@openma/matter-gitlab 0.1.0 → 0.2.0

package/dist/bond/index.js

@@ -1,7 +1,11 @@
-import { ProviderError } from "@openma/matter/bond";
-import { Effect } from "effect";
+import { ProviderError, checkResourceRequest, resourceId } from "@openma/matter/bond";
+import { Data, Effect, Schema } from "effect";
+import { JsonValueSchema } from "@openma/matter";
+import { CredentialError, makeCredentialResolver } from "@openma/matter/credentials";
+import { IntegrationError } from "@openma/matter/integration";
+import { defineLoop } from "@openma/matter-loop";
 //#region src/bond/http.ts
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /**
 * Normalizes a GitLab instance URL to its canonical https origin. Rejects
 * plain http except for loopback hosts, and rejects paths, credentials,
@@ -31,7 +35,8 @@ const requestJson = (fetchImpl, url, init) => Effect.tryPromise({
 		}
 		return {
 			status: response.status,
-			body
+			body,
+			headers: response.headers
 		};
 	},
 	catch: (cause) => new ProviderError({
@@ -48,7 +53,7 @@ const bearer = (token) => ({ authorization: `Bearer ${token}` });
 * configuration or transport problems and must not end a link.
 */
 const statusError = (what, response) => {
-	const error = isRecord(response.body) && typeof response.body.error === "string" ? response.body.error : void 0;
+	const error = isRecord$1(response.body) && typeof response.body.error === "string" ? response.body.error : void 0;
 	return new ProviderError({
 		message: `${what} failed with HTTP ${response.status}${error === void 0 ? "" : ` (${error})`}`,
 		rejected: error === "invalid_grant",
@@ -80,7 +85,7 @@ const discoverInstance = (origin, fetchImpl = globalThis.fetch) => Effect.gen(fu
 		method: "GET",
 		headers: { accept: "application/json" }
 	});
-	if (response.status !== 200 || !isRecord(response.body)) return yield* Effect.fail(statusError("OIDC discovery", response));
+	if (response.status !== 200 || !isRecord$1(response.body)) return yield* Effect.fail(statusError("OIDC discovery", response));
 	const d = response.body;
 	const list = (key) => Array.isArray(d[key]) ? d[key].filter((v) => typeof v === "string") : [];
 	const problems = [];
@@ -117,7 +122,7 @@ const authorizationUrl = (input) => `${canonicalOrigin(input.origin)}/oauth/auth
 	code_challenge_method: "S256"
 }).toString()}`;
 const tokenGrant = (body, now) => {
-	if (!isRecord(body) || typeof body.access_token !== "string") return void 0;
+	if (!isRecord$1(body) || typeof body.access_token !== "string") return void 0;
 	const createdMs = typeof body.created_at === "number" ? body.created_at * 1e3 : Date.parse(now);
 	return {
 		accessToken: body.access_token,
@@ -193,8 +198,8 @@ const readUser = (origin, token, fetchImpl = globalThis.fetch) => Effect.gen(fun
 		}
 	});
 	const b = response.body;
-	if (response.status !== 200 || !isRecord(b) || typeof b.id !== "number") return yield* Effect.fail(statusError("Reading the GitLab user", response));
-	const identities = Array.isArray(b.identities) ? b.identities.flatMap((i) => isRecord(i) && typeof i.provider === "string" && typeof i.extern_uid === "string" ? [{
+	if (response.status !== 200 || !isRecord$1(b) || typeof b.id !== "number") return yield* Effect.fail(statusError("Reading the GitLab user", response));
+	const identities = Array.isArray(b.identities) ? b.identities.flatMap((i) => isRecord$1(i) && typeof i.provider === "string" && typeof i.extern_uid === "string" ? [{
 		provider: i.provider,
 		externUid: i.extern_uid
 	}] : []) : [];
@@ -216,7 +221,7 @@ const readTokenInfo = (origin, token, fetchImpl = globalThis.fetch) => Effect.ge
 		}
 	});
 	const b = response.body;
-	if (response.status !== 200 || !isRecord(b) || typeof b.id !== "number") return yield* Effect.fail(statusError("Reading token metadata", response));
+	if (response.status !== 200 || !isRecord$1(b) || typeof b.id !== "number") return yield* Effect.fail(statusError("Reading token metadata", response));
 	return {
 		id: String(b.id),
 		name: typeof b.name === "string" ? b.name : "",
@@ -633,6 +638,904 @@ const makeGitLabBondProvider = (options = {}) => {
 	};
 };
 //#endregion
-export { ZERO_OID, assistedByTrailer, authorizationUrl, canonicalOrigin, classifyGitLabRequest, coAuthoredByTrailer, commitAuthor, createPkce, discoverInstance, evaluatePush, exchangeCode, isValidRefName, makeGitLabBondProvider, makeReceivePackHeadParser, mergeRequestBodyProblem, mergeRequestFooter, mergeRequestPushOptions, parseReceivePackHead, readTokenInfo, readUser, refreshAccessToken, revokeSelfToken, revokeToken, tokenExpiryInstant, validateBotCredential, validatePersonalAccessToken };
+//#region src/bond/resources.ts
+/** Minimum GitLab access level per operation: 20 Reporter, 30 Developer. */
+const GITLAB_MIN_ACCESS_LEVEL = {
+	fetch: 20,
+	read: 20,
+	push: 30,
+	open_mr: 30,
+	comment_mr: 30
+};
+const gitlabManifest = {
+	provider: "gitlab",
+	title: "GitLab",
+	docsUrl: "https://docs.gitlab.com/integration/oauth_provider/",
+	setupSchema: {
+		type: "object",
+		properties: {
+			baseUrl: {
+				type: "string",
+				title: "Instance URL",
+				format: "uri",
+				description: "Canonical https origin, such as https://gitlab.example.com"
+			},
+			oauthClientId: {
+				type: "string",
+				title: "OAuth application ID",
+				description: "Optional. Without an OAuth application, users link with personal access tokens."
