@simplysf/simply-gitlab 0.2.0 → 0.3.0

package/README.md

@@ -118,6 +118,9 @@ exitCode, status?, body?}}` — and nothing to stdout. Exit codes are identical
 - [`simply gitlab commit diff`](#simply-gitlab-commit-diff)
 - [`simply gitlab commit list`](#simply-gitlab-commit-list)
 - [`simply gitlab commit view`](#simply-gitlab-commit-view)
+- [`simply gitlab config apply`](#simply-gitlab-config-apply)
+- [`simply gitlab config export`](#simply-gitlab-config-export)
+- [`simply gitlab config plan`](#simply-gitlab-config-plan)
 - [`simply gitlab file create`](#simply-gitlab-file-create)
 - [`simply gitlab file update`](#simply-gitlab-file-update)
 - [`simply gitlab file view`](#simply-gitlab-file-view)
@@ -172,7 +175,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/branch/create.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/branch/create.js)_
+_See code: [lib/commands/gitlab/branch/create.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/branch/create.js)_
 
 ## `simply gitlab branch list`
 
@@ -215,7 +218,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/branch/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/branch/list.js)_
+_See code: [lib/commands/gitlab/branch/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/branch/list.js)_
 
 ## `simply gitlab ci environment list`
 
@@ -261,7 +264,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/ci/environment/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/ci/environment/list.js)_
+_See code: [lib/commands/gitlab/ci/environment/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/ci/environment/list.js)_
 
 ## `simply gitlab ci job list`
 
@@ -305,7 +308,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/ci/job/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/ci/job/list.js)_
+_See code: [lib/commands/gitlab/ci/job/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/ci/job/list.js)_
 
 ## `simply gitlab ci job log`
 
@@ -350,7 +353,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/ci/job/log.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/ci/job/log.js)_
+_See code: [lib/commands/gitlab/ci/job/log.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/ci/job/log.js)_
 
