engineering-memory 1.11.27 → 1.11.28

package/runtime/dist/src/providers/gitlab.js

@@ -0,0 +1,417 @@
+import { isIP } from 'node:net';
+import { join } from 'node:path';
+import * as z from 'zod/v4';
+import { principalFingerprint } from '../runtime/principal-state.js';
+import { readJson, removeFile, writeJson } from '../utilities/files.js';
+import { sha256 } from '../utilities/hash.js';
+export function gitLabRemote(remote) {
+    const trimmed = remote.trim();
+    const scpLike = /^(?:[^@/:]+@)?([^/:]+):(.+)$/.exec(trimmed);
+    let scheme = 'ssh';
+    let hostname;
+    let port = '';
+    let path;
+    if (scpLike &&
+        !/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(trimmed) &&
+        !/^[A-Za-z]:[\\/]/.test(trimmed)) {
+        hostname = scpLike[1].toLowerCase();
+        path = scpLike[2];
+    }
+    else if (URL.canParse(trimmed)) {
+        const url = new URL(trimmed);
+        scheme = url.protocol.slice(0, -1).toLowerCase();
+        hostname = url.hostname.toLowerCase();
+        port = url.port;
+        path = url.pathname;
+    }
+    else
+        return { refusal: 'local' };
+    if (!hostname || scheme === 'file')
+        return { refusal: 'local' };
+    if (isIP(hostname.replace(/^\[|\]$/g, '')))
+        return { refusal: 'ip' };
+    if (hostname === 'github.com' || hostname.endsWith('.github.com'))
+        return { refusal: 'github' };
+    const segments = path
+        .replace(/^\/+|\/+$/g, '')
+        .replace(/\.git$/i, '')
+        .split('/');
+    if (segments.length < 2 || !segments.every(pathSegment))
+        return { refusal: 'unsupported' };
+    if (scheme === 'https' || scheme === 'http') {
+        const host = port ? `${hostname}:${port}` : hostname;
+        return {
+            host,
+            address: scheme === 'http' && !loopback(hostname) ? `https://${hostname}` : `${scheme}://${host}`,
+            path: segments.join('/'),
+        };
+    }
+    if (['ssh', 'git+ssh', 'ssh+git', 'git'].includes(scheme))
+        return { host: hostname, address: `https://${hostname}`, path: segments.join('/') };
+    return { refusal: 'unsupported' };
+}
+export function gitLabAddress(value) {
+    const trimmed = value.trim();
+    if (trimmed.length > 300 || !URL.canParse(trimmed))
+        return null;
+    const url = new URL(trimmed);
+    const hostname = url.hostname.toLowerCase();
+    const path = url.pathname.replace(/\/+$/, '');
+    if ((url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback(hostname))) ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        isIP(hostname.replace(/^\[|\]$/g, '')) ||
+        hostname === 'github.com' ||
+        hostname.endsWith('.github.com') ||
+        !path.split('/').slice(1).every(pathSegment))
+        return null;
+    return `${url.protocol}//${url.host.toLowerCase()}${path}`;
+}
+export function projectPath(address, path) {
+    const prefix = new URL(address).pathname.replace(/^\/+|\/+$/g, '');
+    return prefix && path.startsWith(prefix + '/') ? path.slice(prefix.length + 1) : path;
+}
+function pathSegment(segment) {
+    return /^[\w.-]+$/.test(segment) && segment !== '.' && segment !== '..';
+}
+function loopback(hostname) {
+    return hostname === 'localhost' || hostname.endsWith('.localhost');
+}
+export class GitLabError extends Error {
+    failure;
+    address;
+    status;
+    detail;
+    constructor(failure, address, status, detail) {
+        super(`GitLab at ${address}: ${failure}${status ? ` (${status})` : ''}${detail ? `: ${detail}` : ''}`);
+        this.failure = failure;
+        this.address = address;
+        this.status = status;
+        this.detail = detail;
+        this.name = 'GitLabError';
+    }
+}
+const certificateCodes = new Set([
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    'UNABLE_TO_GET_ISSUER_CERT',
+    'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'CERT_HAS_EXPIRED',
+    'CERT_NOT_YET_VALID',
+    'CERT_UNTRUSTED',
+    'CERT_SIGNATURE_FAILURE',
+    'ERR_TLS_CERT_ALTNAME_INVALID',
+]);
+const connectCodes = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ECONNREFUSED',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'EADDRNOTAVAIL',
+    'UND_ERR_CONNECT_TIMEOUT',
+]);
+function networkCode(error) {
+    let current = error;
+    for (let depth = 0; depth < 5 && current && typeof current === 'object'; depth++) {
+        const code = current.code;
+        if (typeof code === 'string')
+            return code;
+        const tried = current.errors;
+        current = current.cause ?? (Array.isArray(tried) ? tried[0] : null);
+    }
+    return null;
+}
+function gitLabMessage(body) {
+    if (!body)
+        return null;
+    let message = body;
+    try {
+        const parsed = JSON.parse(body);
+        message = parsed.message ?? parsed.error ?? null;
+    }
+    catch {
+        return null;
+    }