+			},
+			oauthClientSecret: {
+				type: "string",
+				title: "OAuth application secret",
+				"x-secret": true
+			},
+			linkMethodPolicy: {
+				type: "string",
+				title: "Link methods",
+				enum: [
+					"pat_only",
+					"oauth_only",
+					"oauth_preferred"
+				],
+				default: "oauth_preferred"
+			},
+			principalPolicy: {
+				type: "string",
+				title: "Principal policy",
+				enum: [
+					"user_only",
+					"user",
+					"app"
+				],
+				default: "user_only"
+			},
+			maxPatLifetimeDays: {
+				type: "integer",
+				title: "Maximum personal access token lifetime, in days",
+				minimum: 1,
+				maximum: 365,
+				default: 90
+			},
+			allowUserPrincipalOutput: {
+				type: "boolean",
+				title: "Allow writes as the linked user",
+				default: false
+			}
+		},
+		required: [
+			"baseUrl",
+			"linkMethodPolicy",
+			"principalPolicy"
+		]
+	},
+	linkMethods: ["oauth", "pat"],
+	resourceKinds: [{
+		kind: "project",
+		title: "Project",
+		operations: [
+			{
+				name: "fetch",
+				description: "Clone and fetch over git",
+				access: "read"
+			},
+			{
+				name: "read",
+				description: "Read the project through the REST API",
+				access: "read"
+			},
+			{
+				name: "push",
+				description: "Push branches",
+				access: "write"
+			},
+			{
+				name: "open_mr",
+				description: "Open merge requests",
+				access: "write"
+			},
+			{
+				name: "comment_mr",
+				description: "Comment on merge requests",
+				access: "write"
+			}
+		]
+	}]
+};
+const PROJECT_ID = /^[1-9][0-9]{0,18}$/;
+const DEFAULT_PAGE = 20;
+const MAX_PAGE = 100;
+const toResource = (body) => {
+	if (!isRecord$1(body) || typeof body.id !== "number") return void 0;
+	const title = typeof body.path_with_namespace === "string" ? body.path_with_namespace : typeof body.name === "string" ? body.name : String(body.id);
+	return {
+		id: resourceId("project", body.id),
+		kind: "project",
+		title,
+		...typeof body.web_url === "string" ? { url: body.web_url } : {}
+	};
+};
+const accessLevel = (body) => {
+	const permissions = isRecord$1(body.permissions) ? body.permissions : {};
+	const level = (key) => {
+		const entry = permissions[key];
+		return isRecord$1(entry) && typeof entry.access_level === "number" ? entry.access_level : 0;
+	};
+	return Math.max(level("project_access"), level("group_access"));
+};
+/**
+* Projects as Bond resources, with IDs `project:<numeric id>`. Paths are
+* display data only. `list` returns projects where the token holds at least
+* Reporter; `validate` checks the access level each operation needs and
+* refuses writes to archived projects. An instance administrator without a
+* membership reports no access level and is treated as having none.
+*/
+const makeGitLabResourceCatalog = (options = {}) => {
+	const fetchImpl = options.fetch ?? globalThis.fetch;
+	return {
+		list: ({ config, token, query, cursor, limit }) => Effect.gen(function* () {
+			const perPage = Math.min(Math.max(limit ?? DEFAULT_PAGE, 1), MAX_PAGE);
+			const page = cursor !== void 0 && /^[1-9][0-9]*$/.test(cursor) ? cursor : "1";
+			const url = new URL("/api/v4/projects", config.baseUrl);
+			url.searchParams.set("membership", "true");
+			url.searchParams.set("min_access_level", "20");
+			url.searchParams.set("simple", "true");
+			url.searchParams.set("order_by", "last_activity_at");
+			url.searchParams.set("per_page", String(perPage));
+			url.searchParams.set("page", page);
+			if (query !== void 0 && query.trim() !== "") url.searchParams.set("search", query.trim());
+			const response = yield* requestJson(fetchImpl, url.toString(), { headers: bearer(token) });
+			if (response.status < 200 || response.status >= 300) return yield* Effect.fail(statusError("GitLab project list", response));
+			const items = (Array.isArray(response.body) ? response.body : []).flatMap((row) => {
+				const resource = toResource(row);
+				return resource === void 0 ? [] : [resource];
+			});
+			const next = response.headers?.get("x-next-page") ?? "";
+			return /^[1-9][0-9]*$/.test(next) ? {
+				items,
+				nextCursor: next
+			} : { items };
+		}),
+		validate: ({ config, token, resource, operations }) => Effect.gen(function* () {
+			const checked = checkResourceRequest(gitlabManifest, resource, operations);
+			if (!checked.ok) return checked;
+			if (!PROJECT_ID.test(checked.key)) return {
+				ok: false,
+				reason: "malformed_id",
+				message: "GitLab project resources use the numeric project ID"
+			};
+			const url = new URL(`/api/v4/projects/${checked.key}`, config.baseUrl);
+			const response = yield* requestJson(fetchImpl, url.toString(), { headers: bearer(token) });
+			if (response.status === 404 || response.status === 403) return {
+				ok: false,
+				reason: "not_found",
+				message: `Project ${checked.key} is not visible to this token`
+			};
+			if (response.status < 200 || response.status >= 300 || !isRecord$1(response.body)) return yield* Effect.fail(statusError("GitLab project lookup", response));
+			const project = toResource(response.body);
+			if (project === void 0 || project.id !== resource) return yield* Effect.fail(new ProviderError({
+				message: "GitLab project lookup returned a different project",
+				rejected: false
+			}));
+			const required = Math.max(0, ...operations.map((op) => GITLAB_MIN_ACCESS_LEVEL[op] ?? Infinity));
