engineering-memory 1.11.26 → 1.11.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-memory",
-  "version": "1.11.26",
+  "version": "1.11.28",
   "description": "Installs the Engineering Memory skill and its local MCP bridge. Sign in after installing; your organization and project are resolved from your account.",
   "license": "UNLICENSED",
   "type": "module",

package/runtime/build.json

@@ -1,3 +1,3 @@
 {
-  "gitHead": "0f86f662e39b6ace530d89827a5b14018f1b68fe"
+  "gitHead": "7ca14a854db07f8fda3823f303e8a7a6accbebff"
 }

package/runtime/dist/src/config.js

@@ -70,6 +70,7 @@ export const endpoints = {
     taskDeliveryAnswer: (projectId, taskId) => `/projects/${projectId}/tasks/${taskId}/delivery/answer`,
     taskDeliveryDeliver: (projectId, taskId) => `/projects/${projectId}/tasks/${taskId}/delivery/deliver`,
     taskDeliveryCancel: (projectId, taskId) => `/projects/${projectId}/tasks/${taskId}/delivery/cancel`,
+    taskReviewRequest: (projectId, taskId) => `/projects/${projectId}/tasks/${taskId}/review-request`,
     projectSetup: '/projects/setup',
     projectList: '/projects',
     projectResolve: '/projects/resolve',

package/runtime/dist/src/git/git-inspector.js

@@ -280,14 +280,7 @@ export class GitInspector {
         const upstream = branch
             ? await this.gitValue(repoRoot, ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}'])
             : null;
-        const listed = await this.runner.run('git', ['remote'], { cwd: repoRoot });
-        const remotes = listed.exitCode === 0 ? listed.stdout.split(/\r?\n/).filter(Boolean) : [];
-        const configured = (branch &&
-            (await this.gitValue(repoRoot, ['config', '--get', `branch.${branch}.pushRemote`]))) ||
-            (await this.gitValue(repoRoot, ['config', '--get', 'remote.pushDefault'])) ||
-            (branch && (await this.gitValue(repoRoot, ['config', '--get', `branch.${branch}.remote`]))) ||
-            'origin';
-        const remote = remotes.includes(configured) ? configured : null;
+        const remote = await this.pushRemote(repoRoot, branch);
         const pushUrl = remote
             ? await this.gitValue(repoRoot, ['remote', 'get-url', '--push', remote])
             : null;
@@ -308,6 +301,32 @@ export class GitInspector {
             headCommit: await this.gitValue(repoRoot, ['rev-parse', '--verify', '-q', 'HEAD']),
         };
     }
+    async branchPushUrl(repoRoot, branch) {
+        await this.validateBranch(repoRoot, branch);
+        const remote = await this.pushRemote(repoRoot, branch);
+        const pushUrl = remote
+            ? await this.gitValue(repoRoot, ['remote', 'get-url', '--push', remote])
+            : null;
+        return pushUrl ? withoutCredentials(pushUrl) : null;
+    }
+    async branchCommit(repoRoot, branch) {
+        await this.validateBranch(repoRoot, branch);
+        const result = await this.runner.run('git', ['log', '-1', '--format=%H%x00%s', `refs/heads/${branch}`, '--'], { cwd: repoRoot });
+        const [commit, subject] = result.stdout.trim().split('\0');
+        return result.exitCode === 0 && commit && /^([a-f0-9]{40}|[a-f0-9]{64})$/.test(commit)
+            ? { commit, subject: subject ?? '' }
+            : null;
+    }
+    async pushRemote(repoRoot, branch) {
+        const listed = await this.runner.run('git', ['remote'], { cwd: repoRoot });
+        const remotes = listed.exitCode === 0 ? listed.stdout.split(/\r?\n/).filter(Boolean) : [];
+        const configured = (branch &&
+            (await this.gitValue(repoRoot, ['config', '--get', `branch.${branch}.pushRemote`]))) ||
+            (await this.gitValue(repoRoot, ['config', '--get', 'remote.pushDefault'])) ||
+            (branch && (await this.gitValue(repoRoot, ['config', '--get', `branch.${branch}.remote`]))) ||
+            'origin';
+        return remotes.includes(configured) ? configured : null;
+    }
     async protectedBranchNames(repoRoot) {
         const names = new Set(['main', 'master', 'develop', 'prod']);
         const fallback = await this.defaultBranch(repoRoot);