+    const text = typeof message === 'string' ? message : message ? JSON.stringify(message) : '';
+    return text.replace(/[\u0000-\u001f\u007f]+/g, ' ').slice(0, 200) || null;
+}
+export const mergeRequestSchema = z.object({
+    iid: z.number().int().positive(),
+    web_url: z.string().min(1).max(500),
+    state: z.string(),
+    draft: z.boolean().optional(),
+    work_in_progress: z.boolean().optional(),
+    sha: z.string().nullish(),
+    source_branch: z.string(),
+    target_branch: z.string(),
+    project_id: z.number().optional(),
+    source_project_id: z.number().optional(),
+});
+export function reviewState(request) {
+    if (request.state === 'merged')
+        return 'merged';
+    if (request.state === 'closed')
+        return 'closed';
+    return request.draft || request.work_in_progress ? 'draft' : 'ready';
+}
+export class GitLabClient {
+    timeoutMs;
+    constructor(timeoutMs) {
+        this.timeoutMs = timeoutMs;
+    }
+    async user(address, token) {
+        await this.call(address, token, 'GET', '/user');
+    }
+    async scopes(address, token) {
+        try {
+            const self = z
+                .object({ scopes: z.array(z.string()) })
+                .safeParse(await this.call(address, token, 'GET', '/personal_access_tokens/self'));
+            return self.success ? self.data.scopes : null;
+        }
+        catch (error) {
+            if (error instanceof GitLabError &&
+                ['not_found', 'not_allowed', 'invalid_request'].includes(error.failure))
+                return null;
+            throw error;
+        }
+    }
+    async project(address, token, project) {
+        return await this.found(async () => this.shape(address, z.object({ id: z.number() }), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}`)));
+    }
+    async branch(address, token, project, branch) {
+        const found = await this.found(async () => this.shape(address, z.object({ commit: z.object({ id: z.string(), title: z.string().nullish() }) }), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}/repository/branches/${encodeURIComponent(branch)}`)));
+        return found ? { commit: found.commit.id, title: found.commit.title ?? '' } : null;
+    }
+    async contains(address, token, project, branch, commit) {
+        const query = new URLSearchParams([
+            ['refs[]', commit],
+            ['refs[]', branch],
+        ]);
+        try {
+            const base = this.shape(address, z.object({ id: z.string() }), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}/repository/merge_base?${query}`));
+            return base.id === commit;
+        }
+        catch (error) {
+            if (error instanceof GitLabError &&
+                (error.failure === 'not_found' || error.failure === 'invalid_request'))
+                return false;
+            throw error;
+        }
+    }
+    async mergeRequests(address, token, project, branch, state) {
+        const query = new URLSearchParams({
+            source_branch: branch,
+            order_by: 'created_at',
+            sort: 'desc',
+            per_page: '20',
+            ...(state ? { state } : {}),
+        });
+        const listed = this.shape(address, z.array(mergeRequestSchema), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project.path)}/merge_requests?${query}`));
+        return listed.filter((request) => request.source_branch === branch &&
+            (request.source_project_id === undefined || request.source_project_id === project.id));
+    }
+    async mergeRequest(address, token, project, number) {
+        return this.shape(address, mergeRequestSchema, await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}/merge_requests/${number}`));
+    }
+    async createMergeRequest(address, token, project, request) {
+        return this.shape(address, mergeRequestSchema, await this.call(address, token, 'POST', `/projects/${encodeURIComponent(project)}/merge_requests`, {
+            source_branch: request.source,
+            target_branch: request.target,
+            title: request.title,
+            ...(request.description ? { description: request.description } : {}),
+        }));
+    }
+    async found(read) {
+        try {
+            return await read();
+        }
+        catch (error) {
+            if (error instanceof GitLabError && error.failure === 'not_found')
+                return null;
+            throw error;
+        }
+    }
+    shape(address, schema, value) {
+        const parsed = schema.safeParse(value);
+        if (!parsed.success)
+            throw new GitLabError('unexpected_answer', address, null, null);
+        return parsed.data;
+    }
+    async call(address, token, method, path, body) {
+        let status;
+        let text;
+        try {
+            const response = await fetch(`${address}/api/v4${path}`, {
+                method,
+                redirect: 'manual',
+                headers: {
