@structured-world/gitlab-mcp 6.23.2 → 6.24.0

package/dist/src/entities/context/schema.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManageContextSchema = void 0;
+const zod_1 = require("zod");
+const ShowContextSchema = zod_1.z.object({
+    action: zod_1.z
+        .literal("show")
+        .describe("Display current context including host, preset, scope, and mode"),
+});
+const ListPresetsSchema = zod_1.z.object({
+    action: zod_1.z.literal("list_presets").describe("List all available presets with descriptions"),
+});
+const ListProfilesSchema = zod_1.z.object({
+    action: zod_1.z
+        .literal("list_profiles")
+        .describe("List available OAuth profiles - only works in OAuth mode"),
+});
+const SwitchPresetSchema = zod_1.z.object({
+    action: zod_1.z.literal("switch_preset").describe("Switch to a different preset configuration"),
+    preset: zod_1.z.string().min(1).describe("Name of the preset to activate"),
+});
+const SwitchProfileSchema = zod_1.z.object({
+    action: zod_1.z
+        .literal("switch_profile")
+        .describe("Switch to a different OAuth profile - OAuth mode only"),
+    profile: zod_1.z.string().min(1).describe("Name of the profile to activate"),
+});
+const SetScopeSchema = zod_1.z.object({
+    action: zod_1.z.literal("set_scope").describe("Set scope to restrict operations to a namespace"),
+    namespace: zod_1.z
+        .string()
+        .min(1)
+        .describe("Namespace path (e.g., 'my-group' or 'group/project') - type is auto-detected"),
+    includeSubgroups: zod_1.z
+        .boolean()
+        .optional()
+        .default(true)
+        .describe("Include subgroups when scope is a group (default: true)"),
+});
+const ResetContextSchema = zod_1.z.object({
+    action: zod_1.z.literal("reset").describe("Reset context to initial state from session start"),
+});
+exports.ManageContextSchema = zod_1.z.discriminatedUnion("action", [
+    ShowContextSchema,
+    ListPresetsSchema,
+    ListProfilesSchema,
+    SwitchPresetSchema,
+    SwitchProfileSchema,
+    SetScopeSchema,
+    ResetContextSchema,
+]);
+//# sourceMappingURL=schema.js.map

package/dist/src/entities/context/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../src/entities/context/schema.ts"],"names":[],"mappings":";;;AAaA,6BAAwB;AASxB,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACjC,MAAM,EAAE,OAAC;SACN,OAAO,CAAC,MAAM,CAAC;SACf,QAAQ,CAAC,iEAAiE,CAAC;CAC/E,CAAC,CAAC;AAKH,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACjC,MAAM,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAC3F,CAAC,CAAC;AAKH,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,OAAC;SACN,OAAO,CAAC,eAAe,CAAC;SACxB,QAAQ,CAAC,0DAA0D,CAAC;CACxE,CAAC,CAAC;AAKH,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,OAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACzF,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC;CACrE,CAAC,CAAC;AAKH,MAAM,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,OAAC;SACN,OAAO,CAAC,gBAAgB,CAAC;SACzB,QAAQ,CAAC,uDAAuD,CAAC;IACpE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;CACvE,CAAC,CAAC;AAKH,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,OAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC1F,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,8EAA8E,CAAC;IAC3F,gBAAgB,EAAE,OAAC;SAChB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,yDAAyD,CAAC;CACvE,CAAC,CAAC;AAKH,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,OAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,mDAAmD,CAAC;CACzF,CAAC,CAAC;AASU,QAAA,mBAAmB,GAAG,OAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAChE,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,cAAc;IACd,kBAAkB;CACnB,CAAC,CAAC"}