package/runtime/dist/src/localization/catalogue.generated.js

@@ -63,6 +63,28 @@ export const bundledTexts = {
         'gitPreferences.save': 'Save this choice',
         'gitPreferences.saved': 'This branch is recorded as the project default now, for every member.',
         'gitPreferences.unchanged': 'Nothing changes. This role stays as it is and can be answered another time.',
+        'gitlabToken.address': 'GitLab address',
+        'gitlabToken.addressHint': 'The address you open GitLab with in the browser, such as https://gitlab.example.com, with the path if GitLab runs under one.',
+        'gitlabToken.certificate': 'This computer does not trust the certificate of {address}. If your company uses its own certificate, set the NODE_EXTRA_CA_CERTS environment variable to its file and restart the coding agent.',
+        'gitlabToken.expired': 'This link has expired or was already used. Ask the coding agent for a new one.',
+        'gitlabToken.failed': 'The request could not be handled. Try again in a moment.',
+        'gitlabToken.gitlabError': 'GitLab answered with an error ({status}), so the token was not saved. Try again in a moment.',
+        'gitlabToken.intro': "Engineering Memory opens and follows your merge requests on this GitLab from this computer. The token is kept on this computer in the operating system's protected credential storage; it is not sent to Engineering Memory's server or to the coding agent.",
+        'gitlabToken.invalidAddress': 'Enter the address as https://host, with a path if GitLab runs under one. Plain http works only for a GitLab on this computer, and an address given as an IP number cannot be used.',
+        'gitlabToken.missingToken': 'Enter the token.',
+        'gitlabToken.noApiScope': 'GitLab accepted the token, but it has no access to the API. Create a token with the api scope, or read_api for following merge requests only.',
+        'gitlabToken.notGitLab': '{address} does not answer like GitLab. Check the address, including any path GitLab runs under.',
+        'gitlabToken.redirected': "{address} answered with a redirect, so it is probably not GitLab's own address. Check https and any path GitLab runs under.",
+        'gitlabToken.rejected': 'GitLab did not accept this token. Check that it was copied completely and has not expired or been revoked.',
+        'gitlabToken.remove': 'Remove the saved token',
+        'gitlabToken.removed': 'No token for this GitLab address is saved on this computer any more. You can close this page.',
+        'gitlabToken.save': 'Check and save',
+        'gitlabToken.saved': 'Saved. GitLab accepted the token. You can close this page and go back to the coding agent.',
+        'gitlabToken.savedReadOnly': 'Saved. GitLab accepted the token, but it can only read: Engineering Memory can follow merge requests with it and cannot open them. To open them too, save a token with the api scope.',
+        'gitlabToken.title': 'GitLab token for Engineering Memory',
+        'gitlabToken.token': 'Personal access token',
+        'gitlabToken.tokenHint': 'Create it in GitLab under Preferences, Access tokens. With the api scope Engineering Memory can open merge requests; read_api is enough for following them.',
+        'gitlabToken.unreachable': 'This computer cannot reach {address}. If GitLab is only reachable from your company network, connect to it (for example through the VPN) and try again.',
         'inspection.defer': 'Not now',
         'inspection.deferDetail': 'Nothing is inspected and nothing is written. Your answer is recorded, so inspecting this source later is a new request.',
         'inspection.example': 'When the inspection finishes, a memory record is proposed for each screen, service and flow, and you decide which of them get published.',
