@simplysf/simply-gitlab-core 0.2.0 → 0.4.0

package/lib/baseline-render.js

@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2026, SimplySF.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { summarise } from './baseline-run.js';
+import { stripControlOneLine } from './text.js';
+/**
+ * Renders a plan for a person to read before deciding to apply it.
+ *
+ * Lives in core rather than in the command for the same reason the table column sets do: the MCP
+ * server publishes this plan too, and a renderer only the CLI knew about would drift from what the
+ * tool describes. Nothing here writes to a stream; it returns a string.
+ */
+/** Values in a plan are whatever GitLab returned, so they are rendered defensively. */
+function value(input) {
+    if (input === undefined)
+        return 'unset';
+    if (input === null)
+        return 'null';
+    if (typeof input === 'string')
+        return stripControlOneLine(input) || "''";
+    if (Array.isArray(input))
+        return input.length === 0 ? '[]' : `[${input.map((item) => value(item)).join(', ')}]`;
+    if (typeof input === 'object')
+        return stripControlOneLine(JSON.stringify(input));
+    if (typeof input === 'number' || typeof input === 'boolean')
+        return String(input);
+    // Anything else came from server JSON; serialise rather than coerce it to [object Object].
+    return stripControlOneLine(JSON.stringify(input) ?? '');
+}
+const MARKS = {
+    create: '+',
+    update: '~',
+    delete: '-',
+    recreate: '±',
+    report: '!',
+};
+function renderChange(change) {
+    const mark = MARKS[change.op];
+    const key = stripControlOneLine(change.key);
+    if (change.op === 'update') {
+        const detail = change.detail === undefined ? '' : `   (${change.detail})`;
+        return `    ${mark} ${key}  ${value(change.from)} → ${value(change.to)}${detail}`;
+    }
+    if (change.op === 'report') {
+        const shift = change.to === undefined ? '' : `  ${value(change.from)} → ${value(change.to)}`;
+        return `    ${mark} ${key}${shift}   (${change.detail ?? 'reported only'})`;
+    }
+    const detail = change.detail === undefined ? '' : `   (${change.detail})`;
+    const extra = change.to === undefined ? '' : `  ${value(change.to)}`;
+    return `    ${mark} ${key}${extra}${detail}`;
+}
+function renderSection(section) {
+    if (!section.supported) {
+        return [`  ${section.section}`, `    ! ${section.unsupportedReason ?? 'unsupported on this instance'}`];
+    }
+    if (section.changes.length === 0)
+        return [];
+    return [`  ${section.section}`, ...section.changes.map(renderChange)];
+}
+function renderTarget(target) {
+    const heading = target.kind === 'group' ? `${target.path}  (group)` : target.path;
+    if (target.error !== undefined) {
+        return [heading, `    ✗ ${stripControlOneLine(target.error)}`];
+    }
+    const body = target.sections.flatMap(renderSection);
+    if (body.length === 0)
+        return [heading, '  ✓ matches the baseline'];
+    return [heading, ...body];
+}
+/** The whole plan, target by target, with a closing summary. */
+export function renderPlan(plan) {
+    const blocks = plan.targets.map((target) => renderTarget(target).join('\n'));
+    const counts = summarise(plan);
+    const parts = [
+        `${counts.targets} target(s): ${counts.matching} match, ${counts.differing} differ`,
+        counts.failed > 0 ? `${counts.failed} failed` : undefined,
+        counts.unsupported > 0 ? `${counts.unsupported} with an unsupported section` : undefined,
+    ].filter((part) => part !== undefined);
+    return [blocks.join('\n\n'), `${parts.join(', ')}.`].join('\n\n');
+}
+/**
+ * The plan as data, for `--json` and for the MCP tool.
+ *
+ * `actions` are deliberately dropped: they are how apply executes, not something a caller should
+ * depend on, and publishing them would make an internal shape part of the contract.
+ */
+export function planToJson(plan) {
+    return {
+        targets: plan.targets.map((target) => ({
+            kind: target.kind,
+            path: target.path,
+            id: target.id,
+            ...(target.error === undefined ? {} : { error: target.error }),
+            sections: target.sections.map((section) => ({
+                section: section.section,
+                supported: section.supported,
+                ...(section.unsupportedReason === undefined ? {} : { unsupportedReason: section.unsupportedReason }),
+                changes: section.changes,
+                willChange: section.actions.length > 0,
+            })),
+        })),
+        summary: summarise(plan),
+    };
+}
+/** What an apply actually did, after the fact. */
+export function renderApply(result) {
+    const lines = [];
+    let applied = 0;
+    let failed = 0;
+    for (const target of result.targets) {
+        applied += target.applied;
+        if (target.error !== undefined) {
+            failed += 1;
+            const where = target.failedSection === undefined ? '' : ` in ${target.failedSection}`;
+            lines.push(`${target.path}`);
+            lines.push(`    ✗ stopped${where} after ${target.applied} change(s): ${stripControlOneLine(target.error)}`);
+            continue;
+        }
+        if (target.applied > 0)
+            lines.push(`${target.path}  ✓ ${target.applied} change(s)`);
+    }
+    const summary = failed === 0
+        ? `Applied ${applied} change(s) across ${result.targets.length} target(s).`
+        : `Applied ${applied} change(s); ${failed} target(s) failed. Run plan again to see what is left.`;
+    return lines.length === 0 ? summary : [lines.join('\n'), summary].join('\n\n');
+}
+//# sourceMappingURL=baseline-render.js.map

