forges 0.0.0 → 0.1.0

package/dist/gitlab-Bsr__Z0C.mjs

@@ -0,0 +1,2378 @@
+import { A as toPage, At as UnresolvedThreadError, B as isNamespaceRef, C as requireIssueOrPull, D as syntheticReview, M as versionAtLeast, Mt as WebhookVerificationError, Nt as soleMergeMethod, O as toDate, Ot as TokenRevokedError, Pt as toMergeError, S as phased, T as resolveToken, Y as reactionContent, b as mergeCommitMessage, bt as InsufficientScopeError, ct as eventAction, dt as fromBase64, f as getManyConcurrently, ft as toFileContent, j as toWarning, jt as UnsupportedOperationError, l as createListing, m as hexColour, n as perKind, o as webUrlFor, pt as AuthenticationRequiredError, r as verb, t as defineForgeProvider, u as degradesToWarning, v as memo, w as requireThread, wt as NotFoundError, x as milestoneId, y as memoBy } from "./define-D3yEXtKK.mjs";
+import { n as headerValue, t as bodyText } from "./crypto-CQNEyYHD.mjs";
+import { i as refEvent, o as verifySharedToken, r as nativeEventsFor, t as eventKindsOf } from "./webhooks-rn9-8lxT.mjs";
+//#region src/gitlab/webhook-events.ts
+/**
+* GitLab subscribes per event with a boolean flag rather than an event name,
+* so the flag names are the native events.
+*/
+const GITLAB_NATIVE_EVENTS = {
+	comment: ["note_events", "confidential_note_events"],
+	review: ["merge_requests_events"],
+	review_comment: ["note_events"],
+	state_change: [
+		"issues_events",
+		"confidential_issues_events",
+		"merge_requests_events"
+	],
+	label: ["issues_events", "merge_requests_events"],
+	assignment: ["issues_events", "merge_requests_events"],
+	push: ["push_events"],
+	ref: ["tag_push_events", "push_events"],
+	release: ["releases_events"],
+	membership: ["member_events"]
+};
+/** Normalised kinds and actions GitLab deliveries translate into. */
+const GITLAB_WEBHOOK_EVENTS = [
+	{
+		kind: "comment",
+		action: "created"
+	},
+	{
+		kind: "review",
+		action: "submitted"
+	},
+	{
+		kind: "review_comment",
+		action: "created"
+	},
+	{
+		kind: "state_change",
+		action: "opened"
+	},
+	{
+		kind: "state_change",
+		action: "closed"
+	},
+	{
+		kind: "state_change",
+		action: "reopened"
+	},
+	{
+		kind: "state_change",
+		action: "merged"
+	},
+	{
+		kind: "label",
+		action: "labelled"
+	},
+	{
+		kind: "label",
+		action: "unlabelled"
+	},
+	{
+		kind: "assignment",
+		action: "assigned"
+	},
+	{
+		kind: "assignment",
+		action: "unassigned"
+	},
+	{
+		kind: "assignment",
+		action: "review_requested"
+	},
+	{ kind: "push" },
+	{
+		kind: "ref",
+		action: "created"
+	},
+	{
+		kind: "ref",
+		action: "deleted"
+	},
+	{
+		kind: "release",
+		action: "published"
+	},
+	{ kind: "membership" }
+];
+//#endregion
+//#region src/gitlab/normalise.ts
+const FORGE = "gitlab";
+function toActor(instance, user) {
+	if (!user) return;
+	return {
+		forge: FORGE,
+		instance,
+		login: user.username,
+		id: String(user.id),
+		name: user.name,
+		avatarUrl: user.avatar_url ?? void 0,
+		url: user.web_url,
+		typeRaw: user.bot === void 0 ? void 0 : user.bot ? "bot" : "user",
+		isBotHint: user.bot === true || /^(?:project|group)_\d+_bot(?:_|$)/.test(user.username)
+	};
+}
+/** Splits a full project path into the namespace (which may contain slashes) and the project name. */
+function toRepoRef(instance, pathWithNamespace, id) {
+	const index = pathWithNamespace.lastIndexOf("/");
+	return {
+		forge: FORGE,
+		instance,
+		owner: pathWithNamespace.slice(0, index),
+		name: pathWithNamespace.slice(index + 1),
+		externalId: id === void 0 ? void 0 : String(id)
+	};
+}
+/** Reads the project path out of a `/-/`-style web URL, which cross-project listings carry instead of a project path. */
+function repoRefFromWebUrl(instance, webUrl, id) {
+	const path = webUrl?.match(/^https?:\/\/[^/]+\/(.+?)\/-\//)?.[1];
+	return path ? toRepoRef(instance, path, id) : void 0;
+}
+function toNamespaceRef(instance, fullPath, id) {
+	return {
+		forge: FORGE,
+		instance,
+		kind: "namespace",
+		owner: fullPath,
+		name: "",
+		externalId: id === void 0 ? void 0 : String(id)
+	};
+}
+/** Project id accepted by every `/projects/:id` route. */
+function projectId(repo) {
+	return encodeURIComponent(`${repo.owner}/${repo.name}`);
+}
+function toThreadKind(targetType) {
+	switch (targetType) {
+		case "Issue": return "issue";
+		case "MergeRequest": return "pull_request";
+		case "Commit": return "commit";
+		default: return "other";
+	}
+}
+const REASONS = {
+	added_approver: "approval_requested",
+	approval_required: "approval_requested",
+	assigned: "assigned",
+	build_failed: "ci_activity",
+	directly_addressed: "mention",
+	marked: "manual",
+	member_access_requested: "access_requested",
+	mentioned: "mention",
+	merge_train_removed: "merge_blocked",
+	review_requested: "review_requested",
+	review_submitted: "review_submitted",
+	unmergeable: "merge_blocked"
+};
+function toReason(action) {
+	return REASONS[action] ?? "unknown";
+}
+function toState(state) {
+	switch (state) {
+		case "opened": return "open";
+		case "closed":
+		case "locked": return "closed";
+		case "merged": return "merged";
+		default: return "unknown";
+	}
+}
+function toNotification(instance, raw) {
+	const repo = raw.project ? toRepoRef(instance, raw.project.path_with_namespace, raw.project.id) : toNamespaceRef(instance, raw.group?.full_path ?? "", raw.group?.id);
+	const kind = toThreadKind(raw.target_type);
+	const target = raw.target ?? void 0;
+	const number = kind === "commit" || target?.iid === void 0 ? target?.id === void 0 ? void 0 : String(target.id) : String(target.iid);
+	let subject;
+	if (raw.target_type === "Vulnerability") subject = {
+		type: "security_alert",
+		alert: {
+			forge: FORGE,
+			instance,
+			repo,
+			id: number ?? String(raw.id)
+		}
+	};
+	else if (raw.target_type === "Project" || raw.target_type === "Namespace") subject = {
+		type: "repo",
+		repo
+	};
+	else if (kind === "other" && !raw.target?.iid) subject = {
+		type: "other",
+		typeRaw: raw.target_type,
+		repo,
+		id: number,
+		url: raw.target_url
+	};
+	else subject = {
+		type: "thread",
+		thread: {
+			forge: FORGE,
+			instance,
+			repo,
+			kind,
+			typeRaw: raw.target_type,
+			number
+		}
+	};
+	return {
+		ref: {
+			forge: FORGE,
+			instance,
+			id: String(raw.id)
+		},
+		subject,
+		subjectTypeRaw: raw.target_type,
+		reason: toReason(raw.action_name),
+		reasonRaw: raw.action_name,
+		unread: raw.state === "pending",
+		title: target?.title ?? raw.body ?? "",
+		subjectState: toState(target?.state),
+		subjectStateRaw: target?.state,
+		updatedAt: toDate(raw.updated_at ?? raw.created_at) ?? /* @__PURE__ */ new Date(0),
+		url: raw.target_url,
+		raw
+	};
+}
+const ACCESS_LEVELS$1 = {
+	admin: 50,
+	maintain: 40,
+	push: 30,
+	triage: 20,
+	pull: 10
+};
+/** GitLab access levels: 50 owner, 40 maintainer, 30 developer, 20 reporter, 10 guest. */
+function toRole(level) {
+	return level >= 50 ? "admin" : level >= 40 ? "maintain" : level >= 30 ? "write" : level >= 20 ? "triage" : level >= 10 ? "read" : "none";
+}
+function toLabel(raw) {
+	return {
+		name: raw.name,
+		colour: raw.color?.replace(/^#/, ""),
+		description: raw.description ?? void 0
+	};
+}
+function toMilestone(raw) {
+	return raw ? {
+		id: String(raw.id),
+		title: raw.title,
+		state: raw.state === "closed" ? "closed" : "open",
+		description: raw.description ?? void 0,
+		dueOn: toDate(raw.due_date),
+		url: raw.web_url,
+		raw
+	} : void 0;
+}
+/** GitLab counts only thumbs up and down on a thread read; the full set needs the award emoji listing. */
+function toVoteReactions(raw) {
+	if (raw.upvotes === void 0 && raw.downvotes === void 0) return;
+	return {
+		total: (raw.upvotes ?? 0) + (raw.downvotes ?? 0),
+		counts: {
+			...raw.upvotes ? { "+1": raw.upvotes } : {},
+			...raw.downvotes ? { "-1": raw.downvotes } : {}
+		}
+	};
+}
+function toRepo(instance, raw) {
+	const level = Math.max(raw.permissions?.project_access?.access_level ?? 0, raw.permissions?.group_access?.access_level ?? 0);
+	const visibility = raw.visibility === "internal" ? "internal" : raw.visibility === "private" ? "private" : "public";
+	return {
+		ref: toRepoRef(instance, raw.path_with_namespace, raw.id),
+		description: raw.description ?? void 0,
+		defaultBranch: raw.default_branch ?? void 0,
+		visibility,
+		visibilityRaw: raw.visibility,
+		isFork: Boolean(raw.forked_from_project),
+		isArchived: raw.archived ?? false,
+		parent: raw.forked_from_project ? toRepoRef(instance, raw.forked_from_project.path_with_namespace, raw.forked_from_project.id) : void 0,
+		topics: raw.topics ?? [],
+		url: raw.web_url,
+		cloneUrls: raw.http_url_to_repo || raw.ssh_url_to_repo ? {
+			https: raw.http_url_to_repo,
+			ssh: raw.ssh_url_to_repo
+		} : void 0,
+		createdAt: toDate(raw.created_at),
+		updatedAt: toDate(raw.last_activity_at),
+		openIssueCount: raw.open_issues_count,
+		owner: toActor(instance, raw.owner),
+		licence: raw.license?.key && raw.license.key !== "other" ? raw.license.key : void 0,
+		stars: raw.star_count,
+		forks: raw.forks_count,
+		mergeMethods: raw.merge_method === void 0 ? void 0 : [
+			...raw.merge_method === "merge" ? ["merge"] : [],
+			...raw.merge_method === "rebase_merge" ? ["rebase_merge"] : [],
+			...raw.merge_method === "ff" ? ["fast_forward_only"] : [],
+			...raw.squash_option && raw.squash_option !== "never" ? ["squash"] : []
+		],
+		features: raw.issues_access_level === void 0 && raw.issues_enabled === void 0 ? void 0 : {