@@ -467,6 +489,28 @@ export const bundledTexts = {
         'gitPreferences.save': 'Bu tercihi kaydet',
         'gitPreferences.saved': 'Bu dal şimdi proje varsayılanı olarak kaydedilir; ekipteki herkes onu görür.',
         'gitPreferences.unchanged': 'Hiçbir şey değişmez. Bu rol olduğu gibi kalır, sonra yeniden sorulabilir.',
+        'gitlabToken.address': 'GitLab adresi',
+        'gitlabToken.addressHint': "GitLab'ı tarayıcıda açtığın adres, örneğin https://gitlab.example.com. GitLab bir yol altında çalışıyorsa yolu da ekle.",
+        'gitlabToken.certificate': 'Bu bilgisayar {address} adresinin sertifikasına güvenmiyor. Şirketin kendi sertifikasını kullanıyorsa NODE_EXTRA_CA_CERTS ortam değişkenini o sertifika dosyasına ayarla ve kod ajanını yeniden başlat.',
+        'gitlabToken.expired': 'Bu bağlantının süresi dolmuş ya da daha önce kullanılmış. Kod ajanından yeni bir bağlantı iste.',
+        'gitlabToken.failed': 'İstek işlenemedi. Biraz sonra tekrar dene.',
+        'gitlabToken.gitlabError': 'GitLab hatayla cevap verdi ({status}); token kaydedilmedi. Biraz sonra tekrar dene.',
+        'gitlabToken.intro': "Engineering Memory bu GitLab'daki merge request'lerini bu bilgisayardan açar ve takip eder. Token bu bilgisayarda, işletim sisteminin koruduğu kimlik bilgisi deposunda saklanır; Engineering Memory'nin sunucusuna da kod ajanına da gönderilmez.",
+        'gitlabToken.invalidAddress': 'Adresi https://sunucu biçiminde gir; GitLab bir yol altında çalışıyorsa yolu da ekle. Düz http yalnızca bu bilgisayardaki bir GitLab için geçerli; IP numarasıyla verilen bir adres kullanılamaz.',
+        'gitlabToken.missingToken': "Token'ı gir.",
+        'gitlabToken.noApiScope': "GitLab token'ı kabul etti ama token'ın API erişimi yok. api yetkili bir token oluştur; yalnızca takip için read_api yeterli.",
+        'gitlabToken.notGitLab': "{address} GitLab gibi cevap vermiyor. Adresi, GitLab'ın çalıştığı yol dahil kontrol et.",
+        'gitlabToken.redirected': "{address} yönlendirmeyle cevap verdi; büyük olasılıkla GitLab'ın kendi adresi değil. https'i ve GitLab'ın çalıştığı yolu kontrol et.",
+        'gitlabToken.rejected': "GitLab bu token'ı kabul etmedi. Tamamen kopyalandığını, süresinin dolmadığını ve iptal edilmediğini kontrol et.",
+        'gitlabToken.remove': "Kayıtlı token'ı sil",
+        'gitlabToken.removed': 'Bu GitLab adresi için bu bilgisayarda artık kayıtlı bir token yok. Bu sayfayı kapatabilirsin.',
+        'gitlabToken.save': 'Kontrol et ve kaydet',
+        'gitlabToken.saved': "Kaydedildi. GitLab token'ı kabul etti. Bu sayfayı kapatıp kod ajanına dönebilirsin.",
+        'gitlabToken.savedReadOnly': "Kaydedildi. GitLab token'ı kabul etti ama bu token yalnızca okuyabiliyor: Engineering Memory merge request'leri takip edebilir, açamaz. Açabilmesi için api yetkili bir token kaydet.",
+        'gitlabToken.title': "Engineering Memory için GitLab token'ı",
+        'gitlabToken.token': "Kişisel erişim token'ı (personal access token)",
+        'gitlabToken.tokenHint': "GitLab'da Preferences > Access tokens bölümünden oluşturabilirsin. api yetkisiyle Engineering Memory merge request açabilir; yalnızca takip için read_api yeterli.",
+        'gitlabToken.unreachable': "Bu bilgisayar {address} adresine ulaşamıyor. GitLab'a yalnızca şirket ağından ulaşılıyorsa ağa bağlan (örneğin VPN ile) ve tekrar dene.",
         'inspection.defer': 'Şimdilik başlatma',
         'inspection.deferDetail': 'İnceleme başlamaz, hiçbir şey yazılmaz. Cevabın kaydedilir; bu kaynağı sonra incelemek yeni bir istek olur.',
         'inspection.example': 'İnceleme bitince her ekran, servis ve akış için birer hafıza kaydı önerilir; hangilerinin yayınlanacağına sen karar verirsin.',