package/lib/baseline-render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline-render.js","sourceRoot":"","sources":["../src/baseline-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD;;;;;;GAMG;AAEH,uFAAuF;AACvF,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAChH,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,2FAA2F;IAC3F,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,KAAK,GAA2C;IACpD,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;IACb,MAAM,EAAE,GAAG;CACZ,CAAC;AAEF,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAE5C,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAC1E,OAAO,OAAO,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7F,OAAO,OAAO,IAAI,IAAI,GAAG,GAAG,KAAK,OAAO,MAAM,CAAC,MAAM,IAAI,eAAe,GAAG,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACrE,OAAO,OAAO,IAAI,IAAI,GAAG,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,OAAoB;IACzC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,OAAO,CAAC,iBAAiB,IAAI,8BAA8B,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAElF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,OAAO,EAAE,SAAS,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACpE,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,UAAU,CAAC,IAAkB;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE/B,MAAM,KAAK,GAAG;QACZ,GAAG,MAAM,CAAC,OAAO,eAAe,MAAM,CAAC,QAAQ,WAAW,MAAM,CAAC,SAAS,SAAS;QACnF,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS;QACzD,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,8BAA8B,CAAC,CAAC,CAAC,SAAS;KACzF,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAEvD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAkB;IAC3C,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9D,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBACpG,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;aACvC,CAAC,CAAC;SACJ,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QAC1B,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,aAAa,EAAE,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,UAAU,MAAM,CAAC,OAAO,eAAe,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5G,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,YAAY,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,OAAO,GACX,MAAM,KAAK,CAAC;QACV,CAAC,CAAC,WAAW,OAAO,qBAAqB,MAAM,CAAC,OAAO,CAAC,MAAM,aAAa;QAC3E,CAAC,CAAC,WAAW,OAAO,eAAe,MAAM,wDAAwD,CAAC;IAEtG,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC"}