+			const held = accessLevel(response.body);
+			if (held < required) return {
+				ok: false,
+				reason: "insufficient_access",
+				message: `Needs GitLab access level ${required}; the token holds ${held}`
+			};
+			if (operations.some((op) => checked.kind.operations.find((o) => o.name === op)?.access === "write") && response.body.archived === true) return {
+				ok: false,
+				reason: "insufficient_access",
+				message: `Project ${checked.key} is archived`
+			};
+			return {
+				ok: true,
+				resource: project
+			};
+		})
+	};
+};
+/** The provider, manifest, and resource catalog a host registers for GitLab. */
+const makeGitLabBinding = (options = {}) => ({
+	manifest: gitlabManifest,
+	provider: makeGitLabBondProvider(options),
+	resources: makeGitLabResourceCatalog(options.fetch === void 0 ? {} : { fetch: options.fetch })
+});
+//#endregion
+//#region src/bond/integration/shared.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const sensitiveKeys = /* @__PURE__ */ new Set([
+	"access_token",
+	"authorization",
+	"client_secret",
+	"password",
+	"private_key",
+	"private_token",
+	"runners_token",
+	"secret",
+	"secret_token",
+	"token",
+	"webhook_secret"
+]);
+/** Webhook payloads are untrusted. Recursively remove conventional credential
+* keys before a provider snapshot can enter the durable event log. */
+const withoutGitLabCredentials = (value) => {
+	if (Array.isArray(value)) return value.map(withoutGitLabCredentials);
+	if (!isRecord(value)) return value;
+	return Object.fromEntries(Object.entries(value).flatMap(([key, nested]) => sensitiveKeys.has(key.toLowerCase()) ? [] : [[key, withoutGitLabCredentials(nested)]]));
+};
+const gitlabSource = (input) => ({
+	provider: "gitlab",
+	authority: input.authority,
+	...input.project === void 0 ? {} : { conversationId: input.project },
+	...input.threadId === void 0 ? {} : { threadId: input.threadId },
+	...input.messageId === void 0 ? {} : { messageId: input.messageId },
+	...input.uri === void 0 ? {} : { uri: input.uri }
+});
+const positiveInteger = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+const nonEmptyString = (value) => typeof value === "string" && value.length > 0;
+/** GitLab timestamps come as ISO 8601 or as `2026-08-23 08:00:00 UTC`. */
+const isoTimestamp = (...values) => {
+	for (const value of values) {
+		if (typeof value !== "string") continue;
+		const parsed = Date.parse(value.replace(/^(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2}:\d{2}) UTC$/, "$1T$2Z"));
+		if (Number.isFinite(parsed)) return new Date(parsed).toISOString();
+	}
+};
+//#endregion
+//#region src/bond/integration/client.ts
+const invalid = (message) => new IntegrationError({
+	message,
+	retryable: false
+});
+const validate = (value) => {
+	if (!isRecord(value) || !nonEmptyString(value.token) || !nonEmptyString(value.baseUrl)) return Effect.fail(invalid("GitLab credentials must include a baseUrl and a token"));
+	let url;
+	try {
+		url = new URL(value.baseUrl);
+	} catch {
+		return Effect.fail(invalid("GitLab baseUrl is not a URL"));
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") return Effect.fail(invalid("GitLab baseUrl must use http or https"));
+	return Effect.succeed({
+		baseUrl: url.href,
+		token: value.token
+	});
+};
+const makeGitLabCredentialsFor = (option) => {
+	if (typeof option === "object" && option !== null && !("resolve" in option)) {
+		const fixed = validate(option);
+		return () => fixed;
+	}
+	const resolver = typeof option === "function" ? makeCredentialResolver(({ authority }) => option(authority)) : option;
+	return (authority) => authority.length === 0 ? Effect.fail(invalid("GitLab authority is required to resolve credentials")) : Effect.suspend(() => resolver.resolve({
+		integrationId: "gitlab",
+		authority
+	})).pipe(Effect.mapError((cause) => new IntegrationError({
+		message: cause instanceof CredentialError ? cause.message : `Unable to resolve GitLab credentials for ${authority}`,
+		retryable: cause instanceof CredentialError ? cause.retryable : true,
+		cause
+	})), Effect.flatMap(validate));
+};
+const makeGitLabClient = (input) => {
+	const retryAtFrom = (response) => {
+		const retryAfter = response.headers.get("retry-after");
+		if (retryAfter !== null) {
+			const seconds = Number.parseFloat(retryAfter);
+			if (Number.isFinite(seconds) && seconds >= 0) {
+				const now = Date.parse(input.clock());
+				if (Number.isFinite(now)) return new Date(now + seconds * 1e3).toISOString();
+			}
+			const absolute = Date.parse(retryAfter);
+			if (Number.isFinite(absolute)) return new Date(absolute).toISOString();
+		}
+		if (response.status !== 429) return void 0;
+		const reset = Number.parseInt(response.headers.get("ratelimit-reset") ?? "", 10);
+		return Number.isSafeInteger(reset) && reset >= 0 ? (/* @__PURE__ */ new Date(reset * 1e3)).toISOString() : void 0;
+	};
+	/** Calls `/api/v4{path}` on the authority's instance. */
+	const request = (options) => {
+		const label = `GitLab ${options.method} ${options.path}`;
+		return input.credentialsFor(options.authority).pipe(Effect.flatMap(({ baseUrl, token }) => Effect.tryPromise({
+			try: () => input.fetch(new URL(`api/v4${options.path}`, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`), {