+                    'PRIVATE-TOKEN': token,
+                    Accept: 'application/json',
+                    ...(body ? { 'Content-Type': 'application/json' } : {}),
+                },
+                ...(body ? { body: JSON.stringify(body) } : {}),
+                signal: AbortSignal.timeout(this.timeoutMs),
+            });
+            status = response.status;
+            text = await response.text();
+        }
+        catch (error) {
+            const code = networkCode(error);
+            if (code && certificateCodes.has(code))
+                throw new GitLabError('untrusted_certificate', address, null, code);
+            if ((code && connectCodes.has(code)) || method === 'GET')
+                throw new GitLabError('unreachable', address, null, code);
+            throw new GitLabError('unknown_outcome', address, null, code);
+        }
+        if (status >= 200 && status < 300) {
+            try {
+                return JSON.parse(text);
+            }
+            catch {
+                throw new GitLabError('unexpected_answer', address, status, null);
+            }
+        }
+        const failure = status >= 300 && status < 400
+            ? 'redirected'
+            : status === 401
+                ? 'token_rejected'
+                : status === 403
+                    ? 'not_allowed'
+                    : status === 404
+                        ? 'not_found'
+                        : status === 409
+                            ? 'conflict'
+                            : status === 429
+                                ? 'rate_limited'
+                                : status >= 500
+                                    ? 'server_error'
+                                    : 'invalid_request';
+        throw new GitLabError(failure, address, status, gitLabMessage(text));
+    }
+}
+const savedAddresses = z.object({
+    schemaVersion: z.literal(1),
+    principalHash: z.string().min(1),
+    addresses: z.array(z.object({ host: z.string().min(1), address: z.string().min(1) })),
+});
+export class GitLabTokens {
+    stateRoot;
+    credentials;
+    path;
+    queue = Promise.resolve();
+    constructor(stateRoot, credentials) {
+        this.stateRoot = stateRoot;
+        this.credentials = credentials;
+        this.path = join(stateRoot, 'gitlab-addresses.json');
+    }
+    async address(host) {
+        return (await this.current())?.addresses.find((entry) => entry.host === host)?.address ?? null;
+    }
+    async forLink(host, repository) {
+        const addresses = [...new Set((await this.current())?.addresses.map((entry) => entry.address))]
+            .filter((address) => {
+            const url = new URL(address);
+            const prefix = url.pathname.replace(/^\/+/, '');
+            return url.host === host && (!prefix || repository.startsWith(prefix + '/'));
+        })
+            .sort((left, right) => right.length - left.length);
+        return addresses[0]
+            ? { address: addresses[0], project: projectPath(addresses[0], repository) }
+            : null;
+    }
+    async token(address) {
+        const principal = await this.principal();
+        return principal ? await this.credentials.get(tokenName(principal, address)) : null;
+    }
+    async any() {
+        return Boolean((await this.current())?.addresses.length);
+    }
+    async save(host, address, token) {
+        await this.exclusive(async () => {
+            const principal = await this.principal();
+            if (!principal)
+                throw new Error('Sign in to Engineering Memory before saving a GitLab token.');
+            let saved = await this.read();
+            if (saved && saved.principalHash !== principal) {
+                await this.deleteTokens(saved);
+                saved = null;
+            }
+            const previous = saved?.addresses.find((entry) => entry.host === host)?.address;
+            await this.credentials.set(tokenName(principal, address), token);
+            const addresses = [
+                ...(saved?.addresses ?? []).filter((entry) => entry.host !== host),
+                { host, address },
+            ];
+            await writeJson(this.path, { schemaVersion: 1, principalHash: principal, addresses }, this.stateRoot);
+            if (previous && !addresses.some((entry) => entry.address === previous))
+                await this.credentials.delete(tokenName(principal, previous));
+        });
+    }
+    async remove(address) {
+        await this.exclusive(async () => {
+            const principal = await this.principal();
+            if (!principal)
+                return;
+            await this.credentials.delete(tokenName(principal, address));
+            const saved = await this.read();
+            if (saved?.principalHash !== principal)
+                return;
+            await writeJson(this.path, { ...saved, addresses: saved.addresses.filter((entry) => entry.address !== address) }, this.stateRoot);
