@simplysf/simply-gitlab-core 0.1.0

package/lib/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAiBjG,MAAM,UAAU,WAAW,CACzB,QAAwB,EACxB,MAAc,EACd,OAAgB,EAChB,UAAkC,EAAE;IAEpC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC/E,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACxD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACrB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,OAAO,CAAC,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAQ,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,EAAE,GAAkB,EAAE,CACzB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/lib/text.d.ts

@@ -0,0 +1,10 @@
+export declare function stripControl(text: string): string;
+/**
+ * Collapses server text onto a single line, for contexts where a newline is itself the attack.
+ *
+ * `stripControl` keeps `\n` because the layout this module emits depends on it. In an error
+ * message that is the wrong trade: a link type name or issue summary containing a newline can
+ * forge extra stderr lines — including a line that mimics this CLI's own JSON error object —
+ * and an agent parsing stderr line-by-line has no way to tell the forgery from the real thing.
+ */
+export declare function stripControlOneLine(text: string): string;

package/lib/text.js

@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2026, SimplySF.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Removes anything from server-chosen text that could make the rendered output lie.
+ *
+ * Anyone able to file a ticket controls an issue summary, anyone with page-edit rights controls
+ * a page body, and anyone with an account controls their display name. Three classes of
+ * character therefore have to go.
+ *
+ * ESC, BEL, backspace and the C1 range can erase or overwrite lines already printed, so a table
+ * could show a different status or assignee than the API actually returned.
+ *
+ * A bare carriage return does the same thing with no escape sequence at all: everything before
+ * it is overwritten on screen but still reaches a caller reading the stream. That splits what a
+ * person reviewing the terminal sees from what an agent actually ingests, which is precisely the
+ * human-in-the-loop check this output exists to support.
+ *
+ * Invisible Unicode format and bidi characters can reorder or hide text visually while leaving
+ * the underlying bytes intact.
+ *
+ * Newline and tab are kept: they carry the layout this renderer emits.
+ */
+/** Characters that can erase or overwrite text already printed. */
+// eslint-disable-next-line no-control-regex -- matching control characters is the entire point
+const REWRITES_THE_SCREEN = /[\u0000-\u0008\u000B-\u000D\u000E-\u001F\u007F-\u009F]/g;
+/**
+ * Invisible formatting and bidi characters, which reorder or hide text while leaving the bytes
+ * intact. U+2028/U+2029 are line separators that several terminals and JSON consumers treat as
+ * newlines, so they forge a break that `\n` handling would otherwise have caught.
+ */
+const HIDES_OR_REORDERS = /[\u00AD\u061C\u200B-\u200F\u2028\u2029\u202A-\u202E\u2060-\u206F\uFEFF]/g;
+/**
+ * Invisible characters that carry text rather than merely hiding it.
+ *
+ * The tag block is the canonical ASCII-smuggling vector: `Done` plus a tag-encoded instruction
+ * renders as `Done` to a person and reaches a tokenizer in full, which defeats the alignment
+ * this whole module exists to keep. The Hangul fillers are the same trick for a display name
+ * that renders blank; variation selectors carry payload the same way.
+ *
+ * Held in a named constant rather than inlined because the disable below has to sit immediately
+ * above the pattern, and prettier reformats a long inline `.replaceAll(...)` across lines —
+ * which silently moved the directive off its target once already.
+ */
+/*
+ * A block disable, not `eslint-disable-next-line`: variation selectors are combining marks by
+ * definition so the rule fires, and stripping them individually is precisely the intent — but
+ * prettier reflows this assignment across lines, which silently moved a line-scoped directive
+ * off its target twice. A block cannot drift.
+ */
+/* eslint-disable no-misleading-character-class */
+const SMUGGLES_TEXT = /[\u{E0000}-\u{E007F}\u{FE00}-\u{FE0F}\u{E0100}-\u{E01EF}\u115F\u1160\u180B-\u180E\u3164\uFFA0]/gu;
+/* eslint-enable no-misleading-character-class */
+export function stripControl(text) {
+    return text.replaceAll(REWRITES_THE_SCREEN, '').replaceAll(HIDES_OR_REORDERS, '').replaceAll(SMUGGLES_TEXT, '');
+}
+/**
+ * Collapses server text onto a single line, for contexts where a newline is itself the attack.
+ *
+ * `stripControl` keeps `\n` because the layout this module emits depends on it. In an error
+ * message that is the wrong trade: a link type name or issue summary containing a newline can
+ * forge extra stderr lines — including a line that mimics this CLI's own JSON error object —
+ * and an agent parsing stderr line-by-line has no way to tell the forgery from the real thing.
+ */
+export function stripControlOneLine(text) {
+    return stripControl(text).replaceAll(/\s+/g, ' ').trim();
+}
+//# sourceMappingURL=text.js.map

package/lib/text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../src/text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,mEAAmE;AACnE,+FAA+F;AAC/F,MAAM,mBAAmB,GAAG,yDAAyD,CAAC;AAEtF;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,0EAA0E,CAAC;AAErG;;;;;;;;;;;GAWG;AACH;;;;;GAKG;AACH,kDAAkD;AAClD,MAAM,aAAa,GACjB,kGAAkG,CAAC;AACrG,iDAAiD;AAEjD,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AAClH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC"}