package/dist/src/entities/context/types.d.ts

@@ -0,0 +1,49 @@
+import { ProfileInfo, Preset, ScopeConfig } from "../../profiles/types";
+export interface RuntimeScope {
+    type: "project" | "group";
+    path: string;
+    additionalPaths?: string[];
+    includeSubgroups: boolean;
+    detected: boolean;
+}
+export interface SessionContext {
+    host: string;
+    apiUrl: string;
+    profileName?: string;
+    presetName?: string;
+    readOnly: boolean;
+    scope?: RuntimeScope;
+    oauthMode: boolean;
+    initialContext?: Omit<SessionContext, "initialContext">;
+}
+export interface SetScopeResult {
+    success: boolean;
+    scope: RuntimeScope;
+    message: string;
+}
+export interface SwitchResult {
+    success: boolean;
+    previous?: string;
+    current: string;
+    message: string;
+}
+export interface ResetResult {
+    success: boolean;
+    message: string;
+    context: SessionContext;
+}
+export interface PresetInfo {
+    name: string;
+    description?: string;
+    readOnly: boolean;
+    isBuiltIn: boolean;
+    scope?: ScopeConfig;
+    features?: Record<string, boolean>;
+}
+export interface ContextState {
+    currentPreset?: Preset;
+    currentPresetName?: string;
+    currentScope?: ScopeConfig;
+    initialState?: ContextState;
+}
+export type { ProfileInfo };

package/dist/src/entities/context/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/src/entities/context/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/entities/context/types.ts"],"names":[],"mappings":""}

package/dist/src/entities/index.d.ts

@@ -13,3 +13,4 @@ export * from "./releases";
 export * from "./refs";
 export * from "./members";
 export * from "./search";
+export * from "./context";

package/dist/src/entities/index.js

@@ -29,4 +29,5 @@ __exportStar(require("./releases"), exports);
 __exportStar(require("./refs"), exports);
 __exportStar(require("./members"), exports);
 __exportStar(require("./search"), exports);
+__exportStar(require("./context"), exports);
 //# sourceMappingURL=index.js.map

package/dist/src/entities/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/entities/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,yCAAuB;AACvB,yCAAuB;AACvB,+CAA6B;AAC7B,8CAA4B;AAC5B,8CAA4B;AAC5B,2CAAyB;AACzB,wCAAsB;AACtB,0CAAwB;AACxB,8CAA4B;AAC5B,6CAA2B;AAC3B,6CAA2B;AAC3B,yCAAuB;AACvB,4CAA0B;AAC1B,2CAAyB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/entities/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,yCAAuB;AACvB,yCAAuB;AACvB,+CAA6B;AAC7B,8CAA4B;AAC5B,8CAA4B;AAC5B,2CAAyB;AACzB,wCAAsB;AACtB,0CAAwB;AACxB,8CAA4B;AAC5B,6CAA2B;AAC3B,6CAA2B;AAC3B,yCAAuB;AACvB,4CAA0B;AAC1B,2CAAyB;AACzB,4CAA0B"}

package/dist/src/entities/search/schema-readonly.d.ts

@@ -2,11 +2,11 @@ import { z } from "zod";
 export declare const SearchScopeSchema: z.ZodEnum<{
     milestones: "milestones";
     projects: "projects";
+    groups: "groups";
     issues: "issues";
     merge_requests: "merge_requests";
     commits: "commits";
     users: "users";
-    groups: "groups";
     snippet_titles: "snippet_titles";
     blobs: "blobs";
     wiki_blobs: "wiki_blobs";
@@ -17,11 +17,11 @@ declare const GlobalSearchSchema: z.ZodObject<{
     scope: z.ZodEnum<{
         milestones: "milestones";
         projects: "projects";
+        groups: "groups";
         issues: "issues";
         merge_requests: "merge_requests";
         commits: "commits";
         users: "users";
-        groups: "groups";
         snippet_titles: "snippet_titles";
         blobs: "blobs";
         wiki_blobs: "wiki_blobs";
@@ -52,11 +52,11 @@ declare const ProjectSearchSchema: z.ZodObject<{
     scope: z.ZodEnum<{
         milestones: "milestones";
         projects: "projects";
+        groups: "groups";
         issues: "issues";
         merge_requests: "merge_requests";
         commits: "commits";
         users: "users";
-        groups: "groups";
         snippet_titles: "snippet_titles";
         blobs: "blobs";
         wiki_blobs: "wiki_blobs";
@@ -88,11 +88,11 @@ declare const GroupSearchSchema: z.ZodObject<{
     scope: z.ZodEnum<{
         milestones: "milestones";
         projects: "projects";
+        groups: "groups";
         issues: "issues";
         merge_requests: "merge_requests";
         commits: "commits";
         users: "users";
-        groups: "groups";
         snippet_titles: "snippet_titles";
         blobs: "blobs";
         wiki_blobs: "wiki_blobs";
@@ -122,11 +122,11 @@ export declare const BrowseSearchSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     scope: z.ZodEnum<{
         milestones: "milestones";
         projects: "projects";
+        groups: "groups";
         issues: "issues";
         merge_requests: "merge_requests";
         commits: "commits";
         users: "users";
-        groups: "groups";
         snippet_titles: "snippet_titles";
         blobs: "blobs";
         wiki_blobs: "wiki_blobs";
@@ -156,11 +156,11 @@ export declare const BrowseSearchSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     scope: z.ZodEnum<{
         milestones: "milestones";
         projects: "projects";
+        groups: "groups";
         issues: "issues";
         merge_requests: "merge_requests";
         commits: "commits";
         users: "users";
-        groups: "groups";
         snippet_titles: "snippet_titles";
         blobs: "blobs";
         wiki_blobs: "wiki_blobs";
@@ -191,11 +191,11 @@ export declare const BrowseSearchSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     scope: z.ZodEnum<{
         milestones: "milestones";
         projects: "projects";
+        groups: "groups";
         issues: "issues";
         merge_requests: "merge_requests";
         commits: "commits";
         users: "users";
-        groups: "groups";
         snippet_titles: "snippet_titles";
         blobs: "blobs";
         wiki_blobs: "wiki_blobs";