+			issues: raw.issues_enabled ?? raw.issues_access_level !== "disabled",
+			pullRequests: raw.merge_requests_enabled ?? raw.merge_requests_access_level !== "disabled",
+			discussions: false,
+			wiki: raw.wiki_enabled ?? raw.wiki_access_level !== "disabled",
+			projects: false,
+			releases: raw.releases_access_level !== "disabled"
+		},
+		permissions: raw.permissions ? {
+			admin: level >= ACCESS_LEVELS$1.admin,
+			maintain: level >= ACCESS_LEVELS$1.maintain,
+			push: level >= ACCESS_LEVELS$1.push,
+			triage: level >= ACCESS_LEVELS$1.triage,
+			pull: level >= ACCESS_LEVELS$1.pull
+		} : void 0,
+		raw
+	};
+}
+function toThread(ref, raw) {
+	const isMerge = ref.kind === "pull_request";
+	const reviewers = (raw.reviewers ?? []).flatMap((user) => {
+		const actor = toActor(ref.instance, user);
+		return actor ? [{
+			actor,
+			state: "unknown"
+		}] : [];
+	});
+	return {
+		ref: {
+			...ref,
+			externalId: raw.id === void 0 ? ref.externalId : String(raw.id)
+		},
+		kind: ref.kind,
+		title: raw.title,
+		body: raw.description ?? void 0,
+		state: toState(raw.state),
+		stateRaw: raw.state,
+		isDraft: raw.draft ?? false,
+		assignees: (raw.assignees ?? []).flatMap((user) => toActor(ref.instance, user) ?? []),
+		reviewers,
+		lastActivityAt: toDate(raw.updated_at),
+		branches: isMerge && raw.source_branch && raw.target_branch ? {
+			head: {
+				ref: raw.source_branch,
+				sha: raw.diff_refs?.head_sha ?? raw.sha,
+				repo: raw.source_project_id !== void 0 && raw.source_project_id === raw.target_project_id ? ref.repo : void 0
+			},
+			base: {
+				ref: raw.target_branch,
+				sha: raw.diff_refs?.base_sha
+			},
+			mergeCommitSha: raw.merge_commit_sha ?? raw.squash_commit_sha ?? void 0
+		} : void 0,
+		author: toActor(ref.instance, raw.author),
+		url: raw.web_url,
+		createdAt: toDate(raw.created_at),
+		updatedAt: toDate(raw.updated_at),
+		closedAt: toDate(raw.closed_at),
+		labels: (raw.labels ?? []).map((label) => typeof label === "string" ? { name: label } : {
+			name: label.name,
+			colour: label.color,
+			description: label.description ?? void 0
+		}),
+		locked: raw.discussion_locked ?? void 0,
+		commentCount: raw.user_notes_count,
+		milestone: toMilestone(raw.milestone),
+		reactions: toVoteReactions(raw),
+		raw
+	};
+}
+function toCommitThread(ref, raw) {
+	return {
+		ref,
+		kind: "commit",
+		title: raw.title,
+		body: raw.message,
+		state: "unknown",
+		isDraft: false,
+		assignees: [],
+		reviewers: [],
+		url: raw.web_url,
+		createdAt: toDate(raw.created_at),
+		lastActivityAt: toDate(raw.created_at),
+		labels: [],
+		raw
+	};
+}
+/** System notes are the only record of label, state and assignment changes in the notes API. */
+const SYSTEM_NOTE_KINDS = [
+	[/^approved this merge request/i, "review"],
+	[/^added \d+ (?:new )?commits?/i, "commit"],
+	[/^(?:added|removed) .*label/i, "label"],
+	[/^(?:closed|reopened|merged|marked this merge request as|status changed to)/i, "state_change"],
+	[/^(?:assigned to|reassigned to|unassigned|requested review from)/i, "assignment"],
+	[/^mentioned in /i, "referenced"]
+];
+function toNoteKind(note) {
+	if (!note.system) return note.type === "DiffNote" ? "review_comment" : "comment";
+	return SYSTEM_NOTE_KINDS.find(([pattern]) => pattern.test(note.body))?.[1] ?? "other";
+}
+/**
+* A "mentioned in" system note names the subject that mentioned this thread:
+* `!5` or `acme/widgets!5` for a merge request, `#5` for an issue, or a sha
+* for a commit. The reference is read from that wording, since the note
+* carries no structured source.
+*/
+function crossReference(ref, body) {
+	const text = body.match(/^mentioned in (?:merge request|issue|commit) (\S+)/i)?.[1];
+	if (!text) return {
+		type: "referenced",
+		text: body
+	};
+	const thread = text.match(/^(?:([^!#]+)([!#]))?[!#]?(\d+)$/);
+	if (thread) {
+		const repo = thread[1] ? toRepoRef(ref.instance, thread[1]) : ref.repo;
+		return {
+			type: "referenced",
+			from: {
+				forge: FORGE,
+				instance: ref.instance,
+				repo,
+				kind: text.includes("!") ? "pull_request" : "issue",
+				number: thread[3]
+			},
+			fromRepo: repo,
+			text
+		};
+	}
+	return /^[0-9a-f]{7,40}$/i.test(text) ? {
+		type: "referenced",
+		from: {
+			forge: FORGE,
+			instance: ref.instance,
+			repo: ref.repo,
+			sha: text
+		},
+		fromRepo: ref.repo,
+		text
+	} : {
+		type: "referenced",
+		text
+	};
+}
+function toNoteEvent(ref, note) {
+	const actor = toActor(ref.instance, note.author);
+	const kind = toNoteKind(note);
+	const who = actor?.login ?? "someone";
+	return {
+		forge: FORGE,
+		instance: ref.instance,
+		id: String(note.id),
+		kind,
+		kindRaw: note.system ? "system" : note.type ?? "Note",
+		summary: note.system ? `${who} ${note.body.split("\n")[0]}` : `${who} ${kind === "review_comment" ? "commented on a line" : "commented"}`,
+		occurredAt: toDate(note.created_at) ?? /* @__PURE__ */ new Date(0),
+		actor,
+		repo: ref.repo,
+		thread: ref,
+		...kind === "referenced" ? { detail: crossReference(ref, note.body) } : {},
+		source: "poll",
+		payload: note
+	};
+}
+function toCommitCommentEvent(ref, comment, index) {
+	const actor = toActor(ref.instance, comment.author);
+	return {
+		forge: FORGE,
+		instance: ref.instance,
+		id: `${ref.number}:${index}`,
+		kind: comment.line_type ? "review_comment" : "comment",
+		kindRaw: "CommitComment",
+		summary: `${actor?.login ?? "someone"} commented`,
+		occurredAt: toDate(comment.created_at) ?? /* @__PURE__ */ new Date(0),
+		actor,
+		repo: ref.repo,
+		thread: ref,
+		source: "poll",
+		payload: comment
+	};
+}
+function toNoteComment(thread, note, discussion) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: thread.instance,
+			thread,
+			id: String(note.id)
+		},
+		body: note.body,
+		author: toActor(thread.instance, note.author),
+		createdAt: toDate(note.created_at),
+		updatedAt: toDate(note.updated_at),
+		...discussion && note.resolvable && { thread: {
+			id: discussion.id,
+			resolved: Boolean(note.resolved)
+		} },
+		raw: note
+	};
+}
+/** GitLab commit comments carry no id, so they are keyed by creation time and author. */
+function toCommitComment(thread, comment) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: thread.instance,
+			thread,
+			id: `${comment.created_at ?? ""}:${comment.author?.id ?? ""}`
+		},
+		body: comment.note,
+		author: toActor(thread.instance, comment.author),
+		createdAt: toDate(comment.created_at),
+		raw: comment
+	};
+}
+/** Pipeline and job statuses. `manual` jobs wait for a person, so they neither pass nor fail. */
+function pipelineState(status) {
+	switch (status) {
+		case "success": return "success";
+		case "failed":
+		case "canceled": return "failure";
+		case "skipped":
+		case "manual": return "neutral";
+		case "created":
+		case "waiting_for_resource":
+		case "preparing":
+		case "pending":
+		case "running":
+		case "scheduled": return "pending";
+		default: return "unknown";
+	}
+}
+/** The merge request's head pipeline, which GitLab reports as one combined status. */
+function toPipelineSummary(pipeline) {
+	const state = pipelineState(pipeline.status);
+	return {
+		state: state === "neutral" ? "pending" : state,
+		stateRaw: pipeline.status,
+		...pipeline.web_url ? { url: pipeline.web_url } : {}
+	};
+}
+function toJobCheck(repo, job) {
+	const state = pipelineState(job.status);
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			id: String(job.id),
+			type: "job"
+		},
+		name: job.stage ? `${job.stage}: ${job.name}` : job.name,
+		state: state === "failure" && job.allow_failure ? "neutral" : state,
+		stateRaw: job.status,
+		url: job.web_url,
+		startedAt: toDate(job.started_at),
+		completedAt: toDate(job.finished_at),
+		raw: job
+	};
+}
+/** GitLab keys releases by tag and has no drafts or prereleases. */
+function toRelease(repo, raw) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			id: raw.tag_name,
+			tag: raw.tag_name
+		},
+		name: raw.name ?? void 0,
+		tag: raw.tag_name,
+		body: raw.description ?? void 0,
+		isDraft: false,
+		isPrerelease: false,
+		author: toActor(repo.instance, raw.author),
+		publishedAt: raw.upcoming_release ? void 0 : toDate(raw.released_at),
+		createdAt: toDate(raw.created_at),
+		url: raw._links?.self,
+		assets: raw.assets?.links?.map((link) => ({
+			name: link.name,
+			url: link.direct_asset_url ?? link.url
+		})),
+		raw
+	};
+}
+const REPORT_KINDS = {
+	DEPENDENCY_SCANNING: "dependency",
+	CONTAINER_SCANNING: "dependency",
+	CLUSTER_IMAGE_SCANNING: "dependency",
+	SAST: "code_scanning",
+	SECRET_DETECTION: "secret"
+};
+const REPORT_TYPES = {
+	dependency: [
+		"DEPENDENCY_SCANNING",
+		"CONTAINER_SCANNING",
+		"CLUSTER_IMAGE_SCANNING"
+	],
+	code_scanning: ["SAST"],
+	secret: ["SECRET_DETECTION"],
+	advisory: []
+};
+/** `INFO` findings are informational and carry no severity. */
+function toSeverity(raw) {
+	const severity = raw.toLowerCase();
+	return severity === "critical" || severity === "high" || severity === "medium" || severity === "low" ? severity : "unknown";
+}
+function toVulnerability(repo, raw) {
+	const kind = REPORT_KINDS[raw.reportType] ?? "other";
+	const state = raw.state === "DETECTED" || raw.state === "CONFIRMED" ? "open" : raw.state === "RESOLVED" ? "fixed" : raw.state === "DISMISSED" ? "dismissed" : "unknown";
+	const id = raw.id.replace(/^gid:\/\/gitlab\/Vulnerability\//, "");
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			id,
+			kind,
+			severityRaw: raw.severity.toLowerCase()