+				method: options.method,
+				headers: {
+					accept: "application/json",
+					authorization: `Bearer ${token}`,
+					...options.body === void 0 ? {} : { "content-type": "application/json; charset=utf-8" }
+				},
+				...options.body === void 0 ? {} : { body: JSON.stringify(options.body) }
+			}),
+			catch: (cause) => new IntegrationError({
+				message: `${label} request failed`,
+				retryable: true,
+				cause
+			})
+		})), Effect.flatMap((response) => {
+			const retryable = response.status === 429 || response.status >= 500;
+			const retryAt = retryAtFrom(response);
+			const failure = (message, cause) => new IntegrationError({
+				message,
+				retryable,
+				...retryAt === void 0 ? {} : { retryAt },
+				...cause === void 0 ? {} : { cause }
+			});
+			return Effect.tryPromise({
+				try: () => response.text(),
+				catch: (cause) => failure(`${label} response could not be read`, cause)
+			}).pipe(Effect.flatMap((text) => {
+				let payload = null;
+				if (text.length > 0) try {
+					payload = JSON.parse(text);
+				} catch (cause) {
+					return Effect.fail(response.ok ? failure(`${label} returned invalid JSON`, cause) : failure(`${label} failed with HTTP ${response.status}`));
+				}
+				if (!response.ok) return Effect.fail(failure(`${label} failed with HTTP ${response.status}`, payload));
+				if (!Schema.is(JsonValueSchema)(payload)) return Effect.fail(failure(`${label} returned non-portable data`));
+				return Effect.succeed({
+					payload,
+					headers: response.headers
+				});
+			}));
+		}));
+	};
+	return { request };
+};
+//#endregion
+//#region src/bond/integration/delivery.ts
+/** Every Effect operation `deliver` accepts. */
+const GITLAB_OPERATIONS = [
+	"merge_request.note.create",
+	"merge_request.discussion.reply",
+	"issue.note.create",
+	"issue.discussion.reply"
+];
+const fail = (message) => Effect.fail(new IntegrationError({
+	message,
+	retryable: false
+}));
+/**
+* Delivers GitLab Effects. Every input names the `authority` whose
+* credentials post the note, the `projectId` (numeric id or full path), the
+* merge request or issue `iid`, and a non-empty `body`. Discussion replies
+* also name the `discussionId`; replying to a single comment turns it into a
+* thread.
+*/
+const makeGitLabDelivery = (client) => (effect) => {
+	const operation = GITLAB_OPERATIONS.find((name) => name === effect.operation);
+	if (effect.integrationId !== "gitlab" || operation === void 0) return fail(`GitLab does not support the operation ${effect.operation}`);
+	if (!isRecord(effect.input)) return fail(`GitLab ${operation} requires an object input`);
+	const { authority, projectId, body, discussionId } = effect.input;
+	const [parent, iidKey] = operation.startsWith("merge_request.") ? ["merge_requests", "mergeRequestIid"] : ["issues", "issueIid"];
+	const iid = effect.input[iidKey];
+	const replying = operation.endsWith(".discussion.reply");
+	if (!nonEmptyString(authority) || !(positiveInteger(projectId) || nonEmptyString(projectId)) || !positiveInteger(iid) || !nonEmptyString(body) || replying && !nonEmptyString(discussionId)) return fail(`GitLab ${operation} requires authority, projectId, a positive ${iidKey}, ${replying ? "discussionId, " : ""}and a non-empty body`);
+	const base = `/projects/${encodeURIComponent(String(projectId))}/${parent}/${iid}`;
+	const path = replying ? `${base}/discussions/${encodeURIComponent(discussionId)}/notes` : `${base}/notes`;
+	return client.request({
+		authority,
+		method: "POST",
+		path,
+		body: { body }
+	}).pipe(Effect.map(({ payload }) => ({ providerReceipt: isRecord(payload) ? {
+		...positiveInteger(payload.id) ? { noteId: payload.id } : {},
+		...nonEmptyString(discussionId) ? { discussionId } : {}
+	} : null })));
+};
+//#endregion
+//#region src/bond/integration/events.ts
+const MERGE_REQUEST_ACTIONS = {
+	open: "opened",
+	reopen: "reopened",
+	update: "updated",
+	close: "closed",
+	merge: "merged",
+	approved: "approved",
+	unapproved: "unapproved",
+	approval: "approval_added",
+	unapproval: "approval_removed"
+};
+const NOTEABLE_KINDS = {
+	MergeRequest: "merge_request",
+	Issue: "issue",
+	Commit: "commit",
+	Snippet: "snippet"
+};
+const PIPELINE_STATUSES = [
+	"created",
+	"waiting_for_resource",
+	"preparing",
+	"pending",
+	"running",
+	"success",
+	"failed",
+	"canceled",
+	"skipped",
+	"manual",
+	"scheduled"
+];
+/** Every Event type `ingest` can produce. */
+const GITLAB_EVENT_TYPES = [
+	...Object.values(MERGE_REQUEST_ACTIONS).map((action) => `gitlab.merge_request.${action}`),
+	...Object.values(NOTEABLE_KINDS).flatMap((kind) => [`gitlab.${kind}.note.created`, `gitlab.${kind}.note.updated`]),
+	...PIPELINE_STATUSES.map((status) => `gitlab.pipeline.${status}`),
+	"gitlab.event.received"
+];
+const optional = (key, value) => value === void 0 ? {} : { [key]: value };
+const mergeRequest = (attributes) => {
+	const action = typeof attributes.action === "string" ? MERGE_REQUEST_ACTIONS[attributes.action] : void 0;
+	const iid = positiveInteger(attributes.iid) ? attributes.iid : void 0;
+	const lastCommit = isRecord(attributes.last_commit) ? attributes.last_commit : void 0;
+	const draft = typeof attributes.draft === "boolean" ? attributes.draft : typeof attributes.work_in_progress === "boolean" ? attributes.work_in_progress : void 0;
