@vornrun/connector-gitlab 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+All notable changes to `@vornrun/connector-gitlab`.
+
+## 0.1.0
+
+First release.
+
+Trigger a workflow from GitLab issues, merge requests and pipeline results, and
+let a workflow step write back. Works against gitlab.com and self-managed
+instances.
+
+- **Triggers:** `issueCreated`, `mergeRequestOpened`, `pipelineFinished`.
+- **Actions:** `createIssue`, `commentOnIssue`, `commentOnMergeRequest`,
+  `getProject`, `listOpenMergeRequests`, `getIssue`.
+- **Signing in:** borrows the GitLab CLI's login. `glab auth login` is all it
+  needs, and no token is stored here — `glab config get token` supplies it on
+  demand. A pasted personal access token is used instead when one is given.
+
+Every action but the merge request list is a declared request the SDK sends,
+with the response trimmed to camelCase names; the list is hand-written so it can
+answer with a `count` beside its `items`. The three read actions are idempotent
+and carry sample arguments (`gitlab-org/gitlab`) so a live check can call them.
+
+The triggers watermark on the field they filter by — `created_at` for issues
+and merge requests, `updated_at` for pipelines — and only finished pipelines
+are delivered, so one that was running when a poll saw it fires once it ends.
+The first poll looks back one minute rather than replaying the project.
+Ships a conformance receipt covering the mock run and the dedupe replay.

package/README.md

@@ -0,0 +1,138 @@
+# @vornrun/connector-gitlab
+
+Trigger Vorn workflows from GitLab issues, merge requests and pipeline results,
+and create or comment on issues and merge requests from a workflow step. Works
+against gitlab.com and self-managed instances.
+
+## Signing in
+
+There is no token to paste. This connector borrows the GitLab CLI's login:
+
+```sh
+brew install glab      # or see https://gitlab.com/gitlab-org/cli
+glab auth login
+```
+
+`glab config get token --host <host>` supplies the credential on demand, so it
+lives wherever `glab` keeps it — the OS keychain, usually — and nothing is
+stored in the connection. (`glab auth token` does not exist; `config get` is the
+documented way to read what `glab auth login` stored.)
+
+If you would rather not depend on `glab`, paste a
+[personal access token](https://docs.gitlab.com/user/profile/personal_access_tokens/)
+into the **Personal access token** field. It is used as-is and `glab` is never
+run. Scope `api` covers everything here; `read_api` is enough for the triggers
+and the read-only actions.
+
+The token is sent as `Authorization: Bearer`, which GitLab accepts for both
+personal access tokens and the OAuth tokens `glab auth login --web` stores. A
+borrowed OAuth token lives two hours, so the triggers and the merge request
+list re-read it from `glab` once on a `401` before reporting that you are
+signed out. The other actions are declared requests and send the token the host
+borrowed when it started the connector, which it does afresh on every start.
+
+## Settings
+
+| Field | Required | What it does |
+| --- | --- | --- |
+| `baseUrl` | no | Instance URL, default `https://gitlab.com`. Without a trailing slash; `/api/v4` is appended. |
+| `project` | yes | Path such as `gitlab-org/gitlab`, or the numeric id. The triggers poll this project. |
+| `token` | no | Personal access token. Leave empty to borrow `glab`'s login. |
+| `ref` | no | Branch or tag whose pipelines to watch. Blank for every ref. |
+
+Actions take their own `project` input, so one connection can act on several
+projects while its triggers watch one.
+
+## Triggers
+
+**An issue is created**, **A merge request is opened** and **A pipeline
+finishes**. Each polls the project's list endpoint, oldest first, for
+everything at or after the last watermark, and follows `x-next-page` up to ten
+pages of 100 per poll.
+
+Things worth knowing if you are reading `src/connector.ts`:
+
+- The watermark is the field the request filters on. The issue and merge
+  request triggers ask for `created_after`, so their items carry `created_at`
+  as `updatedAt`; the real `updated_at` rides along as `changedAt`. A poll cut
+  short by a limit could otherwise move the watermark past an item created
+  earlier but touched later, and never ask for it again.
+- The very first poll, before any watermark exists, asks for the minute
+  before it rather than the project's whole history.
+- GitLab's time filters are inclusive at second precision while timestamps
+  carry milliseconds, so the item sitting on the watermark comes back on the
+  next poll. The SDK recognises it by its `iid`; adding a second to the cursor
+  would skip whatever else was created in that second.
+- Pipelines are polled with `updated_after`, because `updated_at` moves as a
+  pipeline runs. Only `success`, `failed`, `canceled` and `skipped` are
+  delivered. A running pipeline is neither delivered nor remembered, so it
+  fires once it finishes. A retried pipeline keeps its id and is not delivered
+  again — the cost of keying on the id.
+- Lists over 10,000 records omit `x-total`, so the connector never reads it.
+
+Status suggestions: issues `opened → todo`, `closed → done`; merge requests
+`opened → in_progress`, `merged`/`closed → done`; pipelines `success → done`,
+`failed → todo`, `canceled`/`skipped → cancelled`.
+
+## Actions
+
+| Action | Idempotent | Notes |
+| --- | --- | --- |
+| Create an issue | no | Two identical calls make two issues; GitLab offers no idempotency key |
+| Comment on an issue | no | Posts a note; `internal` hides it from non-members |
+| Comment on a merge request | no | As above, on a merge request |
+| Get a project | yes | `namespace` comes back as `{id, name, path, fullPath, kind}` |
+| List open merge requests | yes | Newest-updated first; `limit` up to 100, optional `targetBranch`. Returns `count` and `items` in the shape the merge request trigger delivers |
+| Get an issue | yes | `author` and `assignees` come back as `{id, username, name}` |
+
+Every action but the merge request list is a declared request: the SDK fills
+in the arguments, URL-encodes the project path (`gitlab-org%2Fgitlab`), sends
+the call and keeps the fields named above under camelCase names. The merge
+request list is hand-written, because a declared request cannot count what it
+returns. Issue and merge request numbers are their
+project-scoped `iid`, the number shown in the UI, and are checked to be numbers
+before anything is sent, so a `{{...}}` that resolved to nothing names itself
+rather than returning a 404.
+
+## What this connector cannot do
+
+- **No webhooks.** It polls. The default seeded workflows run every 5 minutes.
+- **One project per connection** for the triggers.
+- **No pipeline duration.** The list endpoint carries no `duration` or
+  `finished_at`; those need a per-pipeline call this connector does not make.
+- **Nothing beyond the token's scope.** A `403` is reported with GitLab's own
+  message; an OAuth token lacking scope answers `insufficient_scope`.