+		},
+		kind,
+		kindRaw: raw.reportType.toLowerCase(),
+		severity: toSeverity(raw.severity),
+		severityRaw: raw.severity.toLowerCase(),
+		state,
+		stateRaw: raw.state.toLowerCase(),
+		title: raw.title,
+		url: raw.webUrl ?? void 0,
+		createdAt: toDate(raw.detectedAt),
+		updatedAt: toDate(raw.updatedAt),
+		dismissedAt: toDate(raw.dismissedAt),
+		raw
+	};
+}
+function toStatusCheck(repo, raw) {
+	const state = pipelineState(raw.status);
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			id: String(raw.id),
+			type: "status"
+		},
+		name: raw.name ?? String(raw.id),
+		state: state === "failure" && raw.allow_failure ? "neutral" : state,
+		stateRaw: raw.status,
+		url: raw.target_url ?? void 0,
+		startedAt: toDate(raw.created_at),
+		completedAt: toDate(raw.finished_at),
+		raw
+	};
+}
+function toPipeline(repo, raw) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			id: String(raw.id)
+		},
+		name: raw.name || raw.source || `pipeline ${raw.id}`,
+		state: pipelineState(raw.status),
+		stateRaw: raw.status,
+		number: raw.iid === void 0 ? void 0 : String(raw.iid),
+		eventRaw: raw.source,
+		branch: raw.ref,
+		sha: raw.sha,
+		url: raw.web_url,
+		actor: toActor(repo.instance, raw.user),
+		createdAt: toDate(raw.created_at),
+		startedAt: toDate(raw.started_at),
+		completedAt: toDate(raw.finished_at),
+		raw
+	};
+}
+function toCiJob(run, raw) {
+	const state = pipelineState(raw.status);
+	return {
+		ref: {
+			forge: FORGE,
+			instance: run.instance,
+			repo: run.repo,
+			id: String(raw.id),
+			run
+		},
+		name: raw.name,
+		state: state === "failure" && raw.allow_failure ? "neutral" : state,
+		stateRaw: raw.status,
+		stage: raw.stage,
+		url: raw.web_url,
+		startedAt: toDate(raw.started_at),
+		completedAt: toDate(raw.finished_at),
+		raw
+	};
+}
+function toCommit(repo, raw, files) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			sha: raw.id
+		},
+		sha: raw.id,
+		message: raw.message ?? raw.title,
+		author: {
+			name: raw.author_name,
+			email: raw.author_email,
+			date: toDate(raw.authored_date ?? raw.created_at)
+		},
+		committer: {
+			name: raw.committer_name,
+			email: raw.committer_email,
+			date: toDate(raw.committed_date)
+		},
+		parents: raw.parent_ids ?? [],
+		url: raw.web_url,
+		...raw.stats ? { stats: {
+			additions: raw.stats.additions ?? 0,
+			deletions: raw.stats.deletions ?? 0,
+			total: raw.stats.total
+		} } : {},
+		...files ? { files } : {},
+		raw
+	};
+}
+/** GitLab reports a change by three booleans and a unified diff, with no counts. */
+function toChangedFile(raw) {
+	const path = raw.new_path ?? raw.old_path ?? "";
+	const status = raw.new_file ? "added" : raw.deleted_file ? "removed" : raw.renamed_file ? "renamed" : "modified";
+	return {
+		path,
+		previousPath: raw.renamed_file ? raw.old_path : void 0,
+		status,
+		statusRaw: status,
+		patch: raw.diff
+	};
+}
+function toBranch(raw) {
+	return {
+		name: raw.name,
+		sha: raw.commit?.id ?? "",
+		isDefault: raw.default,
+		isProtected: raw.protected,
+		url: raw.web_url,
+		raw
+	};
+}
+function toTag(raw) {
+	return {
+		name: raw.name,
+		sha: raw.commit?.id ?? raw.target ?? "",
+		raw
+	};
+}
+function toTreeEntry(raw) {
+	return {
+		path: raw.path,
+		type: raw.mode === "120000" ? "symlink" : raw.type === "tree" ? "directory" : raw.type === "commit" ? "submodule" : "file",
+		sha: raw.id,
+		mode: raw.mode
+	};
+}
+function toWebhook(target, raw) {
+	const nativeEvents = Object.entries(raw).filter(([key, value]) => key.endsWith("_events") && value === true).map(([key]) => key);
+	return {
+		ref: {
+			forge: FORGE,
+			instance: target.instance,
+			target,
+			id: String(raw.id)
+		},
+		url: raw.url,
+		events: eventKindsOf(GITLAB_NATIVE_EVENTS, nativeEvents),
+		nativeEvents,
+		active: !raw.disabled_until,
+		createdAt: toDate(raw.created_at),
+		raw
+	};
+}
+function toWebhookDelivery(hook, raw) {
+	const status = Number(raw.response_status) || 0;
+	return {
+		ref: {
+			forge: FORGE,
+			instance: hook.instance,
+			hook,
+			id: String(raw.id)
+		},
+		event: raw.trigger ?? "",
+		status,
+		ok: status >= 200 && status < 300,
+		deliveredAt: toDate(raw.created_at),
+		duration: raw.execution_duration === void 0 ? void 0 : Math.round(raw.execution_duration * 1e3),
+		raw
+	};
+}
+//#endregion
+//#region src/gitlab/web.ts
+const SECTIONS = {
+	issue: "issues",
+	pull_request: "merge_requests",
+	commit: "commit"
+};
+const KINDS = new Map(Object.entries(SECTIONS).map(([kind, section]) => [section, kind]));
+const PREFIXES = {
+	issue: "#",
+	pull_request: "!"
+};
+const encode = (path) => path.split("/").map(encodeURIComponent).join("/");
+const projectPath = (repo) => `/${encode(repo.owner)}/${encodeURIComponent(repo.name)}`;
+function gitlabWeb(origin) {
+	return {
+		origin,
+		repo: (repo) => repo.kind === "namespace" ? `/${encode(repo.owner)}` : projectPath(repo),
+		thread: (ref) => ref.repo.kind === "namespace" || !SECTIONS[ref.kind] ? void 0 : `${projectPath(ref.repo)}/-/${SECTIONS[ref.kind]}/${encodeURIComponent(ref.number)}`,
+		comment: (ref) => ref.thread.repo.kind === "namespace" || !SECTIONS[ref.thread.kind] ? void 0 : `${projectPath(ref.thread.repo)}/-/${SECTIONS[ref.thread.kind]}/${encodeURIComponent(ref.thread.number)}#note_${ref.id}`,
+		release: (ref) => ref.tag ? `${projectPath(ref.repo)}/-/releases/${encodeURIComponent(ref.tag)}` : void 0,
+		file: (repo, path, at, line) => `${projectPath(repo)}/-/blob/${encodeURIComponent(at)}/${encode(path)}${line ? `#L${line}` : ""}`,
+		compare: (repo, base, head) => `${projectPath(repo)}/-/compare/${encodeURIComponent(base)}...${encodeURIComponent(head)}`,
+		parse: (segments, url, from) => {
+			const separator = segments.indexOf("-");
+			const path = separator < 0 ? segments : segments.slice(0, separator);
+			if (path.length < 2) return;
+			const repo = {
+				...from,
+				owner: path.slice(0, -1).join("/"),
+				name: path.at(-1).replace(/\.git$/, "")
+			};
+			const [section, id] = separator < 0 ? [] : segments.slice(separator + 1);
+			if (section === "releases" && id) return {
+				repo,
+				release: {
+					...from,
+					repo,
+					id,
+					tag: id
+				}
+			};
+			const kind = section ? KINDS.get(section) : void 0;
+			if (!kind || !id) return { repo };
+			const thread = {
+				...from,
+				repo,
+				kind,
+				number: id
+			};
+			const note = url.hash.startsWith("#note_") ? url.hash.slice(6) : void 0;
+			return {
+				repo,
+				thread,
+				...note ? { comment: {
+					...from,
+					thread,
+					id: note
+				} } : {}
+			};
+		},
+		reference: (ref, same, expand) => {
+			if (ref.kind === "commit") return `${same ? "" : `${ref.repo.owner}/${ref.repo.name}@`}${ref.number.slice(0, 8)}`;
+			const prefix = PREFIXES[ref.kind];
+			if (!prefix || ref.repo.kind === "namespace") return;
+			return `${same ? "" : `${ref.repo.owner}/${ref.repo.name}`}${prefix}${ref.number}${expand ? "+" : ""}`;
+		}
+	};
+}
+//#endregion
+//#region src/gitlab/webhooks.ts
+const TOKEN_HEADER = "x-gitlab-token";
+const EVENT_HEADER = "x-gitlab-event";
+/**
+* GitLab sends the configured secret verbatim in `X-Gitlab-Token`; there is no
+* body signature to compute.
+*/
+async function verifyGitLabToken(delivery, secret) {
+	return verifySharedToken(delivery, secret, TOKEN_HEADER);
+}
+const ZERO_SHA = /^0+$/;
+function repoLevel(instance, payload, who, repo) {
+	switch (payload.object_kind ?? payload.event_name) {
+		case "push":
+		case "tag_push": return refEvent(who, {
+			ref: payload.ref ?? "",
+			before: payload.before,
+			after: payload.after,
+			created: Boolean(payload.before && ZERO_SHA.test(payload.before)),
+			deleted: Boolean(payload.after && ZERO_SHA.test(payload.after)),
+			commits: (payload.commits ?? []).map((commit) => ({
+				sha: commit.id,
+				message: commit.message,
+				author: commit.author?.name,
+				url: commit.url
+			})),
+			commitCount: payload.total_commits_count
+		});
+		case "release":
+			if (payload.action !== "create" || !repo) return;
+			return {
+				kind: "release",
+				action: "published",
+				detail: {
+					type: "release",
+					release: {
+						forge: FORGE,
+						instance,
+						repo,
+						id: payload.tag ?? String(payload.id),
+						tag: payload.tag
+					},
+					name: payload.name
+				},
+				summary: `${who} published ${payload.name ?? payload.tag ?? "a release"}`
+			};
+		case "project_rename": return {
+			kind: "repo",
+			action: "renamed",
+			detail: {
+				type: "repo_renamed",
+				from: payload.old_path_with_namespace ?? "",
+				to: payload.path_with_namespace ?? ""
+			},
+			summary: `${who} renamed the project`
+		};
+		case "project_transfer": return {
+			kind: "repo",
+			action: "transferred",
+			detail: {
+				type: "repo_transferred",
+				fromOwner: payload.old_path_with_namespace?.split("/").slice(0, -1).join("/"),
+				toOwner: payload.path_with_namespace?.split("/").slice(0, -1).join("/")
+			},
+			summary: `${who} transferred the project`
+		};
+		case "user_add_to_team":
+		case "user_remove_from_team":
+		case "user_add_to_group":
+		case "user_remove_from_group":
+		case "user_access_request_to_project":
+		case "user_update_for_team":
+		case "user_update_for_group": return {
+			kind: "membership",
+			action: membershipAction(payload.event_name),
+			detail: {
+				type: "membership",
+				actionRaw: payload.event_name ?? "member",
+				member: payload.user_name ? toActor(instance, {
