@openma/matter-gitlab 0.0.0-stage → 0.2.0

package/dist/bond/index.js

@@ -0,0 +1,1541 @@
+import { ProviderError, checkResourceRequest, resourceId } from "@openma/matter/bond";
+import { Data, Effect, Schema } from "effect";
+import { JsonValueSchema } from "@openma/matter";
+import { CredentialError, makeCredentialResolver } from "@openma/matter/credentials";
+import { IntegrationError } from "@openma/matter/integration";
+import { defineLoop } from "@openma/matter-loop";
+//#region src/bond/http.ts
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* Normalizes a GitLab instance URL to its canonical https origin. Rejects
+* plain http except for loopback hosts, and rejects paths, credentials,
+* queries, and fragments.
+*/
+const canonicalOrigin = (input) => {
+	const url = new URL(input);
+	const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) throw new Error("GitLab instance URL must use https");
+	if (url.username || url.password || url.search || url.hash) throw new Error("GitLab instance URL must not carry credentials, query, or fragment");
+	if (url.pathname !== "/" && url.pathname !== "") throw new Error("GitLab instance URL must be an origin without a path");
+	return url.origin.toLowerCase();
+};
+/** One JSON request. Never follows redirects: a redirect is an error. */
+const requestJson = (fetchImpl, url, init) => Effect.tryPromise({
+	try: async () => {
+		const response = await fetchImpl(url, {
+			...init,
+			redirect: "manual"
+		});
+		const text = await response.text();
+		let body = void 0;
+		if (text.length > 0) try {
+			body = JSON.parse(text);
+		} catch {
+			body = void 0;
+		}
+		return {
+			status: response.status,
+			body,
+			headers: response.headers
+		};
+	},
+	catch: (cause) => new ProviderError({
+		message: `GitLab request failed: ${new URL(url).pathname}`,
+		rejected: false,
+		cause
+	})
+});
+const bearer = (token) => ({ authorization: `Bearer ${token}` });
+/**
+* Maps a non-2xx GitLab response to a ProviderError without echoing bodies.
+* Only OAuth `invalid_grant` is a rejection, the one answer that means the
+* grant itself is gone. `invalid_client`, other 4xx, and 5xx are
+* configuration or transport problems and must not end a link.
+*/
+const statusError = (what, response) => {
+	const error = isRecord$1(response.body) && typeof response.body.error === "string" ? response.body.error : void 0;
+	return new ProviderError({
+		message: `${what} failed with HTTP ${response.status}${error === void 0 ? "" : ` (${error})`}`,
+		rejected: error === "invalid_grant",
+		status: response.status
+	});
+};
+//#endregion
+//#region src/bond/oauth.ts
+const base64url = (bytes) => {
+	let binary = "";
+	for (const b of bytes) binary += String.fromCharCode(b);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+/**
+* Reads OIDC discovery and requires authorization code with PKCE S256 and
+* refresh tokens, and an issuer equal to the instance origin. Device flow is
+* recorded when present; GitLab can disable it per instance.
+*/
+const discoverInstance = (origin, fetchImpl = globalThis.fetch) => Effect.gen(function* () {
+	const canonical = yield* Effect.try({
+		try: () => canonicalOrigin(origin),
+		catch: (cause) => new ProviderError({
+			message: cause instanceof Error ? cause.message : "Invalid origin",
+			rejected: true,
+			cause
+		})
+	});
+	const response = yield* requestJson(fetchImpl, `${canonical}/.well-known/openid-configuration`, {
+		method: "GET",
+		headers: { accept: "application/json" }
+	});
+	if (response.status !== 200 || !isRecord$1(response.body)) return yield* Effect.fail(statusError("OIDC discovery", response));
+	const d = response.body;
+	const list = (key) => Array.isArray(d[key]) ? d[key].filter((v) => typeof v === "string") : [];
+	const problems = [];
+	if (typeof d.issuer !== "string" || d.issuer.replace(/\/$/, "").toLowerCase() !== canonical) problems.push("issuer does not match the instance origin");
+	if (!list("code_challenge_methods_supported").includes("S256")) problems.push("PKCE S256 is not supported");
+	if (!list("grant_types_supported").includes("refresh_token")) problems.push("refresh_token grant is not supported");
+	if (typeof d.authorization_endpoint !== "string" || typeof d.token_endpoint !== "string") problems.push("authorization or token endpoint is missing");
+	if (problems.length > 0) return yield* Effect.fail(new ProviderError({
+		message: `GitLab instance is not usable: ${problems.join("; ")}`,
+		rejected: true
+	}));
+	return {
+		origin: canonical,
+		deviceFlow: typeof d.device_authorization_endpoint === "string"
+	};
+});
+/** A fresh PKCE verifier and its S256 challenge. Keep the verifier server-side. */
+const createPkce = () => Effect.promise(async () => {
+	const verifier = base64url(globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(48)));
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return {
+		verifier,
+		challenge: base64url(new Uint8Array(digest)),
+		method: "S256"
+	};
+});
+const authorizationUrl = (input) => `${canonicalOrigin(input.origin)}/oauth/authorize?${new URLSearchParams({
+	client_id: input.clientId,
+	redirect_uri: input.redirectUri,
+	response_type: "code",
+	scope: input.scopes.join(" "),
+	state: input.state,
+	code_challenge: input.codeChallenge,
+	code_challenge_method: "S256"
+}).toString()}`;
+const tokenGrant = (body, now) => {
+	if (!isRecord$1(body) || typeof body.access_token !== "string") return void 0;
+	const createdMs = typeof body.created_at === "number" ? body.created_at * 1e3 : Date.parse(now);
+	return {
+		accessToken: body.access_token,
+		...typeof body.refresh_token === "string" ? { refreshToken: body.refresh_token } : {},
+		...typeof body.expires_in === "number" ? { accessExpiresAt: new Date(createdMs + body.expires_in * 1e3).toISOString() } : {},
+		...typeof body.scope === "string" ? { scopes: body.scope.split(" ").filter(Boolean) } : {}
+	};
+};
+const postToken = (client, what, params) => Effect.gen(function* () {
+	const origin = canonicalOrigin(client.origin);
+	const now = (client.clock ?? (() => (/* @__PURE__ */ new Date()).toISOString()))();
+	const response = yield* requestJson(client.fetch ?? globalThis.fetch, `${origin}/oauth/token`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json"
+		},
+		body: new URLSearchParams({
+			...params,
+			client_id: client.clientId,
+			...client.clientSecret === void 0 ? {} : { client_secret: client.clientSecret }
+		}).toString()
+	});
+	const grant = response.status === 200 ? tokenGrant(response.body, now) : void 0;
+	if (grant === void 0) return yield* Effect.fail(statusError(what, response));
+	return grant;
+});
+/** Exchanges an authorization code. A wrong verifier does not consume the code on GitLab. */
+const exchangeCode = (client, input) => postToken(client, "Authorization code exchange", {
+	grant_type: "authorization_code",
+	code: input.code,
+	redirect_uri: input.redirectUri,
+	code_verifier: input.codeVerifier
+});
+/**
+* Refreshes a user token. GitLab rotates both tokens and invalidates the old
+* access token immediately, and does not detect refresh-token reuse, so the
+* caller must hold the Bond refresh lease.
+*/
+const refreshAccessToken = (client, refreshToken) => postToken(client, "Token refresh", {
+	grant_type: "refresh_token",
+	refresh_token: refreshToken
+});
+/**
+* Revokes one access or refresh token. GitLab (Doorkeeper) stores an access
+* token and its refresh token as one record, so revoking either ends that
+* pair only. Other tokens the same user holds for the same application keep
+* working: on a live instance, revoking the previous token after a relink left
+* the new one valid.