+
+Rate limits are honoured by the SDK: a `429` waits out `Retry-After` a bounded
+number of times before the poll gives up and the next scheduled one tries again.
+
+## Checks
+
+```sh
+yarn typecheck && yarn test && yarn build
+yarn workspace @vornrun/connector-gitlab exec vorn-connector check ./dist/index.js --mock --receipt verified.json
+```
+
+`scripts/check.sh` at the repository root runs exactly this for this package.
+`scripts/check-live.sh` runs `vorn-connector check --live` against a real
+instance when `GITLAB_TOKEN` is set, and exits 0 with a note when it is not.
+
+## Built from
+
+- [REST API overview: base path, URL encoding, pagination](https://docs.gitlab.com/api/rest/)
+- [REST API authentication: PRIVATE-TOKEN, Bearer, OAuth, 401/403](https://docs.gitlab.com/api/rest/authentication/)
+- [Issues API](https://docs.gitlab.com/api/issues/)
+- [Merge requests API](https://docs.gitlab.com/api/merge_requests/)
+- [Pipelines API](https://docs.gitlab.com/api/pipelines/)
+- [Notes API (issue and merge request comments)](https://docs.gitlab.com/api/notes/)
+- [Projects API](https://docs.gitlab.com/api/projects/)
+- [Personal access tokens](https://docs.gitlab.com/user/profile/personal_access_tokens/)
+- [Access token scopes](https://docs.gitlab.com/security/tokens/access_token_scopes/)
+- [Rate limit response headers](https://docs.gitlab.com/administration/settings/user_and_ip_rate_limits/)
+- [GitLab.com rate limits](https://docs.gitlab.com/user/gitlab_com/)
+- [glab CLI repository](https://gitlab.com/gitlab-org/cli):
+  [README and environment variables](https://gitlab.com/gitlab-org/cli/-/blob/main/README.md),
+  [authentication](https://gitlab.com/gitlab-org/cli/-/blob/main/docs/source/authentication.md),
+  [`glab auth login`](https://gitlab.com/gitlab-org/cli/-/blob/main/docs/source/auth/login.md),
+  [`glab auth status`](https://gitlab.com/gitlab-org/cli/-/blob/main/docs/source/auth/status.md),
+  [`glab config get`](https://gitlab.com/gitlab-org/cli/-/blob/main/docs/source/config/get.md)

package/dist/index.d.ts

@@ -0,0 +1,214 @@
+import * as _vornrun_connector_sdk from '@vornrun/connector-sdk';
+import { ConnectorConfig, ConnectorItem } from '@vornrun/connector-sdk';
+
+/**
+ * GitLab's REST API, with the credential borrowed from the GitLab CLI.
+ *
+ * The connector keeps no token of its own unless someone pastes one. When the
+ * `token` field is empty it asks `glab config get token --host <host>` — the
+ * documented, machine-readable way to read what `glab auth login` stored —
+ * and sends the answer as `Authorization: Bearer`. Bearer rather than
+ * `PRIVATE-TOKEN` because `glab auth login --web` stores an OAuth token, which
+ * the `PRIVATE-TOKEN` header does not accept; a personal access token is fine
+ * either way.
+ *
+ * A borrowed credential can rotate underneath us — OAuth tokens live two hours
+ * — so a 401 re-reads it once and retries before giving up.
+ */
+
+declare function glabInstallHint(platform?: NodeJS.Platform): string;
+declare class GlabNotFoundError extends Error {
+    readonly code = "GLAB_NOT_FOUND";
+    constructor();
+}
+declare class GlabSignedOutError extends Error {
+    readonly code = "GLAB_SIGNED_OUT";
+    constructor(detail?: string);
+}
+type RunGlab = (args: string[]) => Promise<string>;
+/** Run `glab`, translating the two failures a user can actually do something about. */
+declare const runGlab: RunGlab;
+/** The instance URL with nothing after the host (or the relative root), trailing slash gone. */
+declare function normalizeBaseUrl(value: unknown): string;
+/** The `--host` `glab` keeps its login under: the host as typed at `glab auth login`. */
+declare function hostOf(baseUrl: string): string;
+declare function apiUrl(baseUrl: string, path: string, query?: Record<string, string | number | undefined>): string;
+/** A project path is sent URL-encoded (`group%2Fproject`); a numeric id passes through. */
+declare function projectSegment(project: unknown): string;
+interface TokenSourceOptions {
+    /** A personal access token from the connection. When set, `glab` is never run. */
+    token?: string;
+    /** The instance the token must belong to. */
+    baseUrl?: string;
+    /** Injected in tests, so nothing spawns a process. */
+    glab?: RunGlab;
+}
+/**
+ * The current GitLab token, cached until something rejects it.
+ *
+ * Cached because `glab config get token` is a process spawn and a poll makes
+ * several calls; invalidated rather than expired because the CLI, not this
+ * connector, knows when a token rotates — the only reliable signal is a 401.
+ * A pasted token is never invalidated: re-reading it would give the same one.
+ */
+declare function createTokenSource(options?: TokenSourceOptions): {
+    /** Whether the token came from `glab`, and so could be re-read. */
+    borrowed: boolean;
+    get(): Promise<string>;
+    /** Drop a borrowed token so the next `get()` asks `glab` again. */
+    invalidate(): void;
+};
+type TokenSource = ReturnType<typeof createTokenSource>;
+interface GitLabClientOptions {
+    config: ConnectorConfig;
+    /** The SDK's fetch, which already retries rate limits and gateway hiccups. */
+    fetch: typeof fetch;
+    tokens?: TokenSource;
+    glab?: RunGlab;
+}
+interface ListOptions {
+    /** Stop once this many items are in hand; the SDK truncates to it anyway. */
+    limit?: number;
+    /** Longest chain of pages one call follows. */
+    maxPages?: number;
+}
+/**
+ * A client bound to the connection's token, which re-authenticates itself once.
+ *
+ * Every call goes through `get`, so the 401 path is shared rather than
+ * repeated per endpoint: read the token again, try once more. A second 401 is
+ * a real authorization problem and is reported as one.
+ */
+declare function createGitLabClient(options: GitLabClientOptions): {
+    baseUrl: string;
+    /** One GET, parsed as JSON. Whatever shape comes back is the caller's to judge. */
+    getJson<T>(path: string, query?: Record<string, string | number | undefined>): Promise<T>;
+    /**
+     * Every page of a list endpoint, following `x-next-page` (empty when there
+     * is no next page). Never `x-total`: lists over 10,000 records omit it.
+     */
+    list<T>(path: string, query: Record<string, string | number | undefined>, listOptions?: ListOptions): Promise<T[]>;
+};
+type GitLabClient = ReturnType<typeof createGitLabClient>;
+interface PreflightResult {
+    ok: boolean;
+    message?: string;
+}
+/**
+ * Whether this connector could run right now.