+	const uri = nonEmptyString(attributes.url) ? attributes.url : void 0;
+	const occurredAt = isoTimestamp(attributes.updated_at, attributes.created_at);
+	return {
+		type: action === void 0 ? "gitlab.event.received" : `gitlab.merge_request.${action}`,
+		...iid === void 0 ? {} : { threadId: `merge_request:${iid}` },
+		...uri === void 0 ? {} : { uri },
+		...occurredAt === void 0 ? {} : { occurredAt },
+		fields: {
+			resourceType: "merge_request",
+			...optional("mergeRequestIid", iid),
+			...optional("title", typeof attributes.title === "string" ? attributes.title : void 0),
+			...optional("draft", draft),
+			...optional("state", typeof attributes.state === "string" ? attributes.state : void 0),
+			...optional("sourceBranch", nonEmptyString(attributes.source_branch) ? attributes.source_branch : void 0),
+			...optional("targetBranch", nonEmptyString(attributes.target_branch) ? attributes.target_branch : void 0),
+			...optional("headSha", nonEmptyString(lastCommit?.id) ? lastCommit.id : void 0),
+			newCommits: attributes.action === "open" || attributes.action === "reopen" || attributes.action === "update" && nonEmptyString(attributes.oldrev)
+		}
+	};
+};
+const note = (attributes, payload) => {
+	const kind = typeof attributes.noteable_type === "string" ? NOTEABLE_KINDS[attributes.noteable_type] : void 0;
+	const action = attributes.action === void 0 || attributes.action === "create" ? "created" : attributes.action === "update" ? "updated" : void 0;
+	const parent = kind === "merge_request" ? payload.merge_request : kind === "issue" ? payload.issue : kind === "commit" ? payload.commit : kind === "snippet" ? payload.snippet : void 0;
+	const parentRecord = isRecord(parent) ? parent : void 0;
+	const parentIid = positiveInteger(parentRecord?.iid) ? parentRecord.iid : void 0;
+	const threadId = kind === "merge_request" || kind === "issue" ? parentIid === void 0 ? void 0 : `${kind}:${parentIid}` : kind === "commit" ? nonEmptyString(parentRecord?.id) ? `commit:${parentRecord.id}` : void 0 : kind === "snippet" && positiveInteger(parentRecord?.id) ? `snippet:${parentRecord.id}` : void 0;
+	const noteId = positiveInteger(attributes.id) ? attributes.id : void 0;
+	const uri = nonEmptyString(attributes.url) ? attributes.url : void 0;
+	const occurredAt = isoTimestamp(attributes.updated_at, attributes.created_at);
+	return {
+		type: kind === void 0 || action === void 0 ? "gitlab.event.received" : `gitlab.${kind}.note.${action}`,
+		...threadId === void 0 ? {} : { threadId },
+		...noteId === void 0 ? {} : { messageId: `note:${noteId}` },
+		...uri === void 0 ? {} : { uri },
+		...occurredAt === void 0 ? {} : { occurredAt },
+		fields: {
+			resourceType: "note",
+			...optional("noteId", noteId),
+			...optional("text", typeof attributes.note === "string" ? attributes.note : void 0),
+			...optional("discussionId", nonEmptyString(attributes.discussion_id) ? attributes.discussion_id : void 0),
+			...optional("noteableType", typeof attributes.noteable_type === "string" ? attributes.noteable_type : void 0),
+			...optional(kind === "issue" ? "issueIid" : "mergeRequestIid", kind === "merge_request" || kind === "issue" ? parentIid : void 0),
+			...optional("draft", kind === "merge_request" && typeof parentRecord?.draft === "boolean" ? parentRecord.draft : void 0),
+			system: attributes.system === true
+		}
+	};
+};
+const pipeline = (attributes, payload) => {
+	const status = PIPELINE_STATUSES.find((candidate) => candidate === attributes.status);
+	const id = positiveInteger(attributes.id) ? attributes.id : void 0;
+	const mergeRequestIid = isRecord(payload.merge_request) && positiveInteger(payload.merge_request.iid) ? payload.merge_request.iid : void 0;
+	const uri = nonEmptyString(attributes.url) ? attributes.url : void 0;
+	const occurredAt = isoTimestamp(attributes.finished_at, attributes.created_at);
+	return {
+		type: status === void 0 ? "gitlab.event.received" : `gitlab.pipeline.${status}`,
+		...mergeRequestIid !== void 0 ? { threadId: `merge_request:${mergeRequestIid}` } : id === void 0 ? {} : { threadId: `pipeline:${id}` },
+		...id === void 0 || status === void 0 ? {} : { messageId: `pipeline:${id}:${status}` },
+		...uri === void 0 ? {} : { uri },
+		...occurredAt === void 0 ? {} : { occurredAt },
+		fields: {
+			resourceType: "pipeline",
+			...optional("pipelineId", id),
+			...optional("status", status),
+			...optional("ref", nonEmptyString(attributes.ref) ? attributes.ref : void 0),
+			...optional("sha", nonEmptyString(attributes.sha) ? attributes.sha : void 0),
+			...optional("mergeRequestIid", mergeRequestIid)
+		}
+	};
+};
+const normalize = (payload) => {
+	const attributes = isRecord(payload.object_attributes) ? payload.object_attributes : void 0;
+	if (attributes !== void 0) {
+		if (payload.object_kind === "merge_request") return mergeRequest(attributes);
+		if (payload.object_kind === "note") return note(attributes, payload);
+		if (payload.object_kind === "pipeline") return pipeline(attributes, payload);
+	}
+	return {
+		type: "gitlab.event.received",
+		fields: {}
+	};
+};
+/**
+* Turns a verified `GitLabWebhookInput` into one WorkEvent. Inputs of another
+* kind produce no Events. The Event id combines the authority and the
+* delivery id, so a GitLab retry is the same Event.