+*/
+const revokeToken = (client, token) => Effect.gen(function* () {
+	const origin = canonicalOrigin(client.origin);
+	const response = yield* requestJson(client.fetch ?? globalThis.fetch, `${origin}/oauth/revoke`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			token,
+			client_id: client.clientId,
+			...client.clientSecret === void 0 ? {} : { client_secret: client.clientSecret }
+		}).toString()
+	});
+	if (response.status !== 200) return yield* Effect.fail(statusError("Token revocation", response));
+});
+//#endregion
+//#region src/bond/tokens.ts
+const api = (origin, path) => `${canonicalOrigin(origin)}/api/v4${path}`;
+const readUser = (origin, token, fetchImpl = globalThis.fetch) => Effect.gen(function* () {
+	const response = yield* requestJson(fetchImpl, api(origin, "/user"), {
+		method: "GET",
+		headers: {
+			...bearer(token),
+			accept: "application/json"
+		}
+	});
+	const b = response.body;
+	if (response.status !== 200 || !isRecord$1(b) || typeof b.id !== "number") return yield* Effect.fail(statusError("Reading the GitLab user", response));
+	const identities = Array.isArray(b.identities) ? b.identities.flatMap((i) => isRecord$1(i) && typeof i.provider === "string" && typeof i.extern_uid === "string" ? [{
+		provider: i.provider,
+		externUid: i.extern_uid
+	}] : []) : [];
+	return {
+		id: String(b.id),
+		username: typeof b.username === "string" ? b.username : "",
+		name: typeof b.name === "string" ? b.name : "",
+		...typeof b.commit_email === "string" && b.commit_email.length > 0 ? { commitEmail: b.commit_email } : {},
+		bot: b.bot === true,
+		identities
+	};
+});
+const readTokenInfo = (origin, token, fetchImpl = globalThis.fetch) => Effect.gen(function* () {
+	const response = yield* requestJson(fetchImpl, api(origin, "/personal_access_tokens/self"), {
+		method: "GET",
+		headers: {
+			...bearer(token),
+			accept: "application/json"
+		}
+	});
+	const b = response.body;
+	if (response.status !== 200 || !isRecord$1(b) || typeof b.id !== "number") return yield* Effect.fail(statusError("Reading token metadata", response));
+	return {
+		id: String(b.id),
+		name: typeof b.name === "string" ? b.name : "",
+		active: b.active === true,
+		revoked: b.revoked === true,
+		scopes: Array.isArray(b.scopes) ? b.scopes.filter((s) => typeof s === "string") : [],
+		...typeof b.expires_at === "string" ? { expiresAt: b.expires_at } : {},
+		userId: String(b.user_id)
+	};
+});
+/** `DELETE /api/v4/personal_access_tokens/self`: a token revokes itself. */
+const revokeSelfToken = (origin, token, fetchImpl = globalThis.fetch) => Effect.gen(function* () {
+	const response = yield* requestJson(fetchImpl, api(origin, "/personal_access_tokens/self"), {
+		method: "DELETE",
+		headers: bearer(token)
+	});
+	if (response.status !== 204 && response.status !== 200) return yield* Effect.fail(statusError("Token self-revocation", response));
+});
+/** End of the UTC expiry day, which is when GitLab stops accepting the token. */
+const tokenExpiryInstant = (expiresAt) => (/* @__PURE__ */ new Date(`${expiresAt}T23:59:59.999Z`)).toISOString();
+const commonProblems = (info, user, policy) => {
+	const problems = [];
+	if (info.userId !== user.id) problems.push("user_mismatch");
+	if (info.revoked) problems.push("revoked");
+	if (!info.active) problems.push("inactive");
+	if (info.scopes.some((s) => !policy.allowedScopes.includes(s))) problems.push("scope_not_allowed");
+	if (info.expiresAt === void 0) problems.push("no_expiry");
+	else {
+		const end = Date.parse(tokenExpiryInstant(info.expiresAt));
+		const now = Date.parse(policy.now);
+		if (end <= now) problems.push("expired");
+		else if (end - now > (policy.maxLifetimeDays + 1) * 24 * 60 * 6e4) problems.push("lifetime_exceeded");
+	}
+	return problems;
+};
+/**
+* Checks a pasted personal access token: active, scopes within the allowed
+* set, an expiry within the maximum lifetime, and a human owner.
+*/
+const validatePersonalAccessToken = (info, user, policy) => [...commonProblems(info, user, policy), ...user.bot ? ["is_a_bot"] : []];
+/**
+* Checks a bot credential registered as an Installation: the same token
+* checks, plus `bot: true` on its user. A human account's token is never
+* accepted as an app principal.
+*/
+const validateBotCredential = (info, user, policy) => [...commonProblems(info, user, policy), ...user.bot ? [] : ["not_a_bot"]];
+//#endregion
+//#region src/bond/classify.ts
+const deny = (reason) => ({
+	allow: false,
+	reason
+});
+const normalizePath = (raw) => {
+	let decoded;
+	try {
+		decoded = decodeURIComponent(raw);
+	} catch {
+		return;
+	}
+	const path = decoded.replace(/\.git$/i, "").replace(/^\/+|\/+$/g, "").toLowerCase();
+	const segments = path.split("/");
+	if (segments.length < 2 || segments.some((s) => s === "" || s === "." || s === ".." || !/^[\w.-]+$/.test(s))) return;
+	return path;
+};
+const projectRefOf = (raw) => /^\d+$/.test(raw) ? {
+	kind: "id",
+	id: Number(raw)
+} : (() => {
+	const path = normalizePath(raw);
+	return path === void 0 ? void 0 : {
+		kind: "path",
+		path
+	};
+})();
+/**
+* REST reads, by exact shape. A branch name may carry encoded slashes
+* (`feature%2Fx`), and nothing else is percent-encoded.
+*/
+const READ_TAILS = [
+	/^$/,
+	/^\/merge_requests$/,
+	/^\/merge_requests\/\d+(\/(notes|commits|changes|diffs|approvals))?$/,
+	/^\/repository\/branches$/,
+	/^\/repository\/branches\/([\w.-]|%2[fF])+$/,
+	/^\/repository\/commits$/,
+	/^\/repository\/commits\/[0-9a-f]{7,64}$/
+];
+const GIT_ROUTE = /^\/(.+?)(?:\.git)?\/(info\/refs|git-upload-pack|git-receive-pack)$/i;
+/**
+* Classifies one request in GitLab's own URL shape. Allows git smart HTTP
+* fetch and push, REST reads of a project, merge request creation, and
+* merge request notes. Denies GraphQL, LFS, archives, raw files, and every
+* other route.
+*/
+const classifyGitLabRequest = (method, url) => {
+	const u = typeof url === "string" ? new URL(url, "https://gitlab.invalid") : url;
+	const verb = method.toUpperCase();
+	const path = u.pathname;
+	if (path.includes("/../") || path.endsWith("/..")) return deny("path traversal");
+	if (/%2e|%5c/i.test(path)) return deny("encoded traversal characters");
+	if (/^\/api\/graphql\/?$/i.test(path)) return deny("GraphQL is not proxied");
+	if (/\/info\/lfs(\/|$)/i.test(path)) return deny("LFS is not proxied");
+	const git = path.match(GIT_ROUTE);
+	if (git !== null && !/^\/api\//i.test(path)) {
+		const [, rawProject, endpoint] = git;
+		const ref = rawProject === void 0 ? void 0 : normalizePath(rawProject);
+		if (ref === void 0) return deny("invalid project path");
+		const service = endpoint?.toLowerCase() === "info/refs" ? u.searchParams.get("service") : endpoint?.toLowerCase();
+		const operation = service === "git-upload-pack" ? "fetch" : service === "git-receive-pack" ? "push" : void 0;
+		if (operation === void 0) return deny("git service not allowed");
+		if (verb !== (endpoint?.toLowerCase() === "info/refs" ? "GET" : "POST")) return deny(`method ${verb} not allowed`);
+		return {
+			allow: true,
+			projectRef: {
+				kind: "path",
+				path: ref
+			},
+			operation,
+			surface: "git"
+		};
+	}
+	const rest = path.match(/^\/api\/v4\/projects\/([^/]+)(\/.*)?$/i);
+	if (rest !== null) {
+		const [, rawProject, rest2] = rest;
+		const projectRef = rawProject === void 0 ? void 0 : projectRefOf(rawProject);
+		if (projectRef === void 0) return deny("invalid project reference");
+		const tail = (rest2 ?? "").replace(/\/$/, "");
+		if (tail.includes("..")) return deny("path traversal");
+		const allow = (operation) => ({
+			allow: true,
+			projectRef,
+			operation,
+			surface: "rest",
+			restTail: tail
+		});
+		if (verb === "GET" && READ_TAILS.some((re) => re.test(tail))) return allow("read");
+		if (verb === "POST") {
+			if (u.search !== "") return deny("query parameters on a write");
+			if (tail === "/merge_requests") return allow("open_mr");
+			if (/^\/merge_requests\/\d+\/notes$/.test(tail)) return allow("comment_mr");
+		}
+		return deny("REST route not allowed");
+	}
+	return deny("route not allowed");
+};
+/**
+* GitLab lets `POST /projects/:id/merge_requests` name another project in
+* `target_project_id`, so the URL alone does not bound where the merge
+* request opens. Returns the reason to deny, or undefined when the body
+* targets the classified project.
+*
+* Pass the parsed JSON object or form body and the numeric ID the URL's
+* project reference resolved to, then forward the body you checked
+* (re-serialized), never the raw bytes: parsers disagree on repeated keys.
+* For the same reason a form that repeats `target_project_id`, or uses a
+* variant such as `target_project_id[]`, is denied.
