gitlab-mcp-test 6.62.1

package/dist/src/oauth/token-utils.js

@@ -0,0 +1,148 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createJWT = createJWT;
+exports.verifyJWT = verifyJWT;
+exports.verifyMCPToken = verifyMCPToken;
+exports.generateCodeVerifier = generateCodeVerifier;
+exports.generateCodeChallenge = generateCodeChallenge;
+exports.verifyCodeChallenge = verifyCodeChallenge;
+exports.generateRandomString = generateRandomString;
+exports.generateUUID = generateUUID;
+exports.generateAuthorizationCode = generateAuthorizationCode;
+exports.generateSessionId = generateSessionId;
+exports.generateRefreshToken = generateRefreshToken;
+exports.isTokenExpiringSoon = isTokenExpiringSoon;
+exports.calculateTokenExpiry = calculateTokenExpiry;
+const crypto = __importStar(require("crypto"));
+function createJWT(payload, secret, expiresIn) {
+    const header = { alg: "HS256", typ: "JWT" };
+    const now = Math.floor(Date.now() / 1000);
+    const fullPayload = {
+        ...payload,
+        iat: now,
+        exp: now + expiresIn,
+    };
+    const headerB64 = base64UrlEncode(JSON.stringify(header));
+    const payloadB64 = base64UrlEncode(JSON.stringify(fullPayload));
+    const signature = crypto
+        .createHmac("sha256", secret)
+        .update(`${headerB64}.${payloadB64}`)
+        .digest("base64url");
+    return `${headerB64}.${payloadB64}.${signature}`;
+}
+function verifyJWT(token, secret) {
+    try {
+        const parts = token.split(".");
+        if (parts.length !== 3) {
+            return null;
+        }
+        const [headerB64, payloadB64, signature] = parts;
+        const expectedSig = crypto
+            .createHmac("sha256", secret)
+            .update(`${headerB64}.${payloadB64}`)
+            .digest("base64url");
+        if (signature !== expectedSig) {
+            return null;
+        }
+        const payload = JSON.parse(base64UrlDecode(payloadB64));
+        const exp = payload.exp;
+        if (exp && exp < Math.floor(Date.now() / 1000)) {
+            return null;
+        }
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}
+function verifyMCPToken(token, secret) {
+    const payload = verifyJWT(token, secret);
+    if (!payload) {
+        return null;
+    }
+    if (typeof payload.iss !== "string" ||
+        typeof payload.sub !== "string" ||
+        typeof payload.aud !== "string" ||
+        typeof payload.sid !== "string" ||
+        typeof payload.scope !== "string" ||
+        typeof payload.gitlab_user !== "string" ||
+        typeof payload.iat !== "number" ||
+        typeof payload.exp !== "number") {
+        return null;
+    }
+    return payload;
+}
+function generateCodeVerifier() {
+    return crypto.randomBytes(32).toString("base64url");
+}
+function generateCodeChallenge(verifier) {
+    return crypto.createHash("sha256").update(verifier).digest("base64url");
+}
+function verifyCodeChallenge(verifier, challenge, method) {
+    if (method !== "S256") {
+        return false;
+    }
+    return generateCodeChallenge(verifier) === challenge;
+}
+function generateRandomString(length = 32) {
+    const byteLength = Math.ceil((length * 3) / 4);
+    return crypto.randomBytes(byteLength).toString("base64url").slice(0, length);
+}
+function generateUUID() {
+    return crypto.randomUUID();
+}
+function generateAuthorizationCode() {
+    return generateRandomString(32);
+}
+function generateSessionId() {
+    return generateUUID();
+}
+function generateRefreshToken() {
+    return generateRandomString(64);
+}
+function base64UrlEncode(str) {
+    return Buffer.from(str, "utf-8").toString("base64url");
+}
+function base64UrlDecode(str) {
+    return Buffer.from(str, "base64url").toString("utf-8");
+}
+function isTokenExpiringSoon(expiryMs, bufferMs = 5 * 60 * 1000) {
+    return Date.now() + bufferMs >= expiryMs;
+}
+function calculateTokenExpiry(expiresIn) {
+    return Date.now() + expiresIn * 1000;
+}
+//# sourceMappingURL=token-utils.js.map