+*/
+const normalizeGitLabEvents = (input, clock) => Effect.try({
+	try: () => {
+		if (!isRecord(input) || input.kind !== "gitlab.webhook" || !nonEmptyString(input.authority) || !nonEmptyString(input.eventName) || !nonEmptyString(input.deliveryId) || !isRecord(input.payload) || !Schema.is(JsonValueSchema)(input.payload)) return [];
+		const webhook = input;
+		const payload = webhook.payload;
+		const project = isRecord(payload.project) ? payload.project : void 0;
+		const projectId = positiveInteger(project?.id) ? project.id : positiveInteger(payload.project_id) ? payload.project_id : void 0;
+		const projectPath = nonEmptyString(project?.path_with_namespace) ? project.path_with_namespace : void 0;
+		const user = isRecord(payload.user) ? payload.user : void 0;
+		const actor = {
+			...optional("id", positiveInteger(user?.id) ? String(user.id) : void 0),
+			...optional("username", nonEmptyString(user?.username) ? user.username : void 0),
+			...optional("name", nonEmptyString(user?.name) ? user.name : void 0)
+		};
+		const normalized = normalize(payload);
+		const receivedAt = clock();
+		const id = `gitlab:${webhook.authority}:${webhook.deliveryId}`;
+		return [{
+			schemaVersion: "0.1",
+			id,
+			type: normalized.type,
+			occurredAt: normalized.occurredAt ?? receivedAt,
+			receivedAt,
+			idempotencyKey: id,
+			source: gitlabSource({
+				authority: webhook.authority,
+				...projectPath === void 0 ? {} : { project: projectPath },
+				...normalized.threadId === void 0 ? {} : { threadId: normalized.threadId },
+				...normalized.messageId === void 0 ? {} : { messageId: normalized.messageId },
+				...normalized.uri === void 0 ? {} : { uri: normalized.uri }
+			}),
+			payload: {
+				activation: "observation",
+				eventName: webhook.eventName,
+				...optional("objectKind", nonEmptyString(payload.object_kind) ? payload.object_kind : void 0),
+				authority: webhook.authority,
+				...optional("instance", webhook.instance),
+				...optional("projectId", projectId),
+				...optional("project", projectPath),
+				...optional("resource", projectId === void 0 ? void 0 : `project:${projectId}`),
+				...normalized.fields,
+				...Object.keys(actor).length === 0 ? {} : { actor }
+			},
+			raw: withoutGitLabCredentials(webhook.payload)
+		}];
+	},
+	catch: (cause) => new IntegrationError({
+		message: "Unable to normalize GitLab webhook",
+		retryable: false,
+		cause
+	})
+});
+//#endregion
+//#region src/bond/integration/http.ts
+var GitLabHttpIngressError = class extends Data.TaggedError("GitLabHttpIngressError") {};
+var GitLabHttpSubmissionError = class extends Data.TaggedError("GitLabHttpSubmissionError") {};
+const sha256 = async (value) => new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)));
+/**
+* Compares the `X-Gitlab-Token` header with the configured secret token in
+* constant time. Both values are hashed first, so the comparison does not
+* reveal the secret's length either. An empty configured token never matches.
+*/
+const verifyGitLabToken = (input) => Effect.tryPromise({
+	try: async () => {
+		if (input.webhookToken.length === 0) return false;
+		const [expected, received] = await Promise.all([sha256(input.webhookToken), sha256(input.received)]);
+		let difference = 0;
+		for (let index = 0; index < expected.length; index += 1) difference |= expected[index] ^ received[index];
+		return difference === 0;
+	},
+	catch: (cause) => new GitLabHttpIngressError({
+		message: "Unable to verify GitLab request",
+		status: 401,
+		cause
+	})
+});
+const header = (request, name) => {
+	const value = request.headers.get(name);
+	return value === null || value.length === 0 ? void 0 : value;
+};
+/**
+* Verifies and decodes one GitLab webhook request. The delivery id is the
+* first of `webhook-id` and `Idempotency-Key` (both stable across retries,
+* GitLab 17.4+) and `X-Gitlab-Event-UUID` (GitLab 14.8+).
+*/
+const decodeGitLabHttpRequest = (request, options) => Effect.gen(function* () {
+	if (!(yield* verifyGitLabToken({
+		webhookToken: options.webhookToken,
+		received: header(request, "x-gitlab-token") ?? ""
+	}))) return yield* new GitLabHttpIngressError({
+		message: "GitLab webhook token is invalid",
+		status: 401
+	});
+	const eventName = header(request, "x-gitlab-event");
+	const deliveryId = header(request, "webhook-id") ?? header(request, "idempotency-key") ?? header(request, "x-gitlab-event-uuid");
+	if (eventName === void 0 || deliveryId === void 0) return yield* new GitLabHttpIngressError({
+		message: "GitLab event and delivery id headers are required",
+		status: 400
+	});
+	const rawBody = yield* Effect.tryPromise({
+		try: () => request.text(),
+		catch: (cause) => new GitLabHttpIngressError({
+			message: "Unable to read GitLab request body",
+			status: 400,
+			cause
+		})
+	});
+	const payload = yield* Effect.try({
+		try: () => JSON.parse(rawBody),
+		catch: (cause) => new GitLabHttpIngressError({
+			message: "GitLab request body is malformed",
+			status: 400,
+			cause
+		})
+	});
+	if (!isRecord(payload) || !Schema.is(JsonValueSchema)(payload)) return yield* new GitLabHttpIngressError({
+		message: "GitLab request body must be a portable JSON object",
+		status: 400
+	});
+	const instance = header(request, "x-gitlab-instance");
+	return {
+		kind: "gitlab.webhook",
+		authority: options.authority,
+		eventName,
+		deliveryId,
+		...instance === void 0 ? {} : { instance },
+		payload
+	};
+});
+const jsonResponse = (body, status) => new Response(JSON.stringify(body), {
+	status,
+	headers: { "content-type": "application/json; charset=utf-8" }
+});
+/**
+* A webhook endpoint for one GitLab authority. Hosts that serve many
+* authorities from one route call `decodeGitLabHttpRequest` with the token
+* and authority they look up for the request instead.