package/runtime/dist/src/mcp/delivery-tools.js

@@ -66,6 +66,9 @@ const recordSchema = z.object({
 });
 export function registerDeliveryTools(server, service) {
     registerTaskDelivery(server, service);
+    registerTaskReviewRequest(server, service);
+    registerTaskOpenReviewRequest(server, service);
+    registerGitLabToken(server, service);
     server.registerTool('task.close', {
         description: 'Close the verified task, then open its durable mode-governed Git delivery selector in the same call. Memory publication is separate. Cancellation/feedback leave delivery pending; retry identical input to resume. PR/MR is one review-request concept, not an instruction to merge. No Git action is performed by this tool. Read-only tasks need no delivery. Supply complete copy when the product text catalogue lacks the conversation language. If the user already explicitly chose Git delivery in their own message, deliveryInstruction preserves that choice with its exact relevant excerpt; it is an agent-reported instruction, never a native answer or a substitute for missing user consent. Do not use it for agent decisions or memory-publication approval.',
         inputSchema: z.object({
@@ -507,6 +510,88 @@ function registerTaskDelivery(server, service) {
         });
     });
 }
+function registerTaskReviewRequest(server, service) {
+    server.registerTool('task.review_request', {
+        description: "Record the pull request (GitHub) or merge request (GitLab) a closed task's changes went into, and its state: draft, ready, merged or closed. Call it with the link copied from the provider as soon as the pull request is opened, and again when the user says it became ready, was merged or was closed. Engineering Memory then moves the task's work item as the project's workflow rules say, for example to PR when every pull request of the work item is ready and to READY FOR QA when they are all merged. It works from any chat, also for a delivery session.entry lists. What is recorded is what was reported: Engineering Memory does not check it with the provider, and performs no Git or provider action.",
+        inputSchema: z.strictObject({
+            projectId: z.string().uuid(),
+            taskId: z.string().uuid(),
+            url: z.string().trim().min(1).max(500),
+            state: z.enum(['draft', 'ready', 'merged', 'closed']),
+        }),
+    }, async (input) => {
+        const result = await service.taskReviewRequest(input);
+        if (!result.ok)
+            return output(result);
+        const recorded = result.data;
+        return output({
+            ok: true,
+            data: {
+                ...result.data,
+                nextAction: recorded.queued
+                    ? 'Engineering Memory is unreachable, so this report is queued. It is recorded, and the work item moves as the rules say, when Engineering Memory is reachable again.'
+                    : (recorded.data?.reviewEvent?.nextAction ??
+                        (recorded.data?.reviewEvent
+                            ? 'The pull request is recorded; the work item stays where it is.'
+                            : 'The pull request is recorded. The work item does not move yet: other work on it is still open or undelivered, or the task has no active work item.')),
+            },
+        });
+    });
+}
+function registerTaskOpenReviewRequest(server, service) {
+    server.registerTool('task.open_review_request', {
+        description: "Open the merge request of a delivered task on GitLab from this computer and record it, in one call. It works for a GitLab only this computer's network reaches, with the user's own token saved on this computer through gitlab.token. The target branch and draft come from the delivery answer unless given here. The branch must already be on GitLab with the delivered commit. An open merge request of the branch is reused, never opened twice. When it refuses, it says why and what works instead; opening the merge request in GitLab by hand and recording it with task.review_request always works.",
+        inputSchema: z.strictObject({
+            projectId: z.string().uuid(),
+            taskId: z.string().uuid(),
+            repoRoot: z.string().min(1).optional(),
+            targetBranch: z.string().trim().min(1).max(240).optional(),
+            draft: z.boolean().optional(),
+            title: z
+                .string()
+                .trim()
+                .min(1)
+                .max(200)
+                .regex(/^[^\r\n]+$/)
+                .optional(),
+            description: z.string().trim().min(1).max(4000).optional(),
+        }),
+    }, async (input) => {
+        const result = await service.taskOpenReviewRequest(input);
+        if (!result.ok)
+            return output(result);
+        const data = result.data;
+        const opened = data.mergeRequest;
+        const said = opened
+            ? `${opened.reused ? 'The branch already had an open merge request, and it is used' : 'The merge request is opened'}: ${opened.url} (${opened.state}, into ${opened.targetBranch}).`
+            : '';
+        return output({
+            ok: true,
+            data: {
+                ...data,
+                nextAction: data.alreadyRecorded
+                    ? `This delivery already has its merge request recorded: ${data.alreadyRecorded.url} (${data.alreadyRecorded.state}). Nothing was opened. When the user says its state changed, record that with task.review_request.`
+                    : data.reportRefused
+                        ? `${said} Recording it in Engineering Memory was refused: ${data.reportRefused} Tell the user; once the cause is fixed, record it with task.review_request.`
+                        : data.report?.queued
+                            ? `${said} Engineering Memory is unreachable, so recording it is queued; it is recorded, and the work item moves, when Engineering Memory is reachable again.`
+                            : `${said} ${data.report?.data?.reviewEvent?.nextAction ??
+                                (data.report?.data?.reviewEvent
+                                    ? 'It is recorded; the work item stays where it is.'
+                                    : 'It is recorded. The work item does not move yet: other work on it is still open or undelivered, or the task has no active work item.')}`,
+            },
+        });
+    });
+}
+function registerGitLabToken(server, service) {
+    server.registerTool('gitlab.token', {
+        description: "Give the user a page on this computer where they save their own GitLab personal access token, so task.open_review_request can open merge requests and Engineering Memory can follow them on a GitLab only this computer's network reaches. The token is typed only on that page: it never passes through the chat, this agent or Engineering Memory's server, and it is kept in this computer's credential store for the signed-in account. Never open or fill in the page yourself. The same page removes a saved token.",
+        inputSchema: z.strictObject({
+            repoRoot: z.string().min(1).optional(),
+            language: languageTag.optional(),
+        }),
+    }, async (input) => output(await service.gitlabToken(input)));
+}
 function askPullRequestBase(server, service, context, input, language, copy, owner) {
     return askQuestionnaire(server, service, {
         repoRoot: input.repoRoot,