package/lib/baseline-run.d.ts

@@ -0,0 +1,49 @@
+import { type BaselineConfig } from './baseline-config.js';
+import { type BaselinePlan, type TargetPlan } from './baseline-plan.js';
+import { type ResolvedTargets } from './baseline-targets.js';
+import type { GitLabClient } from './gitlab-client.js';
+/** How a run is paced and how it reacts to a target failing. */
+export interface RunOptions {
+    /**
+     * How many targets are in flight at once. Small on purpose: the transport already retries 429
+     * with a capped Retry-After, so setting this high trades a shared instance's responsiveness for
+     * very little wall-clock.
+     */
+    readonly concurrency?: number;
+    /** Stop at the first target that fails, for when a systematic problem makes the rest pointless. */
+    readonly failFast?: boolean;
+    /** Narrow the run to these project paths without editing the config. */
+    readonly only?: readonly string[];
+}
+export declare const DEFAULT_CONCURRENCY = 4;
+export interface PlannedRun {
+    readonly targets: ResolvedTargets;
+    readonly plan: BaselinePlan;
+}
+/**
+ * Runs `worker` over `items` with at most `limit` in flight, preserving input order in the result.
+ *
+ * A pool rather than `Promise.all` in chunks: with fifty targets of uneven size, chunking waits for
+ * the slowest project in each batch before starting the next, which is most of the run.
+ */
+export declare function mapPool<T, R>(items: readonly T[], limit: number, worker: (item: T, index: number) => Promise<R>, 
+/** Return true to stop scheduling further items. Those already in flight still finish. */
+stopAfter?: (result: R) => boolean): Promise<R[]>;
+/**
+ * Resolves the targets and plans every one of them.
+ *
+ * Groups are planned before projects, matching the order `apply` writes them in: a group setting
+ * that projects inherit should be in place before the projects are looked at.
+ */
+export declare function planRun(client: GitLabClient, config: BaselineConfig, options?: RunOptions): Promise<PlannedRun>;
+/** What a plan or an apply amounted to, for the closing summary and the exit code. */
+export interface RunSummary {
+    readonly targets: number;
+    readonly matching: number;
+    readonly differing: number;
+    readonly failed: number;
+    readonly unsupported: number;
+}
+export declare function summarise(plan: BaselinePlan): RunSummary;
+/** Targets that could not be planned or applied, for reporting before the exit code. */
+export declare function failures(plan: BaselinePlan): readonly TargetPlan[];

package/lib/baseline-run.js

@@ -0,0 +1,102 @@
+/*
+ * Copyright (c) 2026, SimplySF.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { effectiveGroup, effectiveProject } from './baseline-config.js';
+import { planGroup, planProject } from './baseline-plan.js';
+import { resolveTargets } from './baseline-targets.js';
+import { ConfigError } from './errors.js';
+export const DEFAULT_CONCURRENCY = 4;
+const MAX_CONCURRENCY = 16;
+/**
+ * Runs `worker` over `items` with at most `limit` in flight, preserving input order in the result.
+ *
+ * A pool rather than `Promise.all` in chunks: with fifty targets of uneven size, chunking waits for
+ * the slowest project in each batch before starting the next, which is most of the run.
+ */
+export async function mapPool(items, limit, worker, 
+/** Return true to stop scheduling further items. Those already in flight still finish. */
+stopAfter) {
+    const results = [];
+    let next = 0;
+    let stopped = false;
+    const run = async () => {
+        for (;;) {
+            if (stopped)
+                return;
+            const index = next++;
+            if (index >= items.length)
+                return;
+            // eslint-disable-next-line no-await-in-loop -- one worker handles its items in sequence
+            const value = await worker(items[index], index);
+            results.push({ index, value });
+            if (stopAfter?.(value) === true)
+                stopped = true;
+        }
+    };
+    const width = Math.max(1, Math.min(limit, items.length));
+    await Promise.all(Array.from({ length: width }, () => run()));
+    // Input order, not completion order: a plan that listed fifty projects in a different order on
+    // every run would be unreadable as a diff between runs.
+    return results.sort((a, b) => a.index - b.index).map(({ value }) => value);
+}
+function resolveConcurrency(value) {
+    if (value === undefined)
+        return DEFAULT_CONCURRENCY;
+    if (!Number.isInteger(value) || value < 1 || value > MAX_CONCURRENCY) {
+        throw new ConfigError(`--concurrency must be a whole number between 1 and ${MAX_CONCURRENCY}, got ${value}.`);
+    }
+    return value;
+}
+/**
+ * Resolves the targets and plans every one of them.
+ *
+ * Groups are planned before projects, matching the order `apply` writes them in: a group setting
+ * that projects inherit should be in place before the projects are looked at.
+ */
+export async function planRun(client, config, options = {}) {
+    const concurrency = resolveConcurrency(options.concurrency);
+    const targets = await resolveTargets(client, config, { only: options.only });
+    const stopAfter = options.failFast === true ? (result) => result.error !== undefined : undefined;
+    const groupPlans = await mapPool(targets.groups, concurrency, (target) => planGroup(client, target, effectiveGroup(config, target.path)), stopAfter);
+    // A group that could not be planned under --fail-fast stops the run before any project is read.
+    const projectPlans = options.failFast === true && groupPlans.some((group) => group.error !== undefined)
+        ? []
+        : await mapPool(targets.projects, concurrency, (target) => planProject(client, target, effectiveProject(config, target.path)), stopAfter);
+    return { targets, plan: { targets: [...groupPlans, ...projectPlans] } };
+}
+export function summarise(plan) {
+    let matching = 0;
+    let differing = 0;
+    let failed = 0;
+    let unsupported = 0;
+    for (const target of plan.targets) {
+        if (target.error !== undefined) {
+            failed += 1;
+            continue;
+        }
+        if (target.sections.some((section) => !section.supported))
+            unsupported += 1;
+        if (target.sections.some((section) => section.changes.length > 0))
+            differing += 1;
+        else
+            matching += 1;
+    }
+    return { targets: plan.targets.length, matching, differing, failed, unsupported };
+}
+/** Targets that could not be planned or applied, for reporting before the exit code. */
+export function failures(plan) {
+    return plan.targets.filter((target) => target.error !== undefined);
+}
+//# sourceMappingURL=baseline-run.js.map

