gitlab-mcp-test 6.62.1

package/dist/src/profiles/scope-enforcer.js

@@ -0,0 +1,236 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeEnforcer = exports.ScopeViolationError = void 0;
+exports.isInNamespace = isInNamespace;
+exports.extractProjectsFromArgs = extractProjectsFromArgs;
+exports.extractGroupsFromArgs = extractGroupsFromArgs;
+exports.enforceArgsScope = enforceArgsScope;
+const logger_1 = require("../logger");
+class ScopeViolationError extends Error {
+    attemptedTarget;
+    allowedScope;
+    constructor(attemptedTarget, allowedScope) {
+        const scopeDescription = getScopeDescription(allowedScope);
+        super(`Operation on '${attemptedTarget}' is outside the allowed scope (${scopeDescription})`);
+        this.attemptedTarget = attemptedTarget;
+        this.allowedScope = allowedScope;
+        this.name = "ScopeViolationError";
+    }
+}
+exports.ScopeViolationError = ScopeViolationError;
+function getScopeDescription(scope) {
+    const parts = [];
+    if (scope.project) {
+        parts.push(`project: ${scope.project}`);
+    }
+    if (scope.group) {
+        const subgroupSuffix = scope.includeSubgroups !== false ? "/*" : "";
+        parts.push(`group: ${scope.group}${subgroupSuffix}`);
+    }
+    if (scope.namespace) {
+        parts.push(`namespace: ${scope.namespace}/*`);
+    }
+    if (scope.projects && scope.projects.length > 0) {
+        if (scope.projects.length <= 3) {
+            parts.push(`projects: ${scope.projects.join(", ")}`);
+        }
+        else {
+            parts.push(`${scope.projects.length} allowed projects`);
+        }
+    }
+    if (scope.groups && scope.groups.length > 0) {
+        if (scope.groups.length <= 3) {
+            parts.push(`groups: ${scope.groups.join(", ")}`);
+        }
+        else {
+            parts.push(`${scope.groups.length} allowed groups`);
+        }
+    }
+    return parts.length > 0 ? parts.join("; ") : "unrestricted";
+}
+function normalizeProjectPath(path) {
+    const trimmed = path.trim().replace(/^\/+|\/+$/g, "");
+    if (/^\d+$/.test(trimmed)) {
+        return trimmed;
+    }
+    return trimmed.toLowerCase();
+}
+function isInNamespace(projectPath, namespace) {
+    const normalizedProject = normalizeProjectPath(projectPath);
+    const normalizedNamespace = normalizeProjectPath(namespace);
+    return (normalizedProject === normalizedNamespace ||
+        normalizedProject.startsWith(normalizedNamespace + "/"));
+}
+class ScopeEnforcer {
+    scope;
+    allowedProjectsSet;
+    allowedGroupsSet;
+    includeSubgroups;
+    constructor(scope) {
+        this.scope = scope;
+        this.includeSubgroups = scope.includeSubgroups !== false;
+        this.allowedProjectsSet = new Set((scope.projects ?? []).map(p => normalizeProjectPath(p)));
+        if (scope.project) {
+            this.allowedProjectsSet.add(normalizeProjectPath(scope.project));
+        }
+        this.allowedGroupsSet = new Set((scope.groups ?? []).map(g => normalizeProjectPath(g)));
+        if (scope.group) {
+            this.allowedGroupsSet.add(normalizeProjectPath(scope.group));
+        }
+        (0, logger_1.logDebug)("ScopeEnforcer initialized", {
+            scope: getScopeDescription(scope),
+            allowedProjectsCount: this.allowedProjectsSet.size,
+            allowedGroupsCount: this.allowedGroupsSet.size,
+            includeSubgroups: this.includeSubgroups,
+        });
+    }
+    static fromPreset(preset) {
+        if (!preset.scope) {
+            return null;
+        }
+        return new ScopeEnforcer(preset.scope);
+    }
+    isAllowed(projectPath) {
+        if (!this.hasProjectRestrictions()) {
+            return true;
+        }
+        const normalized = normalizeProjectPath(projectPath);
+        if (this.allowedProjectsSet.size > 0 && this.allowedProjectsSet.has(normalized)) {
+            return true;
+        }
+        if (this.scope.namespace && isInNamespace(projectPath, this.scope.namespace)) {