 ## `simply gitlab ci variable list`
 
@@ -401,7 +404,7 @@ FLAG DESCRIPTIONS
     where this output is going.
 ```
 
-_See code: [lib/commands/gitlab/ci/variable/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/ci/variable/list.js)_
+_See code: [lib/commands/gitlab/ci/variable/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/ci/variable/list.js)_
 
 ## `simply gitlab commit create`
 
@@ -461,7 +464,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/commit/create.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/commit/create.js)_
+_See code: [lib/commands/gitlab/commit/create.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/commit/create.js)_
 
 ## `simply gitlab commit diff`
 
@@ -503,7 +506,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/commit/diff.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/commit/diff.js)_
+_See code: [lib/commands/gitlab/commit/diff.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/commit/diff.js)_
 
 ## `simply gitlab commit list`
 
@@ -554,7 +557,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/commit/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/commit/list.js)_
+_See code: [lib/commands/gitlab/commit/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/commit/list.js)_
 
 ## `simply gitlab commit view`
 
@@ -595,7 +598,193 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/commit/view.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/commit/view.js)_
+_See code: [lib/commands/gitlab/commit/view.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/commit/view.js)_
+
+## `simply gitlab config apply`
+
+Bring projects onto a baseline config.
+
+```
+USAGE
+  $ simply gitlab config apply -c <value> [--json] [-e <value>] [--gitlab-url <value>] [--gitlab-token <value>] [--target
+    <value>...] [--concurrency <value>] [--fail-fast] [--dry-run]
+
+FLAGS
+  -c, --config=<value>       (required) Path to the baseline configuration file.
+      --concurrency=<value>  [default: 4] How many targets to work on at once.
+      --dry-run              Print the request that would be sent and exit without sending it.
+      --fail-fast            Stop at the first target that fails instead of continuing.
+      --target=<value>...    Limit the run to this project path. Repeatable.
+
+CONNECTION FLAGS
+  -e, --env-file=<value>      Path to a .env file holding connection settings.
+      --gitlab-token=<value>  [env: GITLAB_TOKEN] Personal, project, or group access token.
+      --gitlab-url=<value>    [env: GITLAB_URL] Base URL of the GitLab instance. Defaults to https://gitlab.com.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Bring projects onto a baseline config.
+
+  Computes the same plan as config plan, then executes it. Only what the plan showed is sent, so a preview is a
+  guarantee rather than an approximation, and a second run against a converged project sends no requests at all.
+
+  Sections are applied in a fixed order — settings, protected branches, protected tags, approval settings, approval
+  rules, push rules — because an approval rule scoped to a branch needs that branch protected before it can reference
+  it.
+
+  By default the config only adds and corrects what it declares. A section that sets "prune": true also deletes entries
+  the config does not mention.
+
+  One target failing does not abandon the rest; the summary says which ones failed and where they stopped. There is no
+  transaction across GitLab endpoints, so a target that failed part-way keeps the sections already applied — run config
+  plan afterwards to see what is left.
+
+EXAMPLES
+  $ simply gitlab config apply --config ./baseline.json --dry-run
+
+  $ simply gitlab config apply --config ./baseline.json
+
+  $ simply gitlab config apply --config ./baseline.json --target group/project
+
+FLAG DESCRIPTIONS
+  -e, --env-file=<value>  Path to a .env file holding connection settings.
+
+    Loaded before anything else. Variables already present in the environment win, so the file never overrides an
+    explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
+
+  --concurrency=<value>  How many targets to work on at once.
+
+    Small by default. The client already retries a rate-limited request with a capped Retry-After, so raising this
+    trades a shared instance responsiveness for very little wall-clock time.
+
+  --target=<value>...  Limit the run to this project path. Repeatable.
+
+    Narrows a run without editing the config, for the loop of fixing one project and checking it again. Naming a project
+    the config does not target is an error rather than a silent no-op.
+```
+
+_See code: [lib/commands/gitlab/config/apply.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/config/apply.js)_
+
+## `simply gitlab config export`
+
+Write a baseline config describing an existing project.
+
+```
+USAGE
+  $ simply gitlab config export -p <value> [--json] [-e <value>] [--gitlab-url <value>] [--gitlab-token <value>]
+    [--section settings|protectedBranches|protectedTags|approvals|approvalRules|pushRules|variables...]
+
+FLAGS
+  -p, --project=<value>      (required) [env: GITLAB_PROJECT] Project id, or its full path such as
+                             group/subgroup/project.
+      --section=<option>...  Comma-separated sections to export. Defaults to all of them.
+                             <options:
+                             settings|protectedBranches|protectedTags|approvals|approvalRules|pushRules|variables>
+
+CONNECTION FLAGS
+  -e, --env-file=<value>      Path to a .env file holding connection settings.
+      --gitlab-token=<value>  [env: GITLAB_TOKEN] Personal, project, or group access token.
+      --gitlab-url=<value>    [env: GITLAB_URL] Base URL of the GitLab instance. Defaults to https://gitlab.com.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Write a baseline config describing an existing project.
+
+  Reads one project and prints a configuration file that describes it, ready to be edited and pointed at the rest of
+  your projects. Writing a baseline by hand against forty attributes is miserable and the first draft is wrong;
+  exporting the project that already looks right and deleting what you do not care about is the way to start.
+
+  The output is deliberately verbose — every supported key, not a curated subset — because deleting a line is easier
+  than discovering that a key exists. Variables are exported as metadata only: keys, scopes, and flags, never values.
+
+  The exported targets name only the project it came from. Widen that on purpose rather than inheriting a blast radius
+  from an export.
+
+EXAMPLES
+  $ simply gitlab config export --project group/project > baseline.json
+
+  $ simply gitlab config export --project group/project --section settings,protectedBranches
+
+FLAG DESCRIPTIONS
+  -e, --env-file=<value>  Path to a .env file holding connection settings.
+