package/runtime/dist/src/mcp/tool-annotations.js

@@ -78,6 +78,9 @@ export const toolAnnotations = {
     'task.verify': write,
     'task.close': write,
     'task.delivery': write,
+    'task.review_request': repeatableWrite,
+    'task.open_review_request': { ...outward, idempotentHint: true },
+    'gitlab.token': outward,
     'task.abandon': destructive,
     'task.branch': outward, // fetches the chosen base from the Git remote
     'architecture.plan': read,

package/runtime/dist/src/mcp/tool-definitions.js

@@ -117,6 +117,9 @@ export const engineeringMemoryToolNames = [
     'task.verify',
     'task.close',
     'task.delivery',
+    'task.review_request',
+    'task.open_review_request',
+    'gitlab.token',
     'task.abandon',
     'task.branch',
     'architecture.plan',

package/runtime/dist/src/providers/gitlab-token-page.js

@@ -0,0 +1,226 @@
+import { randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import * as z from 'zod/v4';
+import { copies, escapeHtml, format, textDirection } from '../runtime/texts.js';
+import { GitLabError, gitLabAddress } from './gitlab.js';
+const text = z.string().min(1);
+const pageWording = z.strictObject({
+    title: text,
+    intro: text,
+    address: text,
+    addressHint: text,
+    token: text,
+    tokenHint: text,
+    save: text,
+    remove: text,
+    saved: text,
+    savedReadOnly: text,
+    removed: text,
+    rejected: text,
+    noApiScope: text,
+    unreachable: text,
+    certificate: text,
+    redirected: text,
+    notGitLab: text,
+    invalidAddress: text,
+    missingToken: text,
+    gitlabError: text,
+    failed: text,
+    expired: text,
+});
+const maximumBody = 8 * 1024;
+export class GitLabTokenPage {
+    tokens;
+    gitlab;
+    language;
+    server = null;
+    page = null;
+    timer = null;
+    queue = Promise.resolve();
+    constructor(tokens, gitlab, language) {
+        this.tokens = tokens;
+        this.gitlab = gitlab;
+        this.language = language;
+    }
+    async open(target) {
+        await this.close();
+        const server = createServer((request, response) => {
+            this.queue = this.queue.then(() => this.handle(request, response)).catch(() => undefined);
+        });
+        await new Promise((resolvePromise, reject) => {
+            server.once('error', reject);
+            server.listen(0, '127.0.0.1', resolvePromise);
+        });
+        server.unref();
+        const port = server.address().port;
+        const expiresAt = Date.now() + 10 * 60 * 1000;
+        this.server = server;
+        this.page = { nonce: randomBytes(32).toString('base64url'), port, ...target, expiresAt };
+        this.timer = setTimeout(() => void this.close(), expiresAt - Date.now());
+        this.timer.unref();
+        return {
+            url: `http://127.0.0.1:${port}/${this.page.nonce}`,
+            expiresAt: new Date(expiresAt).toISOString(),
+        };
+    }
+    async close() {
+        const server = this.server;
+        this.server = null;
+        this.page = null;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+        if (!server)
+            return;
+        await new Promise((resolvePromise) => {
+            server.close(() => resolvePromise());
+            server.closeAllConnections();
+        });
+    }
+    async handle(request, response) {
+        const page = this.page;
+        try {
+            const own = page ? `127.0.0.1:${page.port}` : null;
+            if (!page || request.headers.host !== own)
+                return this.send(response, 421, await this.notice('expired'));
+            if (request.url !== `/${page.nonce}`)
+                return this.send(response, 404, await this.notice('expired'));