+        });
+    }
+    async clear() {
+        await this.exclusive(async () => {
+            const saved = await this.read();
+            if (saved)
+                await this.deleteTokens(saved);
+            await removeFile(this.path, this.stateRoot);
+        });
+    }
+    async deleteTokens(saved) {
+        for (const address of new Set(saved.addresses.map((entry) => entry.address)))
+            await this.credentials.delete(tokenName(saved.principalHash, address));
+    }
+    async current() {
+        const principal = await this.principal();
+        const saved = principal ? await this.read() : null;
+        return saved?.principalHash === principal ? saved : null;
+    }
+    async read() {
+        const parsed = savedAddresses.safeParse(await readJson(this.path, this.stateRoot));
+        return parsed.success ? parsed.data : null;
+    }
+    async principal() {
+        const accessToken = await this.credentials.get('access-token');
+        if (!accessToken)
+            return null;
+        try {
+            return principalFingerprint(accessToken);
+        }
+        catch {
+            return null;
+        }
+    }
+    async exclusive(action) {
+        const previous = this.queue;
+        let release = () => undefined;
+        this.queue = new Promise((resolvePromise) => {
+            release = resolvePromise;
+        });
+        await previous;
+        try {
+            await action();
+        }
+        finally {
+            release();
+        }
+    }
+}
+function tokenName(principal, address) {
+    return `gitlab-token-${sha256(`${principal}\n${address}`).slice(0, 32)}`;
+}
+//# sourceMappingURL=gitlab.js.map

package/runtime/dist/src/runtime/bridge-service.js

@@ -23,6 +23,8 @@ import { sameHolder, suggestedBranchNames, taskStartChoice } from './task-start.
 import { catalogueLanguages, copies, fetchLanguage, format } from './texts.js';
 import * as z from 'zod/v4';
 import { BridgeRecoveryError } from './recovery-error.js';
+import { gitLabRemote } from '../providers/gitlab.js';
+import { awaitsReviewRequest, reviewDeliveries, } from './merge-request-sync.js';
 export const validationIds = [
     'format',
     'static_analysis',
@@ -3774,6 +3776,10 @@ export class BridgeService {
                 query.set('limit', String(input.limit));
             const suffix = query.size > 0 ? `?${query.toString()}` : '';
             const response = await this.dependencies.client.request(`${endpoints.workItemList(input.projectId)}${suffix}`);
+            this.followMergeRequests(input.projectId, async () => {
+                const here = await this.dependencies.repositories.resolveIdentity(process.cwd());
+                return here.projectId === input.projectId ? here.repoRoot : null;
+            });
             return asJsonValue({
                 selectionRequired: true,
                 questionnaire: 'Select the project work item to run in this chat',
@@ -4163,7 +4169,7 @@ export class BridgeService {
             const livePointers = authenticated && state === 'bound'
                 ? this.dependencies.activeContexts.list(repository.repoFingerprint)
                 : Promise.resolve([]);
-            const [client, liveTasksRaw, workItems, gitPreferences, worktrees, pendingQuestionnaires, moved, deliveries,] = await Promise.all([
+            const [client, liveTasksRaw, workItems, gitPreferences, worktrees, pendingQuestionnaires, moved, deliveries, reviews,] = await Promise.all([
                 this.clientUpdate(authenticated),
                 livePointers,
                 authenticated && state === 'bound' && projectId
@@ -4187,8 +4193,14 @@ export class BridgeService {
                 authenticated && state === 'bound' && projectId
                     ? this.openDeliveries(projectId)
                     : Promise.resolve(null),
+                authenticated && state === 'bound' && projectId
+                    ? this.reviewCandidates(projectId)
+                    : Promise.resolve(null),
             ]);
             timer.mark('independent_lookups');
+            if (projectId && reviews)
+                this.followMergeRequests(projectId, repository.repoRoot, reviews);
+            const awaiting = reviews?.filter(awaitsReviewRequest) ?? [];
             const liveTasks = liveTasksRaw.map(describePointer);
             const shipped = objectValue(objectValue(client)?.shippedKnowledge);
             const incomplete = shipped && (shipped.failure !== null || Number(shipped.live) < Number(shipped.expected));
@@ -4235,6 +4247,22 @@ export class BridgeService {
                     ? { deferredTaskStarts: pendingQuestionnaires.deferred }
                     : {}),
                 ...(deliveries ? { openDeliveries: deliveries } : {}),
+                ...(awaiting.length
+                    ? {