+*/
+const mergeRequestBodyProblem = (body, resolvedProjectId) => {
+	let target;
+	if (body instanceof URLSearchParams) {
+		const keys = [...body.keys()].filter((k) => k.startsWith("target_project_id"));
+		if (keys.some((k) => k !== "target_project_id")) return "target_project_id has an unsupported form";
+		if (keys.length > 1) return "target_project_id appears more than once";
+		target = body.get("target_project_id") ?? void 0;
+	} else if (typeof body === "object" && body !== null && !Array.isArray(body)) {
+		const record = body;
+		if (Object.keys(record).some((k) => k.startsWith("target_project_id") && k !== "target_project_id")) return "target_project_id has an unsupported form";
+		target = record.target_project_id;
+	} else if (body === void 0 || body === null) target = void 0;
+	else return "merge request body is not an object";
+	if (target === void 0 || target === "") return void 0;
+	const id = typeof target === "number" ? target : typeof target === "string" && /^\d+$/.test(target) ? Number(target) : NaN;
+	if (!Number.isSafeInteger(id)) return "target_project_id is not a project ID";
+	return id === resolvedProjectId ? void 0 : "target_project_id names another project";
+};
+//#endregion
+//#region src/bond/receive-pack.ts
+const ZERO_OID = "0".repeat(40);
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const OID = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+/**
+* A strict subset of `git check-ref-format`: a full `refs/` name with no
+* control characters, no characters git forbids, no empty, dot-leading, or
+* `.lock` components, no `..`, and no `@{`.
+*/
+const isValidRefName = (ref) => {
+	if (!ref.startsWith("refs/") || ref.length > 1024) return false;
+	if (/[\x00-\x20\x7f~^:?*[\\]/.test(ref)) return false;
+	if (ref.includes("..") || ref.includes("@{") || ref.endsWith(".")) return false;
+	return ref.split("/").every((c) => c !== "" && !c.startsWith(".") && !c.endsWith(".lock"));
+};
+const concat = (a, b) => {
+	if (a.length === 0) return b;
+	const out = new Uint8Array(a.length + b.length);
+	out.set(a, 0);
+	out.set(b, a.length);
+	return out;
+};
+/**
+* Incremental receive-pack head parser. Each byte is examined once, and only
+* an unfinished pkt-line is buffered, so a head fed in many small chunks
+* costs linear time. Capabilities are the union over every command line, as
+* in git's `read_head`: a client cannot hide `push-options` behind a later
+* line without them.
+*/
+const makeReceivePackHeadParser = (limits = {}) => {
+	const maxHeadBytes = limits.maxHeadBytes ?? 1048576;
+	const maxCommands = limits.maxCommands ?? 1e3;
+	const maxOptions = limits.maxOptions ?? 100;
+	let pending = /* @__PURE__ */ new Uint8Array(0);
+	let consumed = 0;
+	let phase = "commands";
+	const commands = [];
+	const capabilities = /* @__PURE__ */ new Set();
+	const options = [];
+	let result = { _tag: "Incomplete" };
+	const malformed = (reason) => {
+		result = {
+			_tag: "Malformed",
+			reason
+		};
+		phase = "done";
+		return result;
+	};
+	const complete = () => {
+		phase = "done";
+		result = {
+			_tag: "Complete",
+			head: {
+				commands,
+				capabilities: [...capabilities],
+				options,
+				headLength: consumed
+			}
+		};
+		return result;
+	};
+	/** One pkt-line: text, null for a flush, undefined when more bytes are needed. */
+	const nextPkt = () => {
+		if (pending.length < 4) return void 0;
+		let lenText;
+		try {
+			lenText = decoder.decode(pending.subarray(0, 4));
+		} catch {
+			return malformed("bad pkt-line length");
+		}
+		if (!/^[0-9a-f]{4}$/i.test(lenText)) return malformed("bad pkt-line length");
+		const len = Number.parseInt(lenText, 16);
+		if (len === 0) {
+			pending = pending.subarray(4);
+			consumed += 4;
+			return null;
+		}
+		if (len < 4) return malformed("bad pkt-line length");
+		if (pending.length < len) return void 0;
+		let line;
+		try {
+			line = decoder.decode(pending.subarray(4, len));
+		} catch {
+			return malformed("pkt-line is not valid UTF-8");
+		}
+		pending = pending.subarray(len);
+		consumed += len;
+		return line.endsWith("\n") ? line.slice(0, -1) : line;
+	};
+	const step = () => {
+		for (;;) {
+			const pkt = nextPkt();
+			if (pkt === void 0) return consumed + pending.length > maxHeadBytes ? malformed("receive-pack head is too large") : result;
+			if (typeof pkt === "object" && pkt !== null) return pkt;
+			if (phase === "commands") {
+				if (pkt === null) {
+					if (commands.length === 0) return malformed("no receive-pack commands");
+					if (!capabilities.has("push-options")) return complete();
+					phase = "options";
+					continue;
+				}
+				if (pkt.startsWith("shallow ")) continue;
+				const nul = pkt.indexOf("\0");
+				const command = nul === -1 ? pkt : pkt.slice(0, nul);
+				if (nul !== -1) {
+					for (const cap of pkt.slice(nul + 1).split(" ")) if (cap !== "") capabilities.add(cap);
+				}
+				const [oldId, newId, ref, extra] = command.split(" ");
+				if (oldId === void 0 || newId === void 0 || ref === void 0 || extra !== void 0 || !OID.test(oldId) || !OID.test(newId)) return malformed("bad receive-pack command");
+				if (!isValidRefName(ref)) return malformed("invalid ref name");
+				if (commands.length >= maxCommands) return malformed("too many receive-pack commands");
+				commands.push({
+					oldId,
+					newId,
+					ref
+				});
+				continue;
+			}
+			if (pkt === null) return complete();
+			if (options.length >= maxOptions) return malformed("too many push options");
+			options.push(pkt);
+		}
+	};
+	return {
+		push: (chunk) => {
+			if (phase === "done") return result;
+			pending = concat(pending, chunk);
+			return step();
+		},
+		remainder: () => phase === "done" ? pending : /* @__PURE__ */ new Uint8Array(0)
+	};
+};
+/**
+* Parses as much of the receive-pack head as `bytes` holds. A convenience
+* for a buffered prefix; streaming proxies should use
+* `makeReceivePackHeadParser` and feed chunks as they arrive.
+*/
+const parseReceivePackHead = (bytes, limits) => makeReceivePackHeadParser(limits).push(bytes);
+const MERGE_REQUEST_OPTIONS = [
+	/^merge_request\.create$/,
+	/^merge_request\.target=[\w./-]{1,255}$/,
+	/^merge_request\.title=.{1,255}$/s,
+	/^merge_request\.description=.{0,10000}$/s,
+	/^merge_request\.label=[\w.:-]{1,100}$/,
+	/^merge_request\.remove_source_branch$/,
+	/^merge_request\.draft$/
+];
+/**
+* Returns the reason a push is denied, or undefined when it is allowed.
+* Denies tags and other non-branch refs, deletions, the default branch, and
+* any push option outside the merge request allow-list. GitLab still applies
+* its own branch protection afterwards.
+*/
+const evaluatePush = (head, policy) => {
+	for (const c of head.commands) {
+		if (!c.ref.startsWith("refs/heads/")) return `ref ${c.ref} is not a branch`;
+		if (/^0+$/.test(c.newId)) return `deleting ${c.ref} is not allowed`;
+		const branch = c.ref.slice(11);
+		if (branch === policy.defaultBranch && policy.allowDefaultBranch !== true) return "pushing to the default branch is not allowed";
+		if (policy.branchPrefix !== void 0 && !branch.startsWith(policy.branchPrefix)) return `branch ${branch} is outside ${policy.branchPrefix}`;
+	}
+	for (const option of head.options) {
+		const name = option.split("=")[0] ?? option;
+		if (!policy.allowMergeRequestOptions || !MERGE_REQUEST_OPTIONS.some((re) => re.test(option))) return `push option ${name} is not allowed`;
+	}
+	if (head.options.includes("merge_request.create") && !head.options.includes(`merge_request.label=${policy.requiredMergeRequestLabel}`)) return `merge requests must carry merge_request.label=${policy.requiredMergeRequestLabel}`;
+};
+//#endregion
+//#region src/bond/attribution.ts
+/** The commit author for a GitLab user: their name and `commit_email`. */
+const commitAuthor = (user) => {
+	if (user.commitEmail === void 0) throw new Error(`GitLab user ${user.username} has no commit email`);
+	return {
+		name: user.name || user.username,
+		email: user.commitEmail
+	};
+};
+const oneLine = (value) => value.replace(/[\r\n]+/g, " ").trim();
+/** `Assisted-by: <app> <session URL>`, added to every commit. */
+const assistedByTrailer = (appName, sessionUrl) => `Assisted-by: ${oneLine(appName)} <${oneLine(sessionUrl)}>`;
+/** `Co-authored-by` for a participant or, with the app principal, the requester. */
+const coAuthoredByTrailer = (who) => `Co-authored-by: ${oneLine(who.name)} <${oneLine(who.email)}>`;
+/** Description footer for merge requests and comments. */
+const mergeRequestFooter = (input) => ["---", input.requestedBy === void 0 ? `Opened through ${oneLine(input.appName)}: ${oneLine(input.sessionUrl)}` : `Requested by @${oneLine(input.requestedBy)} via ${oneLine(input.appName)}: ${oneLine(input.sessionUrl)}`].join("\n");
+/** `git push -o` options that create a labelled merge request. */
+const mergeRequestPushOptions = (input) => [
+	"merge_request.create",
+	`merge_request.target=${input.target}`,
+	`merge_request.title=${oneLine(input.title)}`,
+	`merge_request.description=${oneLine(input.description)}`,
+	`merge_request.label=${input.label}`
+];
+//#endregion
+//#region src/bond/provider.ts
+/**
+* Bond's GitLab provider. A configured `oauth.clientSecret` requires
+* `resolveSecret`; the provider never silently degrades to a public client. GitLab has no delegation marker, so user-principal
+* writes need the ProviderApp's `allowUserPrincipalOutput`. The app principal
+* is a registered bot credential stored on the Installation; GitLab 17.1
+* cannot rotate it from the bot itself, so an administrator replaces it.
