside the merge request allow-list. GitLab still applies
+* its own branch protection afterwards.
+*/
+const evaluatePush = (head, policy) => {
+	for (const c of head.commands) {
+		if (!c.ref.startsWith("refs/heads/")) return `ref ${c.ref} is not a branch`;
+		if (/^0+$/.test(c.newId)) return `deleting ${c.ref} is not allowed`;
+		const branch = c.ref.slice(11);
+		if (branch === policy.defaultBranch && policy.allowDefaultBranch !== true) return "pushing to the default branch is not allowed";
+		if (policy.branchPrefix !== void 0 && !branch.startsWith(policy.branchPrefix)) return `branch ${branch} is outside ${policy.branchPrefix}`;
+	}
+	for (const option of head.options) {
+		const name = option.split("=")[0] ?? option;
+		if (!policy.allowMergeRequestOptions || !MERGE_REQUEST_OPTIONS.some((re) => re.test(option))) return `push option ${name} is not allowed`;
+	}
+	if (head.options.includes("merge_request.create") && !head.options.includes(`merge_request.label=${policy.requiredMergeRequestLabel}`)) return `merge requests must carry merge_request.label=${policy.requiredMergeRequestLabel}`;
+};
+//#endregion
+//#region src/bond/attribution.ts
+/** The commit author for a GitLab user: their name and `commit_email`. */
+const commitAuthor = (user) => {
+	if (user.commitEmail === void 0) throw new Error(`GitLab user ${user.username} has no commit email`);
+	return {
+		name: user.name || user.username,
+		email: user.commitEmail
+	};
+};
+const oneLine = (value) => value.replace(/[\r\n]+/g, " ").trim();
+/** `Assisted-by: <app> <session URL>`, added to every commit. */
+const assistedByTrailer = (appName, sessionUrl) => `Assisted-by: ${oneLine(appName)} <${oneLine(sessionUrl)}>`;
+/** `Co-authored-by` for a participant or, with the app principal, the requester. */
+const coAuthoredByTrailer = (who) => `Co-authored-by: ${oneLine(who.name)} <${oneLine(who.email)}>`;
+/** Description footer for merge requests and comments. */
+const mergeRequestFooter = (input) => ["---", input.requestedBy === void 0 ? `Opened through ${oneLine(input.appName)}: ${oneLine(input.sessionUrl)}` : `Requested by @${oneLine(input.requestedBy)} via ${oneLine(input.appName)}: ${oneLine(input.sessionUrl)}`].join("\n");
+/** `git push -o` options that create a labelled merge request. */
+const mergeRequestPushOptions = (input) => [
+	"merge_request.create",
+	`merge_request.target=${input.target}`,
+	`merge_request.title=${oneLine(input.title)}`,
+	`merge_request.description=${oneLine(input.description)}`,
+	`merge_request.label=${input.label}`
+];
+//#endregion
+//#region src/bond/provider.ts
+/**
+* Bond's GitLab provider. A configured `oauth.clientSecret` requires
+* `resolveSecret`; the provider never silently degrades to a public client. GitLab has no delegation marker, so user-principal
+* writes need the ProviderApp's `allowUserPrincipalOutput`. The app principal
+* is a registered bot credential stored on the Installation; GitLab 17.1
+* cannot rotate it from the bot itself, so an administrator replaces it.
+*/
+const makeGitLabBondProvider = (options = {}) => {
+	const client = (config) => Effect.gen(function* () {
+		if (config.oauth === void 0) return yield* Effect.fail(new ProviderError({
+			message: `${config.id} has no OAuth application`,
+			rejected: false
+		}));
+		const secretRef = config.oauth.clientSecret;
+		if (secretRef !== void 0 && options.resolveSecret === void 0) return yield* Effect.fail(new ProviderError({
+			message: `${config.id} has an OAuth client secret but the provider has no resolveSecret`,
+			rejected: false
+		}));
+		const clientSecret = secretRef === void 0 || options.resolveSecret === void 0 ? void 0 : yield* options.resolveSecret(secretRef).pipe(Effect.mapError((cause) => new ProviderError({
+			message: "Unable to resolve the OAuth client secret",
+			rejected: false,
+			cause
+		})));
+		return {
+			origin: config.baseUrl,
+			clientId: config.oauth.clientId,
+			...clientSecret === void 0 ? {} : { clientSecret },
+			...options.fetch === void 0 ? {} : { fetch: options.fetch },
+			...options.clock === void 0 ? {} : { clock: options.clock }
+		};
+	});
+	return {
+		provider: "gitlab",
+		delegationMarker: false,
+		refreshUserToken: (config, refreshToken) => client(config).pipe(Effect.flatMap((c) => refreshAccessToken(c, refreshToken))),
+		revokeUserToken: (config, tokens) => tokens.method === "pat" ? revokeSelfToken(config.baseUrl, tokens.accessToken, options.fetch) : client(config).pipe(Effect.flatMap((c) => revokeToken(c, tokens.accessToken))),
+		appCredential: (config, installation, stored) => stored === void 0 ? Effect.fail(new ProviderError({
+			message: `Installation ${installation.id} of ${config.id} has no bot credential`,
+			rejected: true
+		})) : Effect.succeed({
+			token: stored,
+			...installation.credentialExpiresAt === void 0 ? {} : { expiresAt: installation.credentialExpiresAt }
+		})
+	};
+};
+//#endregion
+export { ZERO_OID, assistedByTrailer, authorizationUrl, canonicalOrigin, classifyGitLabRequest, coAuthoredByTrailer, commitAuthor, createPkce, discoverInstance, evaluatePush, exchangeCode, isValidRefName, makeGitLabBondProvider, makeReceivePackHeadParser, mergeRequestBodyProblem, mergeRequestFooter, mergeRequestPushOptions, parseReceivePackHead, readTokenInfo, readUser, refreshAccessToken, revokeSelfToken, revokeToken, tokenExpiryInstant, validateBotCredential, validatePersonalAccessToken };
+
+//# sourceMappingURL=index.js.map