+                        awaitingReviewRequests: {
+                            total: awaiting.length,
+                            items: awaiting.slice(0, 5).map((delivery) => ({
+                                taskId: delivery.taskId,
+                                externalTaskId: delivery.externalTaskId ?? null,
+                                workItemKey: delivery.workItemKey ?? null,
+                                branch: delivery.branch ?? null,
+                                targetBranch: delivery.baseBranch ?? null,
+                                draft: delivery.choice === 'commit_push_draft_pr',
+                            })),
+                            nextAction: 'These delivered tasks chose a pull request, but none is recorded for them yet. Mention them to the user in one line. On a GitLab remote, task.open_review_request opens one from this computer when the user asks; a pull request opened anywhere else is recorded with task.review_request. A merge request someone opened by hand on a GitLab this computer follows is found by itself.',
+                        },
+                    }
+                    : {}),
                 client,
                 ...moved,
                 ...(incomplete && state === 'bound'
@@ -4673,6 +4701,73 @@ export class BridgeService {
     async taskReviewRequest(input) {
         return this.execute(() => this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: input.url, state: input.state }));
     }
+    async taskOpenReviewRequest(input) {
+        return this.execute(async () => {
+            const gitlab = this.gitlab();
+            const repository = await this.dependencies.repositories.resolveIdentity(input.repoRoot ?? process.cwd());
+            if (repository.projectId !== input.projectId)
+                throw refuse("Call this in a clone of the task's project repository: this folder belongs to another project, or to none.", 'session.entry');
+            const opened = await gitlab.requests.open({ ...input, repoRoot: repository.repoRoot });
+            if ('recorded' in opened)
+                return asJsonValue({ alreadyRecorded: opened.recorded });
+            try {
+                const report = await this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: opened.url, state: opened.state, source: 'machine' });
+                return asJsonValue({ mergeRequest: opened, report });
+            }
+            catch (error) {
+                return asJsonValue({
+                    mergeRequest: opened,
+                    reportRefused: error instanceof Error ? error.message : String(error),
+                });
+            }
+        });
+    }
+    async gitlabToken(input = {}) {
+        return this.execute(async () => {
+            const gitlab = this.gitlab();
+            if (!(await this.dependencies.credentials.get('access-token')))
+                throw refuse('Sign in to Engineering Memory first: a GitLab token is kept for the signed-in account.', 'auth.signin_browser');
+            await this.language(input.language);
+            const git = this.dependencies.repositories.git;
+            const pushUrl = await git
+                .findRoot(input.repoRoot ?? process.cwd())
+                .then(async (root) => (await git.pushDestination(root)).pushUrl)
+                .catch(() => null);
+            const remote = pushUrl ? gitLabRemote(pushUrl) : null;
+            if (remote && 'refusal' in remote && remote.refusal === 'github')
+                throw refuse('This repository is on GitHub. Engineering Memory opens merge requests only on GitLab so far; a GitHub pull request is opened with the tools you have and recorded with task.review_request.', 'task.review_request');
+            const target = remote && !('refusal' in remote)
+                ? {
+                    host: remote.host,
+                    address: (await gitlab.tokens.address(remote.host)) ?? remote.address,
+                }
+                : { host: null, address: null };
+            const link = await gitlab.page.open(target);
+            return asJsonValue({
+                ...link,
+                address: target.address,
+                tokenSaved: target.address ? Boolean(await gitlab.tokens.token(target.address)) : false,
+                nextAction: "Give this link to the user to open in a browser on this computer, and tell them to enter their GitLab address and personal access token there: the api scope lets Engineering Memory open merge requests, read_api only lets it follow them. Never open the link, fill in the page or ask for the token yourself, and if the user pastes a token into the chat, do not use it: ask them to revoke it and use the page. The page checks the token with GitLab, keeps it in this computer's credential store and closes after one save or removal, or after 10 minutes. When the user says it is saved, retry what needed it.",