package/lib/baseline-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline-run.js","sourceRoot":"","sources":["../src/baseline-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAuB,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAqB,SAAS,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAwB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,eAAe,GAAG,EAAE,CAAC;AAO3B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,KAAmB,EACnB,KAAa,EACb,MAA8C;AAC9C,0FAA0F;AAC1F,SAAkC;IAElC,MAAM,OAAO,GAAuC,EAAE,CAAC;IACvD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,GAAG,GAAG,KAAK,IAAmB,EAAE;QACpC,SAAS,CAAC;YACR,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO;YAClC,wFAAwF;YACxF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/B,IAAI,SAAS,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;QAClD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAE9D,+FAA+F;IAC/F,wDAAwD;IACxD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAyB;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,sDAAsD,eAAe,SAAS,KAAK,GAAG,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAoB,EACpB,MAAsB,EACtB,UAAsB,EAAE;IAExB,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAE7E,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAkB,EAAW,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtH,MAAM,UAAU,GAAG,MAAM,OAAO,CAC9B,OAAO,CAAC,MAAM,EACd,WAAW,EACX,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAC1E,SAAS,CACV,CAAC;IAEF,gGAAgG;IAChG,MAAM,YAAY,GAChB,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;QAChF,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,OAAO,CACX,OAAO,CAAC,QAAQ,EAChB,WAAW,EACX,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAC9E,SAAS,CACV,CAAC;IAER,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,CAAC;AAC1E,CAAC;AAWD,MAAM,UAAU,SAAS,CAAC,IAAkB;IAC1C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,WAAW,IAAI,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,SAAS,IAAI,CAAC,CAAC;;YAC7E,QAAQ,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACpF,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,QAAQ,CAAC,IAAkB;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AACrE,CAAC"}

package/lib/baseline-targets.d.ts

@@ -0,0 +1,31 @@
+import type { BaselineConfig } from './baseline-config.js';
+import type { GitLabClient } from './gitlab-client.js';
+/** One thing a run will act on. */
+export interface ResolvedTarget {
+    readonly kind: 'project' | 'group';
+    /** Full path, as GitLab reports it — what overrides are keyed by, and what output names. */
+    readonly path: string;
+    readonly id: number;
+}
+export interface ResolvedTargets {
+    readonly groups: readonly ResolvedTarget[];
+    readonly projects: readonly ResolvedTarget[];
+    /** Paths removed by an `exclude` pattern, so a run can say what it left out. */
+    readonly excluded: readonly string[];
+}
+/**
+ * Matches an exclude pattern against a path. Only a trailing `*` is supported: it drops a subtree,
+ * which is the case that comes up. A full glob language here would be a second thing to learn for
+ * a file whose whole point is being obvious.
+ */
+export declare function matchesExclude(path: string, pattern: string): boolean;
+/**
+ * Turns the `targets` block into the concrete list a run will act on.
+ *
+ * A target the token cannot see is a hard error rather than a silent omission: a baseline that
+ * quietly skipped six of fifty projects would be worse than one that refused to start, because the
+ * six would stay wrong and nobody would know to look.
+ */
+export declare function resolveTargets(client: GitLabClient, config: BaselineConfig, options?: {
+    readonly only?: readonly string[];
+}): Promise<ResolvedTargets>;