+ *
+ * Answers the states a user can correct — `glab` missing, `glab` present but
+ * signed out — and says what to do about each. Anything else is reported
+ * verbatim rather than guessed at. A pasted token is taken at its word: the
+ * first request will say if GitLab disagrees.
+ */
+declare function gitlabPreflight(options?: TokenSourceOptions): Promise<PreflightResult>;
+
+interface GitLabConnectorOptions {
+    version?: string;
+    /** Injected in tests so nothing spawns `glab`. */
+    glab?: RunGlab;
+    /** Where preflight reads the token and instance from; defaults to the process environment. */
+    env?: NodeJS.ProcessEnv;
+}
+declare function createGitLabConnector(options?: GitLabConnectorOptions): _vornrun_connector_sdk.Connector;
+
+/**
+ * What GitLab returns, and how each becomes the item Vorn indexes.
+ *
+ * Kept apart from anything that talks to the network so the mappings — and
+ * the one non-obvious choice in them, which timestamp is the watermark — are
+ * tested directly against the payloads gitlab.com actually returned.
+ */
+
+interface GitLabUser {
+    id?: number;
+    username: string;
+    name?: string;
+}
+interface GitLabIssue {
+    id: number;
+    iid: number;
+    project_id: number;
+    title: string;
+    description?: string | null;
+    state: string;
+    created_at: string;
+    updated_at: string;
+    closed_at?: string | null;
+    labels?: string[];
+    author?: GitLabUser | null;
+    assignees?: GitLabUser[];
+    web_url: string;
+    issue_type?: string;
+    confidential?: boolean;
+}
+interface GitLabMergeRequest {
+    id: number;
+    iid: number;
+    project_id: number;
+    title: string;
+    description?: string | null;
+    state: string;
+    draft?: boolean;
+    created_at: string;
+    updated_at: string;
+    merged_at?: string | null;
+    closed_at?: string | null;
+    source_branch: string;
+    target_branch: string;
+    sha?: string;
+    author?: GitLabUser | null;
+    labels?: string[];
+    web_url: string;
+    has_conflicts?: boolean;
+    detailed_merge_status?: string;
+}
+interface GitLabPipeline {
+    id: number;
+    iid?: number;
+    project_id: number;
+    sha: string;
+    ref: string;
+    status: string;
+    source?: string;
+    created_at: string;
+    updated_at: string;
+    web_url: string;
+    name?: string | null;
+}
+/**
+ * Pipeline statuses that will not change again, from the documented enum.
+ *
+ * The rest — `created`, `waiting_for_resource`, `preparing`,
+ * `waiting_for_callback`, `pending`, `running`, `canceling`, `manual`,
+ * `scheduled` — describe a pipeline still in flight. One of those is neither
+ * delivered nor remembered, so it fires once it finishes.
+ */
+declare const TERMINAL_PIPELINE_STATUSES: ReadonlySet<string>;
+declare function isFinishedPipeline(pipeline: Pick<GitLabPipeline, 'status'>): boolean;
+/**
+ * Map an issue onto the shape Vorn indexes.
+ *
+ * `updatedAt` is `created_at`, deliberately. The trigger asks GitLab for
+ * issues `created_after` its watermark, and the SDK sets that watermark from
+ * this field; if it carried `updated_at` instead, a poll cut short by `limit`
+ * could move the watermark past an issue created earlier but touched later,
+ * and that issue would never be asked for again. The real `updated_at` rides
+ * along as `changedAt` (`updatedAt` is a reserved key in `data`).
+ */
+declare function issueToItem(issue: GitLabIssue): ConnectorItem;
+/** Map a merge request onto the shape Vorn indexes. Same watermark rule as issues. */
+declare function mergeRequestToItem(mr: GitLabMergeRequest): ConnectorItem;
+/**
+ * Map a pipeline onto the shape Vorn indexes.
+ *
+ * Here `updatedAt` really is `updated_at`: the trigger filters on
+ * `updated_after`, and a pipeline's `updated_at` moving as it runs is what
+ * makes a finished one reappear after the poll that first saw it running.
+ */
+declare function pipelineToItem(pipeline: GitLabPipeline): ConnectorItem;
+
+declare const gitlabConnector: _vornrun_connector_sdk.Connector;
+
+export { type GitLabClient, type GitLabConnectorOptions, type GitLabIssue, type GitLabMergeRequest, type GitLabPipeline, GlabNotFoundError, GlabSignedOutError, type PreflightResult, type RunGlab, TERMINAL_PIPELINE_STATUSES, type TokenSource, apiUrl, gitlabConnector as connector, createGitLabClient, createGitLabConnector, createTokenSource, gitlabConnector as default, gitlabConnector, gitlabPreflight, glabInstallHint, hostOf, isFinishedPipeline, issueToItem, mergeRequestToItem, normalizeBaseUrl, pipelineToItem, projectSegment, runGlab };

package/dist/index.js

@@ -0,0 +1,890 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { createRequire } from "module";
+
+// src/connector.ts
+import {
+  defineConnector
+} from "@vornrun/connector-sdk";
+
+// src/client.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var GLAB_TIMEOUT_MS = 1e4;
+var API_PATH = "/api/v4";
+var DEFAULT_BASE_URL = "https://gitlab.com";
+var MAX_PAGE_SIZE = 100;
+var MAX_ERROR_BODY = 300;
+function glabInstallHint(platform = process.platform) {
+  switch (platform) {
+    case "darwin":
+      return "Install with Homebrew: `brew install glab`";
+    case "win32":
+      return "Install with winget: `winget install glab.glab` (or see https://gitlab.com/gitlab-org/cli)";
+    default:
+      return "Install from https://gitlab.com/gitlab-org/cli (releases carry .deb, .rpm and tarballs)";
+  }
+}
+var GlabNotFoundError = class extends Error {
+  code = "GLAB_NOT_FOUND";
+  constructor() {
+    super(`GitLab CLI (glab) not found on PATH. ${glabInstallHint()}`);
+    this.name = "GlabNotFoundError";
+  }
+};
+var GlabSignedOutError = class extends Error {
+  code = "GLAB_SIGNED_OUT";
+  constructor(detail) {
+    super(`Not signed in to GitLab. Run \`glab auth login\`.${detail ? `
+${detail}` : ""}`);
+    this.name = "GlabSignedOutError";
+  }
+};
+var runGlab = async (args) => {
+  try {
+    const { stdout } = await execFileAsync("glab", args, { timeout: GLAB_TIMEOUT_MS });
+    return stdout;
+  } catch (error) {
+    if (error.code === "ENOENT") throw new GlabNotFoundError();