+    Loaded before anything else. Variables already present in the environment win, so the file never overrides an
+    explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
+```
+
+_See code: [lib/commands/gitlab/config/export.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/config/export.js)_
+
+## `simply gitlab config plan`
+
+Report how projects differ from a baseline config.
+
+```
+USAGE
+  $ simply gitlab config plan -c <value> [--json] [-e <value>] [--gitlab-url <value>] [--gitlab-token <value>] [--target
+    <value>...] [--concurrency <value>] [--fail-fast] [--fail-on-drift]
+
+FLAGS
+  -c, --config=<value>       (required) Path to the baseline configuration file.
+      --concurrency=<value>  [default: 4] How many targets to work on at once.
+      --fail-fast            Stop at the first target that fails instead of continuing.
+      --fail-on-drift        Exit 1 when any target differs from the baseline.
+      --target=<value>...    Limit the run to this project path. Repeatable.
+
+CONNECTION FLAGS
+  -e, --env-file=<value>      Path to a .env file holding connection settings.
+      --gitlab-token=<value>  [env: GITLAB_TOKEN] Personal, project, or group access token.
+      --gitlab-url=<value>    [env: GITLAB_URL] Base URL of the GitLab instance. Defaults to https://gitlab.com.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Report how projects differ from a baseline config.
+
+  Reads the baseline, expands its targets, and prints what differs on each one. Nothing is sent that changes anything,
+  so this is safe to run against every project you have.
+
+  Only the attributes the config declares are compared. A project with forty settings the config never mentions shows
+  nothing for them — that is what makes a baseline safe to point at projects that already exist.
+
+  Entries that exist on the instance but are not in the config are shown as removals, marked as not pruned unless that
+  section opts into pruning. Seeing what you are choosing not to fix is most of the value of running this across fifty
+  projects.
+
+  Use --fail-on-drift in a scheduled job: it exits 1 when anything differs, so CI can tell you that something drifted
+  without anyone having to read the output.
+
+EXAMPLES
+  $ simply gitlab config plan --config ./baseline.json
+
+  $ simply gitlab config plan --config ./baseline.json --target group/project
+
+  $ simply gitlab config plan --config ./baseline.json --fail-on-drift
+
+  $ simply gitlab config plan --config ./baseline.json --json | jq .summary
+
+FLAG DESCRIPTIONS
+  -e, --env-file=<value>  Path to a .env file holding connection settings.
+
+    Loaded before anything else. Variables already present in the environment win, so the file never overrides an
+    explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
+
+  --concurrency=<value>  How many targets to work on at once.
+
+    Small by default. The client already retries a rate-limited request with a capped Retry-After, so raising this
+    trades a shared instance responsiveness for very little wall-clock time.
+
+  --target=<value>...  Limit the run to this project path. Repeatable.
+
+    Narrows a run without editing the config, for the loop of fixing one project and checking it again. Naming a project
+    the config does not target is an error rather than a silent no-op.
+```
+
+_See code: [lib/commands/gitlab/config/plan.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/config/plan.js)_
 
 ## `simply gitlab file create`
 
@@ -647,7 +836,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/file/create.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/file/create.js)_
+_See code: [lib/commands/gitlab/file/create.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/file/create.js)_
 
 ## `simply gitlab file update`
 
@@ -700,7 +889,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/file/update.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/file/update.js)_
+_See code: [lib/commands/gitlab/file/update.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/file/update.js)_
 
 ## `simply gitlab file view`
 
@@ -746,7 +935,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/file/view.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/file/view.js)_
+_See code: [lib/commands/gitlab/file/view.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/file/view.js)_
 
 ## `simply gitlab mr create`
 
@@ -807,7 +996,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/mr/create.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/mr/create.js)_
+_See code: [lib/commands/gitlab/mr/create.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/mr/create.js)_
 
 ## `simply gitlab mr list`
 
@@ -861,7 +1050,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/mr/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/mr/list.js)_
+_See code: [lib/commands/gitlab/mr/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/mr/list.js)_
 
 ## `simply gitlab mr update`
 
@@ -925,7 +1114,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/mr/update.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/mr/update.js)_
+_See code: [lib/commands/gitlab/mr/update.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/mr/update.js)_
 
 ## `simply gitlab mr view`
 
@@ -966,7 +1155,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/mr/view.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/mr/view.js)_
+_See code: [lib/commands/gitlab/mr/view.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/mr/view.js)_
 
 ## `simply gitlab project list`
 
@@ -1013,7 +1202,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/project/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/project/list.js)_
+_See code: [lib/commands/gitlab/project/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/project/list.js)_
 
 ## `simply gitlab project view`
 
@@ -1052,7 +1241,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/project/view.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/project/view.js)_
+_See code: [lib/commands/gitlab/project/view.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/project/view.js)_
 
 ## `simply gitlab release list`
 
@@ -1093,7 +1282,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/release/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/release/list.js)_
+_See code: [lib/commands/gitlab/release/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/release/list.js)_
 
 ## `simply gitlab search`
 
@@ -1148,7 +1337,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/search.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/search.js)_
+_See code: [lib/commands/gitlab/search.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/search.js)_
 
 ## `simply gitlab tag list`
 
@@ -1195,7 +1384,7 @@ FLAG DESCRIPTIONS
     explicit export, and only GitLab connection variables are read from it. A path that cannot be read is an error.
 ```
 