+            });
+        });
+    }
+    gitlab() {
+        if (!this.dependencies.gitlab)
+            throw refuse('This bridge was started without GitLab support. Open the merge request in GitLab and record it with task.review_request.', 'task.review_request');
+        return this.dependencies.gitlab;
+    }
+    followMergeRequests(projectId, repoRoot, deliveries) {
+        this.dependencies.gitlab?.requests.schedule(projectId, repoRoot, deliveries);
+    }
+    async reviewCandidates(projectId) {
+        try {
+            const response = await this.dependencies.client.request(`${endpoints.projectDeliveries(projectId)}?state=review&limit=100`);
+            return reviewDeliveries(response.data);
+        }
+        catch {
+            return null;
+        }
+    }
     async taskDeliveryRecord(input) {
         return this.execute(async () => {
             const response = await this.dependencies.client.request(endpoints.taskDelivery(input.projectId, input.taskId));
@@ -5699,7 +5794,7 @@ function deliveryQuestion(touchedContract, destination, publishApplicable, commi
                 alsoAsk: 'This task changed an endpoint contract. Ask whether to document the change for the linked project, and if so write what the other side must do differently with memory.propose_revision as an integration_note.',
             }
             : {}),
-        afterPullRequest: 'Do not end the turn once a pull request exists. Record it with task.review_request: its link, and draft or ready as it was opened. Then check whether it merges cleanly, report the conflicting files if it does not, and ask whether to resolve them before touching anything. When the user later says it became ready, was merged or was closed, record that with task.review_request too.',
+        afterPullRequest: 'Do not end the turn once the pull request is due. On a GitLab remote, task.open_review_request opens it from this computer and records it in one call; when it says no GitLab token is saved, gitlab.token gives the user a page on this computer to save their own. Anywhere else, open it with the tools you have and record it with task.review_request: its link, and draft or ready as it was opened. Then check whether it merges cleanly, report the conflicting files if it does not, and ask whether to resolve them before touching anything. When the user later says it became ready, was merged or was closed, record that with task.review_request too; a GitLab merge request this computer can read is also followed by itself.',
         afterCommit,
     });
 }

package/runtime/dist/src/runtime/create-bridge-service.js

@@ -18,7 +18,10 @@ import { RepositoryDecisionStore } from './repository-decision-store.js';
 import { ShadowNoticeStore } from './shadow-notice-store.js';
 import { LanguageStore } from './language-store.js';
 import { UpdateChoiceStore } from './update-choice-store.js';
-import { PrincipalStateGuard } from './principal-state.js';
+import { PrincipalStateGuard, principalFingerprint } from './principal-state.js';
+import { MergeRequests } from './merge-request-sync.js';
+import { GitLabClient, GitLabTokens } from '../providers/gitlab.js';
+import { GitLabTokenPage } from '../providers/gitlab-token-page.js';
 import { OnboardingStore } from './onboarding-store.js';
 import { QuestionnaireStore } from './questionnaire-store.js';
 import { sha256 } from '../utilities/hash.js';
@@ -78,8 +81,14 @@ export function createBridgeService(options = {}) {
         knownReservations,
     });
     const gate = new VerificationGate(stateRoot, git, outbox, undefined, worktreePool);
-    const principalState = new PrincipalStateGuard(stateRoot, credentials, cache, outbox, activeContexts, gate);
+    const gitlabTokens = new GitLabTokens(stateRoot, credentials);
+    const principalState = new PrincipalStateGuard(stateRoot, credentials, cache, outbox, activeContexts, gate, gitlabTokens);
     const languages = new LanguageStore(stateRoot);
+    const gitlab = new GitLabClient(config.requestTimeoutMs);
+    const signedInLanguage = async () => {
+        const accessToken = await credentials.get('access-token');
+        return languages.read(accessToken ? principalFingerprint(accessToken) : sha256('anonymous'));
+    };
     return (service = new BridgeService({
         live,
         releaseNotes: new ReleaseNotes(stateRoot, client, credentials),
@@ -101,6 +110,11 @@ export function createBridgeService(options = {}) {
         onboarding: new OnboardingStore(stateRoot),
         clientVersion: options.clientVersion === undefined ? config.clientVersion : options.clientVersion,
         principalState,
+        gitlab: {
+            tokens: gitlabTokens,
+            page: new GitLabTokenPage(gitlabTokens, gitlab, signedInLanguage),
+            requests: new MergeRequests(client, gitlabTokens, gitlab, git),
+        },
     }));
 }
 //# sourceMappingURL=create-bridge-service.js.map