+    const stderr = String(error.stderr ?? "").trim();
+    throw new Error(stderr || (error instanceof Error ? error.message : String(error)));
+  }
+};
+function normalizeBaseUrl(value) {
+  const trimmed = String(value ?? "").trim();
+  const base = trimmed === "" ? DEFAULT_BASE_URL : trimmed;
+  let url;
+  try {
+    url = new URL(base);
+  } catch {
+    throw new Error(`GITLAB_BASE_URL is not a URL: "${base}"`);
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+function hostOf(baseUrl) {
+  return new URL(normalizeBaseUrl(baseUrl)).host;
+}
+function apiUrl(baseUrl, path, query) {
+  const url = new URL(`${normalizeBaseUrl(baseUrl)}${API_PATH}${path}`);
+  for (const [key, value] of Object.entries(query ?? {})) {
+    if (value === void 0 || value === "") continue;
+    url.searchParams.set(key, String(value));
+  }
+  return url.toString();
+}
+function projectSegment(project) {
+  const value = String(project ?? "").trim();
+  if (!value) throw new Error("GITLAB_PROJECT is required");
+  return encodeURIComponent(value);
+}
+function createTokenSource(options = {}) {
+  const glab = options.glab ?? runGlab;
+  const pasted = String(options.token ?? "").trim();
+  const host = hostOf(options.baseUrl ?? DEFAULT_BASE_URL);
+  let cached = pasted || void 0;
+  async function read() {
+    const token = (await glab(["config", "get", "token", "--host", host])).trim();
+    if (!token) throw new GlabSignedOutError(`glab has no token for ${host}.`);
+    return token;
+  }
+  return {
+    /** Whether the token came from `glab`, and so could be re-read. */
+    borrowed: !pasted,
+    async get() {
+      return cached ??= await read();
+    },
+    /** Drop a borrowed token so the next `get()` asks `glab` again. */
+    invalidate() {
+      if (!pasted) cached = void 0;
+    }
+  };
+}
+async function describeFailure(response) {
+  const text2 = await response.text().catch(() => "");
+  let detail = text2;
+  try {
+    const parsed = JSON.parse(text2);
+    const message = parsed.message ?? parsed.error;
+    if (message !== void 0) detail = typeof message === "string" ? message : JSON.stringify(message);
+  } catch {
+  }
+  const quoted = detail.length > MAX_ERROR_BODY ? `${detail.slice(0, MAX_ERROR_BODY)}\u2026` : detail;
+  return `GitLab API ${response.status}${quoted ? `: ${quoted}` : ""}`;
+}
+var MAX_LIST_PAGES = 10;
+function createGitLabClient(options) {
+  const baseUrl = normalizeBaseUrl(options.config.baseUrl);
+  const tokens = options.tokens ?? createTokenSource({
+    ...options.config.token !== void 0 && { token: options.config.token },
+    baseUrl,
+    ...options.glab && { glab: options.glab }
+  });
+  async function send(url) {
+    const token = await tokens.get();
+    return options.fetch(url, { headers: { Authorization: `Bearer ${token}`, Accept: "application/json" } });
+  }
+  async function get(url) {
+    let response = await send(url);
+    if (response.status === 401 && tokens.borrowed) {
+      tokens.invalidate();
+      response = await send(url);
+      if (response.status === 401) {
+        throw new GlabSignedOutError("The token from `glab config get token` was rejected twice.");
+      }
+    }
+    if (response.status === 401) {
+      throw new Error(
+        "GitLab rejected the personal access token (401). Check it has not expired and carries the api or read_api scope."
+      );
+    }
+    if (!response.ok) throw new Error(await describeFailure(response));
+    return response;
+  }
+  return {
+    baseUrl,
+    /** One GET, parsed as JSON. Whatever shape comes back is the caller's to judge. */
+    async getJson(path, query) {
+      const response = await get(apiUrl(baseUrl, path, query));
+      return await response.json();
+    },
+    /**
+     * Every page of a list endpoint, following `x-next-page` (empty when there
+     * is no next page). Never `x-total`: lists over 10,000 records omit it.
+     */
+    async list(path, query, listOptions = {}) {
+      const maxPages = listOptions.maxPages ?? MAX_LIST_PAGES;
+      const collected = [];
+      let page = 1;
+      for (let index = 0; index < maxPages; index++) {
+        const response = await get(apiUrl(baseUrl, path, { ...query, per_page: MAX_PAGE_SIZE, page }));
+        const items = await response.json();
+        if (!Array.isArray(items)) {
+          throw new Error(`GitLab answered ${path} with something other than a list`);
+        }
+        collected.push(...items);
+        if (listOptions.limit !== void 0 && collected.length >= listOptions.limit) break;
+        const next = Number(response.headers.get("x-next-page") ?? "");
+        if (!Number.isInteger(next) || next <= page) break;
+        page = next;
+      }
+      return collected;
+    }
+  };
+}
+async function gitlabPreflight(options = {}) {
+  try {
+    await createTokenSource(options).get();
+    return { ok: true };
+  } catch (error) {
+    return { ok: false, message: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+// src/items.ts
+var TERMINAL_PIPELINE_STATUSES = /* @__PURE__ */ new Set([
+  "success",
+  "failed",
+  "canceled",
+  "skipped"
+]);
+function isFinishedPipeline(pipeline) {
+  return TERMINAL_PIPELINE_STATUSES.has(pipeline.status);
+}
+function issueToItem(issue) {
+  return {
+    externalId: String(issue.iid),
+    title: issue.title,
+    url: issue.web_url,
+    description: issue.description ?? "",
+    status: issue.state,
+    labels: issue.labels ?? [],
+    ...issue.assignees?.[0]?.username && { assignee: issue.assignees[0].username },
+    updatedAt: issue.created_at,
+    data: {
+      id: issue.id,
+      iid: issue.iid,
+      projectId: issue.project_id,
+      author: issue.author?.username ?? "",
+      assignees: (issue.assignees ?? []).map((user) => user.username),
+      createdAt: issue.created_at,
+      changedAt: issue.updated_at,
+      closedAt: issue.closed_at ?? null,
+      issueType: issue.issue_type ?? "issue",
+      confidential: issue.confidential === true
+    }
+  };
+}
+function mergeRequestToItem(mr) {
+  return {
+    externalId: String(mr.iid),