-_See code: [lib/commands/gitlab/tag/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.1.0/packages/simply-gitlab/lib/commands/gitlab/tag/list.js)_
+_See code: [lib/commands/gitlab/tag/list.js](https://github.com/SimplySF/simply-gitlab/blob/@simplysf/simply-gitlab@0.2.0/packages/simply-gitlab/lib/commands/gitlab/tag/list.js)_
 <!-- commandsstop -->
 
 ## License

package/lib/commands/gitlab/config/apply.d.ts

@@ -0,0 +1,15 @@
+import { GitLabCommand } from '../../../shared/base-command.js';
+export default class GitlabConfigApply extends GitLabCommand<typeof GitlabConfigApply> {
+    static isWrite: boolean;
+    static readonly summary = "Bring projects onto a baseline config.";
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        target: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        concurrency: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        'fail-fast': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}

package/lib/commands/gitlab/config/apply.js

@@ -0,0 +1,78 @@
+/*
+ * Copyright (c) 2026, SimplySF.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { applyFailures, applyPlan, CliError, hasChanges, loadBaselineConfig, planRun, planToJson, renderApply, renderPlan, } from '@simplysf/simply-gitlab-core';
+import { GitLabCommand, writeFlags } from '../../../shared/base-command.js';
+import { baselineFlags } from '../../../shared/baseline-flags.js';
+export default class GitlabConfigApply extends GitLabCommand {
+    static isWrite = true;
+    static summary = 'Bring projects onto a baseline config.';
+    static description = 'Computes the same plan as config plan, then executes it. Only what the plan showed is sent, ' +
+        'so a preview is a guarantee rather than an approximation, and a second run against a ' +
+        'converged project sends no requests at all.\n\n' +
+        'Sections are applied in a fixed order — settings, protected branches, protected tags, ' +
+        'approval settings, approval rules, push rules — because an approval rule scoped to a branch ' +
+        'needs that branch protected before it can reference it.\n\n' +
+        'By default the config only adds and corrects what it declares. A section that sets ' +
+        '"prune": true also deletes entries the config does not mention.\n\n' +
+        'One target failing does not abandon the rest; the summary says which ones failed and where ' +
+        'they stopped. There is no transaction across GitLab endpoints, so a target that failed ' +
+        'part-way keeps the sections already applied — run config plan afterwards to see what is left.';
+    static examples = [
+        '<%= config.bin %> <%= command.id %> --config ./baseline.json --dry-run',
+        '<%= config.bin %> <%= command.id %> --config ./baseline.json',
+        '<%= config.bin %> <%= command.id %> --config ./baseline.json --target group/project',
+    ];
+    static flags = {
+        ...baselineFlags,
+        ...writeFlags,
+    };
+    async run() {
+        const config = loadBaselineConfig(this.flags.config);
+        const options = {
+            concurrency: this.flags.concurrency,
+            failFast: this.flags['fail-fast'],
+            only: this.flags.target,
+        };
+        const { targets, plan } = await planRun(this.gitlab(), config, options);
+        if (!this.jsonEnabled()) {
+            this.log(`Targets: ${targets.projects.length} project(s), ${targets.groups.length} group(s).`);
+            if (targets.excluded.length > 0)
+                this.logSafe(`Excluded: ${targets.excluded.join(', ')}`);
+            this.log('');
+            this.logSafe(renderPlan(plan));
+            this.log('');
+        }
+        if (this.flags['dry-run']) {
+            if (!this.jsonEnabled())
+                this.log('Dry run — nothing sent.');
+            return planToJson(plan);
+        }
+        if (!hasChanges(plan)) {
+            if (!this.jsonEnabled())
+                this.log('Nothing to apply.');
+            return { ...planToJson(plan), applied: [] };
+        }
+        const result = await applyPlan(this.gitlab(), plan, options);
+        if (!this.jsonEnabled())
+            this.logSafe(renderApply(result));
+        const failed = applyFailures(result);
+        if (failed.length > 0) {
+            throw new CliError(`${failed.length} of ${result.targets.length} target(s) failed. See the output above.`);
+        }
+        return { ...planToJson(plan), applied: result.targets };
+    }
+}
+//# sourceMappingURL=apply.js.map