+					id: payload.user_id ?? 0,
+					username: payload.user_username ?? payload.user_name,
+					name: payload.user_name
+				}) : void 0
+			},
+			summary: `${who} changed a membership`
+		};
+		default: return;
+	}
+}
+function membershipAction(eventName) {
+	if (eventName?.startsWith("user_add_")) return "added";
+	if (eventName?.startsWith("user_remove_")) return "removed";
+	return eventName?.startsWith("user_update_") ? "edited" : "other";
+}
+function diff(change, key) {
+	const previous = change?.previous ?? [];
+	const current = change?.current ?? [];
+	const before = new Set(previous.map(key));
+	const after = new Set(current.map(key));
+	return {
+		added: current.filter((item) => !before.has(key(item))),
+		removed: previous.filter((item) => !after.has(key(item)))
+	};
+}
+/** One event per label, assignee or reviewer an `update` delivery adds or removes. */
+function changeEvents(instance, payload, who) {
+	const changes = payload.changes;
+	if (payload.object_attributes?.action !== "update" || !changes) return [];
+	const events = [];
+	const labels = diff(changes.labels, (label) => label.title);
+	for (const [items, action, verb] of [[
+		labels.added,
+		"labelled",
+		"added"
+	], [
+		labels.removed,
+		"unlabelled",
+		"removed"
+	]]) for (const { title = "" } of items) events.push({
+		kind: "label",
+		action,
+		detail: {
+			type: "label",
+			label: title
+		},
+		summary: `${who} ${verb} label ${title}`.trim()
+	});
+	const people = (change, added, removed) => {
+		const { added: joined, removed: left } = diff(change, (user) => user.username);
+		for (const [users, [action, verb]] of [[joined, added], [left, removed]]) for (const user of users) events.push({
+			kind: "assignment",
+			action,
+			detail: {
+				type: "assignment",
+				assignee: toActor(instance, user)
+			},
+			summary: `${who} ${verb} ${user.username}`
+		});
+	};
+	people(changes.assignees, ["assigned", "assigned"], ["unassigned", "unassigned"]);
+	people(changes.reviewers, ["review_requested", "requested review from"], ["other", "removed the review request for"]);
+	return events;
+}
+function eventKindFor(payload) {
+	const attributes = payload.object_attributes;
+	switch (payload.object_kind) {
+		case "note": return attributes?.type === "DiffNote" || attributes?.position ? "review_comment" : "comment";
+		case "push": return "commit";
+		case "emoji": return "reaction";
+		case "issue":
+		case "merge_request": switch (attributes?.action) {
+			case "approved":
+			case "approval": return "review";
+			case "open":
+			case "close":
+			case "reopen":
+			case "merge": return "state_change";
+			case "update":
+				if (payload.changes?.labels) return "label";
+				if (payload.changes?.assignees || payload.changes?.reviewers) return "assignment";
+				return "other";
+			default: return "other";
+		}
+		default: return "other";
+	}
+}
+function translateGitLabWebhook(instance, delivery) {
+	const event = headerValue(delivery.headers, EVENT_HEADER);
+	if (!event) throw new WebhookVerificationError(`Missing ${EVENT_HEADER} header`, {
+		forge: FORGE,
+		instance
+	});
+	const deliveryId = headerValue(delivery.headers, "x-gitlab-event-uuid") ?? crypto.randomUUID();
+	const payload = JSON.parse(bodyText(delivery.body));
+	const repo = payload.project?.path_with_namespace ? toRepoRef(instance, payload.project.path_with_namespace, payload.project.id) : payload.path_with_namespace ? toRepoRef(instance, payload.path_with_namespace, payload.project_id) : void 0;
+	const user = payload.user?.username ? toActor(instance, {
+		id: payload.user.id ?? 0,
+		...payload.user,
+		username: payload.user.username
+	}) : void 0;
+	const attributes = payload.object_attributes;
+	const subject = payload.object_kind === "note" ? payload.merge_request ? {
+		kind: "pull_request",
+		iid: payload.merge_request.iid
+	} : payload.issue ? {
+		kind: "issue",
+		iid: payload.issue.iid
+	} : void 0 : payload.object_kind === "merge_request" && attributes?.iid !== void 0 ? {
+		kind: "pull_request",
+		iid: attributes.iid
+	} : payload.object_kind === "issue" && attributes?.iid !== void 0 ? {
+		kind: "issue",
+		iid: attributes.iid
+	} : void 0;
+	const thread = repo && subject ? {
+		forge: FORGE,
+		instance,
+		repo,
+		kind: subject.kind,
+		number: String(subject.iid)
+	} : void 0;
+	const level = repoLevel(instance, payload, user?.login ?? payload.user_username ?? "someone", repo);
+	if (level) return [{
+		forge: FORGE,
+		instance,
+		id: deliveryId,
+		kind: level.kind,
+		action: level.action,
+		kindRaw: payload.object_kind ?? payload.event_name ?? event,
+		summary: level.summary,
+		occurredAt: toDate(payload.commits?.at(-1)?.timestamp ?? payload.released_at) ?? /* @__PURE__ */ new Date(),
+		actor: user,
+		repo,
+		detail: level.detail,
+		source: "webhook",
+		payload
+	}];
+	const occurredAt = toDate(attributes?.created_at && payload.object_kind === "note" ? attributes.created_at : attributes?.updated_at) ?? /* @__PURE__ */ new Date();
+	const changes = changeEvents(instance, payload, user?.login ?? "someone");
+	if (changes.length) return changes.map((change, index) => ({
+		forge: FORGE,
+		instance,
+		id: changes.length === 1 ? deliveryId : `${deliveryId}:${index}`,
+		...change,
+		kindRaw: `${payload.object_kind}.update`,
+		actionRaw: "update",
+		occurredAt,
+		actor: user,
+		repo,
+		thread,
+		source: "webhook",
+		payload
+	}));
+	const kind = eventKindFor(payload);
+	const action = attributes?.action;
+	return [{
+		forge: FORGE,
+		instance,
+		id: deliveryId,
+		kind,
+		kindRaw: action ? `${payload.object_kind}.${action}` : payload.object_kind ?? event,
+		action: action === "update" && attributes?.oldrev ? "synchronised" : action === "merge" ? "merged" : eventAction(action),
+		actionRaw: action,
+		detail: kind === "comment" || kind === "review_comment" ? {
+			type: kind,
+			comment: thread && attributes?.id !== void 0 ? {
+				forge: FORGE,
+				instance,
+				thread,
+				id: String(attributes.id)
+			} : void 0,
+			body: attributes?.note
+		} : kind === "state_change" ? {
+			type: "state_change",
+			state: action === "merge" ? "merged" : action === "close" ? "closed" : "open"
+		} : void 0,
+		summary: payload.object_kind === "note" ? `${user?.login ?? "someone"} commented` : `${user?.login ?? "someone"} ${action ? `${action} ` : ""}${payload.object_kind ?? event}`.trim(),
+		occurredAt,
+		actor: user,
+		repo,
+		thread,
+		source: "webhook",
+		payload
+	}];
+}
+const gitlabWebhooks = ({ options, instance }) => ({
+	events: GITLAB_WEBHOOK_EVENTS,
+	verify: (delivery) => verifyGitLabToken(delivery, options.webhookSecret),
+	translate: (delivery) => translateGitLabWebhook(instance, delivery)
+});
+//#endregion
+//#region src/gitlab/index.ts
+/** GitLab versions with the webhook event log and resend endpoints. */
+const GITLAB_HOOK_EVENTS = "17.0";
+const ISSUE_LIKE = {
+	issue: true,
+	pull_request: true
+};
+/** Access level per normalised role, as `POST /projects/:id/members` takes it. */
+const ACCESS_LEVELS = {
+	admin: 50,
+	maintain: 40,
+	write: 30,
+	triage: 20,
+	read: 10,
+	none: 0
+};
+/** GitLab awards emoji by name; these are the names behind the normalised reactions. */
+const AWARD_EMOJI = {
+	"+1": "thumbsup",
+	"-1": "thumbsdown",
+	"laugh": "laughing",
+	"confused": "confused",
+	"heart": "heart",
+	"hooray": "tada",
+	"rocket": "rocket",
+	"eyes": "eyes"
+};
+/** The model's name for each award emoji `forges` writes. */
+const REACTION_NAMES = Object.fromEntries(Object.entries(AWARD_EMOJI).map(([content, name]) => [name, content]));
+const VULNERABILITIES_QUERY = `query ProjectVulnerabilities($fullPath: ID!, $first: Int, $after: String, $state: [VulnerabilityState!], $reportType: [VulnerabilityReportType!]) {
+  project(fullPath: $fullPath) {
+    vulnerabilities(first: $first, after: $after, state: $state, reportType: $reportType) {
+      pageInfo { hasNextPage endCursor }
+      nodes { id title severity state reportType detectedAt updatedAt dismissedAt resolvedAt webUrl }
+    }
+  }
+}`;
+const PROJECTS_QUERY = `query CodeSearchProjects($ids: [ID!]) {
+  projects(ids: $ids) {
+    nodes { id fullPath }
+  }
+}`;
+const BASE_METHODS = {
+	merge: "merge",
+	rebase_merge: "rebase_merge",
+	ff: "fast_forward_only"
+};
+function threadPath(ref) {
+	const project = `/projects/${projectId(ref.repo)}`;
+	switch (ref.kind) {
+		case "pull_request": return `${project}/merge_requests/${encodeURIComponent(ref.number)}`;
+		case "commit": return `${project}/repository/commits/${encodeURIComponent(ref.number)}`;
+		default: return `${project}/issues/${encodeURIComponent(ref.number)}`;
+	}
+}
+const GITLAB = {
+	forge: FORGE,
+	baseUrl: "https://gitlab.com",
+	anonymous: true,
+	apiPath: "/api/v4",
+	headers: { accept: "application/json" },
+	authHeaders: ({ options: { auth } }) => auth?.type === "token" ? async () => ({ authorization: `Bearer ${await resolveToken(auth)}` }) : void 0,
+	setup({ options, instance, baseUrl, origin: context, fetcher }) {
+		/** GitLab serves notes, labels, milestones, members, commit statuses, commit and code search and vulnerabilities only to signed-in users. */
+		const anonymous = options.auth?.type === "anonymous";
+		const web = gitlabWeb(baseUrl.replace(/\/api\/v4$/, ""));
+		/**
+		* GitLab lists pending and done to-dos separately. With `all`, pending
+		* pages are followed by done pages; `cursor.token` marks the switch.