+    title: mr.title,
+    url: mr.web_url,
+    description: mr.description ?? "",
+    status: mr.state,
+    labels: mr.labels ?? [],
+    updatedAt: mr.created_at,
+    data: {
+      id: mr.id,
+      iid: mr.iid,
+      projectId: mr.project_id,
+      sourceBranch: mr.source_branch,
+      targetBranch: mr.target_branch,
+      draft: mr.draft === true,
+      sha: mr.sha ?? "",
+      author: mr.author?.username ?? "",
+      createdAt: mr.created_at,
+      changedAt: mr.updated_at,
+      mergedAt: mr.merged_at ?? null,
+      closedAt: mr.closed_at ?? null,
+      hasConflicts: mr.has_conflicts === true,
+      detailedMergeStatus: mr.detailed_merge_status ?? ""
+    }
+  };
+}
+function pipelineToItem(pipeline) {
+  return {
+    externalId: String(pipeline.id),
+    title: `${pipeline.name || pipeline.ref}: ${pipeline.status}`,
+    url: pipeline.web_url,
+    status: pipeline.status,
+    updatedAt: pipeline.updated_at,
+    data: {
+      id: pipeline.id,
+      iid: pipeline.iid ?? null,
+      projectId: pipeline.project_id,
+      ref: pipeline.ref,
+      sha: pipeline.sha,
+      source: pipeline.source ?? "",
+      name: pipeline.name ?? "",
+      createdAt: pipeline.created_at
+    }
+  };
+}
+var SAMPLE_ISSUE = {
+  id: 201377309,
+  iid: 627684,
+  project_id: 278964,
+  title: "Restructure Package Metadata Database documentation and split the offline quick start guide",
+  description: "This issue tracks a documentation follow-up agreed during review of https://gitlab.com/gitlab-org/gitlab/-/merge_requests/...",
+  state: "opened",
+  created_at: "2026-09-04T02:23:26.054Z",
+  updated_at: "2026-09-04T03:10:09.633Z",
+  closed_at: null,
+  labels: ["automation:quick-win-judged", "documentation", "group::composition analysis", "type::maintenance"],
+  author: { id: 32685309, username: "azaydan", name: "Ahmad Zaydan" },
+  assignees: [],
+  web_url: "https://gitlab.com/gitlab-org/gitlab/-/work_items/627684",
+  issue_type: "issue",
+  confidential: false
+};
+var SAMPLE_MERGE_REQUEST = {
+  id: 527853893,
+  iid: 253583,
+  project_id: 278964,
+  title: "Add scope, engine and level properties to perform_search",
+  description: "Nothing in GitLab measured whether a search returned any results, so the zero-result rate could not be computed. This adds...",
+  state: "opened",
+  draft: false,
+  created_at: "2026-09-04T03:07:05.722Z",
+  updated_at: "2026-09-04T03:12:24.611Z",
+  merged_at: null,
+  closed_at: null,
+  source_branch: "wt/telemetry-zero-result",
+  target_branch: "master",
+  sha: "ae17207bc7b8ea3696979d9888fd25e0629c8bde",
+  author: { id: 9717668, username: "johnmason", name: "John Mason" },
+  labels: ["analytics instrumentation", "backend", "feature::addition", "type::feature"],
+  web_url: "https://gitlab.com/gitlab-org/gitlab/-/merge_requests/253583",
+  has_conflicts: false,
+  detailed_merge_status: "not_approved"
+};
+var SAMPLE_PIPELINE = {
+  id: 2818962738,
+  iid: 6291260,
+  project_id: 278964,
+  sha: "631b08ab8c69929b88af7f06d64500c3e5f400ae",
+  ref: "master",
+  status: "success",
+  source: "push",
+  created_at: "2026-09-04T03:12:16.050Z",
+  updated_at: "2026-09-04T03:12:20.492Z",
+  web_url: "https://gitlab.com/gitlab-org/gitlab/-/pipelines/2818962738",
+  name: "Ruby 3.3.12 master branch"
+};
+
+// src/connector.ts
+function text(value) {
+  const trimmed = String(value ?? "").trim();
+  return trimmed || void 0;
+}
+var AUTH_HEADERS = { Authorization: "Bearer {{config.token}}" };
+var API = "{{config.baseUrl}}/api/v4";
+var FIRST_POLL_LOOKBACK_MS = 6e4;
+function pageSize(limit) {
+  if (typeof limit !== "number") return void 0;
+  return Math.min(MAX_PAGE_SIZE, Math.max(1, Math.floor(limit)));
+}
+function renames(mapping, path) {
+  return Object.entries(mapping).map(([from, to]) => ({
+    op: "rename",
+    from,
+    to,
+    ...path !== void 0 && { path }
+  }));
+}
+var ISSUE_SHAPE = [
+  {
+    op: "pick",
+    keys: [
+      "id",
+      "iid",
+      "project_id",
+      "title",
+      "description",
+      "state",
+      "web_url",
+      "labels",
+      "author",
+      "assignees",
+      "created_at",
+      "updated_at",
+      "closed_at",
+      "issue_type",
+      "confidential"
+    ]
+  },
+  ...renames({
+    project_id: "projectId",
+    web_url: "url",
+    created_at: "createdAt",
+    updated_at: "updatedAt",
+    closed_at: "closedAt",
+    issue_type: "issueType"
+  }),
+  { op: "pick", keys: ["id", "username", "name"], path: "author" },
+  { op: "pick", keys: ["id", "username", "name"], path: "assignees" }
+];
+var NOTE_SHAPE = [
+  {
+    op: "pick",
+    keys: ["id", "body", "author", "created_at", "noteable_iid", "noteable_type", "internal"]
+  },
+  ...renames({ created_at: "createdAt", noteable_iid: "noteableIid", noteable_type: "noteableType" }),
+  { op: "pick", keys: ["id", "username", "name"], path: "author" }
+];
+var NOTE_OUTPUTS = [
+  { key: "id", type: "number", description: "The note id" },
+  { key: "body", description: "The comment as posted" },
+  { key: "author", description: "Who posted it, as {id, username, name}" },
+  { key: "createdAt", description: "When it was posted" },
+  { key: "noteableIid", type: "number", description: "The iid it was posted on" },
+  { key: "noteableType", description: "Issue or MergeRequest" },
+  { key: "internal", type: "boolean", description: "Whether only members can see it" }
+];
+var PROJECT_INPUT = {
+  key: "project",
+  label: "Project",
+  required: true,
+  description: "Project path such as group/project, or its numeric id",
+  builderHint: "The path is what the URL shows after the host; the id is on the project page. Either is sent URL-encoded as the :id segment."
+};
+var BODY_INPUT = {
+  key: "body",
+  label: "Comment",
+  required: true,
+  description: "Markdown, up to 1,000,000 characters"
+};
+var INTERNAL_INPUT = {
+  key: "internal",
+  label: "Internal note",
+  type: "boolean",
+  description: "Visible to project members only. Defaults to false.",
+  builderHint: "The documented replacement for the deprecated confidential flag on notes."