package/dist/src/oauth/token-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-utils.js","sourceRoot":"","sources":["../../../src/oauth/token-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,8BAuBC;AAWD,8BAgCC;AASD,wCAqBC;AAWD,oDAEC;AAQD,sDAEC;AAUD,kDAMC;AAYD,oDAIC;AAOD,oCAEC;AAOD,8DAEC;AAOD,8CAEC;AAOD,oDAEC;AA+BD,kDAEC;AAQD,oDAEC;AAvPD,+CAAiC;AAiBjC,SAAgB,SAAS,CACvB,OAAgC,EAChC,MAAc,EACd,SAAiB;IAEjB,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,MAAM,WAAW,GAAG;QAClB,GAAG,OAAO;QACV,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,SAAS;KACrB,CAAC;IAEF,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAEhE,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC5B,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;SACpC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;AACnD,CAAC;AAWD,SAAgB,SAAS,CAAC,KAAa,EAAE,MAAc;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAGjD,MAAM,WAAW,GAAG,MAAM;aACvB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC5B,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;aACpC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvB,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,CAA4B,CAAC;QAGnF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAyB,CAAC;QAC9C,IAAI,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD,SAAgB,cAAc,CAAC,KAAa,EAAE,MAAc;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;QACvC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,OAAqC,CAAC;AAC/C,CAAC;AAWD,SAAgB,oBAAoB;IAClC,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAQD,SAAgB,qBAAqB,CAAC,QAAgB;IACpD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAUD,SAAgB,mBAAmB,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc;IACrF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAEtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AACvD,CAAC;AAYD,SAAgB,oBAAoB,CAAC,SAAiB,EAAE;IAEtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC;AAOD,SAAgB,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAOD,SAAgB,yBAAyB;IACvC,OAAO,oBAAoB,CAAC,EAAE,CAAC,CAAC;AAClC,CAAC;AAOD,SAAgB,iBAAiB;IAC/B,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC;AAOD,SAAgB,oBAAoB;IAClC,OAAO,oBAAoB,CAAC,EAAE,CAAC,CAAC;AAClC,CAAC;AASD,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACzD,CAAC;AAKD,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAaD,SAAgB,mBAAmB,CAAC,QAAgB,EAAE,WAAmB,CAAC,GAAG,EAAE,GAAG,IAAI;IACpF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,QAAQ,CAAC;AAC3C,CAAC;AAQD,SAAgB,oBAAoB,CAAC,SAAiB;IACpD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;AACvC,CAAC"}

package/dist/src/oauth/types.d.ts

@@ -0,0 +1,117 @@
+export interface NamespaceTierInfo {
+    tier: "free" | "premium" | "ultimate";
+    features: Record<string, boolean>;
+    cachedAt: Date;
+}
+export interface OAuthSession {
+    id: string;
+    mcpAccessToken: string;
+    mcpRefreshToken: string;
+    mcpTokenExpiry: number;
+    gitlabAccessToken: string;
+    gitlabRefreshToken: string;
+    gitlabTokenExpiry: number;
+    gitlabUserId: number;
+    gitlabUsername: string;
+    gitlabApiUrl?: string;
+    instanceLabel?: string;
+    clientId: string;
+    scopes: string[];
+    createdAt: number;
+    updatedAt: number;
+}
+export interface AuthCodeFlowState {
+    clientId: string;
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    clientState: string;
+    internalState: string;
+    clientRedirectUri: string;
+    callbackUri: string;
+    expiresAt: number;
+    selectedInstance?: string;
+    selectedInstanceLabel?: string;
+}
+export interface DeviceFlowState {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+    expiresAt: number;
+    interval: number;
+    clientId: string;
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    state: string;
+    redirectUri?: string;
+    selectedInstance?: string;
+    selectedInstanceLabel?: string;
+}
+export interface AuthorizationCode {
+    code: string;
+    sessionId: string;
+    clientId: string;
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    redirectUri?: string;
+    expiresAt: number;
+}
+export interface GitLabTokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token: string;
+    created_at: number;
+    scope?: string;
+}
+export interface GitLabDeviceResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    expires_in: number;
+    interval: number;
+}
+export interface TokenContext {
+    gitlabToken: string;
+    gitlabUserId: number;
+    gitlabUsername: string;
+    sessionId: string;
+    apiUrl: string;
+    instanceLabel?: string;
+}
+export interface GitLabUserInfo {
+    id: number;
+    username: string;
+    name?: string;
+    email?: string;
+}
+export interface MCPTokenResponse {
+    access_token: string;
+    token_type: "Bearer";
+    expires_in: number;
+    refresh_token: string;
+    scope: string;
+}
+export interface OAuthErrorResponse {
+    error: string;
+    error_description?: string;
+}
+export type DeviceFlowPollStatus = "pending" | "complete" | "failed" | "expired";
+export interface DeviceFlowPollResponse {
+    status: DeviceFlowPollStatus;
+    redirect_uri?: string;
+    code?: string;
+    state?: string;
+    error?: string;
+}
+export interface MCPTokenPayload {
+    iss: string;
+    sub: string;
+    aud: string;
+    sid: string;
+    scope: string;
+    gitlab_user: string;
+    iat: number;
+    exp: number;
+}