package/lib/write-safety.d.ts

@@ -0,0 +1,19 @@
+import type { EnvLike } from './config.js';
+/** The environment variable that marks a context as one that does not make changes. */
+export declare const READ_ONLY_ENV = "GITLAB_READ_ONLY";
+/** Whether the environment says this context does not write. Any value not meaning "yes" is ignored. */
+export declare function isReadOnly(env?: EnvLike): boolean;
+/**
+ * Refuses a write when the environment says this context does not write.
+ *
+ * A guardrail, not a security boundary: an agent with shell access can unset the variable. It
+ * exists for the different and real problem of a person, or an agent, running against the wrong
+ * credentials or in the wrong context — pushing a commit to the wrong project is not undoable by
+ * a delete. The boundary that actually binds is a `read_api`-scoped GitLab token, which makes the
+ * instance refuse the write server-side.
+ *
+ * Shared by the CLI (checked once in its base command before any write command runs) and the
+ * MCP server (checked before any write tool runs), so the two cannot disagree about what the
+ * variable means.
+ */
+export declare function assertWritesAllowed(env?: EnvLike): void;

package/lib/write-safety.js

@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2026, SimplySF.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import process from 'node:process';
+import { ConfigError } from './errors.js';
+/** The environment variable that marks a context as one that does not make changes. */
+export const READ_ONLY_ENV = 'GITLAB_READ_ONLY';
+const TRUTHY = new Set(['1', 'true', 'yes', 'on']);
+/** Whether the environment says this context does not write. Any value not meaning "yes" is ignored. */
+export function isReadOnly(env = process.env) {
+    const raw = env[READ_ONLY_ENV];
+    return raw !== undefined && TRUTHY.has(raw.trim().toLowerCase());
+}
+/**
+ * Refuses a write when the environment says this context does not write.
+ *
+ * A guardrail, not a security boundary: an agent with shell access can unset the variable. It
+ * exists for the different and real problem of a person, or an agent, running against the wrong
+ * credentials or in the wrong context — pushing a commit to the wrong project is not undoable by
+ * a delete. The boundary that actually binds is a `read_api`-scoped GitLab token, which makes the
+ * instance refuse the write server-side.
+ *
+ * Shared by the CLI (checked once in its base command before any write command runs) and the
+ * MCP server (checked before any write tool runs), so the two cannot disagree about what the
+ * variable means.
+ */
+export function assertWritesAllowed(env = process.env) {
+    if (isReadOnly(env)) {
+        throw new ConfigError(`${READ_ONLY_ENV} is set, so this context does not make changes. Unset it, or pass a ` +
+            'credential file that is meant for writing, to proceed.');
+    }
+}
+//# sourceMappingURL=write-safety.js.map

package/lib/write-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-safety.js","sourceRoot":"","sources":["../src/write-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEhD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAEnD,wGAAwG;AACxG,MAAM,UAAU,UAAU,CAAC,MAAe,OAAO,CAAC,GAAG;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/B,OAAO,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAe,OAAO,CAAC,GAAG;IAC5D,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,WAAW,CACnB,GAAG,aAAa,sEAAsE;YACpF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,130 @@
+{
+  "name": "@simplysf/simply-gitlab-core",
+  "description": "Configuration, authentication, HTTP client, and shared logic for working with GitLab",
+  "version": "0.1.0",
+  "author": "@ClayChipps",
+  "homepage": "https://github.com/SimplySF/simply-gitlab",
+  "bugs": "https://github.com/SimplySF/simply-gitlab/issues",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SimplySF/simply-gitlab",
+    "directory": "packages/simply-gitlab-core"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "files": [
+    "/lib"
+  ],
+  "keywords": [
+    "gitlab",
+    "ci",
+    "merge-requests",
+    "simply"
+  ],
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./testing": {
+      "types": "./lib/testing.d.ts",
+      "default": "./lib/testing.js"
+    }
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@vitest/coverage-v8": "^4.1.10",
+    "vitest": "^4.1.10"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "wireit",
+    "compile": "wireit",
+    "fix-license": "eslint src test --fix --rule \"header/header: [2]\"",
+    "format": "wireit",
+    "lint": "wireit",
+    "test": "wireit",
+    "test:coverage": "vitest run --coverage --project simply-gitlab-core",
+    "test:only": "wireit",
+    "test:watch": "vitest watch --project simply-gitlab-core"
+  },
+  "wireit": {
+    "build": {
+      "dependencies": [
+        "compile",
+        "lint"
+      ]
+    },
+    "compile": {
+      "command": "tsc -p . --pretty --incremental",
+      "files": [
+        "src/**/*.ts",
+        "**/tsconfig.json",
+        "../../tsconfig.json"
+      ],
+      "output": [
+        "lib/**",
+        "*.tsbuildinfo"
+      ],
+      "clean": "if-file-deleted"
+    },
+    "format": {
+      "command": "prettier --write \"+(src|test)/**/*.+(ts|js|json)\"",
+      "files": [
+        "src/**/*.ts",
+        "test/**/*.ts",
+        ".prettier*"
+      ],
+      "output": []
+    },
+    "lint": {
+      "command": "eslint src test --color --cache --cache-location .eslintcache",
+      "files": [
+        "src/**/*.ts",
+        "test/**/*.ts",
+        "**/.eslint*",
+        "**/tsconfig.json",
+        "../../eslint.config.mjs",
+        "../../tsconfig.json"
+      ],
+      "output": []
+    },
+    "test": {
+      "dependencies": [
+        "test:compile",
+        "test:only",
+        "lint"
+      ]
+    },
+    "test:compile": {
+      "command": "tsc -p \"./test\" --pretty",
+      "files": [
+        "test/**/*.ts",
+        "**/tsconfig.json",
+        "../../tsconfig.json"
+      ],
+      "output": []
+    },
+    "test:only": {
+      "command": "vitest run --project simply-gitlab-core",
+      "env": {
+        "FORCE_COLOR": "2"
+      },
+      "files": [
+        "test/**/*.ts",
+        "src/**/*.ts",
+        "**/tsconfig.json",
+        "../../tsconfig.json",
+        "vitest.config.ts"
+      ],
+      "output": []
+    }
+  }
+}