+};
+function createGitLabConnector(options = {}) {
+  const env = options.env ?? process.env;
+  const sources = /* @__PURE__ */ new Map();
+  function tokensFor(config) {
+    const baseUrl = normalizeBaseUrl(config.baseUrl);
+    const token = text(config.token);
+    const key = `${baseUrl} ${token ?? ""}`;
+    let source = sources.get(key);
+    if (!source) {
+      source = createTokenSource({
+        ...token !== void 0 && { token },
+        baseUrl,
+        ...options.glab && { glab: options.glab }
+      });
+      sources.set(key, source);
+    }
+    return source;
+  }
+  function client(context) {
+    return createGitLabClient({
+      config: context.config,
+      fetch: context.fetch,
+      tokens: tokensFor(context.config)
+    });
+  }
+  function sinceOf(context) {
+    return context.since ?? new Date(Date.parse(context.now()) - FIRST_POLL_LOOKBACK_MS).toISOString();
+  }
+  function fetchIssues(context) {
+    return client(context).list(
+      `/projects/${projectSegment(context.config.project)}/issues`,
+      {
+        state: "all",
+        order_by: "created_at",
+        sort: "asc",
+        created_after: sinceOf(context)
+      },
+      { ...context.limit !== void 0 && { limit: context.limit } }
+    ).then((issues) => issues.map(issueToItem));
+  }
+  function fetchMergeRequests(context) {
+    return client(context).list(
+      `/projects/${projectSegment(context.config.project)}/merge_requests`,
+      {
+        state: "all",
+        order_by: "created_at",
+        sort: "asc",
+        created_after: sinceOf(context)
+      },
+      { ...context.limit !== void 0 && { limit: context.limit } }
+    ).then((mrs) => mrs.map(mergeRequestToItem));
+  }
+  async function fetchPipelines(context) {
+    const pipelines = await client(context).list(
+      `/projects/${projectSegment(context.config.project)}/pipelines`,
+      {
+        order_by: "updated_at",
+        sort: "asc",
+        updated_after: sinceOf(context),
+        ref: text(context.config.ref)
+      }
+      // No `limit` here: a page is mostly pipelines still running, and cutting
+      // the walk short on the raw count would starve the finished ones behind them.
+    );
+    return pipelines.filter(isFinishedPipeline).map(pipelineToItem);
+  }
+  return defineConnector({
+    id: "gitlab",
+    name: "GitLab",
+    ...options.version && { version: options.version },
+    description: "Trigger workflows from GitLab issues, merge requests and pipeline results, and create or comment on issues and merge requests from a step.",
+    // GitLab's own mark.
+    icon: {
+      viewBox: "0 0 24 24",
+      paths: [
+        "m23.6004 9.5927-.0337-.0862L20.3.9814a.851.851 0 0 0-.3362-.405.8748.8748 0 0 0-.9997.0539.8748.8748 0 0 0-.29.4399l-2.2055 6.748H7.5375l-2.2057-6.748a.8573.8573 0 0 0-.29-.4412.8748.8748 0 0 0-.9997-.0537.8585.8585 0 0 0-.3362.4049L.4332 9.5015l-.0325.0862a6.0657 6.0657 0 0 0 2.0119 7.0105l.0113.0087.03.0213 4.976 3.7264 2.462 1.8627 1.4995 1.1321a1.0085 1.0085 0 0 0 1.2197 0l1.4995-1.1321 2.4619-1.8627 5.006-3.7489.0125-.01a6.0682 6.0682 0 0 0 2.0094-7.003z"
+      ]
+    },
+    auth: {
+      rung: "cli",
+      probe: { command: "glab", args: ["auth", "status"] },
+      // `glab auth token` does not exist; `config get token` is the documented
+      // way to read what `glab auth login` stored. The host runs it at spawn
+      // and hands the answer over as GITLAB_TOKEN, which is why that variable
+      // is also the `token` field's env: a host refuses to borrow a name the
+      // connector does not openly read. This is the gitlab.com default; the
+      // connector's own token source adds `--host` from `baseUrl` when it has
+      // to borrow for itself.
+      borrow: {
+        env: ["GITLAB_TOKEN"],
+        tokenArgs: ["glab", "config", "get", "token"],
+        tokenEnv: "GITLAB_TOKEN"
+      }
+    },
+    config: [
+      {
+        key: "baseUrl",
+        env: "GITLAB_BASE_URL",
+        label: "GitLab URL",
+        default: DEFAULT_BASE_URL,
+        description: "Instance URL without a trailing slash. Leave the default for gitlab.com.",
+        builderHint: "Every request goes to <baseUrl>/api/v4. A self-managed instance under a relative root (https://host/gitlab) works as-is. Declared requests append the path verbatim, so a trailing slash here would double it."
+      },
+      {
+        key: "project",
+        env: "GITLAB_PROJECT",
+        label: "Project",
+        required: true,
+        description: "Path such as group/project, or the numeric id. The triggers poll this project.",
+        builderHint: "Sent URL-encoded (group%2Fproject) as the :id segment, as the docs require for namespaced paths. Actions take their own project input so one connection can act on several."
+      },
+      {
+        key: "token",
+        env: "GITLAB_TOKEN",
+        label: "Personal access token",
+        secret: true,
+        description: "Leave empty to borrow the glab CLI login. Needs scope api, or read_api for the triggers and read-only actions.",
+        builderHint: "Created under Edit profile, Access, Personal access tokens, Generate token; prefixed glpat-, 365-day default expiry. Filled, it is sent as-is and glab is never run; empty, the connector asks glab config get token --host <host>."
+      },
+      {
+        key: "ref",
+        env: "GITLAB_REF",
+        label: "Pipeline ref",
+        description: "Branch or tag whose pipelines to watch. Blank for every ref.",
+        builderHint: "Sent as the ref filter on GET /projects/:id/pipelines; the other two triggers ignore it."
+      }
+    ],
+    preflight: () => gitlabPreflight({
+      ...text(env.GITLAB_TOKEN) !== void 0 && { token: env.GITLAB_TOKEN },
+      baseUrl: text(env.GITLAB_BASE_URL) ?? DEFAULT_BASE_URL,
+      ...options.glab && { glab: options.glab }
+    }),
+    triggers: [
+      {
+        type: "issueCreated",
+        label: "An issue is created",
+        description: "Fires once for each issue created in the project since the last poll.",
+        // The SDK keeps the watermark and the ids sitting on it; the fetch
+        // asks GitLab for everything created on or after it.