+*/
+const makeGitLabBondProvider = (options = {}) => {
+	const client = (config) => Effect.gen(function* () {
+		if (config.oauth === void 0) return yield* Effect.fail(new ProviderError({
+			message: `${config.id} has no OAuth application`,
+			rejected: false
+		}));
+		const secretRef = config.oauth.clientSecret;
+		if (secretRef !== void 0 && options.resolveSecret === void 0) return yield* Effect.fail(new ProviderError({
+			message: `${config.id} has an OAuth client secret but the provider has no resolveSecret`,
+			rejected: false
+		}));
+		const clientSecret = secretRef === void 0 || options.resolveSecret === void 0 ? void 0 : yield* options.resolveSecret(secretRef).pipe(Effect.mapError((cause) => new ProviderError({
+			message: "Unable to resolve the OAuth client secret",
+			rejected: false,
+			cause
+		})));
+		return {
+			origin: config.baseUrl,
+			clientId: config.oauth.clientId,
+			...clientSecret === void 0 ? {} : { clientSecret },
+			...options.fetch === void 0 ? {} : { fetch: options.fetch },
+			...options.clock === void 0 ? {} : { clock: options.clock }
+		};
+	});
+	return {
+		provider: "gitlab",
+		delegationMarker: false,
+		refreshUserToken: (config, refreshToken) => client(config).pipe(Effect.flatMap((c) => refreshAccessToken(c, refreshToken))),
+		revokeUserToken: (config, tokens) => tokens.method === "pat" ? revokeSelfToken(config.baseUrl, tokens.accessToken, options.fetch) : client(config).pipe(Effect.flatMap((c) => revokeToken(c, tokens.accessToken))),
+		appCredential: (config, installation, stored) => stored === void 0 ? Effect.fail(new ProviderError({
+			message: `Installation ${installation.id} of ${config.id} has no bot credential`,
+			rejected: true
+		})) : Effect.succeed({
+			token: stored,
+			...installation.credentialExpiresAt === void 0 ? {} : { expiresAt: installation.credentialExpiresAt }
+		})
+	};
+};
+//#endregion
+//#region src/bond/resources.ts
+/** Minimum GitLab access level per operation: 20 Reporter, 30 Developer. */
+const GITLAB_MIN_ACCESS_LEVEL = {
+	fetch: 20,
+	read: 20,
+	push: 30,
+	open_mr: 30,
+	comment_mr: 30
+};
+const gitlabManifest = {
+	provider: "gitlab",
+	title: "GitLab",
+	docsUrl: "https://docs.gitlab.com/integration/oauth_provider/",
+	setupSchema: {
+		type: "object",
+		properties: {
+			baseUrl: {
+				type: "string",
+				title: "Instance URL",
+				format: "uri",
+				description: "Canonical https origin, such as https://gitlab.example.com"
+			},
+			oauthClientId: {
+				type: "string",
+				title: "OAuth application ID",
+				description: "Optional. Without an OAuth application, users link with personal access tokens."
+			},
+			oauthClientSecret: {
+				type: "string",
+				title: "OAuth application secret",
+				"x-secret": true
+			},
+			linkMethodPolicy: {
+				type: "string",
+				title: "Link methods",
+				enum: [
+					"pat_only",
+					"oauth_only",
+					"oauth_preferred"
+				],
+				default: "oauth_preferred"
+			},
+			principalPolicy: {
+				type: "string",
+				title: "Principal policy",
+				enum: [
+					"user_only",
+					"user",
+					"app"
+				],
+				default: "user_only"
+			},
+			maxPatLifetimeDays: {
+				type: "integer",
+				title: "Maximum personal access token lifetime, in days",
+				minimum: 1,
+				maximum: 365,
+				default: 90
+			},
+			allowUserPrincipalOutput: {
+				type: "boolean",
+				title: "Allow writes as the linked user",
+				default: false
+			}
+		},
+		required: [
+			"baseUrl",
+			"linkMethodPolicy",
+			"principalPolicy"
+		]
+	},
+	linkMethods: ["oauth", "pat"],
+	resourceKinds: [{
+		kind: "project",
+		title: "Project",
+		operations: [
+			{
+				name: "fetch",
+				description: "Clone and fetch over git",
+				access: "read"
+			},
+			{
+				name: "read",
+				description: "Read the project through the REST API",
+				access: "read"
+			},
+			{
+				name: "push",
+				description: "Push branches",
+				access: "write"
+			},
+			{
+				name: "open_mr",
+				description: "Open merge requests",
+				access: "write"
+			},
+			{
+				name: "comment_mr",
+				description: "Comment on merge requests",
+				access: "write"
+			}
+		]
+	}]
+};
+const PROJECT_ID = /^[1-9][0-9]{0,18}$/;
+const DEFAULT_PAGE = 20;
+const MAX_PAGE = 100;
+const toResource = (body) => {
+	if (!isRecord$1(body) || typeof body.id !== "number") return void 0;
+	const title = typeof body.path_with_namespace === "string" ? body.path_with_namespace : typeof body.name === "string" ? body.name : String(body.id);
+	return {
+		id: resourceId("project", body.id),
+		kind: "project",
+		title,
+		...typeof body.web_url === "string" ? { url: body.web_url } : {}
+	};
+};
+const accessLevel = (body) => {
+	const permissions = isRecord$1(body.permissions) ? body.permissions : {};
+	const level = (key) => {
+		const entry = permissions[key];
+		return isRecord$1(entry) && typeof entry.access_level === "number" ? entry.access_level : 0;
+	};
+	return Math.max(level("project_access"), level("group_access"));
+};
+/**
+* Projects as Bond resources, with IDs `project:<numeric id>`. Paths are
+* display data only. `list` returns projects where the token holds at least
+* Reporter; `validate` checks the access level each operation needs and
+* refuses writes to archived projects. An instance administrator without a
+* membership reports no access level and is treated as having none.