package/dist/src/profiles/scope-enforcer.d.ts

@@ -1,24 +1,28 @@
-import { ProjectPreset } from "./types";
-export interface ScopeConfig {
-    project?: string;
-    namespace?: string;
-    projects?: string[];
-}
+import { ProjectPreset, ScopeConfig } from "./types";
+export type { ScopeConfig } from "./types";
 export declare class ScopeViolationError extends Error {
     readonly attemptedTarget: string;
     readonly allowedScope: ScopeConfig;
     constructor(attemptedTarget: string, allowedScope: ScopeConfig);
 }
+export declare function isInNamespace(projectPath: string, namespace: string): boolean;
 export declare class ScopeEnforcer {
     private readonly scope;
     private readonly allowedProjectsSet;
+    private readonly allowedGroupsSet;
+    private readonly includeSubgroups;
     constructor(scope: ScopeConfig);
     static fromPreset(preset: ProjectPreset): ScopeEnforcer | null;
     isAllowed(projectPath: string): boolean;
+    isGroupAllowed(groupPath: string): boolean;
     enforce(projectPath: string): void;
+    enforceGroup(groupPath: string): void;
     getScope(): ScopeConfig;
     getScopeDescription(): string;
+    hasProjectRestrictions(): boolean;
+    hasGroupRestrictions(): boolean;
     hasRestrictions(): boolean;
 }
 export declare function extractProjectsFromArgs(args: Record<string, unknown>): string[];
+export declare function extractGroupsFromArgs(args: Record<string, unknown>): string[];
 export declare function enforceArgsScope(enforcer: ScopeEnforcer, args: Record<string, unknown>): void;