+*/
+const makeGitLabHttpEndpoint = (options) => ({
+	method: "POST",
+	path: options.path ?? "/gitlab/events",
+	handle: (request) => Effect.runPromise(decodeGitLabHttpRequest(request, options).pipe(Effect.flatMap((input) => Effect.tryPromise({
+		try: () => options.submit(input),
+		catch: (cause) => new GitLabHttpSubmissionError({
+			message: "Unable to submit GitLab work",
+			status: 503,
+			cause
+		})
+	}).pipe(Effect.as(new Response(null, { status: 202 })))), Effect.catchAll((error) => Effect.succeed(jsonResponse({
+		ok: false,
+		error: error.message
+	}, error.status)))))
+});
+//#endregion
+//#region src/bond/integration/integration.ts
+/**
+* The GitLab work integration: `ingest` takes a `GitLabWebhookInput` from
+* `decodeGitLabHttpRequest`, and `deliver` posts merge request and issue
+* notes.
+*/
+const makeGitLabIntegration = (options) => {
+	const clock = options.clock ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+	const client = makeGitLabClient({
+		credentialsFor: makeGitLabCredentialsFor(options.credentials),
+		fetch: options.fetch ?? ((...args) => globalThis.fetch(...args)),
+		clock
+	});
+	return {
+		manifest: {
+			id: "gitlab",
+			displayName: "GitLab",
+			events: GITLAB_EVENT_TYPES,
+			operations: GITLAB_OPERATIONS
+		},
+		ingest: (input) => normalizeGitLabEvents(input, clock),
+		deliver: makeGitLabDelivery(client)
+	};
+};
+//#endregion
+//#region src/bond/integration/templates.ts
+const VERSION = "0.1.0";
+const agentField = {
+	type: "string",
+	minLength: 1,
+	title: "Agent",
+	"x-oma-widget": "agent"
+};
+const projectsField = {
+	type: "array",
+	items: {
+		type: "string",
+		minLength: 1
+	},
+	minItems: 1,
+	title: "Projects",
+	description: "Bond resource ids of the projects the Loop watches",
+	"x-oma-widget": "bond-resources",
+	"x-bond-provider": "gitlab"
+};
+const instructionsField = {
+	type: "string",
+	default: "",
+	title: "Extra instructions",
+	description: "Appended to the instructions the Agent receives"
+};
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const fields = (event) => isObject(event.payload) ? event.payload : {};
+const watched = (config, event) => {
+	const resource = fields(event).resource;
+	return typeof resource === "string" && Array.isArray(config.projects) && config.projects.includes(resource);
+};
+const mergeRequestTarget = (event) => {
+	const { projectId, mergeRequestIid } = fields(event);
+	return typeof projectId === "number" && typeof mergeRequestIid === "number" ? {
+		authority: event.source.authority,
+		projectId,
+		mergeRequestIid
+	} : void 0;
+};
+/**
+* One Session per merge request: both templates continue the same Work
+* Thread, so an Agent that reviewed a merge request remembers it when
+* mentioned there later.
+*/
+const sessionFor = (target) => {
+	const scopeId = `gitlab:${target.authority}:project:${target.projectId}`;
+	return {
+		scopeId,
+		workThreadId: `merge_request:${target.mergeRequestIid}`,
+		privacyPartition: scopeId
+	};
+};
+/** Runs one Agent Turn and posts its output as a merge request note. */
+const answer = async (work, target, instructions, reply) => {
+	const binding = sessionFor(target);
+	const capability = `gitlab.${reply.operation}`;
+	const context = await work.context.project({
+		scopeId: binding.scopeId,
+		workThreadId: binding.workThreadId,
+		items: [work.context.event(), work.context.value({
+			kind: "instructions",
+			value: instructions,
+			provenance: [{
+				sourceType: "loop-template",
+				sourceId: "gitlab"
+			}]
+		})],
+		grants: [capability]
+	});
+	const turn = await work.agent(String(work.config.agentId)).session(binding).turn({
+		context,
+		allow: [capability]
+	});
+	const body = typeof turn.output === "string" ? turn.output.trim() : "";
+	if (turn.outcome !== "completed" || body.length === 0) return work.react.none(turn.outcome === "completed" ? "The Agent produced no reply" : `The Agent Turn ended ${turn.outcome}`);
+	const note = await work.effect(context, {
+		integrationId: "gitlab",
+		operation: reply.operation,
+		input: {
+			authority: target.authority,
+			projectId: target.projectId,
+			mergeRequestIid: target.mergeRequestIid,
+			body,
+			...reply.operation === "merge_request.discussion.reply" ? { discussionId: reply.discussionId } : {}
+		}
+	});
+	return work.react.effects([note]);
+};
+const extra = (config) => typeof config.instructions === "string" && config.instructions.trim() !== "" ? `\n\n${config.instructions.trim()}` : "";
+/**
+* Reviews a merge request when it opens, reopens, or receives new commits,
+* and posts the review as a note. Title or label edits do not trigger a
+* review. Draft merge requests are skipped unless `skipDrafts` is false.