package/lib/baseline-targets.js

@@ -0,0 +1,100 @@
+/*
+ * Copyright (c) 2026, SimplySF.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { ConfigError } from './errors.js';
+/**
+ * Matches an exclude pattern against a path. Only a trailing `*` is supported: it drops a subtree,
+ * which is the case that comes up. A full glob language here would be a second thing to learn for
+ * a file whose whole point is being obvious.
+ */
+export function matchesExclude(path, pattern) {
+    const lowered = path.toLowerCase();
+    const wanted = pattern.trim().toLowerCase();
+    if (wanted.endsWith('*'))
+        return lowered.startsWith(wanted.slice(0, -1));
+    return lowered === wanted;
+}
+function readProject(row) {
+    return typeof row === 'object' && row !== null ? row : {};
+}
+/**
+ * Turns the `targets` block into the concrete list a run will act on.
+ *
+ * A target the token cannot see is a hard error rather than a silent omission: a baseline that
+ * quietly skipped six of fifty projects would be worse than one that refused to start, because the
+ * six would stay wrong and nobody would know to look.
+ */
+export async function resolveTargets(client, config, options = {}) {
+    const targets = config.targets;
+    if (targets === undefined) {
+        throw new ConfigError('The config declares no targets. Add a "targets" block naming groups or projects.');
+    }
+    const groups = [];
+    const byPath = new Map();
+    const excluded = new Set();
+    const exclude = targets.exclude ?? [];
+    const admit = (path, id) => {
+        if (exclude.some((pattern) => matchesExclude(path, pattern))) {
+            excluded.add(path);
+            return;
+        }
+        if (!byPath.has(path))
+            byPath.set(path, { kind: 'project', path, id });
+    };
+    /* Each group is a separate paged read; awaiting in sequence keeps the request rate predictable
+       against an instance that is also serving everyone else. */
+    /* eslint-disable no-await-in-loop */
+    for (const reference of targets.groups ?? []) {
+        const group = (await client.getGroup(reference).catch((error) => {
+            throw new ConfigError(`Target group "${reference}" could not be read: ${error instanceof Error ? error.message : String(error)}`);
+        }));
+        const path = typeof group.full_path === 'string' ? group.full_path : reference;
+        const id = typeof group.id === 'number' ? group.id : 0;
+        groups.push({ kind: 'group', path, id });
+        const listed = await client.listGroupProjects(reference);
+        for (const row of listed.items) {
+            const project = readProject(row);
+            if (typeof project.path_with_namespace === 'string' && typeof project.id === 'number') {
+                admit(project.path_with_namespace, project.id);
+            }
+        }
+        if (!listed.complete) {
+            throw new ConfigError(`Group "${path}" has more projects than one run reads. Narrow it with subgroups or list the projects explicitly.`);
+        }
+    }
+    for (const reference of targets.projects ?? []) {
+        const project = (await client.getProject(reference).catch((error) => {
+            throw new ConfigError(`Target project "${reference}" could not be read: ${error instanceof Error ? error.message : String(error)}`);
+        }));
+        const path = typeof project.path_with_namespace === 'string' ? project.path_with_namespace : reference;
+        const id = typeof project.id === 'number' ? project.id : 0;
+        admit(path, id);
+    }
+    /* eslint-enable no-await-in-loop */
+    let projects = [...byPath.values()].sort((a, b) => a.path.localeCompare(b.path));
+    // `--target` narrows a run without editing the file, for the loop of fixing one project and
+    // re-checking it. Naming something the config does not target is a mistake worth reporting.
+    if (options.only !== undefined && options.only.length > 0) {
+        const wanted = new Set(options.only.map((path) => path.toLowerCase()));
+        const matched = projects.filter((target) => wanted.has(target.path.toLowerCase()));
+        const missing = [...wanted].filter((path) => !projects.some((target) => target.path.toLowerCase() === path));
+        if (missing.length > 0) {
+            throw new ConfigError(`--target named ${missing.join(', ')}, which this config does not target.`);
+        }
+        projects = matched;
+    }
+    return { groups, projects, excluded: [...excluded].sort() };
+}
+//# sourceMappingURL=baseline-targets.js.map