+            return true;
+        }
+        if (this.allowedGroupsSet.size > 0) {
+            for (const allowedGroup of this.allowedGroupsSet) {
+                if (this.includeSubgroups) {
+                    if (isInNamespace(projectPath, allowedGroup)) {
+                        return true;
+                    }
+                }
+                else {
+                    const parts = normalized.split("/");
+                    if (parts.length >= 2) {
+                        const projectGroup = parts.slice(0, -1).join("/");
+                        if (projectGroup === allowedGroup) {
+                            return true;
+                        }
+                    }
+                }
+            }
+        }
+        if (/^\d+$/.test(normalized)) {
+            (0, logger_1.logWarn)("Numeric project ID not in allowed scope - denying access", {
+                projectId: normalized,
+            });
+            return false;
+        }
+        return false;
+    }
+    isGroupAllowed(groupPath) {
+        if (!this.hasGroupRestrictions()) {
+            return true;
+        }
+        const normalized = normalizeProjectPath(groupPath);
+        if (this.allowedGroupsSet.size > 0 && this.allowedGroupsSet.has(normalized)) {
+            return true;
+        }
+        if (this.includeSubgroups && this.allowedGroupsSet.size > 0) {
+            for (const allowedGroup of this.allowedGroupsSet) {
+                if (isInNamespace(groupPath, allowedGroup)) {
+                    return true;
+                }
+            }
+        }
+        if (this.scope.namespace && isInNamespace(groupPath, this.scope.namespace)) {
+            return true;
+        }
+        if (/^\d+$/.test(normalized)) {
+            (0, logger_1.logWarn)("Numeric group ID not in allowed scope - denying access", { groupId: normalized });
+            return false;
+        }
+        return false;
+    }
+    enforce(projectPath) {
+        if (!this.isAllowed(projectPath)) {
+            (0, logger_1.logWarn)("Project scope violation attempted", {
+                attempted: projectPath,
+                scope: getScopeDescription(this.scope),
+            });
+            throw new ScopeViolationError(projectPath, this.scope);
+        }
+    }
+    enforceGroup(groupPath) {
+        if (!this.isGroupAllowed(groupPath)) {
+            (0, logger_1.logWarn)("Group scope violation attempted", {
+                attempted: groupPath,
+                scope: getScopeDescription(this.scope),
+            });
+            throw new ScopeViolationError(groupPath, this.scope);
+        }
+    }
+    getScope() {
+        return this.scope;
+    }
+    getScopeDescription() {
+        return getScopeDescription(this.scope);
+    }
+    hasProjectRestrictions() {
+        const hasProject = Boolean(this.scope.project);
+        const hasNamespace = Boolean(this.scope.namespace);
+        const hasProjects = Boolean(this.scope.projects && this.scope.projects.length > 0);
+        const hasGroup = Boolean(this.scope.group);
+        const hasGroups = Boolean(this.scope.groups && this.scope.groups.length > 0);
+        return hasProject || hasNamespace || hasProjects || hasGroup || hasGroups;
+    }
+    hasGroupRestrictions() {
+        const hasGroup = Boolean(this.scope.group);
+        const hasNamespace = Boolean(this.scope.namespace);
+        const hasGroups = Boolean(this.scope.groups && this.scope.groups.length > 0);
+        return hasGroup || hasNamespace || hasGroups;
+    }
+    hasRestrictions() {
+        return this.hasProjectRestrictions() || this.hasGroupRestrictions();
+    }
+}
+exports.ScopeEnforcer = ScopeEnforcer;
+function extractProjectsFromArgs(args) {
+    const projects = [];
+    const projectFields = [
+        "project_id",
+        "projectId",
+        "project",
+        "namespace",
+        "namespacePath",
+        "fullPath",
+    ];
+    for (const field of projectFields) {