package/dist/src/profiles/scope-enforcer.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ScopeEnforcer = exports.ScopeViolationError = void 0;
+exports.isInNamespace = isInNamespace;
 exports.extractProjectsFromArgs = extractProjectsFromArgs;
+exports.extractGroupsFromArgs = extractGroupsFromArgs;
 exports.enforceArgsScope = enforceArgsScope;
 const logger_1 = require("../logger");
 class ScopeViolationError extends Error {
@@ -17,19 +19,34 @@ class ScopeViolationError extends Error {
 }
 exports.ScopeViolationError = ScopeViolationError;
 function getScopeDescription(scope) {
+    const parts = [];
     if (scope.project) {
-        return `project: ${scope.project}`;
+        parts.push(`project: ${scope.project}`);
+    }
+    if (scope.group) {
+        const subgroupSuffix = scope.includeSubgroups !== false ? "/*" : "";
+        parts.push(`group: ${scope.group}${subgroupSuffix}`);
     }
     if (scope.namespace) {
-        return `namespace: ${scope.namespace}/*`;
+        parts.push(`namespace: ${scope.namespace}/*`);
     }
     if (scope.projects && scope.projects.length > 0) {
         if (scope.projects.length <= 3) {
-            return `projects: ${scope.projects.join(", ")}`;
+            parts.push(`projects: ${scope.projects.join(", ")}`);
+        }
+        else {
+            parts.push(`${scope.projects.length} allowed projects`);
+        }
+    }
+    if (scope.groups && scope.groups.length > 0) {
+        if (scope.groups.length <= 3) {
+            parts.push(`groups: ${scope.groups.join(", ")}`);
+        }
+        else {
+            parts.push(`${scope.groups.length} allowed groups`);
         }
-        return `${scope.projects.length} allowed projects`;
     }
-    return "unrestricted";
+    return parts.length > 0 ? parts.join("; ") : "unrestricted";
 }
 function normalizeProjectPath(path) {
     const trimmed = path.trim().replace(/^\/+|\/+$/g, "");
@@ -47,15 +64,24 @@ function isInNamespace(projectPath, namespace) {
 class ScopeEnforcer {
     scope;
     allowedProjectsSet;
+    allowedGroupsSet;
+    includeSubgroups;
     constructor(scope) {
         this.scope = scope;
+        this.includeSubgroups = scope.includeSubgroups !== false;
         this.allowedProjectsSet = new Set((scope.projects ?? []).map(p => normalizeProjectPath(p)));
         if (scope.project) {
             this.allowedProjectsSet.add(normalizeProjectPath(scope.project));
         }
+        this.allowedGroupsSet = new Set((scope.groups ?? []).map(g => normalizeProjectPath(g)));
+        if (scope.group) {
+            this.allowedGroupsSet.add(normalizeProjectPath(scope.group));
+        }
         logger_1.logger.debug({
             scope: getScopeDescription(scope),
-            allowedCount: this.allowedProjectsSet.size,
+            allowedProjectsCount: this.allowedProjectsSet.size,
+            allowedGroupsCount: this.allowedGroupsSet.size,
+            includeSubgroups: this.includeSubgroups,
         }, "ScopeEnforcer initialized");
     }
     static fromPreset(preset) {
@@ -65,6 +91,9 @@ class ScopeEnforcer {
         return new ScopeEnforcer(preset.scope);
     }
     isAllowed(projectPath) {
+        if (!this.hasProjectRestrictions()) {
+            return true;
+        }
         const normalized = normalizeProjectPath(projectPath);
         if (this.allowedProjectsSet.size > 0 && this.allowedProjectsSet.has(normalized)) {
             return true;
@@ -72,32 +101,94 @@ class ScopeEnforcer {
         if (this.scope.namespace && isInNamespace(projectPath, this.scope.namespace)) {
             return true;
         }
+        if (this.allowedGroupsSet.size > 0) {
+            for (const allowedGroup of this.allowedGroupsSet) {
+                if (this.includeSubgroups) {
+                    if (isInNamespace(projectPath, allowedGroup)) {
+                        return true;
+                    }
+                }
+                else {
+                    const parts = normalized.split("/");
+                    if (parts.length >= 2) {