package/lib/baseline-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline-targets.js","sourceRoot":"","sources":["../src/baseline-targets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B1C;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAe;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,OAAO,KAAK,MAAM,CAAC;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAoB,EACpB,MAAsB,EACtB,UAAiD,EAAE;IAEnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,WAAW,CAAC,kFAAkF,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IAEtC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAU,EAAQ,EAAE;QAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC;IAEF;iEAC6D;IAC7D,qCAAqC;IACrC,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACvE,MAAM,IAAI,WAAW,CACnB,iBAAiB,SAAS,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3G,CAAC;QACJ,CAAC,CAAC,CAAa,CAAC;QAEhB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,OAAO,OAAO,CAAC,mBAAmB,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtF,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CACnB,UAAU,IAAI,mGAAmG,CAClH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC3E,MAAM,IAAI,WAAW,CACnB,mBAAmB,SAAS,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7G,CAAC;QACJ,CAAC,CAAC,CAAe,CAAC;QAClB,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,EAAE,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,oCAAoC;IAEpC,IAAI,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjF,4FAA4F;IAC5F,4FAA4F;IAC5F,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACpG,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC;IACrB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC9D,CAAC"}

package/lib/gitlab-client.d.ts

@@ -120,6 +120,38 @@ export declare class GitLabClient {
     listVariables(project: ProjectRef, limit?: number): Promise<ListResult>;
     listEnvironments(project: ProjectRef, options?: ListEnvironmentsOptions, limit?: number): Promise<ListResult>;
     listReleases(project: ProjectRef, limit?: number): Promise<ListResult>;
+    /**
+     * Partially updates a project. Only the attributes sent are changed — GitLab does not document
+     * that outright, and `test/gitlab-client.test.ts` pins it, because a full-replace PUT would make
+     * every baseline apply destructive.
+     */
+    updateProject(project: ProjectRef, body: Record<string, unknown>): Promise<unknown>;
+    getGroup(group: ProjectRef): Promise<unknown>;
+    updateGroup(group: ProjectRef, body: Record<string, unknown>): Promise<unknown>;
+    /** Every project in a group, subgroups included — how a baseline names fifty projects at once. */
+    listGroupProjects(group: ProjectRef, limit?: number): Promise<ListResult>;
+    listProtectedBranches(project: ProjectRef, limit?: number): Promise<ListResult>;
+    protectBranch(project: ProjectRef, body: Record<string, unknown>): Promise<unknown>;
+    /**
+     * Changes an existing branch protection in place. This is what keeps a baseline apply safe: the
+     * alternative is DELETE followed by POST, which leaves the branch unprotected in between.
+     */
+    patchProtectedBranch(project: ProjectRef, name: string, body: Record<string, unknown>): Promise<unknown>;
+    unprotectBranch(project: ProjectRef, name: string): Promise<unknown>;
+    listProtectedTags(project: ProjectRef, limit?: number): Promise<ListResult>;
+    protectTag(project: ProjectRef, body: Record<string, unknown>): Promise<unknown>;
+    unprotectTag(project: ProjectRef, name: string): Promise<unknown>;
+    getApprovalSettings(project: ProjectRef): Promise<unknown>;
+    /** Approval settings are updated with POST rather than PUT. That is GitLab's shape, not a slip. */
+    updateApprovalSettings(project: ProjectRef, body: Record<string, unknown>): Promise<unknown>;
+    listApprovalRules(project: ProjectRef, limit?: number): Promise<ListResult>;
+    createApprovalRule(project: ProjectRef, body: Record<string, unknown>): Promise<unknown>;
+    updateApprovalRule(project: ProjectRef, ruleId: number, body: Record<string, unknown>): Promise<unknown>;
+    deleteApprovalRule(project: ProjectRef, ruleId: number): Promise<unknown>;
+    getPushRules(project: ProjectRef): Promise<unknown>;
+    /** POST creates the project push rule set; PUT edits it once one exists. */
+    createPushRules(project: ProjectRef, body: Record<string, unknown>): Promise<unknown>;
+    updatePushRules(project: ProjectRef, body: Record<string, unknown>): Promise<unknown>;
     /**
      * Global, group, or project search. GitLab exposes these as three separate endpoints rather
      * than one endpoint with a filter, and the scopes each accepts differ, so the caller's choice