+		*/
+		async function notificationPage(listOptions = {}) {
+			const cursor = listOptions.cursor;
+			const state = cursor?.token === "done" ? "done" : "pending";
+			const result = await fetcher.json(cursor?.nextUrl ?? "/todos", {
+				query: cursor?.nextUrl ? void 0 : {
+					state,
+					per_page: listOptions.perPage
+				},
+				signal: listOptions.signal
+			});
+			const since = listOptions.since?.getTime();
+			const items = (result.data ?? []).map((raw) => toNotification(instance, raw)).filter((item) => since === void 0 || item.updatedAt.getTime() >= since);
+			const phase = cursor?.token ?? "pending";
+			return {
+				items,
+				cursor: result.cursor?.nextUrl ? {
+					...result.cursor,
+					token: phase === "done" ? "done" : void 0
+				} : listOptions.all && phase !== "done" ? { token: "done" } : void 0,
+				notModified: result.notModified
+			};
+		}
+		/** GitLab assigns by user id, so logins are resolved once each. */
+		/** Award emoji hang off the issue, the merge request or a note, all under the same path. */
+		function awardPath(target) {
+			return "thread" in target ? `${threadPath(requireIssueOrPull(target.thread, context, "react to"))}/notes/${target.id}` : threadPath(requireIssueOrPull(target, context, "react to"));
+		}
+		/** The authenticated username, read once; removing an award needs its id, which is found by owner. */
+		const viewerLogin = memo(() => fetcher.json("/user").then((result) => result.data.username, () => void 0));
+		const userIdByName = memoBy((username) => fetcher.json("/users", { query: { username } }).then(({ data }) => {
+			if (!data[0]) throw new UnsupportedOperationError(`No GitLab user named ${username}`, context);
+			return data[0].id;
+		}));
+		function userId(actor) {
+			if (typeof actor !== "string" && /^\d+$/.test(actor.id)) return Promise.resolve(Number(actor.id));
+			return userIdByName(typeof actor === "string" ? actor : actor.login);
+		}
+		const STATUS_STATES = {
+			pending: "pending",
+			success: "success",
+			failure: "failed",
+			neutral: "success",
+			unknown: "pending"
+		};
+		const PIPELINE_STATES = {
+			pending: "running",
+			success: "success",
+			failure: "failed",
+			neutral: "manual",
+			unknown: void 0
+		};
+		async function setDiscussionResolved(thread, id, resolved, options) {
+			const ref = requireThread(thread, context);
+			await fetcher.raw(`${threadPath(ref)}/discussions/${encodeURIComponent(id)}`, {
+				method: "PUT",
+				query: { resolved },
+				signal: options?.signal
+			});
+		}
+		const list = createListing(fetcher, "per_page");
+		function milestonesPage(repo, listOptions = {}, includeAncestors) {
+			return list(`${projectPath(repo)}/milestones`, listOptions, (raw) => toMilestone(raw), { query: {
+				state: (listOptions.state ?? "open") === "all" ? void 0 : listOptions.state === "closed" ? "closed" : "active",
+				include_ancestors: includeAncestors
+			} });
+		}
+		async function readUser(path, signal) {
+			const { data } = await fetcher.json(path, { signal });
+			return {
+				...toActor(instance, data),
+				bio: data.bio || void 0,
+				company: data.organization || void 0,
+				location: data.location || void 0,
+				websiteUrl: data.website_url || void 0,
+				createdAt: toDate(data.created_at),
+				followers: data.followers,
+				following: data.following,
+				raw: data
+			};
+		}
+		function projectPath(repo) {
+			return `/projects/${projectId(repo)}`;
+		}
+		/** Project hooks, or group hooks for a namespace ref. */
+		function hooksPath(target) {
+			return isNamespaceRef(target) ? `/groups/${encodeURIComponent(target.externalId ?? target.owner)}/hooks` : `${projectPath(target)}/hooks`;
+		}
+		/** GitLab subscribes with one boolean per event group rather than a list of names. */
+		function hookFlags(input) {
+			return Object.fromEntries(nativeEventsFor(GITLAB_NATIVE_EVENTS, input.events, input.nativeEvents).map((flag) => [flag, true]));
+		}
+		function requireMerge(thread, action) {
+			const ref = requireThread(thread, context);
+			if (ref.kind !== "pull_request") throw new UnsupportedOperationError(`Only merge requests can be ${action}`, context);
+			return ref;
+		}
+		/** GitLab's file endpoint needs an explicit ref, so the project's default branch stands in. */
+		async function defaultBranch(repo, options) {
+			const { data } = await fetcher.json(projectPath(repo), { signal: options?.signal });
+			return data.default_branch ?? "HEAD";
+		}
+		async function get(thread, options) {
+			const ref = requireThread(thread, context);
+			if (ref.kind === "discussion") throw new UnsupportedOperationError("GitLab has no discussion threads", context);
+			if (ref.kind === "commit") return toCommitThread(ref, (await fetcher.json(threadPath(ref), { signal: options?.signal })).data);
+			const { data } = await fetcher.json(threadPath(ref), { signal: options?.signal });
+			const result = toThread(ref, data);
+			if (data.head_pipeline) result.checks = toPipelineSummary(data.head_pipeline);
+			return result;
+		}
+		const graphqlUrl = `${baseUrl.replace(/\/api\/v4$/, "")}/api/graphql`;
+		async function vulnerabilitiesPage(repo, listOptions = {}) {
+			const state = listOptions.state ?? "open";
+			const { data } = await fetcher.json(graphqlUrl, {
+				method: "POST",
+				json: {
+					operationName: "ProjectVulnerabilities",
+					query: VULNERABILITIES_QUERY,
+					variables: {
+						fullPath: `${repo.owner}/${repo.name}`,
+						first: Math.min(listOptions.perPage ?? 50, 100),
+						after: listOptions.cursor?.token ?? null,
+						state: state === "open" ? ["DETECTED", "CONFIRMED"] : state === "closed" ? ["RESOLVED", "DISMISSED"] : null,
+						reportType: listOptions.kind ? REPORT_TYPES[listOptions.kind] : null
+					}
+				},
+				signal: listOptions.signal
+			});
+			const vulnerabilities = data.data?.project?.vulnerabilities;
+			if (!vulnerabilities) {
+				const error = new InsufficientScopeError(data.errors?.[0]?.message ?? "The token cannot read vulnerabilities for this project, or its licence has no vulnerability report", 403, "", context);
+				if (listOptions.kind) throw error;
+				return {
+					items: [],
+					warnings: [toWarning("insufficient_scope", error, `${repo.owner}/${repo.name}`)]
+				};
+			}
+			return {
+				items: vulnerabilities.nodes.map((node) => toVulnerability(repo, node)),
+				cursor: vulnerabilities.pageInfo.hasNextPage && vulnerabilities.pageInfo.endCursor ? { token: vulnerabilities.pageInfo.endCursor } : void 0
+			};
+		}
+		async function releasesPage(repo, listOptions = {}) {
+			return list(`${projectPath(repo)}/releases`, listOptions, (raw) => toRelease(repo, raw));
+		}
+		function requirePublishedRelease(input) {
+			if (input.draft) throw new UnsupportedOperationError("GitLab has no draft releases", context);
+			if (input.prerelease) throw new UnsupportedOperationError("GitLab has no prereleases", context);
+		}
+		async function listPage(repo, query = {}) {
+			if (query.kind === "discussion") return {
+				items: [],
+				warnings: [{
+					code: "kind_unsupported",
+					message: "GitLab has no discussion threads"
+				}]
+			};
+			const warnings = !query.cursor && query.sort === "comments" ? [{
+				code: "sort_unsupported",
+				message: "GitLab cannot sort by comment count; sorted by creation time"
+			}] : [];
+			const state = query.state ?? "open";
+			const kinds = query.kind ? [query.kind] : ["issue", "pull_request"];
+			const page = await phased(kinds.map((kind) => async (cursor) => {
+				const merges = kind === "pull_request";
+				const result = await fetcher.page(`${projectPath(repo)}/${merges ? "merge_requests" : "issues"}`, {
+					query: {
+						state: state === "open" ? "opened" : state === "merged" ? "merged" : state === "closed" && !merges ? "closed" : void 0,
+						labels: query.labels?.join(","),
+						author_username: query.author,
+						assignee_username: query.assignee,
+						updated_after: query.since?.toISOString(),
+						created_after: query.createdAfter?.toISOString(),
+						order_by: query.sort === "updated" ? "updated_at" : "created_at",
+						sort: query.direction ?? "desc",
+						per_page: query.perPage
+					},
+					cursor,
+					signal: query.signal
+				});
+				return toPage(result, (raw) => merges && state === "closed" && raw.state === "opened" ? void 0 : toThread({
+					forge: FORGE,
+					instance,
+					repo,
+					kind,
+					number: String(raw.iid)
+				}, raw));
+			}), query.cursor);
+			return warnings.length ? {
+				...page,
+				warnings
+			} : page;
+		}
+		/** Cross-project search runs on the global issue and merge request listings, which take `search` and `in`. */
+		async function searchThreadsPage(query) {
+			const warnings = [];
+			if (!query.cursor && query.involves) warnings.push({
+				code: "filter_unsupported",
+				message: "GitLab has no involves filter; it was ignored"
+			});
+			if (!query.cursor && query.sort === "comments") warnings.push({
+				code: "sort_unsupported",
+				message: "GitLab cannot sort by comment count; sorted by update time"
+			});
+			const state = query.state ?? "all";
+			const kinds = query.kind ? [query.kind] : ["issue", "pull_request"];
+			const page = await phased(kinds.map((kind) => async (cursor) => {
+				const merges = kind === "pull_request";
+				const base = query.repo ? `${projectPath(query.repo)}/` : "/";
+				const result = await fetcher.page(`${base}${merges ? "merge_requests" : "issues"}`, {
+					query: {
+						scope: query.repo ? void 0 : "all",
+						search: query.text,
+						in: query.text ? "title,description" : void 0,
+						state: state === "open" ? "opened" : state === "closed" ? "closed" : void 0,
+						labels: query.labels?.join(","),
+						author_username: query.author,
+						assignee_username: query.assignee,
+						updated_after: query.since?.toISOString(),
+						order_by: query.sort === "created" ? "created_at" : "updated_at",
+						sort: query.direction ?? "desc",
+						per_page: query.perPage
+					},
+					cursor,
+					signal: query.signal
+				});
+				return toPage(result, (raw) => {
+					const repo = query.repo ?? repoRefFromWebUrl(instance, raw.web_url, merges ? raw.target_project_id : void 0);
+					return repo ? toThread({
+						forge: FORGE,
+						instance,
+						repo,
+						kind,
+						number: String(raw.iid)
+					}, raw) : void 0;
+				});
+			}), query.cursor);
+			return warnings.length ? {
+				...page,
+				warnings: [...warnings, ...page.warnings ?? []]
+			} : page;
+		}
+		async function searchReposPage(query) {
+			const path = query.owner ? `/groups/${encodeURIComponent(query.owner)}/projects` : "/projects";
+			const result = await fetcher.page(path, {
+				query: {
+					search: query.text,
+					order_by: query.sort === "created" ? "created_at" : query.sort === "stars" ? "star_count" : query.sort === "updated" ? "updated_at" : void 0,
+					sort: query.direction,
+					per_page: query.perPage
+				},
+				cursor: query.cursor,
+				signal: query.signal
+			});
+			return toPage(result, (raw) => toRepo(instance, raw));
+		}
+		/** Needs Advanced Search, which no endpoint reports; an instance without it returns an empty page. */
+		async function searchCommitsPage(query) {
+			const unsupported = [
+				"author",
+				"committer",
+				"since",
+				"until",
+				"sort"
+			].filter((field) => query[field] !== void 0);
+			const warnings = unsupported.length ? [{
+				code: "filter_unsupported",
+				message: `GitLab commit search cannot filter or sort by ${unsupported.join(", ")}`
+			}] : [];
+			const result = await fetcher.page(query.repo ? `${projectPath(query.repo)}/search` : "/search", {
+				query: {
+					scope: "commits",
+					search: query.text ?? "",
+					per_page: query.perPage
+				},
+				cursor: query.cursor,
+				signal: query.signal
+			});
+			const repo = query.repo;