+        const value = args[field];
+        if (typeof value === "string" && value.trim()) {
+            projects.push(value.trim());
+        }
+    }
+    return projects;
+}
+function extractGroupsFromArgs(args) {
+    const groups = [];
+    const groupFields = ["group_id", "groupId", "group"];
+    for (const field of groupFields) {
+        const value = args[field];
+        if (typeof value === "string" && value.trim()) {
+            groups.push(value.trim());
+        }
+    }
+    return groups;
+}
+function enforceArgsScope(enforcer, args) {
+    const projects = extractProjectsFromArgs(args);
+    for (const project of projects) {
+        enforcer.enforce(project);
+    }
+    const groups = extractGroupsFromArgs(args);
+    for (const group of groups) {
+        enforcer.enforceGroup(group);
+    }
+}
+//# sourceMappingURL=scope-enforcer.js.map

package/dist/src/profiles/scope-enforcer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-enforcer.js","sourceRoot":"","sources":["../../../src/profiles/scope-enforcer.ts"],"names":[],"mappings":";;;AA2FA,sCASC;AAkPD,0DAqBC;AAaD,sDAcC;AAWD,4CAYC;AAhZD,sCAA8C;AAQ9C,MAAa,mBAAoB,SAAQ,KAAK;IAE1B;IACA;IAFlB,YACkB,eAAuB,EACvB,YAAyB;QAEzC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QAC3D,KAAK,CAAC,iBAAiB,eAAe,mCAAmC,gBAAgB,GAAG,CAAC,CAAC;QAJ9E,oBAAe,GAAf,eAAe,CAAQ;QACvB,iBAAY,GAAZ,YAAY,CAAa;QAIzC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AATD,kDASC;AAKD,SAAS,mBAAmB,CAAC,KAAkB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,cAAc,GAAG,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,KAAK,GAAG,cAAc,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,mBAAmB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;AAC9D,CAAC;AASD,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAEtD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;AAC/B,CAAC;AAWD,SAAgB,aAAa,CAAC,WAAmB,EAAE,SAAiB;IAClE,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAG5D,OAAO,CACL,iBAAiB,KAAK,mBAAmB;QACzC,iBAAiB,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,CACxD,CAAC;AACJ,CAAC;AASD,MAAa,aAAa;IACP,KAAK,CAAc;IACnB,kBAAkB,CAAc;IAChC,gBAAgB,CAAc;IAC9B,gBAAgB,CAAU;IAE3C,YAAY,KAAkB;QAC5B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC;QAGzD,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAG5F,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;QAGD,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAGxF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,IAAA,iBAAQ,EAAC,2BAA2B,EAAE;YACpC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;YACjC,oBAAoB,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI;YAClD,kBAAkB,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI;YAC9C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,CAAC;IACL,CAAC;IAMD,MAAM,CAAC,UAAU,CAAC,MAAqB;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAQD,SAAS,CAAC,WAAmB;QAE3B,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAGrD,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACjD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBAE1B,IAAI,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;wBAC7C,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;qBAAM,CAAC;oBAEN,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACpC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;wBACtB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAClD,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;4BAClC,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAID,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,IAAA,gBAAO,EAAC,0DAA0D,EAAE;gBAClE,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAQD,cAAc,CAAC,SAAiB;QAE9B,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAGnD,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACjD,IAAI,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;oBAC3C,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAGD,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QAID,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