+                        const projectGroup = parts.slice(0, -1).join("/");
+                        if (projectGroup === allowedGroup) {
+                            return true;
+                        }
+                    }
+                }
+            }
+        }
         if (/^\d+$/.test(normalized)) {
             logger_1.logger.warn({ projectId: normalized }, "Numeric project ID not in allowed scope - denying access");
             return false;
         }
         return false;
     }
+    isGroupAllowed(groupPath) {
+        if (!this.hasGroupRestrictions()) {
+            return true;
+        }
+        const normalized = normalizeProjectPath(groupPath);
+        if (this.allowedGroupsSet.size > 0 && this.allowedGroupsSet.has(normalized)) {
+            return true;
+        }
+        if (this.includeSubgroups && this.allowedGroupsSet.size > 0) {
+            for (const allowedGroup of this.allowedGroupsSet) {
+                if (isInNamespace(groupPath, allowedGroup)) {
+                    return true;
+                }
+            }
+        }
+        if (this.scope.namespace && isInNamespace(groupPath, this.scope.namespace)) {
+            return true;
+        }
+        if (/^\d+$/.test(normalized)) {
+            logger_1.logger.warn({ groupId: normalized }, "Numeric group ID not in allowed scope - denying access");
+            return false;
+        }
+        return false;
+    }
     enforce(projectPath) {
         if (!this.isAllowed(projectPath)) {
             logger_1.logger.warn({
                 attempted: projectPath,
                 scope: getScopeDescription(this.scope),
-            }, "Scope violation attempted");
+            }, "Project scope violation attempted");
             throw new ScopeViolationError(projectPath, this.scope);
         }
     }
+    enforceGroup(groupPath) {
+        if (!this.isGroupAllowed(groupPath)) {
+            logger_1.logger.warn({
+                attempted: groupPath,
+                scope: getScopeDescription(this.scope),
+            }, "Group scope violation attempted");
+            throw new ScopeViolationError(groupPath, this.scope);
+        }
+    }
     getScope() {
         return this.scope;
     }
     getScopeDescription() {
         return getScopeDescription(this.scope);
     }
-    hasRestrictions() {
+    hasProjectRestrictions() {
         const hasProject = Boolean(this.scope.project);
         const hasNamespace = Boolean(this.scope.namespace);
         const hasProjects = Boolean(this.scope.projects && this.scope.projects.length > 0);
-        return hasProject || hasNamespace || hasProjects;
+        const hasGroup = Boolean(this.scope.group);
+        const hasGroups = Boolean(this.scope.groups && this.scope.groups.length > 0);
+        return hasProject || hasNamespace || hasProjects || hasGroup || hasGroups;
+    }
+    hasGroupRestrictions() {
+        const hasGroup = Boolean(this.scope.group);
+        const hasNamespace = Boolean(this.scope.namespace);
+        const hasGroups = Boolean(this.scope.groups && this.scope.groups.length > 0);
+        return hasGroup || hasNamespace || hasGroups;
+    }
+    hasRestrictions() {
+        return this.hasProjectRestrictions() || this.hasGroupRestrictions();
     }
 }
 exports.ScopeEnforcer = ScopeEnforcer;
@@ -119,10 +210,25 @@ function extractProjectsFromArgs(args) {
     }
     return projects;
 }
+function extractGroupsFromArgs(args) {
+    const groups = [];
+    const groupFields = ["group_id", "groupId", "group"];
+    for (const field of groupFields) {
+        const value = args[field];
+        if (typeof value === "string" && value.trim()) {
+            groups.push(value.trim());
+        }
+    }
+    return groups;
+}
 function enforceArgsScope(enforcer, args) {
     const projects = extractProjectsFromArgs(args);
     for (const project of projects) {
         enforcer.enforce(project);
     }
+    const groups = extractGroupsFromArgs(args);
+    for (const group of groups) {
+        enforcer.enforceGroup(group);
+    }
 }
 //# sourceMappingURL=scope-enforcer.js.map