package/lib/commands/gitlab/config/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../../src/commands/gitlab/config/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,aAAa,EACb,SAAS,EACT,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,WAAW,EACX,UAAU,GACX,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,aAAuC;IAC7E,MAAM,CAAU,OAAO,GAAG,IAAI,CAAC;IAE/B,MAAM,CAAmB,OAAO,GAAG,wCAAwC,CAAC;IAC5E,MAAM,CAAmB,WAAW,GACzC,8FAA8F;QAC9F,uFAAuF;QACvF,iDAAiD;QACjD,wFAAwF;QACxF,8FAA8F;QAC9F,6DAA6D;QAC7D,qFAAqF;QACrF,qEAAqE;QACrE,6FAA6F;QAC7F,yFAAyF;QACzF,+FAA+F,CAAC;IAE3F,MAAM,CAAmB,QAAQ,GAAG;QACzC,wEAAwE;QACxE,8DAA8D;QAC9D,qFAAqF;KACtF,CAAC;IAEK,MAAM,CAAmB,KAAK,GAAG;QACtC,GAAG,aAAa;QAChB,GAAG,UAAU;KACd,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG;YACd,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW;YACnC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACjC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;SACxB,CAAC;QAEF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAExE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,QAAQ,CAAC,MAAM,gBAAgB,OAAO,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,CAAC;YAC/F,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,aAAa,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YAC7D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACvD,OAAO,EAAE,GAAI,UAAU,CAAC,IAAI,CAAY,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,QAAQ,CAAC,GAAG,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,0CAA0C,CAAC,CAAC;QAC7G,CAAC;QAED,OAAO,EAAE,GAAI,UAAU,CAAC,IAAI,CAAY,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC"}

package/lib/commands/gitlab/config/export.d.ts

@@ -0,0 +1,11 @@
+import { GitLabCommand } from '../../../shared/base-command.js';
+export default class GitlabConfigExport extends GitLabCommand<typeof GitlabConfigExport> {
+    static readonly summary = "Write a baseline config describing an existing project.";
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        section: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        project: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/lib/commands/gitlab/config/export.js