,IAAA,gBAAO,EAAC,wDAAwD,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAQD,OAAO,CAAC,WAAmB;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,IAAA,gBAAO,EAAC,mCAAmC,EAAE;gBAC3C,SAAS,EAAE,WAAW;gBACtB,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;aACvC,CAAC,CAAC;YACH,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAQD,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,IAAA,gBAAO,EAAC,iCAAiC,EAAE;gBACzC,SAAS,EAAE,SAAS;gBACpB,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;aACvC,CAAC,CAAC;YACH,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAKD,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAKD,mBAAmB;QACjB,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAKD,sBAAsB;QACpB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE7E,OAAO,UAAU,IAAI,YAAY,IAAI,WAAW,IAAI,QAAQ,IAAI,SAAS,CAAC;IAC5E,CAAC;IAKD,oBAAoB;QAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7E,OAAO,QAAQ,IAAI,YAAY,IAAI,SAAS,CAAC;IAC/C,CAAC;IAKD,eAAe;QACb,OAAO,IAAI,CAAC,sBAAsB,EAAE,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACtE,CAAC;CACF;AA5ND,sCA4NC;AAaD,SAAgB,uBAAuB,CAAC,IAA6B;IACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAG9B,MAAM,aAAa,GAAG;QACpB,YAAY;QACZ,WAAW;QACX,SAAS;QACT,WAAW;QACX,eAAe;QACf,UAAU;KACX,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAaD,SAAgB,qBAAqB,CAAC,IAA6B;IACjE,MAAM,MAAM,GAAa,EAAE,CAAC;IAG5B,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAErD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD,SAAgB,gBAAgB,CAAC,QAAuB,EAAE,IAA6B;IAErF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAGD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/src/profiles/types.d.ts

@@ -0,0 +1,261 @@
+import { z } from "zod";
+declare const PatAuthSchema: z.ZodObject<{
+    type: z.ZodLiteral<"pat">;
+    token_env: z.ZodString;
+}, z.core.$strip>;
+declare const OAuthAuthSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    client_id_env: z.ZodString;
+    client_secret_env: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const CookieAuthSchema: z.ZodObject<{
+    type: z.ZodLiteral<"cookie">;
+    cookie_path: z.ZodString;
+}, z.core.$strip>;
+declare const AuthConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"pat">;
+    token_env: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    client_id_env: z.ZodString;
+    client_secret_env: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"cookie">;
+    cookie_path: z.ZodString;
+}, z.core.$strip>], "type">;
+declare const FeatureFlagsSchema: z.ZodOptional<z.ZodObject<{
+    wiki: z.ZodOptional<z.ZodBoolean>;
+    milestones: z.ZodOptional<z.ZodBoolean>;
+    pipelines: z.ZodOptional<z.ZodBoolean>;
+    labels: z.ZodOptional<z.ZodBoolean>;
+    mrs: z.ZodOptional<z.ZodBoolean>;
+    files: z.ZodOptional<z.ZodBoolean>;
+    variables: z.ZodOptional<z.ZodBoolean>;
+    workitems: z.ZodOptional<z.ZodBoolean>;
+    webhooks: z.ZodOptional<z.ZodBoolean>;
+    snippets: z.ZodOptional<z.ZodBoolean>;
+    integrations: z.ZodOptional<z.ZodBoolean>;
+    releases: z.ZodOptional<z.ZodBoolean>;
+    refs: z.ZodOptional<z.ZodBoolean>;
+    members: z.ZodOptional<z.ZodBoolean>;
+    search: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>>;
+export declare const ProfileSchema: z.ZodObject<{
+    host: z.ZodString;
+    api_url: z.ZodOptional<z.ZodString>;
+    auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"pat">;
+        token_env: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"oauth">;
+        client_id_env: z.ZodString;
+        client_secret_env: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"cookie">;
+        cookie_path: z.ZodString;
+    }, z.core.$strip>], "type">;
+    read_only: z.ZodOptional<z.ZodBoolean>;
+    allowed_projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowed_groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    denied_tools_regex: z.ZodOptional<z.ZodString>;