package/dist/src/oauth/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/src/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/oauth/types.ts"],"names":[],"mappings":""}

package/dist/src/profiles/applicator.d.ts

@@ -0,0 +1,19 @@
+import { Profile, Preset, ProfileValidationResult } from "./types";
+export interface ApplyProfileResult {
+    success: boolean;
+    profileName: string;
+    host: string;
+    appliedSettings: string[];
+    validation: ProfileValidationResult;
+}
+export interface ApplyPresetResult {
+    success: boolean;
+    presetName: string;
+    appliedSettings: string[];
+    validation: ProfileValidationResult;
+}
+export declare function applyProfile(profile: Profile, profileName: string): Promise<ApplyProfileResult>;
+export declare function applyPreset(preset: Preset, presetName: string): Promise<ApplyPresetResult>;
+export declare function loadAndApplyProfile(profileName: string): Promise<ApplyProfileResult>;
+export declare function loadAndApplyPreset(presetName: string): Promise<ApplyPresetResult>;
+export declare function tryApplyProfileFromEnv(cliProfileName?: string): Promise<ApplyProfileResult | ApplyPresetResult | undefined>;

package/dist/src/profiles/applicator.js

@@ -0,0 +1,256 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyProfile = applyProfile;
+exports.applyPreset = applyPreset;
+exports.loadAndApplyProfile = loadAndApplyProfile;
+exports.loadAndApplyPreset = loadAndApplyPreset;
+exports.tryApplyProfileFromEnv = tryApplyProfileFromEnv;
+const loader_1 = require("./loader");
+const logger_1 = require("../logger");
+const FEATURE_ENV_MAP = {
+    wiki: "USE_GITLAB_WIKI",
+    milestones: "USE_MILESTONE",
+    pipelines: "USE_PIPELINE",
+    labels: "USE_LABELS",
+    mrs: "USE_MRS",
+    files: "USE_FILES",
+    variables: "USE_VARIABLES",
+    workitems: "USE_WORKITEMS",
+    webhooks: "USE_WEBHOOKS",
+    snippets: "USE_SNIPPETS",
+    integrations: "USE_INTEGRATIONS",
+    releases: "USE_RELEASES",
+    refs: "USE_REFS",
+    members: "USE_MEMBERS",
+    search: "USE_SEARCH",
+};
+async function applyProfile(profile, profileName) {
+    const appliedSettings = [];
+    const loader = new loader_1.ProfileLoader();
+    const validation = await loader.validateProfile(profile);
+    for (const warning of validation.warnings) {
+        (0, logger_1.logWarn)(warning, { profile: profileName });
+    }
+    if (!validation.valid) {
+        (0, logger_1.logError)("Profile validation failed", { profile: profileName, errors: validation.errors });
+        return {
+            success: false,
+            profileName,
+            host: profile.host,
+            appliedSettings,
+            validation,
+        };
+    }
+    const apiUrl = profile.api_url ?? `https://${profile.host}`;
+    process.env.GITLAB_API_URL = apiUrl;
+    appliedSettings.push(`GITLAB_API_URL=${apiUrl}`);
+    switch (profile.auth.type) {
+        case "pat":
+            if (profile.auth.token_env) {
+                const token = process.env[profile.auth.token_env];
+                if (token) {
+                    process.env.GITLAB_TOKEN = token;
+                    appliedSettings.push(`GITLAB_TOKEN=<from ${profile.auth.token_env}>`);
+                }
+            }
+            break;
+        case "oauth":
+            if (profile.auth.client_id_env) {
+                const clientId = process.env[profile.auth.client_id_env];
+                if (clientId) {
+                    process.env.GITLAB_OAUTH_CLIENT_ID = clientId;
+                    appliedSettings.push(`GITLAB_OAUTH_CLIENT_ID=<from ${profile.auth.client_id_env}>`);
+                }
+            }
+            if (profile.auth.client_secret_env) {
+                const clientSecret = process.env[profile.auth.client_secret_env];
+                if (clientSecret) {
+                    process.env.GITLAB_OAUTH_CLIENT_SECRET = clientSecret;