@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2026, SimplySF.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Flags } from '@oclif/core';
+import { EXPORTABLE_SECTIONS, exportConfig } from '@simplysf/simply-gitlab-core';
+import { GitLabCommand, projectFlag } from '../../../shared/base-command.js';
+export default class GitlabConfigExport extends GitLabCommand {
+    static summary = 'Write a baseline config describing an existing project.';
+    static description = 'Reads one project and prints a configuration file that describes it, ready to be edited and ' +
+        'pointed at the rest of your projects. Writing a baseline by hand against forty attributes is ' +
+        'miserable and the first draft is wrong; exporting the project that already looks right and ' +
+        'deleting what you do not care about is the way to start.\n\n' +
+        'The output is deliberately verbose — every supported key, not a curated subset — because ' +
+        'deleting a line is easier than discovering that a key exists. Variables are exported as ' +
+        'metadata only: keys, scopes, and flags, never values.\n\n' +
+        'The exported targets name only the project it came from. Widen that on purpose rather than ' +
+        'inheriting a blast radius from an export.';
+    static examples = [
+        '<%= config.bin %> <%= command.id %> --project group/project > baseline.json',
+        '<%= config.bin %> <%= command.id %> --project group/project --section settings,protectedBranches',
+    ];
+    static flags = {
+        ...projectFlag,
+        section: Flags.string({
+            summary: 'Comma-separated sections to export. Defaults to all of them.',
+            options: [...EXPORTABLE_SECTIONS],
+            multiple: true,
+            delimiter: ',',
+            multipleNonGreedy: true,
+        }),
+    };
+    async run() {
+        const sections = this.flags.section;
+        const config = await exportConfig(this.gitlab(), this.flags.project, {
+            sections: sections === undefined || sections.length === 0 ? undefined : sections,
+        });
+        // Straight to stdout, formatted, because the point of this command is to be redirected to a
+        // file. Under --json oclif prints the same object itself.
+        if (!this.jsonEnabled())
+            this.logSafe(JSON.stringify(config, null, 2));
+        return config;
+    }
+}
+//# sourceMappingURL=export.js.map

package/lib/commands/gitlab/config/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../../src/commands/gitlab/config/export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAA0B,MAAM,8BAA8B,CAAC;AACzG,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE7E,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,aAAwC;IAC/E,MAAM,CAAmB,OAAO,GAAG,yDAAyD,CAAC;IAC7F,MAAM,CAAmB,WAAW,GACzC,8FAA8F;QAC9F,+FAA+F;QAC/F,6FAA6F;QAC7F,8DAA8D;QAC9D,2FAA2F;QAC3F,0FAA0F;QAC1F,2DAA2D;QAC3D,6FAA6F;QAC7F,2CAA2C,CAAC;IAEvC,MAAM,CAAmB,QAAQ,GAAG;QACzC,6EAA6E;QAC7E,kGAAkG;KACnG,CAAC;IAEK,MAAM,CAAmB,KAAK,GAAG;QACtC,GAAG,WAAW;QACd,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;YACpB,OAAO,EAAE,8DAA8D;YACvE,OAAO,EAAE,CAAC,GAAG,mBAAmB,CAAC;YACjC,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,GAAG;YACd,iBAAiB,EAAE,IAAI;SACxB,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAA0C,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YACnE,QAAQ,EAAE,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;SACjF,CAAC,CAAC;QAEH,4FAA4F;QAC5F,0DAA0D;QAC1D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC;IAChB,CAAC"}

package/lib/commands/gitlab/config/plan.d.ts

@@ -0,0 +1,14 @@
+import { GitLabCommand } from '../../../shared/base-command.js';
+export default class GitlabConfigPlan extends GitLabCommand<typeof GitlabConfigPlan> {
+    static readonly summary = "Report how projects differ from a baseline config.";
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        'fail-on-drift': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        target: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        concurrency: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        'fail-fast': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}