package/lib/gitlab-client.js

@@ -170,6 +170,102 @@ export class GitLabClient {
     async listReleases(project, limit = 20) {
         return this.collect(`/projects/${segment(project)}/releases`, {}, limit);
     }
+    // --- Configuration: project and group settings ---
+    /**
+     * Partially updates a project. Only the attributes sent are changed — GitLab does not document
+     * that outright, and `test/gitlab-client.test.ts` pins it, because a full-replace PUT would make
+     * every baseline apply destructive.
+     */
+    async updateProject(project, body) {
+        return this.request(`/projects/${segment(project)}`, { method: 'PUT', body, mutating: true });
+    }
+    async getGroup(group) {
+        return this.request(`/groups/${segment(group)}`, { method: 'GET' });
+    }
+    async updateGroup(group, body) {
+        return this.request(`/groups/${segment(group)}`, { method: 'PUT', body, mutating: true });
+    }
+    /** Every project in a group, subgroups included — how a baseline names fifty projects at once. */
+    async listGroupProjects(group, limit = 500) {
+        return this.collect(`/groups/${segment(group)}/projects`, { include_subgroups: true, archived: false, with_shared: false, simple: true }, limit);
+    }
+    // --- Configuration: protected branches and tags ---
+    async listProtectedBranches(project, limit = 100) {
+        return this.collect(`/projects/${segment(project)}/protected_branches`, {}, limit);
+    }
+    async protectBranch(project, body) {
+        return this.request(`/projects/${segment(project)}/protected_branches`, {
+            method: 'POST',
+            body,
+            mutating: true,
+        });
+    }
+    /**
+     * Changes an existing branch protection in place. This is what keeps a baseline apply safe: the
+     * alternative is DELETE followed by POST, which leaves the branch unprotected in between.
+     */
+    async patchProtectedBranch(project, name, body) {
+        return this.request(`/projects/${segment(project)}/protected_branches/${segment(name)}`, {
+            method: 'PATCH',
+            body,
+            mutating: true,
+        });
+    }
+    async unprotectBranch(project, name) {
+        return this.request(`/projects/${segment(project)}/protected_branches/${segment(name)}`, {
+            method: 'DELETE',
+            mutating: true,
+        });
+    }
+    async listProtectedTags(project, limit = 100) {
+        return this.collect(`/projects/${segment(project)}/protected_tags`, {}, limit);
+    }
+    async protectTag(project, body) {
+        return this.request(`/projects/${segment(project)}/protected_tags`, { method: 'POST', body, mutating: true });
+    }
+    async unprotectTag(project, name) {
+        return this.request(`/projects/${segment(project)}/protected_tags/${segment(name)}`, {
+            method: 'DELETE',
+            mutating: true,
+        });
+    }
+    // --- Configuration: approvals and push rules (Premium/Ultimate) ---
+    async getApprovalSettings(project) {
+        return this.request(`/projects/${segment(project)}/approvals`, { method: 'GET' });
+    }
+    /** Approval settings are updated with POST rather than PUT. That is GitLab's shape, not a slip. */
+    async updateApprovalSettings(project, body) {
+        return this.request(`/projects/${segment(project)}/approvals`, { method: 'POST', body, mutating: true });
+    }
+    async listApprovalRules(project, limit = 100) {
+        return this.collect(`/projects/${segment(project)}/approval_rules`, {}, limit);
+    }
+    async createApprovalRule(project, body) {
+        return this.request(`/projects/${segment(project)}/approval_rules`, { method: 'POST', body, mutating: true });
+    }
+    async updateApprovalRule(project, ruleId, body) {
+        return this.request(`/projects/${segment(project)}/approval_rules/${ruleId}`, {
+            method: 'PUT',
+            body,
+            mutating: true,
+        });
+    }
+    async deleteApprovalRule(project, ruleId) {
+        return this.request(`/projects/${segment(project)}/approval_rules/${ruleId}`, {
+            method: 'DELETE',
+            mutating: true,
+        });
+    }
+    async getPushRules(project) {
+        return this.request(`/projects/${segment(project)}/push_rule`, { method: 'GET' });
+    }
+    /** POST creates the project push rule set; PUT edits it once one exists. */
+    async createPushRules(project, body) {
+        return this.request(`/projects/${segment(project)}/push_rule`, { method: 'POST', body, mutating: true });
+    }
+    async updatePushRules(project, body) {
+        return this.request(`/projects/${segment(project)}/push_rule`, { method: 'PUT', body, mutating: true });
+    }
     // --- Search ---
     /**
      * Global, group, or project search. GitLab exposes these as three separate endpoints rather