+*/
+const makeGitLabResourceCatalog = (options = {}) => {
+	const fetchImpl = options.fetch ?? globalThis.fetch;
+	return {
+		list: ({ config, token, query, cursor, limit }) => Effect.gen(function* () {
+			const perPage = Math.min(Math.max(limit ?? DEFAULT_PAGE, 1), MAX_PAGE);
+			const page = cursor !== void 0 && /^[1-9][0-9]*$/.test(cursor) ? cursor : "1";
+			const url = new URL("/api/v4/projects", config.baseUrl);
+			url.searchParams.set("membership", "true");
+			url.searchParams.set("min_access_level", "20");
+			url.searchParams.set("simple", "true");
+			url.searchParams.set("order_by", "last_activity_at");
+			url.searchParams.set("per_page", String(perPage));
+			url.searchParams.set("page", page);
+			if (query !== void 0 && query.trim() !== "") url.searchParams.set("search", query.trim());
+			const response = yield* requestJson(fetchImpl, url.toString(), { headers: bearer(token) });
+			if (response.status < 200 || response.status >= 300) return yield* Effect.fail(statusError("GitLab project list", response));
+			const items = (Array.isArray(response.body) ? response.body : []).flatMap((row) => {
+				const resource = toResource(row);
+				return resource === void 0 ? [] : [resource];
+			});
+			const next = response.headers?.get("x-next-page") ?? "";
+			return /^[1-9][0-9]*$/.test(next) ? {
+				items,
+				nextCursor: next
+			} : { items };
+		}),
+		validate: ({ config, token, resource, operations }) => Effect.gen(function* () {
+			const checked = checkResourceRequest(gitlabManifest, resource, operations);
+			if (!checked.ok) return checked;
+			if (!PROJECT_ID.test(checked.key)) return {
+				ok: false,
+				reason: "malformed_id",
+				message: "GitLab project resources use the numeric project ID"
+			};
+			const url = new URL(`/api/v4/projects/${checked.key}`, config.baseUrl);
+			const response = yield* requestJson(fetchImpl, url.toString(), { headers: bearer(token) });
+			if (response.status === 404 || response.status === 403) return {
+				ok: false,
+				reason: "not_found",
+				message: `Project ${checked.key} is not visible to this token`
+			};
+			if (response.status < 200 || response.status >= 300 || !isRecord$1(response.body)) return yield* Effect.fail(statusError("GitLab project lookup", response));
+			const project = toResource(response.body);
+			if (project === void 0 || project.id !== resource) return yield* Effect.fail(new ProviderError({
+				message: "GitLab project lookup returned a different project",
+				rejected: false
+			}));
+			const required = Math.max(0, ...operations.map((op) => GITLAB_MIN_ACCESS_LEVEL[op] ?? Infinity));
+			const held = accessLevel(response.body);
+			if (held < required) return {
+				ok: false,
+				reason: "insufficient_access",
+				message: `Needs GitLab access level ${required}; the token holds ${held}`
+			};
+			if (operations.some((op) => checked.kind.operations.find((o) => o.name === op)?.access === "write") && response.body.archived === true) return {
+				ok: false,
+				reason: "insufficient_access",
+				message: `Project ${checked.key} is archived`
+			};
+			return {
+				ok: true,
+				resource: project
+			};
+		})
+	};
+};
+/** The provider, manifest, and resource catalog a host registers for GitLab. */
+const makeGitLabBinding = (options = {}) => ({
+	manifest: gitlabManifest,
+	provider: makeGitLabBondProvider(options),
+	resources: makeGitLabResourceCatalog(options.fetch === void 0 ? {} : { fetch: options.fetch })
+});
+//#endregion
+//#region src/bond/integration/shared.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const sensitiveKeys = /* @__PURE__ */ new Set([
+	"access_token",
+	"authorization",
+	"client_secret",
+	"password",
+	"private_key",
+	"private_token",
+	"runners_token",
+	"secret",
+	"secret_token",
+	"token",
+	"webhook_secret"
+]);
+/** Webhook payloads are untrusted. Recursively remove conventional credential
+* keys before a provider snapshot can enter the durable event log. */
+const withoutGitLabCredentials = (value) => {
+	if (Array.isArray(value)) return value.map(withoutGitLabCredentials);
+	if (!isRecord(value)) return value;
+	return Object.fromEntries(Object.entries(value).flatMap(([key, nested]) => sensitiveKeys.has(key.toLowerCase()) ? [] : [[key, withoutGitLabCredentials(nested)]]));
+};
+const gitlabSource = (input) => ({
+	provider: "gitlab",
+	authority: input.authority,
+	...input.project === void 0 ? {} : { conversationId: input.project },
+	...input.threadId === void 0 ? {} : { threadId: input.threadId },
+	...input.messageId === void 0 ? {} : { messageId: input.messageId },
+	...input.uri === void 0 ? {} : { uri: input.uri }
+});
+const positiveInteger = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+const nonEmptyString = (value) => typeof value === "string" && value.length > 0;
+/** GitLab timestamps come as ISO 8601 or as `2026-08-23 08:00:00 UTC`. */
+const isoTimestamp = (...values) => {
+	for (const value of values) {
+		if (typeof value !== "string") continue;
+		const parsed = Date.parse(value.replace(/^(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2}:\d{2}) UTC$/, "$1T$2Z"));
+		if (Number.isFinite(parsed)) return new Date(parsed).toISOString();
+	}
+};
+//#endregion
+//#region src/bond/integration/client.ts
+const invalid = (message) => new IntegrationError({
+	message,
+	retryable: false
+});
+const validate = (value) => {
+	if (!isRecord(value) || !nonEmptyString(value.token) || !nonEmptyString(value.baseUrl)) return Effect.fail(invalid("GitLab credentials must include a baseUrl and a token"));
+	let url;
+	try {
+		url = new URL(value.baseUrl);
+	} catch {
+		return Effect.fail(invalid("GitLab baseUrl is not a URL"));
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") return Effect.fail(invalid("GitLab baseUrl must use http or https"));
+	return Effect.succeed({
+		baseUrl: url.href,
+		token: value.token
+	});
+};
+const makeGitLabCredentialsFor = (option) => {
+	if (typeof option === "object" && option !== null && !("resolve" in option)) {
+		const fixed = validate(option);
+		return () => fixed;
+	}
+	const resolver = typeof option === "function" ? makeCredentialResolver(({ authority }) => option(authority)) : option;
+	return (authority) => authority.length === 0 ? Effect.fail(invalid("GitLab authority is required to resolve credentials")) : Effect.suspend(() => resolver.resolve({
+		integrationId: "gitlab",
+		authority
+	})).pipe(Effect.mapError((cause) => new IntegrationError({
+		message: cause instanceof CredentialError ? cause.message : `Unable to resolve GitLab credentials for ${authority}`,
+		retryable: cause instanceof CredentialError ? cause.retryable : true,
+		cause
+	})), Effect.flatMap(validate));
+};
+const makeGitLabClient = (input) => {
+	const retryAtFrom = (response) => {
+		const retryAfter = response.headers.get("retry-after");
+		if (retryAfter !== null) {
+			const seconds = Number.parseFloat(retryAfter);
+			if (Number.isFinite(seconds) && seconds >= 0) {
+				const now = Date.parse(input.clock());
+				if (Number.isFinite(now)) return new Date(now + seconds * 1e3).toISOString();
+			}
+			const absolute = Date.parse(retryAfter);
+			if (Number.isFinite(absolute)) return new Date(absolute).toISOString();
+		}
+		if (response.status !== 429) return void 0;
+		const reset = Number.parseInt(response.headers.get("ratelimit-reset") ?? "", 10);
+		return Number.isSafeInteger(reset) && reset >= 0 ? (/* @__PURE__ */ new Date(reset * 1e3)).toISOString() : void 0;
+	};
+	/** Calls `/api/v4{path}` on the authority's instance. */
+	const request = (options) => {
+		const label = `GitLab ${options.method} ${options.path}`;
+		return input.credentialsFor(options.authority).pipe(Effect.flatMap(({ baseUrl, token }) => Effect.tryPromise({
+			try: () => input.fetch(new URL(`api/v4${options.path}`, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`), {
+				method: options.method,
+				headers: {
+					accept: "application/json",
+					authorization: `Bearer ${token}`,
+					...options.body === void 0 ? {} : { "content-type": "application/json; charset=utf-8" }
+				},
+				...options.body === void 0 ? {} : { body: JSON.stringify(options.body) }
+			}),
+			catch: (cause) => new IntegrationError({
+				message: `${label} request failed`,
+				retryable: true,
+				cause
+			})
+		})), Effect.flatMap((response) => {
+			const retryable = response.status === 429 || response.status >= 500;
+			const retryAt = retryAtFrom(response);
+			const failure = (message, cause) => new IntegrationError({
+				message,
+				retryable,
+				...retryAt === void 0 ? {} : { retryAt },
+				...cause === void 0 ? {} : { cause }
+			});
+			return Effect.tryPromise({
+				try: () => response.text(),
+				catch: (cause) => failure(`${label} response could not be read`, cause)
+			}).pipe(Effect.flatMap((text) => {
+				let payload = null;
+				if (text.length > 0) try {
+					payload = JSON.parse(text);
+				} catch (cause) {
+					return Effect.fail(response.ok ? failure(`${label} returned invalid JSON`, cause) : failure(`${label} failed with HTTP ${response.status}`));
+				}
+				if (!response.ok) return Effect.fail(failure(`${label} failed with HTTP ${response.status}`, payload));
+				if (!Schema.is(JsonValueSchema)(payload)) return Effect.fail(failure(`${label} returned non-portable data`));
+				return Effect.succeed({
+					payload,
+					headers: response.headers
+				});
+			}));
+		}));
+	};
+	return { request };
+};
+//#endregion
+//#region src/bond/integration/delivery.ts
+/** Every Effect operation `deliver` accepts. */
+const GITLAB_OPERATIONS = [
+	"merge_request.note.create",
+	"merge_request.discussion.reply",
+	"issue.note.create",
+	"issue.discussion.reply"
+];
+const fail = (message) => Effect.fail(new IntegrationError({
+	message,
+	retryable: false
+}));
+/**
+* Delivers GitLab Effects. Every input names the `authority` whose
+* credentials post the note, the `projectId` (numeric id or full path), the
+* merge request or issue `iid`, and a non-empty `body`. Discussion replies
+* also name the `discussionId`; replying to a single comment turns it into a
+* thread.