+                    appliedSettings.push(`GITLAB_OAUTH_CLIENT_SECRET=<from ${profile.auth.client_secret_env}>`);
+                }
+            }
+            process.env.OAUTH_ENABLED = "true";
+            appliedSettings.push("OAUTH_ENABLED=true");
+            break;
+        case "cookie":
+            if (profile.auth.cookie_path) {
+                process.env.GITLAB_AUTH_COOKIE_PATH = profile.auth.cookie_path;
+                appliedSettings.push(`GITLAB_AUTH_COOKIE_PATH=${profile.auth.cookie_path}`);
+            }
+            break;
+    }
+    if (profile.read_only) {
+        process.env.GITLAB_READ_ONLY_MODE = "true";
+        appliedSettings.push("GITLAB_READ_ONLY_MODE=true");
+    }
+    if (profile.allowed_projects && profile.allowed_projects.length > 0) {
+        process.env.GITLAB_ALLOWED_PROJECT_IDS = profile.allowed_projects.join(",");
+        appliedSettings.push(`GITLAB_ALLOWED_PROJECT_IDS=${profile.allowed_projects.join(",")}`);
+    }
+    if (profile.allowed_groups && profile.allowed_groups.length > 0) {
+        process.env.GITLAB_ALLOWED_GROUP_IDS = profile.allowed_groups.join(",");
+        appliedSettings.push(`GITLAB_ALLOWED_GROUP_IDS=${profile.allowed_groups.join(",")}`);
+    }
+    if (profile.allowed_tools && profile.allowed_tools.length > 0) {
+        process.env.GITLAB_ALLOWED_TOOLS = profile.allowed_tools.join(",");
+        appliedSettings.push(`GITLAB_ALLOWED_TOOLS=${profile.allowed_tools.join(",")}`);
+    }
+    if (profile.denied_tools_regex) {
+        process.env.GITLAB_DENIED_TOOLS_REGEX = profile.denied_tools_regex;
+        appliedSettings.push(`GITLAB_DENIED_TOOLS_REGEX=${profile.denied_tools_regex}`);
+    }
+    if (profile.denied_actions && profile.denied_actions.length > 0) {
+        process.env.GITLAB_DENIED_ACTIONS = profile.denied_actions.join(",");
+        appliedSettings.push(`GITLAB_DENIED_ACTIONS=${profile.denied_actions.join(",")}`);
+    }
+    if (profile.features) {
+        for (const [feature, envVar] of Object.entries(FEATURE_ENV_MAP)) {
+            const value = profile.features[feature];
+            if (value !== undefined) {
+                process.env[envVar] = value ? "true" : "false";
+                appliedSettings.push(`${envVar}=${value}`);
+            }
+        }
+    }
+    if (profile.timeout_ms) {
+        process.env.GITLAB_API_HEADERS_TIMEOUT_MS = String(profile.timeout_ms);
+        appliedSettings.push(`GITLAB_API_HEADERS_TIMEOUT_MS=${profile.timeout_ms}`);
+    }
+    if (profile.skip_tls_verify) {
+        process.env.SKIP_TLS_VERIFY = "true";
+        appliedSettings.push("SKIP_TLS_VERIFY=true");
+    }
+    if (profile.ssl_cert_path) {
+        process.env.SSL_CERT_PATH = profile.ssl_cert_path;
+        appliedSettings.push(`SSL_CERT_PATH=${profile.ssl_cert_path}`);
+    }
+    if (profile.ssl_key_path) {
+        process.env.SSL_KEY_PATH = profile.ssl_key_path;
+        appliedSettings.push(`SSL_KEY_PATH=${profile.ssl_key_path}`);
+    }
+    if (profile.ca_cert_path) {
+        process.env.GITLAB_CA_CERT_PATH = profile.ca_cert_path;
+        appliedSettings.push(`GITLAB_CA_CERT_PATH=${profile.ca_cert_path}`);
+    }
+    if (profile.default_project) {
+        process.env.GITLAB_PROJECT_ID = profile.default_project;
+        appliedSettings.push(`GITLAB_PROJECT_ID=${profile.default_project}`);
+    }
+    if (profile.default_namespace) {
+        process.env.GITLAB_DEFAULT_NAMESPACE = profile.default_namespace;
+        appliedSettings.push(`GITLAB_DEFAULT_NAMESPACE=${profile.default_namespace}`);
+    }
+    (0, logger_1.logInfo)("Profile applied successfully", {
+        profile: profileName,
+        host: profile.host,
+        authType: profile.auth.type,
+        readOnly: profile.read_only ?? false,
+        settingsCount: appliedSettings.length,
+    });
+    return {
+        success: true,
+        profileName,
+        host: profile.host,
+        appliedSettings,
+        validation,
+    };