package/lib/commands/gitlab/config/plan.js

@@ -0,0 +1,69 @@
+/*
+ * Copyright (c) 2026, SimplySF.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Flags } from '@oclif/core';
+import { CliError, hasDrift, loadBaselineConfig, planRun, planToJson, renderPlan } from '@simplysf/simply-gitlab-core';
+import { GitLabCommand } from '../../../shared/base-command.js';
+import { baselineFlags } from '../../../shared/baseline-flags.js';
+export default class GitlabConfigPlan extends GitLabCommand {
+    static summary = 'Report how projects differ from a baseline config.';
+    static description = 'Reads the baseline, expands its targets, and prints what differs on each one. Nothing is ' +
+        'sent that changes anything, so this is safe to run against every project you have.\n\n' +
+        'Only the attributes the config declares are compared. A project with forty settings the ' +
+        'config never mentions shows nothing for them — that is what makes a baseline safe to point ' +
+        'at projects that already exist.\n\n' +
+        'Entries that exist on the instance but are not in the config are shown as removals, marked ' +
+        'as not pruned unless that section opts into pruning. Seeing what you are choosing not to fix ' +
+        'is most of the value of running this across fifty projects.\n\n' +
+        'Use --fail-on-drift in a scheduled job: it exits 1 when anything differs, so CI can tell you ' +
+        'that something drifted without anyone having to read the output.';
+    static examples = [
+        '<%= config.bin %> <%= command.id %> --config ./baseline.json',
+        '<%= config.bin %> <%= command.id %> --config ./baseline.json --target group/project',
+        '<%= config.bin %> <%= command.id %> --config ./baseline.json --fail-on-drift',
+        '<%= config.bin %> <%= command.id %> --config ./baseline.json --json | jq .summary',
+    ];
+    static flags = {
+        ...baselineFlags,
+        'fail-on-drift': Flags.boolean({
+            summary: 'Exit 1 when any target differs from the baseline.',
+            default: false,
+        }),
+    };
+    async run() {
+        const config = loadBaselineConfig(this.flags.config);
+        const { targets, plan } = await planRun(this.gitlab(), config, {
+            concurrency: this.flags.concurrency,
+            failFast: this.flags['fail-fast'],
+            only: this.flags.target,
+        });
+        if (!this.jsonEnabled()) {
+            // What a run is about to touch is the first question anyone should ask and the last one
+            // they should have to guess at.
+            this.log(`Targets: ${targets.projects.length} project(s), ${targets.groups.length} group(s).`);
+            if (targets.excluded.length > 0)
+                this.logSafe(`Excluded: ${targets.excluded.join(', ')}`);
+            this.log('');
+            this.logSafe(renderPlan(plan));
+        }
+        const drifted = hasDrift(plan);
+        if (this.flags['fail-on-drift'] && drifted) {
+            // Deliberately after the output: the point of the flag is to fail a job, not to hide why.
+            throw new CliError('The baseline does not match. Run without --fail-on-drift to see the plan.');
+        }
+        return planToJson(plan);
+    }
+}
+//# sourceMappingURL=plan.js.map

package/lib/commands/gitlab/config/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../../../src/commands/gitlab/config/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,aAAsC;IAC3E,MAAM,CAAmB,OAAO,GAAG,oDAAoD,CAAC;IACxF,MAAM,CAAmB,WAAW,GACzC,2FAA2F;QAC3F,wFAAwF;QACxF,0FAA0F;QAC1F,6FAA6F;QAC7F,qCAAqC;QACrC,6FAA6F;QAC7F,+FAA+F;QAC/F,iEAAiE;QACjE,+FAA+F;QAC/F,kEAAkE,CAAC;IAE9D,MAAM,CAAmB,QAAQ,GAAG;QACzC,8DAA8D;QAC9D,qFAAqF;QACrF,8EAA8E;QAC9E,mFAAmF;KACpF,CAAC;IAEK,MAAM,CAAmB,KAAK,GAAG;QACtC,GAAG,aAAa;QAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC;YAC7B,OAAO,EAAE,mDAAmD;YAC5D,OAAO,EAAE,KAAK;SACf,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW;YACnC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACjC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,wFAAwF;YACxF,gCAAgC;YAChC,IAAI,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,QAAQ,CAAC,MAAM,gBAAgB,OAAO,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,CAAC;YAC/F,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,aAAa,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,OAAO,EAAE,CAAC;YAC3C,0FAA0F;YAC1F,MAAM,IAAI,QAAQ,CAAC,2EAA2E,CAAC,CAAC;QAClG,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC"}