+*/
+const makeGitLabDelivery = (client) => (effect) => {
+	const operation = GITLAB_OPERATIONS.find((name) => name === effect.operation);
+	if (effect.integrationId !== "gitlab" || operation === void 0) return fail(`GitLab does not support the operation ${effect.operation}`);
+	if (!isRecord(effect.input)) return fail(`GitLab ${operation} requires an object input`);
+	const { authority, projectId, body, discussionId } = effect.input;
+	const [parent, iidKey] = operation.startsWith("merge_request.") ? ["merge_requests", "mergeRequestIid"] : ["issues", "issueIid"];
+	const iid = effect.input[iidKey];
+	const replying = operation.endsWith(".discussion.reply");
+	if (!nonEmptyString(authority) || !(positiveInteger(projectId) || nonEmptyString(projectId)) || !positiveInteger(iid) || !nonEmptyString(body) || replying && !nonEmptyString(discussionId)) return fail(`GitLab ${operation} requires authority, projectId, a positive ${iidKey}, ${replying ? "discussionId, " : ""}and a non-empty body`);
+	const base = `/projects/${encodeURIComponent(String(projectId))}/${parent}/${iid}`;
+	const path = replying ? `${base}/discussions/${encodeURIComponent(discussionId)}/notes` : `${base}/notes`;
+	return client.request({
+		authority,
+		method: "POST",
+		path,
+		body: { body }
+	}).pipe(Effect.map(({ payload }) => ({ providerReceipt: isRecord(payload) ? {
+		...positiveInteger(payload.id) ? { noteId: payload.id } : {},
+		...nonEmptyString(discussionId) ? { discussionId } : {}
+	} : null })));
+};
+//#endregion
+//#region src/bond/integration/events.ts
+const MERGE_REQUEST_ACTIONS = {
+	open: "opened",
+	reopen: "reopened",
+	update: "updated",
+	close: "closed",
+	merge: "merged",
+	approved: "approved",
+	unapproved: "unapproved",
+	approval: "approval_added",
+	unapproval: "approval_removed"
+};
+const NOTEABLE_KINDS = {
+	MergeRequest: "merge_request",
+	Issue: "issue",
+	Commit: "commit",
+	Snippet: "snippet"
+};
+const PIPELINE_STATUSES = [
+	"created",
+	"waiting_for_resource",
+	"preparing",
+	"pending",
+	"running",
+	"success",
+	"failed",
+	"canceled",
+	"skipped",
+	"manual",
+	"scheduled"
+];
+/** Every Event type `ingest` can produce. */
+const GITLAB_EVENT_TYPES = [
+	...Object.values(MERGE_REQUEST_ACTIONS).map((action) => `gitlab.merge_request.${action}`),
+	...Object.values(NOTEABLE_KINDS).flatMap((kind) => [`gitlab.${kind}.note.created`, `gitlab.${kind}.note.updated`]),
+	...PIPELINE_STATUSES.map((status) => `gitlab.pipeline.${status}`),
+	"gitlab.event.received"
+];
+const optional = (key, value) => value === void 0 ? {} : { [key]: value };
+const mergeRequest = (attributes) => {
+	const action = typeof attributes.action === "string" ? MERGE_REQUEST_ACTIONS[attributes.action] : void 0;
+	const iid = positiveInteger(attributes.iid) ? attributes.iid : void 0;
+	const lastCommit = isRecord(attributes.last_commit) ? attributes.last_commit : void 0;
+	const draft = typeof attributes.draft === "boolean" ? attributes.draft : typeof attributes.work_in_progress === "boolean" ? attributes.work_in_progress : void 0;
+	const uri = nonEmptyString(attributes.url) ? attributes.url : void 0;
+	const occurredAt = isoTimestamp(attributes.updated_at, attributes.created_at);
+	return {
+		type: action === void 0 ? "gitlab.event.received" : `gitlab.merge_request.${action}`,
+		...iid === void 0 ? {} : { threadId: `merge_request:${iid}` },
+		...uri === void 0 ? {} : { uri },
+		...occurredAt === void 0 ? {} : { occurredAt },
+		fields: {
+			resourceType: "merge_request",
+			...optional("mergeRequestIid", iid),
+			...optional("title", typeof attributes.title === "string" ? attributes.title : void 0),
+			...optional("draft", draft),
+			...optional("state", typeof attributes.state === "string" ? attributes.state : void 0),
+			...optional("sourceBranch", nonEmptyString(attributes.source_branch) ? attributes.source_branch : void 0),
+			...optional("targetBranch", nonEmptyString(attributes.target_branch) ? attributes.target_branch : void 0),
+			...optional("headSha", nonEmptyString(lastCommit?.id) ? lastCommit.id : void 0),
+			newCommits: attributes.action === "open" || attributes.action === "reopen" || attributes.action === "update" && nonEmptyString(attributes.oldrev)
+		}
+	};
+};
+const note = (attributes, payload) => {
+	const kind = typeof attributes.noteable_type === "string" ? NOTEABLE_KINDS[attributes.noteable_type] : void 0;
+	const action = attributes.action === void 0 || attributes.action === "create" ? "created" : attributes.action === "update" ? "updated" : void 0;
+	const parent = kind === "merge_request" ? payload.merge_request : kind === "issue" ? payload.issue : kind === "commit" ? payload.commit : kind === "snippet" ? payload.snippet : void 0;
+	const parentRecord = isRecord(parent) ? parent : void 0;
+	const parentIid = positiveInteger(parentRecord?.iid) ? parentRecord.iid : void 0;
+	const threadId = kind === "merge_request" || kind === "issue" ? parentIid === void 0 ? void 0 : `${kind}:${parentIid}` : kind === "commit" ? nonEmptyString(parentRecord?.id) ? `commit:${parentRecord.id}` : void 0 : kind === "snippet" && positiveInteger(parentRecord?.id) ? `snippet:${parentRecord.id}` : void 0;
+	const noteId = positiveInteger(attributes.id) ? attributes.id : void 0;
+	const uri = nonEmptyString(attributes.url) ? attributes.url : void 0;
+	const occurredAt = isoTimestamp(attributes.updated_at, attributes.created_at);
+	return {
+		type: kind === void 0 || action === void 0 ? "gitlab.event.received" : `gitlab.${kind}.note.${action}`,
+		...threadId === void 0 ? {} : { threadId },
+		...noteId === void 0 ? {} : { messageId: `note:${noteId}` },
+		...uri === void 0 ? {} : { uri },
+		...occurredAt === void 0 ? {} : { occurredAt },
+		fields: {
+			resourceType: "note",
+			...optional("noteId", noteId),
+			...optional("text", typeof attributes.note === "string" ? attributes.note : void 0),
+			...optional("discussionId", nonEmptyString(attributes.discussion_id) ? attributes.discussion_id : void 0),
+			...optional("noteableType", typeof attributes.noteable_type === "string" ? attributes.noteable_type : void 0),
+			...optional(kind === "issue" ? "issueIid" : "mergeRequestIid", kind === "merge_request" || kind === "issue" ? parentIid : void 0),
+			...optional("draft", kind === "merge_request" && typeof parentRecord?.draft === "boolean" ? parentRecord.draft : void 0),
+			system: attributes.system === true
+		}
+	};
+};
+const pipeline = (attributes, payload) => {
+	const status = PIPELINE_STATUSES.find((candidate) => candidate === attributes.status);
+	const id = positiveInteger(attributes.id) ? attributes.id : void 0;
+	const mergeRequestIid = isRecord(payload.merge_request) && positiveInteger(payload.merge_request.iid) ? payload.merge_request.iid : void 0;
+	const uri = nonEmptyString(attributes.url) ? attributes.url : void 0;
+	const occurredAt = isoTimestamp(attributes.finished_at, attributes.created_at);
+	return {
+		type: status === void 0 ? "gitlab.event.received" : `gitlab.pipeline.${status}`,
+		...mergeRequestIid !== void 0 ? { threadId: `merge_request:${mergeRequestIid}` } : id === void 0 ? {} : { threadId: `pipeline:${id}` },
+		...id === void 0 || status === void 0 ? {} : { messageId: `pipeline:${id}:${status}` },
+		...uri === void 0 ? {} : { uri },
+		...occurredAt === void 0 ? {} : { occurredAt },
+		fields: {
+			resourceType: "pipeline",
+			...optional("pipelineId", id),
+			...optional("status", status),
+			...optional("ref", nonEmptyString(attributes.ref) ? attributes.ref : void 0),
+			...optional("sha", nonEmptyString(attributes.sha) ? attributes.sha : void 0),
+			...optional("mergeRequestIid", mergeRequestIid)
+		}
+	};
+};
+const normalize = (payload) => {
+	const attributes = isRecord(payload.object_attributes) ? payload.object_attributes : void 0;
+	if (attributes !== void 0) {
+		if (payload.object_kind === "merge_request") return mergeRequest(attributes);
+		if (payload.object_kind === "note") return note(attributes, payload);
+		if (payload.object_kind === "pipeline") return pipeline(attributes, payload);
+	}
+	return {
+		type: "gitlab.event.received",
+		fields: {}
+	};
+};
+/**
+* Turns a verified `GitLabWebhookInput` into one WorkEvent. Inputs of another
+* kind produce no Events. The Event id combines the authority and the
+* delivery id, so a GitLab retry is the same Event.