+}
+async function applyPreset(preset, presetName) {
+    const appliedSettings = [];
+    const loader = new loader_1.ProfileLoader();
+    const validation = await loader.validatePreset(preset);
+    for (const warning of validation.warnings) {
+        (0, logger_1.logWarn)(warning, { preset: presetName });
+    }
+    if (!validation.valid) {
+        (0, logger_1.logError)("Preset validation failed", { preset: presetName, errors: validation.errors });
+        return {
+            success: false,
+            presetName,
+            appliedSettings,
+            validation,
+        };
+    }
+    if (!process.env.GITLAB_API_URL && !process.env.GITLAB_TOKEN) {
+        (0, logger_1.logWarn)("Preset applied but GITLAB_API_URL/GITLAB_TOKEN not set - connection may fail", {
+            preset: presetName,
+        });
+    }
+    if (preset.read_only) {
+        process.env.GITLAB_READ_ONLY_MODE = "true";
+        appliedSettings.push("GITLAB_READ_ONLY_MODE=true");
+    }
+    if (preset.denied_tools_regex) {
+        process.env.GITLAB_DENIED_TOOLS_REGEX = preset.denied_tools_regex;
+        appliedSettings.push(`GITLAB_DENIED_TOOLS_REGEX=${preset.denied_tools_regex}`);
+    }
+    if (preset.denied_actions && preset.denied_actions.length > 0) {
+        process.env.GITLAB_DENIED_ACTIONS = preset.denied_actions.join(",");
+        appliedSettings.push(`GITLAB_DENIED_ACTIONS=${preset.denied_actions.join(",")}`);
+    }
+    if (preset.allowed_tools && preset.allowed_tools.length > 0) {
+        process.env.GITLAB_ALLOWED_TOOLS = preset.allowed_tools.join(",");
+        appliedSettings.push(`GITLAB_ALLOWED_TOOLS=${preset.allowed_tools.join(",")}`);
+    }
+    if (preset.features) {
+        for (const [feature, envVar] of Object.entries(FEATURE_ENV_MAP)) {
+            const value = preset.features[feature];
+            if (value !== undefined) {
+                process.env[envVar] = value ? "true" : "false";
+                appliedSettings.push(`${envVar}=${value}`);
+            }
+        }
+    }
+    if (preset.timeout_ms) {
+        process.env.GITLAB_API_HEADERS_TIMEOUT_MS = String(preset.timeout_ms);
+        appliedSettings.push(`GITLAB_API_HEADERS_TIMEOUT_MS=${preset.timeout_ms}`);
+    }
+    (0, logger_1.logInfo)("Preset applied successfully", {
+        preset: presetName,
+        readOnly: preset.read_only ?? false,
+        settingsCount: appliedSettings.length,
+    });
+    return {
+        success: true,
+        presetName,
+        appliedSettings,
+        validation,
+    };
+}
+async function loadAndApplyProfile(profileName) {
+    const loader = new loader_1.ProfileLoader();
+    const profile = await loader.loadProfile(profileName);
+    return applyProfile(profile, profileName);
+}
+async function loadAndApplyPreset(presetName) {
+    const loader = new loader_1.ProfileLoader();
+    const preset = await loader.loadPreset(presetName);
+    return applyPreset(preset, presetName);
+}
+async function tryApplyProfileFromEnv(cliProfileName) {
+    const name = cliProfileName ?? process.env.GITLAB_PROFILE ?? (await getDefaultProfileName());
+    if (!name) {
+        (0, logger_1.logDebug)("No profile specified, using environment variables directly");
+        return undefined;
+    }
+    try {
+        const loader = new loader_1.ProfileLoader();
+        const loaded = await loader.loadAny(name);
+        if (loaded.type === "profile") {
+            return await applyProfile(loaded.data, name);
+        }
+        else {
+            return await applyPreset(loaded.data, name);
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        (0, logger_1.logError)("Failed to apply profile/preset", { profile: name, error: message });
+        throw error;
+    }
+}
+async function getDefaultProfileName() {
+    const loader = new loader_1.ProfileLoader();
+    return loader.getDefaultProfileName();
+}
+//# sourceMappingURL=applicator.js.map