+*/
+const gitlabMergeRequestReview = defineLoop({
+	id: "gitlab-mr-review",
+	version: VERSION,
+	description: "Review merge requests when they open or receive new commits",
+	spec: {
+		sources: [
+			"gitlab.merge_request.opened",
+			"gitlab.merge_request.reopened",
+			"gitlab.merge_request.updated"
+		],
+		workThread: "gitlab.merge_request",
+		session: "per-work-thread",
+		reaction: "effects"
+	},
+	runAs: "app",
+	requiredBonds: [{
+		provider: "gitlab",
+		operations: ["fetch", "comment_mr"]
+	}],
+	configSchema: {
+		type: "object",
+		properties: {
+			agentId: agentField,
+			projects: projectsField,
+			skipDrafts: {
+				type: "boolean",
+				default: true,
+				title: "Skip draft merge requests"
+			},
+			instructions: instructionsField
+		},
+		required: ["agentId", "projects"]
+	}
+}, (app) => app.on([
+	"gitlab.merge_request.opened",
+	"gitlab.merge_request.reopened",
+	"gitlab.merge_request.updated"
+], (work) => {
+	const target = mergeRequestTarget(work.event);
+	const { draft, newCommits, project } = fields(work.event);
+	if (target === void 0) return work.react.none("Not a merge request Event");
+	if (!watched(work.config, work.event)) return work.react.none("Project is not watched");
+	if (newCommits !== true) return work.react.none("No new commits");
+	if (draft === true && work.config.skipDrafts !== false) return work.react.none("Draft merge request");
+	return answer(work, target, `Review merge request !${target.mergeRequestIid} in ${String(project ?? target.projectId)}. Fetch the source branch through the GitLab Bond, read the diff against the target branch, and reply with a concise review: correctness problems first, then risks, then optional suggestions. Your reply is posted as a merge request note.` + extra(work.config), { operation: "merge_request.note.create" });
+}));
+const mentionPattern = (username) => new RegExp(`(^|[^\\w@.-])@${username.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w.-])`, "i");
+/**
+* Answers a merge request comment that mentions the Agent's GitLab user, in
+* the same thread. System notes and the Agent's own notes are ignored, so a
+* reply never triggers another reply.
+*/
+const gitlabMention = defineLoop({
+	id: "gitlab-mention",
+	version: VERSION,
+	description: "Answer merge request comments that mention the Agent",
+	spec: {
+		sources: ["gitlab.merge_request.note.created"],
+		workThread: "gitlab.merge_request",
+		session: "per-work-thread",
+		reaction: "effects"
+	},
+	runAs: "app",
+	requiredBonds: [{
+		provider: "gitlab",
+		operations: ["fetch", "comment_mr"]
+	}],
+	configSchema: {
+		type: "object",
+		properties: {
+			agentId: agentField,
+			projects: projectsField,
+			username: {
+				type: "string",
+				minLength: 1,
+				title: "GitLab username",
+				description: "The app principal's username, without @. Comments that mention it are answered."
+			},
+			instructions: instructionsField
+		},
+		required: [
+			"agentId",
+			"projects",
+			"username"
+		]
+	}
+}, (app, { config }) => {
+	const username = String(config.username).replace(/^@/, "");
+	const mentions = mentionPattern(username);
+	app.on("gitlab.merge_request.note.created", (work) => {
+		const target = mergeRequestTarget(work.event);
+		const { text, system, discussionId, actor } = fields(work.event);
+		const author = isObject(actor) ? actor.username : void 0;
+		if (target === void 0) return work.react.none("Not a merge request comment");
+		if (!watched(work.config, work.event)) return work.react.none("Project is not watched");
+		if (system === true) return work.react.none("System note");
+		if (typeof author === "string" && author.toLowerCase() === username.toLowerCase()) return work.react.none("The Agent's own note");
+		if (typeof text !== "string" || !mentions.test(text)) return work.react.none("The Agent is not mentioned");
+		return answer(work, target, `@${String(author ?? "someone")} mentioned you (@${username}) in a comment on merge request !${target.mergeRequestIid}. Answer the comment. Fetch the code through the GitLab Bond if you need it. Your reply is posted in the same thread.` + extra(work.config), typeof discussionId === "string" && discussionId.length > 0 ? {
+			operation: "merge_request.discussion.reply",
+			discussionId
+		} : { operation: "merge_request.note.create" });
+	});
+});
+/** The GitLab templates, in the order a console lists them. */
+const gitlabTemplates = [gitlabMergeRequestReview, gitlabMention];
+//#endregion
+export { GITLAB_EVENT_TYPES, GITLAB_MIN_ACCESS_LEVEL, GITLAB_OPERATIONS, GitLabHttpIngressError, GitLabHttpSubmissionError, ZERO_OID, assistedByTrailer, authorizationUrl, canonicalOrigin, classifyGitLabRequest, coAuthoredByTrailer, commitAuthor, createPkce, decodeGitLabHttpRequest, discoverInstance, evaluatePush, exchangeCode, gitlabManifest, gitlabMention, gitlabMergeRequestReview, gitlabTemplates, isValidRefName, makeGitLabBinding, makeGitLabBondProvider, makeGitLabClient, makeGitLabCredentialsFor, makeGitLabDelivery, makeGitLabHttpEndpoint, makeGitLabIntegration, makeGitLabResourceCatalog, makeReceivePackHeadParser, mergeRequestBodyProblem, mergeRequestFooter, mergeRequestPushOptions, normalizeGitLabEvents, parseReceivePackHead, readTokenInfo, readUser, refreshAccessToken, revokeSelfToken, revokeToken, tokenExpiryInstant, validateBotCredential, validatePersonalAccessToken, verifyGitLabToken };
 
 //# sourceMappingURL=index.js.map