+*/
+const normalizeGitLabEvents = (input, clock) => Effect.try({
+	try: () => {
+		if (!isRecord(input) || input.kind !== "gitlab.webhook" || !nonEmptyString(input.authority) || !nonEmptyString(input.eventName) || !nonEmptyString(input.deliveryId) || !isRecord(input.payload) || !Schema.is(JsonValueSchema)(input.payload)) return [];
+		const webhook = input;
+		const payload = webhook.payload;
+		const project = isRecord(payload.project) ? payload.project : void 0;
+		const projectId = positiveInteger(project?.id) ? project.id : positiveInteger(payload.project_id) ? payload.project_id : void 0;
+		const projectPath = nonEmptyString(project?.path_with_namespace) ? project.path_with_namespace : void 0;
+		const user = isRecord(payload.user) ? payload.user : void 0;
+		const actor = {
+			...optional("id", positiveInteger(user?.id) ? String(user.id) : void 0),
+			...optional("username", nonEmptyString(user?.username) ? user.username : void 0),
+			...optional("name", nonEmptyString(user?.name) ? user.name : void 0)
+		};
+		const normalized = normalize(payload);
+		const receivedAt = clock();
+		const id = `gitlab:${webhook.authority}:${webhook.deliveryId}`;
+		return [{
+			schemaVersion: "0.1",
+			id,
+			type: normalized.type,
+			occurredAt: normalized.occurredAt ?? receivedAt,
+			receivedAt,
+			idempotencyKey: id,
+			source: gitlabSource({
+				authority: webhook.authority,
+				...projectPath === void 0 ? {} : { project: projectPath },
+				...normalized.threadId === void 0 ? {} : { threadId: normalized.threadId },
+				...normalized.messageId === void 0 ? {} : { messageId: normalized.messageId },
+				...normalized.uri === void 0 ? {} : { uri: normalized.uri }
+			}),
+			payload: {
+				activation: "observation",
+				eventName: webhook.eventName,
+				...optional("objectKind", nonEmptyString(payload.object_kind) ? payload.object_kind : void 0),
+				authority: webhook.authority,
+				...optional("instance", webhook.instance),
+				...optional("projectId", projectId),
+				...optional("project", projectPath),
+				...optional("resource", projectId === void 0 ? void 0 : `project:${projectId}`),
+				...normalized.fields,
+				...Object.keys(actor).length === 0 ? {} : { actor }
+			},
+			raw: withoutGitLabCredentials(webhook.payload)
+		}];
+	},
+	catch: (cause) => new IntegrationError({
+		message: "Unable to normalize GitLab webhook",
+		retryable: false,
+		cause
+	})
+});
+//#endregion
+//#region src/bond/integration/http.ts
+var GitLabHttpIngressError = class extends Data.TaggedError("GitLabHttpIngressError") {};
+var GitLabHttpSubmissionError = class extends Data.TaggedError("GitLabHttpSubmissionError") {};
+const sha256 = async (value) => new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)));
+/**
+* Compares the `X-Gitlab-Token` header with the configured secret token in
+* constant time. Both values are hashed first, so the comparison does not
+* reveal the secret's length either. An empty configured token never matches.
+*/
+const verifyGitLabToken = (input) => Effect.tryPromise({
+	try: async () => {
+		if (input.webhookToken.length === 0) return false;
+		const [expected, received] = await Promise.all([sha256(input.webhookToken), sha256(input.received)]);
+		let difference = 0;
+		for (let index = 0; index < expected.length; index += 1) difference |= expected[index] ^ received[index];
+		return difference === 0;
+	},
+	catch: (cause) => new GitLabHttpIngressError({
+		message: "Unable to verify GitLab request",
+		status: 401,
+		cause
+	})
+});
+const header = (request, name) => {
+	const value = request.headers.get(name);
+	return value === null || value.length === 0 ? void 0 : value;
+};
+/**
+* Verifies and decodes one GitLab webhook request. The delivery id is the
+* first of `webhook-id` and `Idempotency-Key` (both stable across retries,
+* GitLab 17.4+) and `X-Gitlab-Event-UUID` (GitLab 14.8+).
+*/
+const decodeGitLabHttpRequest = (request, options) => Effect.gen(function* () {
+	if (!(yield* verifyGitLabToken({
+		webhookToken: options.webhookToken,
+		received: header(request, "x-gitlab-token") ?? ""
+	}))) return yield* new GitLabHttpIngressError({
+		message: "GitLab webhook token is invalid",
+		status: 401
+	});
+	const eventName = header(request, "x-gitlab-event");
+	const deliveryId = header(request, "webhook-id") ?? header(request, "idempotency-key") ?? header(request, "x-gitlab-event-uuid");
+	if (eventName === void 0 || deliveryId === void 0) return yield* new GitLabHttpIngressError({
+		message: "GitLab event and delivery id headers are required",
+		status: 400
+	});
+	const rawBody = yield* Effect.tryPromise({
+		try: () => request.text(),
+		catch: (cause) => new GitLabHttpIngressError({
+			message: "Unable to read GitLab request body",
+			status: 400,
+			cause
+		})
+	});
+	const payload = yield* Effect.try({
+		try: () => JSON.parse(rawBody),
+		catch: (cause) => new GitLabHttpIngressError({
+			message: "GitLab request body is malformed",
+			status: 400,
+			cause
+		})
+	});
+	if (!isRecord(payload) || !Schema.is(JsonValueSchema)(payload)) return yield* new GitLabHttpIngressError({
+		message: "GitLab request body must be a portable JSON object",
+		status: 400
+	});
+	const instance = header(request, "x-gitlab-instance");
+	return {
+		kind: "gitlab.webhook",
+		authority: options.authority,
+		eventName,
+		deliveryId,
+		...instance === void 0 ? {} : { instance },
+		payload
+	};
+});
+const jsonResponse = (body, status) => new Response(JSON.stringify(body), {
+	status,
+	headers: { "content-type": "application/json; charset=utf-8" }
+});
+/**
+* A webhook endpoint for one GitLab authority. Hosts that serve many
+* authorities from one route call `decodeGitLabHttpRequest` with the token
+* and authority they look up for the request instead.
+*/
+const makeGitLabHttpEndpoint = (options) => ({
+	method: "POST",
+	path: options.path ?? "/gitlab/events",
+	handle: (request) => Effect.runPromise(decodeGitLabHttpRequest(request, options).pipe(Effect.flatMap((input) => Effect.tryPromise({
+		try: () => options.submit(input),
+		catch: (cause) => new GitLabHttpSubmissionError({
+			message: "Unable to submit GitLab work",
+			status: 503,
+			cause
+		})
+	}).pipe(Effect.as(new Response(null, { status: 202 })))), Effect.catchAll((error) => Effect.succeed(jsonResponse({
+		ok: false,
+		error: error.message
+	}, error.status)))))
+});
+//#endregion
+//#region src/bond/integration/integration.ts
+/**
+* The GitLab work integration: `ingest` takes a `GitLabWebhookInput` from
+* `decodeGitLabHttpRequest`, and `deliver` posts merge request and issue
+* notes.