+			return toPage(result, (raw) => repo && toCommit(repo, raw), warnings);
+		}
+		/** Projects that group and instance code searches named by id, kept so later pages skip the lookup. */
+		const projectRefs = /* @__PURE__ */ new Map();
+		/** A project the token cannot read costs its blobs and a warning, not the page. */
+		async function resolveProjects(ids, signal, warnings) {
+			if (!ids.length) return;
+			try {
+				const { data } = await fetcher.json(graphqlUrl, {
+					method: "POST",
+					json: {
+						operationName: "CodeSearchProjects",
+						query: PROJECTS_QUERY,
+						variables: { ids: ids.map((id) => `gid://gitlab/Project/${id}`) }
+					},
+					signal
+				});
+				for (const node of data.data?.projects?.nodes ?? []) {
+					const id = Number(node.id.slice(node.id.lastIndexOf("/") + 1));
+					projectRefs.set(id, toRepoRef(instance, node.fullPath, id));
+				}
+			} catch (error) {
+				if (!degradesToWarning(error)) throw error;
+				warnings.push(...ids.map((id) => toWarning("record_unreachable", error, `project ${id}`)));
+				return;
+			}
+			for (const id of ids.filter((id) => !projectRefs.has(id))) warnings.push({
+				code: "record_unreachable",
+				message: "GitLab returned no project for this id",
+				subject: `project ${id}`
+			});
+		}
+		/** Any tier searches a project; a group or the instance needs Advanced Search or exact code search. */
+		async function searchCodePage(query) {
+			const path = query.repo ? `${projectPath(query.repo)}/search` : query.owner ? `/groups/${encodeURIComponent(query.owner)}/search` : "/search";
+			const result = await fetcher.page(path, {
+				query: {
+					scope: "blobs",
+					search: query.text ?? "",
+					per_page: query.perPage
+				},
+				cursor: query.cursor,
+				signal: query.signal
+			});
+			const warnings = [];
+			await resolveProjects(query.repo ? [] : [...new Set((result.data ?? []).map((raw) => raw.project_id))].filter((id) => !projectRefs.has(id)), query.signal, warnings);
+			/** GitLab returns one blob per excerpt; basic search lists a file again, with the same first excerpt, when its name matches too. */
+			const files = /* @__PURE__ */ new Map();
+			for (const blob of result.data ?? []) {
+				const key = `${blob.project_id}:${blob.ref}:${blob.path}`;
+				const excerpts = files.get(key);
+				if (!excerpts) files.set(key, [blob]);
+				else if (!excerpts.some((seen) => seen.startline === blob.startline && seen.data === blob.data)) excerpts.push(blob);
+			}
+			return toPage({
+				...result,
+				data: [...files.values()]
+			}, (excerpts) => {
+				const [first] = excerpts;
+				const repo = query.repo ?? projectRefs.get(first.project_id);
+				if (!repo) return;
+				const url = webUrlFor(web, { file: {
+					repo,
+					path: first.path,
+					at: first.ref,
+					line: first.startline
+				} });
+				return {
+					repo,
+					path: first.path,
+					ref: first.ref,
+					fragments: excerpts.map((raw) => ({
+						text: raw.data,
+						line: raw.startline
+					})),
+					url,
+					raw: excerpts
+				};
+			}, warnings);
+		}
+		async function setSubscribed(thread, subscribed, options) {
+			const ref = requireIssueOrPull(thread, context, subscribed ? "subscribe to" : "unsubscribe from");
+			await fetcher.raw(`${threadPath(ref)}/${subscribed ? "subscribe" : "unsubscribe"}`, {
+				method: "POST",
+				signal: options?.signal
+			});
+		}
+		async function unsubscribe(_ref, writeOptions = {}) {
+			if (!writeOptions.thread) throw new UnresolvedThreadError("GitLab cannot look up a to-do by id; pass { thread } to unsubscribe", context);
+			const thread = requireThread(writeOptions.thread, context);
+			if (thread.kind !== "issue" && thread.kind !== "pull_request") throw new UnsupportedOperationError(`GitLab cannot unsubscribe from a ${thread.kind}`, context);
+			await fetcher.raw(`${threadPath(thread)}/unsubscribe`, {
+				method: "POST",
+				signal: writeOptions.signal
+			});
+		}
+		async function setState(thread, stateEvent, options) {
+			await fetcher.raw(threadPath(requireIssueOrPull(thread, context, stateEvent)), {
+				method: "PUT",
+				json: { state_event: stateEvent },
+				signal: options?.signal
+			});
+		}
+		async function resolveMergeMethod(ref, requested, signal) {
+			if (requested === "squash") return requested;
+			const { data: project } = await fetcher.json(`/projects/${projectId(ref.repo)}`, { signal });
+			const base = BASE_METHODS[project.merge_method ?? "merge"];
+			const squash = project.squash_option ?? "default_off";
+			if (requested) {
+				if (requested !== base || squash === "always") throw new UnsupportedOperationError(`This project merges with ${squash === "always" ? "squash" : base}; GitLab cannot override it per merge request`, context);
+				return requested;
+			}
+			return soleMergeMethod({
+				[base]: squash !== "always",
+				squash: squash !== "never"
+			}, context);
+		}
+		/** GitLab has approvals, not reviews: one synthesised review per approver, with no comments to hang on it. */
+		function toApprovalReviews(ref, approvals) {
+			return (approvals.approved_by ?? []).map(({ user }) => syntheticReview(ref, `approval:${user?.username ?? user?.id ?? ""}`, "approved", {
+				author: toActor(instance, user),
+				stateRaw: "approved",
+				raw: user
+			}));
+		}
+		async function approve(thread, body, options) {
+			const ref = requireThread(thread, context);
+			if (ref.kind !== "pull_request") throw new UnsupportedOperationError("Only merge requests can be approved", context);
+			if (body) throw new UnsupportedOperationError("GitLab approvals carry no body; leave a comment instead", context);
+			const { data } = await fetcher.json(`${threadPath(ref)}/approve`, {
+				method: "POST",
+				signal: options?.signal,
+				mapError: (error) => error instanceof TokenRevokedError ? new InsufficientScopeError("Not allowed to approve this merge request", 401, error.body, {
+					...context,
+					url: error.url,
+					method: error.method
+				}, { cause: error }) : error
+			});
+			return data;
+		}
+		async function merge(thread, mergeOptions = {}, hooks = {}) {
+			const ref = requireThread(thread, context);
+			if (ref.kind !== "pull_request") throw new UnsupportedOperationError("Only merge requests can be merged", context);
+			const method = await resolveMergeMethod(ref, mergeOptions.method, mergeOptions.signal);
+			const message = mergeCommitMessage(mergeOptions);
+			await hooks.beforeMerge?.();
+			await fetcher.raw(`${threadPath(ref)}/merge`, {
+				method: "PUT",
+				json: {
+					sha: mergeOptions.sha,
+					...message ? { [method === "squash" ? "squash_commit_message" : "merge_commit_message"]: message } : {},
+					squash: method === "squash",
+					merge_when_pipeline_succeeds: mergeOptions.whenChecksPass ?? false
+				},
+				mapError: toMergeError,
+				signal: mergeOptions.signal
+			});
+		}
+		return {
+			traits: {
+				eventKinds: "heuristic",
+				authKinds: ["token", "anonymous"],
+				limits: {
+					bodyLength: 1048576,
+					commentLength: 1e6,
+					labelLength: 255
+				}
+			},
+			probeVersion: async () => (await fetcher.json("/version")).data.version,
+			web,
+			webhooks: {
+				listPage: verb(true, (target, listOptions = {}) => list(hooksPath(target), listOptions, (raw) => toWebhook(target, raw))),
+				create: verb(true, async (target, input, options) => toWebhook(target, (await fetcher.json(hooksPath(target), {
+					method: "POST",
+					json: {
+						url: input.url,
+						token: input.secret,
+						...hookFlags(input)
+					},
+					signal: options?.signal
+				})).data)),
+				update: verb(true, async (ref, update, options) => toWebhook(ref.target, (await fetcher.json(`${hooksPath(ref.target)}/${ref.id}`, {
+					method: "PUT",
+					json: {
+						...update.url ? { url: update.url } : {},
+						...update.secret ? { token: update.secret } : {},
+						...hookFlags(update)
+					},
+					signal: options?.signal
+				})).data)),
+				delete: verb(true, async (ref, options) => {
+					await fetcher.raw(`${hooksPath(ref.target)}/${ref.id}`, {
+						method: "DELETE",
+						signal: options?.signal
+					});
+				}),
+				rotateSecret: verb(true, async (ref, secret, options) => toWebhook(ref.target, (await fetcher.json(`${hooksPath(ref.target)}/${ref.id}`, {
+					method: "PUT",
+					json: { token: secret },
+					signal: options?.signal
+				})).data)),
+				deliveriesPage: verb(({ version }) => versionAtLeast(version, GITLAB_HOOK_EVENTS), (ref, listOptions = {}) => list(`${hooksPath(ref.target)}/${ref.id}/events`, listOptions, (raw) => toWebhookDelivery(ref, raw))),
+				redeliver: verb(({ version }) => versionAtLeast(version, GITLAB_HOOK_EVENTS), async (ref, options) => {
+					await fetcher.raw(`${hooksPath(ref.hook.target)}/${ref.hook.id}/events/${ref.id}/resend`, {
+						method: "POST",
+						signal: options?.signal
+					});
+				})
+			},
+			scopes: gitlabScopesFor,
+			users: {
+				get: verb(true, async (login, options) => {
+					const { data: matches } = await fetcher.json("/users", {
+						query: { username: login },
+						signal: options?.signal
+					});
+					const [match] = matches ?? [];
+					if (!match) throw new NotFoundError(`No GitLab user named ${login}`, 404, "", context);
+					try {
+						return await readUser(`/users/${match.id}`, options?.signal);
+					} catch (error) {
+						if (error instanceof InsufficientScopeError || error instanceof AuthenticationRequiredError) return {
+							...toActor(instance, match),
+							raw: match
+						};
+						throw error;
+					}
+				}),
+				me: verb(true, (options) => readUser("/user", options?.signal))
+			},
+			repos: {
+				get: verb(true, async (ref, options) => {
+					const query = options?.licence ? { license: true } : void 0;
+					return toRepo(instance, (await fetcher.json(projectPath(ref), {
+						query,
+						signal: options?.signal
+					})).data);
+				}),
+				listPage: verb(true, (listOptions = {}) => list("/projects", listOptions, (raw) => toRepo(instance, raw), { query: { membership: true } })),
+				labelsPage: verb(!anonymous, (repo, listOptions = {}) => list(`${projectPath(repo)}/labels`, listOptions, toLabel)),
+				createLabel: verb(true, async (repo, label, options) => toLabel((await fetcher.json(`${projectPath(repo)}/labels`, {
+					method: "POST",
+					json: {
+						name: label.name,
+						color: hexColour(label.colour, "#"),
+						description: label.description
+					},
+					signal: options?.signal
+				})).data)),
+				milestonesPage: verb(!anonymous, milestonesPage),
+				collaboratorsPage: verb(!anonymous, (repo, listOptions = {}) => list(`${projectPath(repo)}/members/all`, listOptions, (raw) => ({
+					actor: toActor(instance, raw),
+					role: toRole(raw.access_level),
+					roleRaw: String(raw.access_level),
+					raw
+				}))),
+				permissionFor: verb(!anonymous, async (repo, actor, options) => {
+					try {
+						const { data } = await fetcher.json(`${projectPath(repo)}/members/all/${await userId(actor)}`, { signal: options?.signal });
+						return toRole(data.access_level);
+					} catch (error) {
+						if (error instanceof NotFoundError) return "none";
+						throw error;
+					}
+				}),
+				addCollaborator: verb(true, async (repo, actor, role, options) => {
+					await fetcher.raw(`${projectPath(repo)}/members`, {
+						method: "POST",
+						json: {
+							user_id: await userId(actor),
+							access_level: ACCESS_LEVELS[role]
+						},
+						signal: options?.signal
+					});
+				}),
+				assignableUsersPage: verb(true, (repo, listOptions = {}) => list(`${projectPath(repo)}/users`, listOptions, (raw) => toActor(instance, raw))),
+				reviewerCandidatesPage: verb("emulated", (thread, listOptions = {}) => list(`${projectPath(requireThread(thread, context).repo)}/users`, listOptions, (raw) => toActor(instance, raw)))
+			},
+			notifications: {
+				listPage: verb(true, notificationPage),