package/dist/src/profiles/applicator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applicator.js","sourceRoot":"","sources":["../../../src/profiles/applicator.ts"],"names":[],"mappings":";;AAuEA,oCAsKC;AAiBD,kCA8EC;AAcD,kDAIC;AAUD,gDAIC;AAWD,wDAyBC;AAxYD,qCAAyC;AACzC,sCAAiE;AASjE,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,iBAAiB;IACvB,UAAU,EAAE,eAAe;IAC3B,SAAS,EAAE,cAAc;IACzB,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,eAAe;IAC1B,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,cAAc;IACxB,YAAY,EAAE,kBAAkB;IAEhC,QAAQ,EAAE,cAAc;IACxB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,YAAY;CACrB,CAAC;AAoCK,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,WAAmB;IAEnB,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAGzD,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAA,gBAAO,EAAC,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;IAGD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,IAAA,iBAAQ,EAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW;YACX,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,eAAe;YACf,UAAU;SACX,CAAC;IACJ,CAAC;IAGD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,IAAI,WAAW,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,MAAM,CAAC;IACpC,eAAe,CAAC,IAAI,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;IAGjD,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,KAAK,KAAK;YACR,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAClD,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC;oBACjC,eAAe,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;YACD,MAAM;QAER,KAAK,OAAO;YACV,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACzD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,QAAQ,CAAC;oBAC9C,eAAe,CAAC,IAAI,CAAC,gCAAgC,OAAO,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACnC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACjE,IAAI,YAAY,EAAE,CAAC;oBACjB,OAAO,CAAC,GAAG,CAAC,0BAA0B,GAAG,YAAY,CAAC;oBACtD,eAAe,CAAC,IAAI,CAClB,oCAAoC,OAAO,CAAC,IAAI,CAAC,iBAAiB,GAAG,CACtE,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,MAAM,CAAC;YACnC,eAAe,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAC3C,MAAM;QAER,KAAK,QAAQ;YACX,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC/D,eAAe,CAAC,IAAI,CAAC,2BAA2B,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM;IACV,CAAC;IAGD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,MAAM,CAAC;QAC3C,eAAe,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,0BAA0B,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5E,eAAe,CAAC,IAAI,CAAC,8BAA8B,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxE,eAAe,CAAC,IAAI,CAAC,4BAA4B,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,eAAe,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACnE,eAAe,CAAC,IAAI,CAAC,6BAA6B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,eAAe,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAGD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAChE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAwC,CAAC,CAAC;YACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC/C,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAGD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvE,eAAe,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IAGD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,MAAM,CAAC;QACrC,eAAe,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAClD,eAAe,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QAChD,eAAe,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC;QACvD,eAAe,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtE,CAAC;IAGD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;QACxD,eAAe,CAAC,IAAI,CAAC,qBAAqB,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACjE,eAAe,CAAC,IAAI,CAAC,4BAA4B,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,IAAA,gBAAO,EAAC,8BAA8B,EAAE;QACtC,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;QAC3B,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;QACpC,aAAa,EAAE,eAAe,CAAC,MAAM;KACtC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,IAAI;QACb,WAAW;QACX,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,eAAe;QACf,UAAU;KACX,CAAC;AACJ,CAAC;AAiBM,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,UAAkB;IAClE,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAGvD,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAA,gBAAO,EAAC,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3C,CAAC;IAGD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,IAAA,iBAAQ,EAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACxF,OAAO;YACL,OAAO,EAAE,KAAK;YACd,UAAU;YACV,eAAe;YACf,UAAU;SACX,CAAC;IACJ,CAAC;IAGD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7D,IAAA,gBAAO,EAAC,8EAA8E,EAAE;YACtF,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,MAAM,CAAC;QAC3C,eAAe,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAClE,eAAe,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,eAAe,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClE,eAAe,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IAGD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAChE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAuC,CAAC,CAAC;YACvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC/C,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAGD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtE,eAAe,CAAC,IAAI,CAAC,iCAAiC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,IAAA,gBAAO,EAAC,6BAA6B,EAAE;QACrC,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;QACnC,aAAa,EAAE,eAAe,CAAC,MAAM;KACtC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU;QACV,eAAe;QACf,UAAU;KACX,CAAC;AACJ,CAAC;AAcM,KAAK,UAAU,mBAAmB,CAAC,WAAmB;IAC3D,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACtD,OAAO,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAC5C,CAAC;AAUM,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACzC,CAAC;AAWM,KAAK,UAAU,sBAAsB,CAC1C,cAAuB;IAGvB,MAAM,IAAI,GAAG,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,MAAM,qBAAqB,EAAE,CAAC,CAAC;IAE7F,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAA,iBAAQ,EAAC,4DAA4D,CAAC,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,OAAO,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAA,iBAAQ,EAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAKD,KAAK,UAAU,qBAAqB;IAClC,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,qBAAqB,EAAE,CAAC;AACxC,CAAC"}