+*/
+const makeGitLabIntegration = (options) => {
+	const clock = options.clock ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+	const client = makeGitLabClient({
+		credentialsFor: makeGitLabCredentialsFor(options.credentials),
+		fetch: options.fetch ?? ((...args) => globalThis.fetch(...args)),
+		clock
+	});
+	return {
+		manifest: {
+			id: "gitlab",
+			displayName: "GitLab",
+			events: GITLAB_EVENT_TYPES,
+			operations: GITLAB_OPERATIONS
+		},
+		ingest: (input) => normalizeGitLabEvents(input, clock),
+		deliver: makeGitLabDelivery(client)
+	};
+};
+//#endregion
+//#region src/bond/integration/templates.ts
+const VERSION = "0.1.0";
+const agentField = {
+	type: "string",
+	minLength: 1,
+	title: "Agent",
+	"x-oma-widget": "agent"
+};
+const projectsField = {
+	type: "array",
+	items: {
+		type: "string",
+		minLength: 1
+	},
+	minItems: 1,
+	title: "Projects",
+	description: "Bond resource ids of the projects the Loop watches",
+	"x-oma-widget": "bond-resources",
+	"x-bond-provider": "gitlab"
+};
+const instructionsField = {
+	type: "string",
+	default: "",
+	title: "Extra instructions",
+	description: "Appended to the instructions the Agent receives"
+};
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const fields = (event) => isObject(event.payload) ? event.payload : {};
+const watched = (config, event) => {
+	const resource = fields(event).resource;
+	return typeof resource === "string" && Array.isArray(config.projects) && config.projects.includes(resource);
+};
+const mergeRequestTarget = (event) => {
+	const { projectId, mergeRequestIid } = fields(event);
+	return typeof projectId === "number" && typeof mergeRequestIid === "number" ? {
+		authority: event.source.authority,
+		projectId,
+		mergeRequestIid
+	} : void 0;
+};
+/**
+* One Session per merge request: both templates continue the same Work
+* Thread, so an Agent that reviewed a merge request remembers it when
+* mentioned there later.
+*/
+const sessionFor = (target) => {
+	const scopeId = `gitlab:${target.authority}:project:${target.projectId}`;
+	return {
+		scopeId,
+		workThreadId: `merge_request:${target.mergeRequestIid}`,
+		privacyPartition: scopeId
+	};
+};
+/** Runs one Agent Turn and posts its output as a merge request note. */
+const answer = async (work, target, instructions, reply) => {
+	const binding = sessionFor(target);
+	const capability = `gitlab.${reply.operation}`;
+	const context = await work.context.project({
+		scopeId: binding.scopeId,
+		workThreadId: binding.workThreadId,
+		items: [work.context.event(), work.context.value({
+			kind: "instructions",
+			value: instructions,
+			provenance: [{
+				sourceType: "loop-template",
+				sourceId: "gitlab"
+			}]
+		})],
+		grants: [capability]
+	});
+	const turn = await work.agent(String(work.config.agentId)).session(binding).turn({
+		context,
+		allow: [capability]
+	});
+	const body = typeof turn.output === "string" ? turn.output.trim() : "";
+	if (turn.outcome !== "completed" || body.length === 0) return work.react.none(turn.outcome === "completed" ? "The Agent produced no reply" : `The Agent Turn ended ${turn.outcome}`);
+	const note = await work.effect(context, {
+		integrationId: "gitlab",
+		operation: reply.operation,
+		input: {
+			authority: target.authority,
+			projectId: target.projectId,
+			mergeRequestIid: target.mergeRequestIid,
+			body,
+			...reply.operation === "merge_request.discussion.reply" ? { discussionId: reply.discussionId } : {}
+		}
+	});
+	return work.react.effects([note]);
+};
+const extra = (config) => typeof config.instructions === "string" && config.instructions.trim() !== "" ? `\n\n${config.instructions.trim()}` : "";
+/**
+* Reviews a merge request when it opens, reopens, or receives new commits,
+* and posts the review as a note. Title or label edits do not trigger a
+* review. Draft merge requests are skipped unless `skipDrafts` is false.
+*/
+const gitlabMergeRequestReview = defineLoop({
+	id: "gitlab-mr-review",
+	version: VERSION,
+	description: "Review merge requests when they open or receive new commits",
+	spec: {
+		sources: [
+			"gitlab.merge_request.opened",
+			"gitlab.merge_request.reopened",
+			"gitlab.merge_request.updated"
+		],
+		workThread: "gitlab.merge_request",
+		session: "per-work-thread",
+		reaction: "effects"
+	},
+	runAs: "app",
+	requiredBonds: [{
+		provider: "gitlab",
+		operations: ["fetch", "comment_mr"]
+	}],
+	configSchema: {
+		type: "object",
+		properties: {
+			agentId: agentField,
+			projects: projectsField,
+			skipDrafts: {
+				type: "boolean",
+				default: true,
+				title: "Skip draft merge requests"
+			},
+			instructions: instructionsField
+		},
+		required: ["agentId", "projects"]
+	}
+}, (app) => app.on([
+	"gitlab.merge_request.opened",
+	"gitlab.merge_request.reopened",
+	"gitlab.merge_request.updated"
+], (work) => {
+	const target = mergeRequestTarget(work.event);
+	const { draft, newCommits, project } = fields(work.event);
+	if (target === void 0) return work.react.none("Not a merge request Event");
+	if (!watched(work.config, work.event)) return work.react.none("Project is not watched");
+	if (newCommits !== true) return work.react.none("No new commits");
+	if (draft === true && work.config.skipDrafts !== false) return work.react.none("Draft merge request");
+	return answer(work, target, `Review merge request !${target.mergeRequestIid} in ${String(project ?? target.projectId)}. Fetch the source branch through the GitLab Bond, read the diff against the target branch, and reply with a concise review: correctness problems first, then risks, then optional suggestions. Your reply is posted as a merge request note.` + extra(work.config), { operation: "merge_request.note.create" });
+}));
+const mentionPattern = (username) => new RegExp(`(^|[^\\w@.-])@${username.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w.-])`, "i");
+/**
+* Answers a merge request comment that mentions the Agent's GitLab user, in
+* the same thread. System notes and the Agent's own notes are ignored, so a
+* reply never triggers another reply.
+*/
+const gitlabMention = defineLoop({
+	id: "gitlab-mention",
+	version: VERSION,
+	description: "Answer merge request comments that mention the Agent",
+	spec: {
+		sources: ["gitlab.merge_request.note.created"],
+		workThread: "gitlab.merge_request",
+		session: "per-work-thread",
+		reaction: "effects"
+	},
+	runAs: "app",
+	requiredBonds: [{
+		provider: "gitlab",
+		operations: ["fetch", "comment_mr"]
+	}],
+	configSchema: {
+		type: "object",
+		properties: {
+			agentId: agentField,
+			projects: projectsField,
+			username: {
+				type: "string",
+				minLength: 1,
+				title: "GitLab username",
+				description: "The app principal's username, without @. Comments that mention it are answered."
+			},
+			instructions: instructionsField
+		},
+		required: [
+			"agentId",
+			"projects",
+			"username"
+		]
+	}
+}, (app, { config }) => {
+	const username = String(config.username).replace(/^@/, "");
+	const mentions = mentionPattern(username);
+	app.on("gitlab.merge_request.note.created", (work) => {
+		const target = mergeRequestTarget(work.event);
+		const { text, system, discussionId, actor } = fields(work.event);
+		const author = isObject(actor) ? actor.username : void 0;
+		if (target === void 0) return work.react.none("Not a merge request comment");
+		if (!watched(work.config, work.event)) return work.react.none("Project is not watched");
+		if (system === true) return work.react.none("System note");
+		if (typeof author === "string" && author.toLowerCase() === username.toLowerCase()) return work.react.none("The Agent's own note");
+		if (typeof text !== "string" || !mentions.test(text)) return work.react.none("The Agent is not mentioned");
+		return answer(work, target, `@${String(author ?? "someone")} mentioned you (@${username}) in a comment on merge request !${target.mergeRequestIid}. Answer the comment. Fetch the code through the GitLab Bond if you need it. Your reply is posted in the same thread.` + extra(work.config), typeof discussionId === "string" && discussionId.length > 0 ? {
+			operation: "merge_request.discussion.reply",
+			discussionId
+		} : { operation: "merge_request.note.create" });
+	});
+});
+/** The GitLab templates, in the order a console lists them. */
+const gitlabTemplates = [gitlabMergeRequestReview, gitlabMention];
+//#endregion
+export { GITLAB_EVENT_TYPES, GITLAB_MIN_ACCESS_LEVEL, GITLAB_OPERATIONS, GitLabHttpIngressError, GitLabHttpSubmissionError, ZERO_OID, assistedByTrailer, authorizationUrl, canonicalOrigin, classifyGitLabRequest, coAuthoredByTrailer, commitAuthor, createPkce, decodeGitLabHttpRequest, discoverInstance, evaluatePush, exchangeCode, gitlabManifest, gitlabMention, gitlabMergeRequestReview, gitlabTemplates, isValidRefName, makeGitLabBinding, makeGitLabBondProvider, makeGitLabClient, makeGitLabCredentialsFor, makeGitLabDelivery, makeGitLabHttpEndpoint, makeGitLabIntegration, makeGitLabResourceCatalog, makeReceivePackHeadParser, mergeRequestBodyProblem, mergeRequestFooter, mergeRequestPushOptions, normalizeGitLabEvents, parseReceivePackHead, readTokenInfo, readUser, refreshAccessToken, revokeSelfToken, revokeToken, tokenExpiryInstant, validateBotCredential, validatePersonalAccessToken, verifyGitLabToken };
+
+//# sourceMappingURL=index.js.map