package/dist/src/profiles/scope-enforcer.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-enforcer.js","sourceRoot":"","sources":["../../../src/profiles/scope-enforcer.ts"],"names":[],"mappings":";;;AA8NA,0DAqBC;AAWD,4CAMC;AAvPD,sCAAmC;AAiBnC,MAAa,mBAAoB,SAAQ,KAAK;IAE1B;IACA;IAFlB,YACkB,eAAuB,EACvB,YAAyB;QAEzC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QAC3D,KAAK,CAAC,iBAAiB,eAAe,mCAAmC,gBAAgB,GAAG,CAAC,CAAC;QAJ9E,oBAAe,GAAf,eAAe,CAAQ;QACvB,iBAAY,GAAZ,YAAY,CAAa;QAIzC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AATD,kDASC;AAKD,SAAS,mBAAmB,CAAC,KAAkB;IAC7C,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,cAAc,KAAK,CAAC,SAAS,IAAI,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,aAAa,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,mBAAmB,CAAC;IACrD,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AASD,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAEtD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;AAC/B,CAAC;AAWD,SAAS,aAAa,CAAC,WAAmB,EAAE,SAAiB;IAC3D,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAG5D,OAAO,CACL,iBAAiB,KAAK,mBAAmB;QACzC,iBAAiB,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,CACxD,CAAC;AACJ,CAAC;AAQD,MAAa,aAAa;IACP,KAAK,CAAc;IACnB,kBAAkB,CAAc;IAEjD,YAAY,KAAkB;QAC5B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAG5F,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,eAAM,CAAC,KAAK,CACV;YACE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;YACjC,YAAY,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI;SAC3C,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IAMD,MAAM,CAAC,UAAU,CAAC,MAAqB;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAQD,SAAS,CAAC,WAAmB;QAC3B,MAAM,UAAU,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAGrD,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QAID,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,eAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,UAAU,EAAE,EACzB,0DAA0D,CAC3D,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAQD,OAAO,CAAC,WAAmB;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,eAAM,CAAC,IAAI,CACT;gBACE,SAAS,EAAE,WAAW;gBACtB,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;aACvC,EACD,2BAA2B,CAC5B,CAAC;YACF,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAKD,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAKD,mBAAmB;QACjB,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAKD,eAAe;QACb,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnF,OAAO,UAAU,IAAI,YAAY,IAAI,WAAW,CAAC;IACnD,CAAC;CACF;AA3GD,sCA2GC;AAaD,SAAgB,uBAAuB,CAAC,IAA6B;IACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAG9B,MAAM,aAAa,GAAG;QACpB,YAAY;QACZ,WAAW;QACX,SAAS;QACT,WAAW;QACX,eAAe;QACf,UAAU;KACX,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD,SAAgB,gBAAgB,CAAC,QAAuB,EAAE,IAA6B;IACrF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAE/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}
+{"version":3,"file":"scope-enforcer.js","sourceRoot":"","sources":["../../../src/profiles/scope-enforcer.ts"],"names":[],"mappings":";;;AA2FA,sCASC;AA+PD,0DAqBC;AAaD,sDAcC;AAWD,4CAYC;AA7ZD,sCAAmC;AAQnC,MAAa,mBAAoB,SAAQ,KAAK;IAE1B;IACA;IAFlB,YACkB,eAAuB,EACvB,YAAyB;QAEzC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QAC3D,KAAK,CAAC,iBAAiB,eAAe,mCAAmC,gBAAgB,GAAG,CAAC,CAAC;QAJ9E,oBAAe,GAAf,eAAe,CAAQ;QACvB,iBAAY,GAAZ,YAAY,CAAa;QAIzC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AATD,kDASC;AAKD,SAAS,mBAAmB,CAAC,KAAkB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,cAAc,GAAG,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,KAAK,GAAG,cAAc,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,mBAAmB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;AAC9D,CAAC;AASD,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAEtD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;AAC/B,CAAC;AAWD,SAAgB,aAAa,CAAC,WAAmB,EAAE,SAAiB;IAClE,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAG5D,OAAO,CACL,iBAAiB,KAAK,mBAAmB;QACzC,iBAAiB,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,CACxD,CAAC;AACJ,CAAC;AASD,MAAa,aAAa;IACP,KAAK,CAAc;IACnB,kBAAkB,CAAc;IAChC,gBAAgB,CAAc;IAC9B,gBAAgB,CAAU;IAE3C,YAAY,KAAkB;QAC5B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC;QAGzD,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAG5F,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;QAGD,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAGxF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,eAAM,CAAC,KAAK,CACV;YACE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;YACjC,oBAAoB,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI;YAClD,kBAAkB,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI;YAC9C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IAMD,MAAM,CAAC,UAAU,CAAC,MAAqB;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAQD,SAAS,CAAC,WAAmB;QAE3B,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAGrD,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACjD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBAE1B,IAAI,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;wBAC7C,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;qBAAM,CAAC;oBAEN,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACpC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;wBACtB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAClD,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;4BAClC,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAID,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,eAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,UAAU,EAAE,EACzB,0DAA0D,CAC3D,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAQD,cAAc,CAAC,SAAiB;QAE9B,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAGnD,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACjD,IAAI,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;oBAC3C,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAGD,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QAID,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,eAAM,CAAC,IAAI,CACT,EAAE,OAAO,EAAE,UAAU,EAAE,EACvB,wDAAwD,CACzD,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAQD,OAAO,CAAC,WAAmB;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,eAAM,CAAC,IAAI,CACT;gBACE,SAAS,EAAE,WAAW;gBACtB,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;aACvC,EACD,mCAAmC,CACpC,CAAC;YACF,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAQD,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,eAAM,CAAC,IAAI,CACT;gBACE,SAAS,EAAE,SAAS;gBACpB,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;aACvC,EACD,iCAAiC,CAClC,CAAC;YACF,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAKD,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAKD,mBAAmB;QACjB,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAKD,sBAAsB;QACpB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE7E,OAAO,UAAU,IAAI,YAAY,IAAI,WAAW,IAAI,QAAQ,IAAI,SAAS,CAAC;IAC5E,CAAC;IAKD,oBAAoB;QAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7E,OAAO,QAAQ,IAAI,YAAY,IAAI,SAAS,CAAC;IAC/C,CAAC;IAKD,eAAe;QACb,OAAO,IAAI,CAAC,sBAAsB,EAAE,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACtE,CAAC;CACF;AAzOD,sCAyOC;AAaD,SAAgB,uBAAuB,CAAC,IAA6B;IACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAG9B,MAAM,aAAa,GAAG;QACpB,YAAY;QACZ,WAAW;QACX,SAAS;QACT,WAAW;QACX,eAAe;QACf,UAAU;KACX,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAaD,SAAgB,qBAAqB,CAAC,IAA6B;IACjE,MAAM,MAAM,GAAa,EAAE,CAAC;IAG5B,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAErD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD,SAAgB,gBAAgB,CAAC,QAAuB,EAAE,IAA6B;IAErF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAGD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/src/profiles/types.d.ts