+				markDone: verb(true, async (ref, options) => {
+					await fetcher.raw(`/todos/${ref.id}/mark_as_done`, {
+						method: "POST",
+						signal: options?.signal
+					});
+				}),
+				unsubscribe: verb(true, unsubscribe),
+				markAllDone: verb(true, async (bulk = {}) => {
+					if (bulk.repo || bulk.before) throw new UnsupportedOperationError("GitLab marks every to-do done at once; repo and before filters are not supported", context);
+					await fetcher.raw("/todos/mark_as_done", {
+						method: "POST",
+						signal: bulk.signal
+					});
+				}),
+				unreadCount: verb(true, async (options) => {
+					const total = (await fetcher.raw("/todos", {
+						query: {
+							state: "pending",
+							per_page: 1
+						},
+						signal: options?.signal
+					})).headers.get("x-total");
+					if (total === null) throw new UnsupportedOperationError("GitLab omitted X-Total; the to-do count is too large to report", context);
+					return Number(total);
+				})
+			},
+			contents: {
+				file: verb(true, async (repo, path, fileOptions = {}) => {
+					const ref = fileOptions.ref ?? await defaultBranch(repo, fileOptions);
+					const { data } = await fetcher.json(`${projectPath(repo)}/repository/files/${encodeURIComponent(path.replace(/^\//, ""))}`, {
+						query: { ref },
+						signal: fileOptions.signal
+					});
+					const file = {
+						path: data.file_path,
+						sha: data.blob_id,
+						size: data.size
+					};
+					return toFileContent(fromBase64(data.content ?? ""), file, fileOptions, context);
+				}),
+				treePage: verb(true, (repo, treeOptions = {}) => list(`${projectPath(repo)}/repository/tree`, treeOptions, toTreeEntry, { query: {
+					ref: treeOptions.ref,
+					path: treeOptions.path,
+					recursive: treeOptions.recursive ? "true" : void 0
+				} })),
+				branchesPage: verb(true, (repo, listOptions = {}) => list(`${projectPath(repo)}/repository/branches`, listOptions, toBranch)),
+				tagsPage: verb(true, (repo, listOptions = {}) => list(`${projectPath(repo)}/repository/tags`, listOptions, toTag)),
+				resolveRef: verb(true, async (repo, ref, options) => (await fetcher.json(`${projectPath(repo)}/repository/commits/${encodeURIComponent(ref)}`, { signal: options?.signal })).data.id),
+				commitsPage: verb(true, (repo, query = {}) => list(`${projectPath(repo)}/repository/commits`, query, (raw) => toCommit(repo, raw), { query: {
+					ref_name: query.ref,
+					path: query.path,
+					author: query.author,
+					since: query.since?.toISOString(),
+					until: query.until?.toISOString()
+				} })),
+				commit: verb(true, async (repo, sha, options) => {
+					const [commit, diffs] = await Promise.all([fetcher.json(`${projectPath(repo)}/repository/commits/${sha}`, {
+						query: { stats: "true" },
+						signal: options?.signal
+					}), fetcher.json(`${projectPath(repo)}/repository/commits/${sha}/diff`, { signal: options?.signal })]);
+					return toCommit(repo, commit.data, (diffs.data ?? []).map(toChangedFile));
+				}),
+				compare: verb(true, async (repo, base, head, options) => {
+					const { data } = await fetcher.json(`${projectPath(repo)}/repository/compare`, {
+						query: {
+							from: base,
+							to: head
+						},
+						signal: options?.signal
+					});
+					return {
+						base,
+						head,
+						aheadBy: data.commits?.length,
+						commits: (data.commits ?? []).map((raw) => toCommit(repo, raw)),
+						files: (data.diffs ?? []).map(toChangedFile),
+						raw: data
+					};
+				})
+			},
+			releases: {
+				listPage: verb(true, releasesPage),
+				get: verb(true, async (ref, options) => toRelease(ref.repo, (await fetcher.json(`${projectPath(ref.repo)}/releases/${encodeURIComponent(ref.tag ?? ref.id)}`, { signal: options?.signal })).data)),
+				getByTag: verb(true, async (repo, tag, options) => toRelease(repo, (await fetcher.json(`${projectPath(repo)}/releases/${encodeURIComponent(tag)}`, { signal: options?.signal })).data)),
+				latest: verb(true, async (repo, options) => {
+					const { items } = await releasesPage(repo, {
+						perPage: 20,
+						signal: options?.signal
+					});
+					return items.find((release) => release.publishedAt);
+				}),
+				create: verb(true, async (repo, input, options) => {
+					requirePublishedRelease(input);
+					const { data } = await fetcher.json(`${projectPath(repo)}/releases`, {
+						method: "POST",
+						json: {
+							tag_name: input.tag,
+							ref: input.target,
+							name: input.name,
+							description: input.body
+						},
+						signal: options?.signal
+					});
+					return toRelease(repo, data);
+				}),
+				update: verb(true, async (ref, update, options) => {
+					requirePublishedRelease(update);
+					const tag = ref.tag ?? ref.id;
+					if (update.tag !== void 0 && update.tag !== tag) throw new UnsupportedOperationError("GitLab keys a release by its tag, so the tag cannot change", context);
+					if (update.target !== void 0) throw new UnsupportedOperationError("GitLab cannot change the commit a release points to", context);
+					const { data } = await fetcher.json(`${projectPath(ref.repo)}/releases/${encodeURIComponent(tag)}`, {
+						method: "PUT",
+						json: {
+							name: update.name,
+							description: update.body
+						},
+						signal: options?.signal
+					});
+					return toRelease(ref.repo, data);
+				})
+			},
+			search: {
+				threadsPage: verb(true, searchThreadsPage),
+				reposPage: verb(true, searchReposPage),
+				commitsPage: verb(!anonymous && "experimental", searchCommitsPage),
+				codePage: verb(!anonymous, searchCodePage)
+			},
+			checks: {
+				list: verb(!anonymous, async (repo, sha, options) => ({ items: await Array.fromAsync(fetcher.items(`${projectPath(repo)}/repository/commits/${sha}/statuses`, {
+					query: { per_page: 100 },
+					signal: options?.signal
+				}), (raw) => toStatusCheck(repo, raw)) })),
+				report: verb(true, async (repo, sha, input, options) => toStatusCheck(repo, (await fetcher.json(`${projectPath(repo)}/statuses/${sha}`, {
+					method: "POST",
+					json: {
+						state: STATUS_STATES[input.state],
+						name: input.name,
+						description: input.description,
+						target_url: input.url
+					},
+					signal: options?.signal
+				})).data)),
+				rerun: verb(true, async (ref, options) => {
+					if (ref.type !== "job" && ref.type !== "status") throw new UnsupportedOperationError(`GitLab cannot re-run a ${ref.type}`, context);
+					await fetcher.raw(`${projectPath(ref.repo)}/jobs/${ref.id}/retry`, {
+						method: "POST",
+						signal: options?.signal
+					});
+				})
+			},
+			ci: {
+				runsPage: verb(true, (repo, query = {}) => list(`${projectPath(repo)}/pipelines`, query, (raw) => toPipeline(repo, raw), { query: {
+					ref: query.branch,
+					status: PIPELINE_STATES[query.state ?? "unknown"]
+				} })),
+				run: verb(true, async (ref, options) => toPipeline(ref.repo, (await fetcher.json(`${projectPath(ref.repo)}/pipelines/${ref.id}`, { signal: options?.signal })).data)),
+				jobsPage: verb(true, (ref, listOptions = {}) => list(`${projectPath(ref.repo)}/pipelines/${ref.id}/jobs`, listOptions, (raw) => toCiJob(ref, raw))),
+				log: verb(!anonymous, async (ref, options) => (await fetcher.stream(`${projectPath(ref.repo)}/jobs/${encodeURIComponent(ref.id)}/trace`, { signal: options?.signal })).body)
+			},
+			securityAlerts: {
+				kinds: {
+					dependency: !anonymous,
+					code_scanning: !anonymous,
+					secret: !anonymous
+				},
+				listPage: vulnerabilitiesPage
+			},
+			threads: {
+				filesPage: verb(true, (thread, listOptions = {}) => list(`${threadPath(requireMerge(thread, "read for changed files"))}/diffs`, listOptions, toChangedFile)),
+				commitsPage: verb(true, (thread, listOptions = {}) => list(`${threadPath(requireMerge(thread, "read for commits"))}/commits`, listOptions, (raw) => toCommit(thread.repo, raw))),
+				reviewsPage: verb("emulated", async (thread, listOptions) => {
+					const ref = requireThread(thread, context);
+					if (ref.kind !== "pull_request") throw new UnsupportedOperationError("Only merge requests have approvals", context);
+					const { data } = await fetcher.json(`${threadPath(ref)}/approvals`, { signal: listOptions?.signal });
+					return { items: toApprovalReviews(ref, data) };
+				}),
+				approve: verb(true, async (thread, body, options) => {
+					await approve(thread, body, options);
+				}),
+				createReview: verb("emulated", async (thread, input, options) => {
+					if (input.comments?.length) throw new UnsupportedOperationError("GitLab reviews carry no inline comments yet", context);
+					const ref = requireThread(thread, context);
+					if (input.event === "comment" && input.body) {
+						const { data } = await fetcher.json(`${threadPath(ref)}/discussions`, {
+							method: "POST",
+							json: { body: input.body },
+							signal: options?.signal
+						});
+						const note = data.notes[0];
+						return {
+							...syntheticReview(ref, `discussion:${data.id}`, "commented", {
+								author: toActor(instance, note.author),
+								stateRaw: "discussion",
+								submittedAt: toDate(note.created_at),
+								raw: data
+							}),
+							body: note.body,
+							comments: [{
+								...toNoteComment(ref, note, data),
+								raw: note
+							}]
+						};
+					}
+					if (input.event !== "approve") throw new UnsupportedOperationError("GitLab has approvals and discussions, not reviews; create `approve`, or `comment` with a body", context);
+					const approvals = await approve(ref, input.body, options);
+					const viewer = await viewerLogin();
+					const reviews = toApprovalReviews(ref, approvals);
+					return reviews.find((review) => review.author?.login === viewer) ?? reviews.at(-1) ?? {
+						ref: {
+							forge: "gitlab",
+							instance,
+							thread: ref,
+							id: "approval:"
+						},
+						state: "approved",
+						stateRaw: "approved",
+						comments: false,
+						raw: approvals
+					};
+				}),
+				reviewThreads: verb(true, {
+					resolveReviewThread: (thread, id, options) => setDiscussionResolved(thread, id, true, options),
+					unresolveReviewThread: (thread, id, options) => setDiscussionResolved(thread, id, false, options)
+				}),
+				checks: perKind({ pull_request: true }, async (thread, options) => {
+					const ref = requireThread(thread, context);
+					const { data } = await fetcher.json(threadPath(ref), { signal: options?.signal });
+					if (!data.head_pipeline) return { items: [] };
+					const pipelineProject = data.head_pipeline.project_id;
+					const project = pipelineProject === void 0 || pipelineProject === data.target_project_id ? projectPath(ref.repo) : `/projects/${pipelineProject}`;
+					return { items: await Array.fromAsync(fetcher.items(`${project}/pipelines/${data.head_pipeline.id}/jobs`, {
+						query: { per_page: 100 },
+						signal: options?.signal
+					}), (job) => toJobCheck(ref.repo, job)) };
+				}),
+				get: perKind({
+					issue: true,
+					pull_request: true,
+					commit: true
+				}, get),
+				getMany: verb(true, (refs, options) => getManyConcurrently(refs, get, options)),
+				listPage: perKind(ISSUE_LIKE, listPage),
+				eventsPage: verb(!anonymous, async (thread, listOptions = {}) => {
+					const ref = requireThread(thread, context);
+					if (ref.kind === "commit") {
+						const offset = Number(listOptions.cursor?.token ?? 0);
+						const result = await fetcher.page(`${threadPath(ref)}/comments`, {
+							query: { per_page: listOptions.perPage },
+							cursor: listOptions.cursor,
+							signal: listOptions.signal
+						});
+						let index = offset;
+						const page = toPage(result, (comment) => toCommitCommentEvent(ref, comment, index++));
+						return page.cursor ? {
+							...page,
+							cursor: {
+								...page.cursor,
+								token: String(index)
+							}
+						} : page;
+					}