+            if (Date.now() >= page.expiresAt)
+                return this.finish(response, await this.notice('expired'), 410);
+            if (request.method === 'GET')
+                return this.send(response, 200, await this.form(page, page.address ?? ''));
+            if (request.method !== 'POST')
+                return this.send(response, 405, '', { Allow: 'GET, POST' });
+            if (request.headers.origin !== undefined && request.headers.origin !== `http://${own}`)
+                return this.send(response, 403, await this.notice('expired'));
+            if (!/^application\/x-www-form-urlencoded(;|$)/i.test(request.headers['content-type'] ?? ''))
+                return this.send(response, 415, await this.notice('failed'));
+            const body = await readBody(request);
+            if (body === null)
+                return this.send(response, 413, await this.notice('failed'));
+            const fields = new URLSearchParams(body);
+            const typed = fields.get('address') ?? '';
+            const address = gitLabAddress(typed);
+            if (!address)
+                return this.send(response, 400, await this.form(page, typed, 'invalidAddress'));
+            if (fields.get('action') === 'remove') {
+                await this.tokens.remove(address);
+                return this.finish(response, await this.notice('removed'));
+            }
+            const token = (fields.get('token') ?? '').trim();
+            if (!token || token.length > 1024 || /[\s\u0000-\u001f\u007f]/.test(token))
+                return this.send(response, 400, await this.form(page, address, 'missingToken'));
+            try {
+                await this.gitlab.user(address, token);
+                const scopes = await this.gitlab.scopes(address, token);
+                await this.tokens.save(page.host ?? new URL(address).host, address, token);
+                return this.finish(response, await this.notice(scopes && !scopes.includes('api') ? 'savedReadOnly' : 'saved'));
+            }
+            catch (error) {
+                if (!(error instanceof GitLabError))
+                    throw error;
+                return this.send(response, 400, await this.form(page, address, refusal(error), error));
+            }
+        }
+        catch {
+            return this.send(response, 500, await this.notice('failed'));
+        }
+    }
+    async finish(response, html, status = 200) {
+        this.page = null;
+        const server = this.server;
+        response.once('finish', () => {
+            if (this.server === server)
+                void this.close();
+        });
+        this.send(response, status, html);
+    }
+    send(response, status, html, headers = {}) {
+        response.writeHead(status, {
+            'Content-Type': 'text/html; charset=utf-8',
+            'Cache-Control': 'no-store',
+            'Referrer-Policy': 'no-referrer',
+            'X-Content-Type-Options': 'nosniff',
+            'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
+            ...headers,
+        });
+        response.end(html);
+    }
+    async wording() {
+        const told = await this.language().catch(() => undefined);
+        return copies(pageWording, 'gitlabToken', told)[0];
+    }
+    async notice(key) {
+        const { language, copy } = await this.wording();
+        return document(language, copy.title, `<p>${escapeHtml(copy[key])}</p>`);
+    }
+    async form(page, address, problem, error) {
+        const { language, copy } = await this.wording();
+        const shown = problem
+            ? format(copy[problem], language, {
+                address: error?.address ?? address,