@@ -85,12 +85,28 @@ export declare const ProfileSchema: z.ZodObject<{
     ssl_key_path: z.ZodOptional<z.ZodString>;
     ca_cert_path: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+export declare const ScopeConfigSchema: z.ZodObject<{
+    project: z.ZodOptional<z.ZodString>;
+    group: z.ZodOptional<z.ZodString>;
+    namespace: z.ZodOptional<z.ZodString>;
+    projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    includeSubgroups: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
 export declare const PresetSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     read_only: z.ZodOptional<z.ZodBoolean>;
     denied_tools_regex: z.ZodOptional<z.ZodString>;
     allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     denied_actions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    scope: z.ZodOptional<z.ZodObject<{
+        project: z.ZodOptional<z.ZodString>;
+        group: z.ZodOptional<z.ZodString>;
+        namespace: z.ZodOptional<z.ZodString>;
+        projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        includeSubgroups: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
     features: z.ZodOptional<z.ZodObject<{
         wiki: z.ZodOptional<z.ZodBoolean>;
         milestones: z.ZodOptional<z.ZodBoolean>;
@@ -158,17 +174,15 @@ export declare const ProfilesConfigSchema: z.ZodObject<{
     }, z.core.$strip>>;
     default_profile: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-export declare const ScopeConfigSchema: z.ZodObject<{
-    project: z.ZodOptional<z.ZodString>;
-    namespace: z.ZodOptional<z.ZodString>;
-    projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
 export declare const ProjectPresetSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     scope: z.ZodOptional<z.ZodObject<{
         project: z.ZodOptional<z.ZodString>;
+        group: z.ZodOptional<z.ZodString>;
         namespace: z.ZodOptional<z.ZodString>;
         projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        includeSubgroups: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     features: z.ZodOptional<z.ZodObject<{
         wiki: z.ZodOptional<z.ZodBoolean>;
@@ -224,6 +238,7 @@ export type OAuthAuth = z.infer<typeof OAuthAuthSchema>;
 export type CookieAuth = z.infer<typeof CookieAuthSchema>;
 export type AuthConfig = z.infer<typeof AuthConfigSchema>;
 export type FeatureFlags = z.infer<typeof FeatureFlagsSchema>;
+export type ScopeConfig = z.infer<typeof ScopeConfigSchema>;
 export type Profile = z.infer<typeof ProfileSchema>;
 export type Preset = z.infer<typeof PresetSchema>;
 export type ProfilesConfig = z.infer<typeof ProfilesConfigSchema>;