+    allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    denied_actions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    features: z.ZodOptional<z.ZodObject<{
+        wiki: z.ZodOptional<z.ZodBoolean>;
+        milestones: z.ZodOptional<z.ZodBoolean>;
+        pipelines: z.ZodOptional<z.ZodBoolean>;
+        labels: z.ZodOptional<z.ZodBoolean>;
+        mrs: z.ZodOptional<z.ZodBoolean>;
+        files: z.ZodOptional<z.ZodBoolean>;
+        variables: z.ZodOptional<z.ZodBoolean>;
+        workitems: z.ZodOptional<z.ZodBoolean>;
+        webhooks: z.ZodOptional<z.ZodBoolean>;
+        snippets: z.ZodOptional<z.ZodBoolean>;
+        integrations: z.ZodOptional<z.ZodBoolean>;
+        releases: z.ZodOptional<z.ZodBoolean>;
+        refs: z.ZodOptional<z.ZodBoolean>;
+        members: z.ZodOptional<z.ZodBoolean>;
+        search: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    timeout_ms: z.ZodOptional<z.ZodNumber>;
+    default_project: z.ZodOptional<z.ZodString>;
+    default_namespace: z.ZodOptional<z.ZodString>;
+    skip_tls_verify: z.ZodOptional<z.ZodBoolean>;
+    ssl_cert_path: z.ZodOptional<z.ZodString>;
+    ssl_key_path: z.ZodOptional<z.ZodString>;
+    ca_cert_path: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const ScopeConfigSchema: z.ZodObject<{
+    project: z.ZodOptional<z.ZodString>;
+    group: z.ZodOptional<z.ZodString>;
+    namespace: z.ZodOptional<z.ZodString>;
+    projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    includeSubgroups: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const PresetSchema: z.ZodObject<{
+    description: z.ZodOptional<z.ZodString>;
+    read_only: z.ZodOptional<z.ZodBoolean>;
+    denied_tools_regex: z.ZodOptional<z.ZodString>;
+    allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    denied_actions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    scope: z.ZodOptional<z.ZodObject<{
+        project: z.ZodOptional<z.ZodString>;
+        group: z.ZodOptional<z.ZodString>;
+        namespace: z.ZodOptional<z.ZodString>;
+        projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        includeSubgroups: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    features: z.ZodOptional<z.ZodObject<{
+        wiki: z.ZodOptional<z.ZodBoolean>;
+        milestones: z.ZodOptional<z.ZodBoolean>;
+        pipelines: z.ZodOptional<z.ZodBoolean>;
+        labels: z.ZodOptional<z.ZodBoolean>;
+        mrs: z.ZodOptional<z.ZodBoolean>;
+        files: z.ZodOptional<z.ZodBoolean>;
+        variables: z.ZodOptional<z.ZodBoolean>;
+        workitems: z.ZodOptional<z.ZodBoolean>;
+        webhooks: z.ZodOptional<z.ZodBoolean>;
+        snippets: z.ZodOptional<z.ZodBoolean>;
+        integrations: z.ZodOptional<z.ZodBoolean>;
+        releases: z.ZodOptional<z.ZodBoolean>;
+        refs: z.ZodOptional<z.ZodBoolean>;
+        members: z.ZodOptional<z.ZodBoolean>;
+        search: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    timeout_ms: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const ProfilesConfigSchema: z.ZodObject<{
+    profiles: z.ZodRecord<z.ZodString, z.ZodObject<{
+        host: z.ZodString;
+        api_url: z.ZodOptional<z.ZodString>;
+        auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"pat">;
+            token_env: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            client_id_env: z.ZodString;
+            client_secret_env: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"cookie">;
+            cookie_path: z.ZodString;
+        }, z.core.$strip>], "type">;
+        read_only: z.ZodOptional<z.ZodBoolean>;
+        allowed_projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        allowed_groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        denied_tools_regex: z.ZodOptional<z.ZodString>;
+        allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        denied_actions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        features: z.ZodOptional<z.ZodObject<{
+            wiki: z.ZodOptional<z.ZodBoolean>;