+        dedupe: "timestamp",
+        fetch: fetchIssues,
+        statusMapping: [
+          { upstream: "opened", suggestedLocal: "todo" },
+          { upstream: "closed", suggestedLocal: "done" }
+        ],
+        defaultWorkflow: { name: "GitLab: issues", defaultCronFromMinutes: 5 },
+        sample: [issueToItem(SAMPLE_ISSUE)]
+      },
+      {
+        type: "mergeRequestOpened",
+        label: "A merge request is opened",
+        description: "Fires once for each merge request opened in the project since the last poll.",
+        dedupe: "timestamp",
+        fetch: fetchMergeRequests,
+        statusMapping: [
+          { upstream: "opened", suggestedLocal: "in_progress" },
+          { upstream: "merged", suggestedLocal: "done" },
+          { upstream: "closed", suggestedLocal: "done" }
+        ],
+        defaultWorkflow: { name: "GitLab: merge requests", defaultCronFromMinutes: 5 },
+        sample: [mergeRequestToItem(SAMPLE_MERGE_REQUEST)]
+      },
+      {
+        type: "pipelineFinished",
+        label: "A pipeline finishes",
+        description: "Fires once for each pipeline that reaches success, failed, canceled or skipped, with the status on the item.",
+        dedupe: "timestamp",
+        fetch: fetchPipelines,
+        // A failed pipeline is work to pick up; Vorn has no `blocked` status
+        // to suggest, so it lands as todo.
+        statusMapping: [
+          { upstream: "success", suggestedLocal: "done" },
+          { upstream: "failed", suggestedLocal: "todo" },
+          { upstream: "canceled", suggestedLocal: "cancelled" },
+          { upstream: "skipped", suggestedLocal: "cancelled" }
+        ],
+        defaultWorkflow: { name: "GitLab: pipelines", defaultCronFromMinutes: 5 },
+        sample: [pipelineToItem(SAMPLE_PIPELINE)]
+      }
+    ],
+    actions: [
+      {
+        type: "createIssue",
+        label: "Create an issue",
+        description: "Open a new issue in a project.",
+        // Two identical calls make two issues; GitLab offers no idempotency key.
+        idempotent: false,
+        inputs: [
+          PROJECT_INPUT,
+          { key: "title", label: "Title", required: true, description: "Issue title" },
+          {
+            key: "description",
+            label: "Description",
+            description: "Markdown body, up to 1,048,576 characters"
+          },
+          {
+            key: "labels",
+            label: "Labels",
+            description: "Comma-separated label names",
+            builderHint: "GitLab takes labels as one comma-separated string, so this is passed through as typed."
+          }
+        ],
+        outputs: [
+          { key: "id", type: "number", description: "Global issue id" },
+          { key: "iid", type: "number", description: "The number shown in the project, as in #12" },
+          { key: "url", description: "Where to read it" },
+          { key: "title", description: "The title as saved" },
+          { key: "state", description: "opened" },
+          { key: "createdAt", description: "When it was created" }
+        ],
+        request: {
+          method: "POST",
+          url: `${API}/projects/{{args.project}}/issues`,
+          headers: AUTH_HEADERS,
+          body: {
+            title: "{{args.title}}",
+            description: "{{args.description}}",
+            labels: "{{args.labels}}"
+          }
+        },
+        postReceive: [
+          { op: "pick", keys: ["id", "iid", "web_url", "title", "state", "created_at"] },
+          ...renames({ web_url: "url", created_at: "createdAt" })
+        ]
+      },
+      {
+        type: "commentOnIssue",
+        label: "Comment on an issue",
+        description: "Post a note on an issue.",
+        // Two identical calls make two notes.
+        idempotent: false,
+        inputs: [
+          PROJECT_INPUT,
+          {
+            key: "iid",
+            label: "Issue number",
+            type: "number",
+            required: true,
+            description: "The issue number shown in the project (its iid, not the global id)"
+          },
+          BODY_INPUT,
+          INTERNAL_INPUT
+        ],
+        outputs: NOTE_OUTPUTS,
+        request: {
+          method: "POST",
+          url: `${API}/projects/{{args.project}}/issues/{{args.iid}}/notes`,
+          headers: AUTH_HEADERS,
+          body: { body: "{{args.body}}", internal: "{{args.internal}}" }
+        },
+        postReceive: NOTE_SHAPE
+      },
+      {
+        type: "commentOnMergeRequest",
+        label: "Comment on a merge request",
+        description: "Post a note on a merge request.",
+        idempotent: false,
+        inputs: [
+          PROJECT_INPUT,
+          {
+            key: "iid",
+            label: "Merge request number",
+            type: "number",
+            required: true,
+            description: "The merge request number shown in the project (its iid)"
+          },
+          BODY_INPUT,
+          INTERNAL_INPUT
+        ],
+        outputs: NOTE_OUTPUTS,
+        request: {
+          method: "POST",
+          url: `${API}/projects/{{args.project}}/merge_requests/{{args.iid}}/notes`,
+          headers: AUTH_HEADERS,
+          body: { body: "{{args.body}}", internal: "{{args.internal}}" }
+        },
+        postReceive: NOTE_SHAPE
+      },
+      {
+        type: "getProject",
+        label: "Get a project",
+        description: "Read a project by path or id.",
+        // Reading changes nothing.
+        idempotent: true,
+        inputs: [PROJECT_INPUT],
+        outputs: [
+          { key: "id", type: "number", description: "Project id" },
+          { key: "name", description: "Display name" },
+          { key: "path", description: "The last segment of the path" },
+          { key: "pathWithNamespace", description: "group/project" },
+          { key: "description", description: "Project description" },
+          { key: "defaultBranch", description: "Usually main or master" },
+          { key: "visibility", description: "private, internal or public" },
+          { key: "url", description: "Where to open it" },
+          { key: "httpUrlToRepo", description: "Clone URL over HTTPS" },
+          { key: "sshUrlToRepo", description: "Clone URL over SSH" },
+          { key: "createdAt", description: "When the project was created" },
+          { key: "lastActivityAt", description: "When something last happened in it" },
+          { key: "archived", type: "boolean", description: "Whether it is archived" },
+          {
+            key: "namespace",
+            description: "The owning group or user, as {id, name, path, fullPath, kind}"
+          },
+          { key: "starCount", type: "number", description: "Stars" },
+          { key: "forksCount", type: "number", description: "Forks" },
+          { key: "topics", description: "Topic names" }
+        ],
+        // A public project on gitlab.com, so the live check works with read_api.