+                status: error?.status ?? '-',
+            })
+            : null;
+        return document(language, copy.title, `<p>${escapeHtml(copy.intro)}</p>` +
+            (shown ? `<p class="problem" role="alert">${escapeHtml(shown)}</p>` : '') +
+            `<form method="post" action="/${page.nonce}" autocomplete="off">` +
+            `<label for="address">${escapeHtml(copy.address)}</label>` +
+            `<input id="address" name="address" type="url" required value="${escapeHtml(address)}">` +
+            `<p class="hint">${escapeHtml(copy.addressHint)}</p>` +
+            `<label for="token">${escapeHtml(copy.token)}</label>` +
+            `<input id="token" name="token" type="password" autocomplete="new-password" spellcheck="false">` +
+            `<p class="hint">${escapeHtml(copy.tokenHint)}</p>` +
+            `<div class="actions"><button name="action" value="save">${escapeHtml(copy.save)}</button>` +
+            `<button name="action" value="remove" class="secondary" formnovalidate>${escapeHtml(copy.remove)}</button></div>` +
+            `</form>`);
+    }
+}
+function refusal(error) {
+    switch (error.failure) {
+        case 'token_rejected':
+            return 'rejected';
+        case 'not_allowed':
+            return 'noApiScope';
+        case 'unreachable':
+            return 'unreachable';
+        case 'untrusted_certificate':
+            return 'certificate';
+        case 'redirected':
+            return 'redirected';
+        case 'not_found':
+        case 'unexpected_answer':
+            return 'notGitLab';
+        default:
+            return 'gitlabError';
+    }
+}
+function document(language, title, body) {
+    return (`<!doctype html><html lang="${escapeHtml(language)}" dir="${textDirection(language)}"><head>` +
+        '<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">' +
+        `<title>${escapeHtml(title)}</title><style>` +
+        'body{font:16px/1.5 system-ui,sans-serif;margin:0;padding:24px 16px;background:#f6f7f9;color:#1d2330}' +
+        'main{max-width:560px;margin:0 auto}h1{font-size:22px;line-height:1.3}' +
+        'label{display:block;font-weight:600;margin-top:20px}' +
+        'input{box-sizing:border-box;width:100%;padding:10px;margin-top:6px;font:inherit;border:1px solid #9aa3b2;border-radius:6px;background:#fff;color:inherit}' +
+        '.hint{margin:6px 0 0;font-size:14px;color:#4b5565}.problem{padding:10px 12px;border-radius:6px;background:#fdecec;color:#8a1c1c}' +
+        '.actions{display:flex;flex-wrap:wrap;gap:12px;margin-top:24px}' +
+        'button{font:inherit;padding:10px 16px;border-radius:6px;border:1px solid #2952cc;background:#2952cc;color:#fff;cursor:pointer}' +
+        'button.secondary{background:transparent;color:#2952cc}' +
+        '@media (prefers-color-scheme:dark){body{background:#14171c;color:#e6e9ef}input{background:#1d2129;border-color:#4b5565}.hint{color:#aab2c0}.problem{background:#3a1d1d;color:#f3b4b4}button{background:#5b7ef0;border-color:#5b7ef0}button.secondary{color:#9db3ff}}' +
+        `</style></head><body><main><h1>${escapeHtml(title)}</h1>${body}</main></body></html>`);
+}
+function readBody(request) {
+    return new Promise((resolvePromise, reject) => {
+        const chunks = [];
+        let size = 0;
+        request.on('data', (chunk) => {
+            size += chunk.length;
+            if (size <= maximumBody)
+                chunks.push(chunk);
+        });
+        request.once('end', () => resolvePromise(size > maximumBody ? null : Buffer.concat(chunks).toString('utf8')));
+        request.once('error', reject);
+    });
+}
+//# sourceMappingURL=gitlab-token-page.js.map