+            milestones: z.ZodOptional<z.ZodBoolean>;
+            pipelines: z.ZodOptional<z.ZodBoolean>;
+            labels: z.ZodOptional<z.ZodBoolean>;
+            mrs: z.ZodOptional<z.ZodBoolean>;
+            files: z.ZodOptional<z.ZodBoolean>;
+            variables: z.ZodOptional<z.ZodBoolean>;
+            workitems: z.ZodOptional<z.ZodBoolean>;
+            webhooks: z.ZodOptional<z.ZodBoolean>;
+            snippets: z.ZodOptional<z.ZodBoolean>;
+            integrations: z.ZodOptional<z.ZodBoolean>;
+            releases: z.ZodOptional<z.ZodBoolean>;
+            refs: z.ZodOptional<z.ZodBoolean>;
+            members: z.ZodOptional<z.ZodBoolean>;
+            search: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        timeout_ms: z.ZodOptional<z.ZodNumber>;
+        default_project: z.ZodOptional<z.ZodString>;
+        default_namespace: z.ZodOptional<z.ZodString>;
+        skip_tls_verify: z.ZodOptional<z.ZodBoolean>;
+        ssl_cert_path: z.ZodOptional<z.ZodString>;
+        ssl_key_path: z.ZodOptional<z.ZodString>;
+        ca_cert_path: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    default_profile: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const ProjectPresetSchema: z.ZodObject<{
+    description: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodObject<{
+        project: z.ZodOptional<z.ZodString>;
+        group: z.ZodOptional<z.ZodString>;
+        namespace: z.ZodOptional<z.ZodString>;
+        projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        includeSubgroups: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    features: z.ZodOptional<z.ZodObject<{
+        wiki: z.ZodOptional<z.ZodBoolean>;
+        milestones: z.ZodOptional<z.ZodBoolean>;
+        pipelines: z.ZodOptional<z.ZodBoolean>;
+        labels: z.ZodOptional<z.ZodBoolean>;
+        mrs: z.ZodOptional<z.ZodBoolean>;
+        files: z.ZodOptional<z.ZodBoolean>;
+        variables: z.ZodOptional<z.ZodBoolean>;
+        workitems: z.ZodOptional<z.ZodBoolean>;
+        webhooks: z.ZodOptional<z.ZodBoolean>;
+        snippets: z.ZodOptional<z.ZodBoolean>;
+        integrations: z.ZodOptional<z.ZodBoolean>;
+        releases: z.ZodOptional<z.ZodBoolean>;
+        refs: z.ZodOptional<z.ZodBoolean>;
+        members: z.ZodOptional<z.ZodBoolean>;
+        search: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    denied_actions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    denied_tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    read_only: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const ProjectProfileSchema: z.ZodObject<{
+    description: z.ZodOptional<z.ZodString>;
+    extends: z.ZodOptional<z.ZodString>;
+    features: z.ZodOptional<z.ZodObject<{
+        wiki: z.ZodOptional<z.ZodBoolean>;
+        milestones: z.ZodOptional<z.ZodBoolean>;
+        pipelines: z.ZodOptional<z.ZodBoolean>;
+        labels: z.ZodOptional<z.ZodBoolean>;
+        mrs: z.ZodOptional<z.ZodBoolean>;
+        files: z.ZodOptional<z.ZodBoolean>;
+        variables: z.ZodOptional<z.ZodBoolean>;
+        workitems: z.ZodOptional<z.ZodBoolean>;
+        webhooks: z.ZodOptional<z.ZodBoolean>;
+        snippets: z.ZodOptional<z.ZodBoolean>;
+        integrations: z.ZodOptional<z.ZodBoolean>;
+        releases: z.ZodOptional<z.ZodBoolean>;
+        refs: z.ZodOptional<z.ZodBoolean>;
+        members: z.ZodOptional<z.ZodBoolean>;
+        search: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    additional_tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    denied_tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export interface ProjectConfig {
+    configPath: string;
+    preset?: ProjectPreset;
+    profile?: ProjectProfile;
+}
+export type PatAuth = z.infer<typeof PatAuthSchema>;
+export type OAuthAuth = z.infer<typeof OAuthAuthSchema>;
+export type CookieAuth = z.infer<typeof CookieAuthSchema>;
+export type AuthConfig = z.infer<typeof AuthConfigSchema>;