package/dist/src/profiles/types.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProjectProfileSchema = exports.ProjectPresetSchema = exports.ScopeConfigSchema = exports.ProfilesConfigSchema = exports.PresetSchema = exports.ProfileSchema = void 0;
+exports.ProjectProfileSchema = exports.ProjectPresetSchema = exports.ProfilesConfigSchema = exports.PresetSchema = exports.ScopeConfigSchema = exports.ProfileSchema = void 0;
 const zod_1 = require("zod");
 const PatAuthSchema = zod_1.z.object({
     type: zod_1.z.literal("pat"),
@@ -67,6 +67,38 @@ exports.ProfileSchema = zod_1.z.object({
     ssl_key_path: zod_1.z.string().optional().describe("Path to SSL key"),
     ca_cert_path: zod_1.z.string().optional().describe("Path to CA certificate"),
 });
+exports.ScopeConfigSchema = zod_1.z
+    .object({
+    project: zod_1.z.string().optional().describe("Single project path (e.g., group/project)"),
+    group: zod_1.z.string().optional().describe("Single group path (e.g., my-group or parent/child)"),
+    namespace: zod_1.z.string().optional().describe("Namespace/group path"),
+    projects: zod_1.z.array(zod_1.z.string()).optional().describe("List of allowed project paths"),
+    groups: zod_1.z.array(zod_1.z.string()).optional().describe("List of allowed group paths"),
+    includeSubgroups: zod_1.z
+        .boolean()
+        .optional()
+        .describe("Include subgroups when group scope is set (default: true)"),
+})
+    .refine(data => {
+    const hasProject = data.project !== undefined;
+    const hasGroup = data.group !== undefined;
+    const hasNamespace = data.namespace !== undefined;
+    const hasProjects = data.projects !== undefined && data.projects.length > 0;
+    const hasGroups = data.groups !== undefined && data.groups.length > 0;
+    return hasProject || hasGroup || hasNamespace || hasProjects || hasGroups;
+}, { message: "Scope must define at least one of: project, group, namespace, projects, or groups" })
+    .refine(data => {
+    if (data.project && data.projects && data.projects.length > 0) {
+        return false;
+    }
+    return true;
+}, { message: "Cannot combine 'project' with 'projects' - use one or the other" })
+    .refine(data => {
+    if (data.group && data.groups && data.groups.length > 0) {
+        return false;
+    }
+    return true;
+}, { message: "Cannot combine 'group' with 'groups' - use one or the other" });
 exports.PresetSchema = zod_1.z
     .object({
     description: zod_1.z.string().optional().describe("Human-readable description of the preset"),
@@ -77,6 +109,7 @@ exports.PresetSchema = zod_1.z
         .array(zod_1.z.string())
         .optional()
         .describe("Denied actions in format 'tool:action'"),
+    scope: exports.ScopeConfigSchema.optional().describe("Runtime scope restrictions for projects/groups"),
     features: FeatureFlagsSchema,
     timeout_ms: zod_1.z.number().int().positive().optional().describe("API timeout in milliseconds"),
 })
@@ -85,24 +118,6 @@ exports.ProfilesConfigSchema = zod_1.z.object({
     profiles: zod_1.z.record(zod_1.z.string(), exports.ProfileSchema).describe("Named profiles"),
     default_profile: zod_1.z.string().optional().describe("Default profile when none specified"),
 });
-exports.ScopeConfigSchema = zod_1.z
-    .object({
-    project: zod_1.z.string().optional().describe("Single project path (e.g., group/project)"),
-    namespace: zod_1.z.string().optional().describe("Namespace/group path"),
-    projects: zod_1.z.array(zod_1.z.string()).optional().describe("List of allowed project paths"),
-})
-    .refine(data => {
-    const hasProject = data.project !== undefined;
-    const hasNamespace = data.namespace !== undefined;
-    const hasProjects = data.projects !== undefined && data.projects.length > 0;
-    return hasProject || hasNamespace || hasProjects;
-}, { message: "Scope must define at least one of: project, namespace, or projects" })
-    .refine(data => {
-    if (data.project && data.projects && data.projects.length > 0) {
-        return false;
-    }
-    return true;
-}, { message: "Cannot combine 'project' with 'projects' - use one or the other" });
 exports.ProjectPresetSchema = zod_1.z
     .object({
     description: zod_1.z.string().optional().describe("Description of project restrictions"),