package/lib/shared/baseline-flags.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The flags `config plan` and `config apply` share, defined once so the two cannot disagree about
+ * what a run means. Both commands read the same file and resolve the same targets; only what they
+ * do afterwards differs.
+ */
+export declare const baselineFlags: {
+    config: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+    target: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    concurrency: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+    'fail-fast': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+};

package/lib/shared/baseline-flags.js

@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2026, SimplySF.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Flags } from '@oclif/core';
+import { DEFAULT_CONCURRENCY } from '@simplysf/simply-gitlab-core';
+/**
+ * The flags `config plan` and `config apply` share, defined once so the two cannot disagree about
+ * what a run means. Both commands read the same file and resolve the same targets; only what they
+ * do afterwards differs.
+ */
+export const baselineFlags = {
+    config: Flags.string({
+        char: 'c',
+        summary: 'Path to the baseline configuration file.',
+        required: true,
+    }),
+    target: Flags.string({
+        summary: 'Limit the run to this project path. Repeatable.',
+        description: 'Narrows a run without editing the config, for the loop of fixing one project and checking ' +
+            'it again. Naming a project the config does not target is an error rather than a silent ' +
+            'no-op.',
+        multiple: true,
+    }),
+    concurrency: Flags.integer({
+        summary: 'How many targets to work on at once.',
+        description: 'Small by default. The client already retries a rate-limited request with a capped ' +
+            'Retry-After, so raising this trades a shared instance responsiveness for very little ' +
+            'wall-clock time.',
+        default: DEFAULT_CONCURRENCY,
+        min: 1,
+        max: 16,
+    }),
+    'fail-fast': Flags.boolean({
+        summary: 'Stop at the first target that fails instead of continuing.',
+        default: false,
+    }),
+};
+//# sourceMappingURL=baseline-flags.js.map

package/lib/shared/baseline-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline-flags.js","sourceRoot":"","sources":["../../src/shared/baseline-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,0CAA0C;QACnD,QAAQ,EAAE,IAAI;KACf,CAAC;IACF,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,iDAAiD;QAC1D,WAAW,EACT,4FAA4F;YAC5F,yFAAyF;YACzF,QAAQ;QACV,QAAQ,EAAE,IAAI;KACf,CAAC;IACF,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC;QACzB,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EACT,oFAAoF;YACpF,uFAAuF;YACvF,kBAAkB;QACpB,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,CAAC;QACN,GAAG,EAAE,EAAE;KACR,CAAC;IACF,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC;QACzB,OAAO,EAAE,4DAA4D;QACrE,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@simplysf/simply-gitlab",
   "description": "Command-line interface for working with GitLab",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "author": "@ClayChipps",
   "homepage": "https://github.com/SimplySF/simply-gitlab",
   "bugs": "https://github.com/SimplySF/simply-gitlab/issues",
@@ -84,12 +84,15 @@
       },
       "gitlab:ci:environment": {
         "description": "List deployment environments."
+      },
+      "gitlab:config": {
+        "description": "Hold many projects to one baseline configuration."
       }
     }
   },
   "dependencies": {
     "@oclif/core": "^4.11.2",
-    "@simplysf/simply-gitlab-core": "^0.2.0"
+    "@simplysf/simply-gitlab-core": "^0.3.0"
   },
   "devDependencies": {
     "@oclif/plugin-command-snapshot": "^5.4.0",
@@ -240,5 +243,5 @@
       "service": true
     }
   },
-  "gitHead": "0193de41a79b4addeaed5d8caf5e5b562770be6c"
+  "gitHead": "cc972b728b2e7561856f82cb26377b7757fcbca5"
 }