+export type FeatureFlags = z.infer<typeof FeatureFlagsSchema>;
+export type ScopeConfig = z.infer<typeof ScopeConfigSchema>;
+export type Profile = z.infer<typeof ProfileSchema>;
+export type Preset = z.infer<typeof PresetSchema>;
+export type ProfilesConfig = z.infer<typeof ProfilesConfigSchema>;
+export type ProjectPreset = z.infer<typeof ProjectPresetSchema>;
+export type ProjectProfile = z.infer<typeof ProjectProfileSchema>;
+export interface ProfileInfo {
+    name: string;
+    host?: string;
+    authType?: "pat" | "oauth" | "cookie";
+    readOnly: boolean;
+    isBuiltIn: boolean;
+    isPreset: boolean;
+    description?: string;
+}
+export interface ProfileValidationResult {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+}
+export {};

package/dist/src/profiles/types.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProjectProfileSchema = exports.ProjectPresetSchema = exports.ProfilesConfigSchema = exports.PresetSchema = exports.ScopeConfigSchema = exports.ProfileSchema = void 0;
+const zod_1 = require("zod");
+const PatAuthSchema = zod_1.z.object({
+    type: zod_1.z.literal("pat"),
+    token_env: zod_1.z.string().describe("Environment variable containing the PAT token"),
+});
+const OAuthAuthSchema = zod_1.z.object({
+    type: zod_1.z.literal("oauth"),
+    client_id_env: zod_1.z.string().describe("Environment variable containing OAuth client ID"),
+    client_secret_env: zod_1.z
+        .string()
+        .optional()
+        .describe("Environment variable containing OAuth client secret"),
+});
+const CookieAuthSchema = zod_1.z.object({
+    type: zod_1.z.literal("cookie"),
+    cookie_path: zod_1.z.string().describe("Path to cookie file for authentication"),
+});
+const AuthConfigSchema = zod_1.z.discriminatedUnion("type", [
+    PatAuthSchema,
+    OAuthAuthSchema,
+    CookieAuthSchema,
+]);
+const FeatureFlagsSchema = zod_1.z
+    .object({
+    wiki: zod_1.z.boolean().optional(),
+    milestones: zod_1.z.boolean().optional(),
+    pipelines: zod_1.z.boolean().optional(),
+    labels: zod_1.z.boolean().optional(),
+    mrs: zod_1.z.boolean().optional(),
+    files: zod_1.z.boolean().optional(),
+    variables: zod_1.z.boolean().optional(),
+    workitems: zod_1.z.boolean().optional(),
+    webhooks: zod_1.z.boolean().optional(),
+    snippets: zod_1.z.boolean().optional(),
+    integrations: zod_1.z.boolean().optional(),
+    releases: zod_1.z.boolean().optional(),
+    refs: zod_1.z.boolean().optional(),
+    members: zod_1.z.boolean().optional(),
+    search: zod_1.z.boolean().optional(),
+})
+    .optional();
+exports.ProfileSchema = zod_1.z.object({
+    host: zod_1.z.string().describe("GitLab hostname (e.g., gitlab.company.com)"),
+    api_url: zod_1.z.string().url().optional().describe("Override API URL (default: https://{host})"),
+    auth: AuthConfigSchema,
+    read_only: zod_1.z.boolean().optional().describe("Enable read-only mode"),
+    allowed_projects: zod_1.z
+        .array(zod_1.z.string())
+        .optional()
+        .describe("Project whitelist (empty = all allowed)"),
+    allowed_groups: zod_1.z.array(zod_1.z.string()).optional().describe("Group whitelist (empty = all allowed)"),
+    denied_tools_regex: zod_1.z.string().optional().describe("Regex pattern to exclude tools"),
+    allowed_tools: zod_1.z
+        .array(zod_1.z.string())
+        .optional()
+        .describe("Explicit tool whitelist (overrides denied_tools_regex)"),
+    denied_actions: zod_1.z.array(zod_1.z.string()).optional().describe("Denied actions in format 'tool:action'"),
+    features: FeatureFlagsSchema,
+    timeout_ms: zod_1.z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("API headers timeout in milliseconds (maps to GITLAB_API_HEADERS_TIMEOUT_MS)"),
+    default_project: zod_1.z.string().optional().describe("Auto-set project context"),
+    default_namespace: zod_1.z.string().optional().describe("Auto-set namespace context"),
+    skip_tls_verify: zod_1.z.boolean().optional().describe("Skip TLS certificate verification"),