package/dist/src/profiles/builtin/admin.yaml

@@ -0,0 +1,30 @@
+# Admin preset - full access to all features
+#
+# Use with caution - this preset enables all tools
+# including webhooks, integrations, and variables.
+#
+# Recommended only for GitLab administrators.
+#
+# NOTE: This is a PRESET - host/auth come from environment variables.
+
+description: "Full admin access - all features enabled"
+
+read_only: false
+
+features:
+  wiki: true
+  milestones: true
+  pipelines: true
+  labels: true
+  mrs: true
+  files: true
+  variables: true
+  workitems: true
+  webhooks: true
+  snippets: true
+  integrations: true
+  # New entities
+  releases: true
+  refs: true
+  members: true
+  search: true

package/dist/src/profiles/builtin/ci.yaml

@@ -0,0 +1,35 @@
+# CI/CD Bot preset - automation
+#
+# Minimal tools for CI/CD automation:
+# - Pipeline operations
+# - File management
+# - Variables access
+#
+# No access to development workflow tools.
+#
+# NOTE: This is a PRESET - host/auth come from environment variables.
+
+description: "CI/CD Bot - minimal tools for automation"
+
+read_only: false
+
+features:
+  wiki: false
+  milestones: false
+  pipelines: true
+  labels: false
+  mrs: false
+  files: true
+  variables: true
+  workitems: false
+  webhooks: false
+  snippets: false
+  integrations: false
+  # New entities - automation focused
+  releases: true    # Automated releases
+  refs: false       # No branch management
+  members: false    # No team management
+  search: false     # No search needed for CI
+
+# Block workflow-related operations
+denied_tools_regex: "^manage_(work_item|mr|label|milestone|wiki)"