+					return list(`${threadPath(ref)}/notes`, listOptions, (note) => toNoteEvent(ref, note), { query: {
+						sort: "asc",
+						order_by: "created_at"
+					} });
+				}),
+				commentsPage: perKind({
+					issue: !anonymous,
+					pull_request: !anonymous,
+					commit: true
+				}, async (thread, listOptions = {}) => {
+					const ref = requireThread(thread, context);
+					if (ref.kind === "commit") return list(`${threadPath(ref)}/comments`, listOptions, (comment) => toCommitComment(ref, comment));
+					const page = await list(`${threadPath(requireIssueOrPull(ref, context, "list comments on"))}/discussions`, listOptions, (discussion) => discussion);
+					return {
+						...page,
+						items: page.items.flatMap((discussion) => discussion.notes.filter((note) => !note.system).map((note) => toNoteComment(ref, note, discussion)))
+					};
+				}),
+				comment: perKind({
+					issue: true,
+					pull_request: true,
+					commit: true
+				}, async (thread, body, options) => {
+					const ref = requireThread(thread, context);
+					if (ref.kind === "commit") {
+						const { data } = await fetcher.json(`${threadPath(ref)}/comments`, {
+							method: "POST",
+							json: { note: body },
+							signal: options?.signal
+						});
+						return toCommitComment(ref, data);
+					}
+					const { data } = await fetcher.json(`${threadPath(requireIssueOrPull(ref, context, "comment on"))}/notes`, {
+						method: "POST",
+						json: { body },
+						signal: options?.signal
+					});
+					return toNoteComment(ref, data);
+				}),
+				editComment: perKind({
+					issue: true,
+					pull_request: true
+				}, async (ref, body, options) => {
+					const thread = requireIssueOrPull(ref.thread, context, "edit comments on");
+					const { data } = await fetcher.json(`${threadPath(thread)}/notes/${ref.id}`, {
+						method: "PUT",
+						json: { body },
+						signal: options?.signal
+					});
+					return toNoteComment(thread, data);
+				}),
+				deleteComment: perKind({
+					issue: true,
+					pull_request: true
+				}, async (ref, options) => {
+					const thread = requireIssueOrPull(ref.thread, context, "delete comments on");
+					await fetcher.raw(`${threadPath(thread)}/notes/${ref.id}`, {
+						method: "DELETE",
+						signal: options?.signal
+					});
+				}),
+				create: perKind({
+					issue: true,
+					pull_request: true
+				}, async (repo, input, options) => {
+					if (input.kind === "discussion") throw new UnsupportedOperationError("GitLab has no discussion threads", context);
+					const assignee_ids = input.assignees?.length ? await Promise.all(input.assignees.map(userId)) : void 0;
+					const labels = input.labels?.join(",");
+					if (input.kind === "issue") {
+						const { data } = await fetcher.json(`${projectPath(repo)}/issues`, {
+							method: "POST",
+							json: {
+								title: input.title,
+								description: input.body,
+								labels,
+								assignee_ids
+							},
+							signal: options?.signal
+						});
+						return toThread({
+							forge: FORGE,
+							instance,
+							repo,
+							kind: "issue",
+							number: String(data.iid)
+						}, data);
+					}
+					if (!input.head || !input.base) throw new UnsupportedOperationError("Creating a merge request needs head and base branches", context);
+					const { data } = await fetcher.json(`${projectPath(repo)}/merge_requests`, {
+						method: "POST",
+						json: {
+							title: input.draft ? `Draft: ${input.title}` : input.title,
+							description: input.body,
+							source_branch: input.head,
+							target_branch: input.base,
+							labels,
+							assignee_ids
+						},
+						signal: options?.signal
+					});
+					return toThread({
+						forge: FORGE,
+						instance,
+						repo,
+						kind: "pull_request",
+						number: String(data.iid)
+					}, data);
+				}),
+				update: perKind({
+					issue: true,
+					pull_request: true
+				}, async (thread, input, options) => {
+					const ref = requireIssueOrPull(thread, context, "update");
+					const { data } = await fetcher.json(threadPath(ref), {
+						method: "PUT",
+						json: {
+							title: input.title,
+							description: input.body
+						},
+						signal: options?.signal
+					});
+					return toThread(ref, data);
+				}),
+				addLabels: perKind({
+					issue: true,
+					pull_request: true
+				}, async (thread, labels, options) => {
+					const ref = requireIssueOrPull(thread, context, "label");
+					await fetcher.raw(threadPath(ref), {
+						method: "PUT",
+						json: { add_labels: labels.join(",") },
+						signal: options?.signal
+					});
+				}),
+				removeLabels: perKind({
+					issue: true,
+					pull_request: true
+				}, async (thread, labels, options) => {
+					const ref = requireIssueOrPull(thread, context, "label");
+					await fetcher.raw(threadPath(ref), {
+						method: "PUT",
+						json: { remove_labels: labels.join(",") },
+						signal: options?.signal
+					});
+				}),
+				setMilestone: perKind({
+					issue: true,
+					pull_request: true
+				}, async (thread, milestone, options) => {
+					const ref = requireIssueOrPull(thread, context, "set the milestone of");
+					await fetcher.raw(threadPath(ref), {
+						method: "PUT",
+						json: { milestone_id: milestone === void 0 ? 0 : await milestoneId(milestone, (page) => milestonesPage(ref.repo, page, true), context, options) },
+						signal: options?.signal
+					});
+				}),
+				reactionsPage: perKind(ISSUE_LIKE, async (target, listOptions = {}) => {
+					const result = await fetcher.page(`${awardPath(target)}/award_emoji`, {
+						query: { per_page: listOptions.perPage },
+						cursor: listOptions.cursor,
+						signal: listOptions.signal
+					});
+					return toPage(result, (raw) => {
+						const reactor = toActor(instance, raw.user);
+						return reactor && {
+							content: reactionContent(REACTION_NAMES[raw.name] ?? raw.name),
+							contentRaw: raw.name,
+							actor: reactor,
+							createdAt: toDate(raw.created_at),
+							raw
+						};
+					});
+				}),
+				reactions: perKind({
+					issue: true,
+					pull_request: true
+				}, {
+					async react(target, reaction, options) {
+						await fetcher.raw(`${awardPath(target)}/award_emoji`, {
+							method: "POST",
+							json: { name: AWARD_EMOJI[reaction] },
+							signal: options?.signal
+						});
+					},
+					async unreact(target, reaction, options) {
+						const path = `${awardPath(target)}/award_emoji`;
+						const { data } = await fetcher.json(path, {
+							query: { per_page: 100 },
+							signal: options?.signal
+						});
+						const login = await viewerLogin();
+						const mine = data.find((award) => award.name === AWARD_EMOJI[reaction] && award.user?.username === login);
+						if (mine) await fetcher.raw(`${path}/${mine.id}`, {
+							method: "DELETE",
+							signal: options?.signal
+						});
+					}
+				}),
+				transfer: verb(true, async (thread, repo, options) => {
+					const ref = requireIssueOrPull(thread, context, "transfer");
+					if (ref.kind !== "issue") throw new UnsupportedOperationError("GitLab moves issues only", context);
+					const { data: target } = await fetcher.json(`/projects/${projectId(repo)}`, { signal: options?.signal });
+					const { data } = await fetcher.json(`${threadPath(ref)}/move`, {
+						method: "POST",
+						json: { to_project_id: target.id },
+						signal: options?.signal
+					});
+					return {
+						forge: FORGE,
+						instance,
+						repo,
+						kind: "issue",
+						number: String(data.iid),
+						externalId: data.id === void 0 ? void 0 : String(data.id)
+					};
+				}),
+				markDuplicate: verb("emulated", async (thread, canonical, options) => {
+					const ref = requireIssueOrPull(thread, context, "mark duplicate");
+					const reference = canonical.repo.owner === ref.repo.owner && canonical.repo.name === ref.repo.name ? `#${canonical.number}` : `${canonical.repo.owner}/${canonical.repo.name}#${canonical.number}`;
+					await fetcher.raw(`${threadPath(ref)}/notes`, {
+						method: "POST",
+						json: { body: `/duplicate ${reference}` },
+						signal: options?.signal
+					});
+				}),
+				setLabels: perKind({
+					issue: true,
+					pull_request: true
+				}, async (thread, labels, options) => {
+					const ref = requireIssueOrPull(thread, context, "label");
+					await fetcher.raw(threadPath(ref), {
+						method: "PUT",
+						json: { labels: labels.join(",") },
+						signal: options?.signal
+					});
+				}),
+				setAssignees: perKind({
+					issue: true,
+					pull_request: true
+				}, async (thread, assignees, options) => {
+					const ref = requireIssueOrPull(thread, context, "assign");
+					await fetcher.raw(threadPath(ref), {
+						method: "PUT",
+						json: { assignee_ids: await Promise.all(assignees.map(userId)) },
+						signal: options?.signal
+					});
+				}),
+				requestReview: perKind({ pull_request: true }, async (thread, reviewers, options) => {
+					const ref = requireThread(thread, context);
+					if (ref.kind !== "pull_request") throw new UnsupportedOperationError("Only merge requests have reviewers", context);
+					const { data } = await fetcher.json(threadPath(ref), { signal: options?.signal });
+					const ids = /* @__PURE__ */ new Set([...(data.reviewers ?? []).map((user) => user.id), ...await Promise.all(reviewers.map(userId))]);
+					await fetcher.raw(threadPath(ref), {
+						method: "PUT",
+						json: { reviewer_ids: [...ids] },
+						signal: options?.signal
+					});
+				}),
+				close: perKind({
+					issue: true,
+					pull_request: true
+				}, (ref, options) => setState(ref, "close", options)),
+				reopen: perKind({
+					issue: true,
+					pull_request: true
+				}, (ref, options) => setState(ref, "reopen", options)),
+				merge: verb(true, merge),
+				subscriptions: perKind(ISSUE_LIKE, {
+					subscription: async (thread, options) => {
+						const ref = requireIssueOrPull(thread, context, "read the subscription of");
+						return (await fetcher.json(threadPath(ref), { signal: options?.signal })).data.subscribed ? "subscribed" : "none";
+					},
+					subscribe: (thread, options) => setSubscribed(thread, true, options),
+					unsubscribe: (thread, options) => setSubscribed(thread, false, options)
+				})
+			}
+		};
+	}
+};
+/** Creates a GitLab provider for gitlab.com or a self-managed instance. */
+const gitlab = /* @__PURE__ */ defineForgeProvider({
+	...GITLAB,
+	webhooks: gitlabWebhooks
+});
+/** `gitlab()` without webhook ingestion, for bundles that never receive a delivery. */
+const gitlabLite = /* @__PURE__ */ defineForgeProvider(GITLAB);
+/** GitLab tokens carry coarse scopes; `api` covers writes and `read_api` reads. */
+function gitlabScopesFor(verb) {
+	const [group = "", name = ""] = verb.split(".");
+	if (group === "webhooks") return name === "verify" || name === "ingest" ? {} : {
+		token: ["api"],
+		note: "Maintainer on the project, or Owner on the group"
+	};
+	return { token: [(/* @__PURE__ */ new Set([
+		"get",
+		"list",
+		"listPage",
+		"page",
+		"events",
+		"eventsPage",
+		"comments",
+		"commentsPage",
+		"getMany",
+		"reviews",
+		"reviewsPage",
+		"checks",
+		"files",
+		"filesPage",
+		"commits",
+		"commitsPage",
+		"code",
+		"codePage",
+		"subscription",
+		"unreadCount",
+		"threads",
+		"threadsPage",
+		"repos",
+		"reposPage",
+		"tree",
+		"treePage",
+		"branches",
+		"branchesPage",
+		"tags",
+		"tagsPage",
+		"file",
+		"compare",
+		"resolveRef",
+		"commit",
+		"latest",
+		"getByTag",
+		"downloadAsset",
+		"runs",
+		"runsPage",
+		"run",
+		"jobs",
+		"jobsPage",
+		"log",
+		"permissionFor",
+		"labels",
+		"labelsPage",
+		"milestones",
+		"milestonesPage",
+		"collaborators",
+		"collaboratorsPage",
+		"assignableUsers",
+		"assignableUsersPage",
+		"reviewerCandidates",
+		"reviewerCandidatesPage"
+	])).has(name) ? "read_api" : "api"] };
+}
+//#endregion
+export { gitlabLite as n, gitlabScopesFor as r, gitlab as t };