+        sample: { project: "gitlab-org/gitlab" },
+        request: {
+          url: `${API}/projects/{{args.project}}`,
+          headers: AUTH_HEADERS
+        },
+        postReceive: [
+          {
+            op: "pick",
+            keys: [
+              "id",
+              "name",
+              "path",
+              "path_with_namespace",
+              "description",
+              "default_branch",
+              "visibility",
+              "web_url",
+              "http_url_to_repo",
+              "ssh_url_to_repo",
+              "created_at",
+              "last_activity_at",
+              "archived",
+              "namespace",
+              "star_count",
+              "forks_count",
+              "topics"
+            ]
+          },
+          ...renames({
+            path_with_namespace: "pathWithNamespace",
+            default_branch: "defaultBranch",
+            web_url: "url",
+            http_url_to_repo: "httpUrlToRepo",
+            ssh_url_to_repo: "sshUrlToRepo",
+            created_at: "createdAt",
+            last_activity_at: "lastActivityAt",
+            star_count: "starCount",
+            forks_count: "forksCount"
+          }),
+          { op: "pick", keys: ["id", "name", "path", "full_path", "kind"], path: "namespace" },
+          ...renames({ full_path: "fullPath" }, "namespace")
+        ]
+      },
+      {
+        type: "listOpenMergeRequests",
+        label: "List open merge requests",
+        description: "The open merge requests of a project, most recently updated first.",
+        idempotent: true,
+        inputs: [
+          PROJECT_INPUT,
+          {
+            key: "limit",
+            label: "Maximum",
+            type: "number",
+            description: "How many to return, 1 to 100. Defaults to 20.",
+            builderHint: "Sent as per_page; 100 is the documented maximum."
+          },
+          {
+            key: "targetBranch",
+            label: "Target branch",
+            description: "Only merge requests into this branch. Blank for all."
+          }
+        ],
+        outputs: [
+          { key: "count", type: "number", description: "How many merge requests came back" },
+          {
+            key: "items",
+            description: "One entry per merge request, shaped as the merge request trigger delivers it: externalId (the iid), title, url, description, status, labels, updatedAt, and data with id, iid, projectId, sourceBranch, targetBranch, draft, sha, author, createdAt, changedAt, mergedAt, closedAt, hasConflicts, detailedMergeStatus"
+          }
+        ],
+        sample: { project: "gitlab-org/gitlab" },
+        // Hand-written rather than declared: a declared request cannot count
+        // what it returns, and the spec asks for the trigger's own mapping.
+        async run(args, context) {
+          const answer = await client(context).getJson(
+            `/projects/${projectSegment(args.project)}/merge_requests`,
+            {
+              state: "opened",
+              order_by: "updated_at",
+              sort: "desc",
+              per_page: pageSize(args.limit),
+              target_branch: text(args.targetBranch)
+            }
+          );
+          const mrs = Array.isArray(answer) ? answer : [];
+          const items = mrs.map(mergeRequestToItem);
+          return { count: items.length, items };
+        }
+      },
+      {
+        type: "getIssue",
+        label: "Get an issue",
+        description: "Read one issue by its number.",
+        idempotent: true,
+        inputs: [
+          PROJECT_INPUT,
+          {
+            key: "iid",
+            label: "Issue number",
+            type: "number",
+            required: true,
+            description: "The issue number shown in the project (its iid)"
+          }
+        ],
+        outputs: [
+          { key: "id", type: "number", description: "Global issue id" },
+          { key: "iid", type: "number", description: "The number shown in the project" },
+          { key: "projectId", type: "number", description: "The project it belongs to" },
+          { key: "title", description: "Issue title" },
+          { key: "description", description: "Markdown body" },
+          { key: "state", description: "opened or closed" },
+          { key: "url", description: "Where to read it" },
+          { key: "labels", description: "Label names" },
+          { key: "author", description: "Who opened it, as {id, username, name}" },
+          { key: "assignees", description: "Each as {id, username, name}" },
+          { key: "createdAt", description: "When it was opened" },
+          { key: "updatedAt", description: "When it last changed" },
+          { key: "closedAt", description: "When it was closed, or null" },
+          { key: "issueType", description: "issue, incident, test_case or task" },
+          { key: "confidential", type: "boolean", description: "Whether only members can see it" }
+        ],
+        sample: { project: "gitlab-org/gitlab", iid: "1" },
+        request: {
+          url: `${API}/projects/{{args.project}}/issues/{{args.iid}}`,
+          headers: AUTH_HEADERS
+        },
+        postReceive: ISSUE_SHAPE
+      }
+    ]
+  });
+}
+
+// src/entry.ts
+import { realpathSync } from "fs";
+import { fileURLToPath } from "url";
+import { serveConnector } from "@vornrun/connector-sdk";
+function isEntryPoint(moduleUrl, entry = process.argv[1]) {
+  if (!entry) return false;
+  try {
+    return realpathSync(entry) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+function serveIfEntryPoint(connector, moduleUrl, serve = serveConnector) {
+  if (!isEntryPoint(moduleUrl)) return false;
+  void serve(connector);
+  return true;
+}
+
+// src/index.ts
+var { version } = createRequire(import.meta.url)("../package.json");
+var gitlabConnector = createGitLabConnector({ version });
+var index_default = gitlabConnector;
+serveIfEntryPoint(gitlabConnector, import.meta.url);
+export {
+  GlabNotFoundError,
+  GlabSignedOutError,
+  TERMINAL_PIPELINE_STATUSES,
+  apiUrl,
+  gitlabConnector as connector,
+  createGitLabClient,
+  createGitLabConnector,
+  createTokenSource,
+  index_default as default,
+  gitlabConnector,
+  gitlabPreflight,
+  glabInstallHint,
+  hostOf,
+  isFinishedPipeline,
+  issueToItem,
+  mergeRequestToItem,
+  normalizeBaseUrl,
+  pipelineToItem,
+  projectSegment,
+  runGlab
+};

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@vornrun/connector-gitlab",
+  "version": "0.1.0",
+  "description": "Trigger workflows from GitLab issues, merge requests and pipelines.",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vorn-run/connectors.git",
+    "directory": "packages/gitlab"
+  },
+  "bin": {
+    "vorn-connector-gitlab": "dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts --format esm --target node22 --clean",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@vornrun/connector-sdk": "^0.7.0-beta.10"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "@vitest/coverage-v8": "^4.1.10",
+    "tsup": "^8.5.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.10"
+  },
+  "vorn": {
+    "category": "Development",
+    "keywords": [
+      "gitlab",
+      "issues",
+      "merge requests",
+      "pipelines",
+      "ci",
+      "code review",
+      "repositories"
+    ],
+    "auth": "Borrows the GitLab CLI's login — `glab auth login` is all it needs — or takes a personal access token if you would rather paste one."
+  }
+}