+    ssl_cert_path: zod_1.z.string().optional().describe("Path to SSL certificate"),
+    ssl_key_path: zod_1.z.string().optional().describe("Path to SSL key"),
+    ca_cert_path: zod_1.z.string().optional().describe("Path to CA certificate"),
+});
+exports.ScopeConfigSchema = zod_1.z
+    .object({
+    project: zod_1.z.string().optional().describe("Single project path (e.g., group/project)"),
+    group: zod_1.z.string().optional().describe("Single group path (e.g., my-group or parent/child)"),
+    namespace: zod_1.z.string().optional().describe("Namespace/group path"),
+    projects: zod_1.z.array(zod_1.z.string()).optional().describe("List of allowed project paths"),
+    groups: zod_1.z.array(zod_1.z.string()).optional().describe("List of allowed group paths"),
+    includeSubgroups: zod_1.z
+        .boolean()
+        .optional()
+        .describe("Include subgroups when group scope is set (default: true)"),
+})
+    .refine(data => {
+    const hasProject = data.project !== undefined;
+    const hasGroup = data.group !== undefined;
+    const hasNamespace = data.namespace !== undefined;
+    const hasProjects = data.projects !== undefined && data.projects.length > 0;
+    const hasGroups = data.groups !== undefined && data.groups.length > 0;
+    return hasProject || hasGroup || hasNamespace || hasProjects || hasGroups;
+}, { message: "Scope must define at least one of: project, group, namespace, projects, or groups" })
+    .refine(data => {
+    if (data.project && data.projects && data.projects.length > 0) {
+        return false;
+    }
+    return true;
+}, { message: "Cannot combine 'project' with 'projects' - use one or the other" })
+    .refine(data => {
+    if (data.group && data.groups && data.groups.length > 0) {
+        return false;
+    }
+    return true;
+}, { message: "Cannot combine 'group' with 'groups' - use one or the other" });
+exports.PresetSchema = zod_1.z
+    .object({
+    description: zod_1.z.string().optional().describe("Human-readable description of the preset"),
+    read_only: zod_1.z.boolean().optional().describe("Enable read-only mode"),
+    denied_tools_regex: zod_1.z.string().optional().describe("Regex pattern to exclude tools"),
+    allowed_tools: zod_1.z.array(zod_1.z.string()).optional().describe("Explicit tool whitelist"),
+    denied_actions: zod_1.z
+        .array(zod_1.z.string())
+        .optional()
+        .describe("Denied actions in format 'tool:action'"),
+    scope: exports.ScopeConfigSchema.optional().describe("Runtime scope restrictions for projects/groups"),
+    features: FeatureFlagsSchema,
+    timeout_ms: zod_1.z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("API headers timeout in milliseconds (maps to GITLAB_API_HEADERS_TIMEOUT_MS)"),
+})
+    .strict();
+exports.ProfilesConfigSchema = zod_1.z.object({
+    profiles: zod_1.z.record(zod_1.z.string(), exports.ProfileSchema).describe("Named profiles"),
+    default_profile: zod_1.z.string().optional().describe("Default profile when none specified"),
+});
+exports.ProjectPresetSchema = zod_1.z
+    .object({
+    description: zod_1.z.string().optional().describe("Description of project restrictions"),
+    scope: exports.ScopeConfigSchema.optional().describe("Project/namespace scope restrictions"),
+    features: FeatureFlagsSchema,
+    denied_actions: zod_1.z
+        .array(zod_1.z.string())
+        .optional()
+        .describe("Denied actions in format 'tool:action'"),
+    denied_tools: zod_1.z.array(zod_1.z.string()).optional().describe("List of denied tool names"),
+    read_only: zod_1.z.boolean().optional().describe("Enable read-only mode"),
+})
+    .strict();
+exports.ProjectProfileSchema = zod_1.z
+    .object({
+    description: zod_1.z.string().optional().describe("Description of project configuration"),
+    extends: zod_1.z.string().optional().describe("Built-in preset name to inherit from"),
+    features: FeatureFlagsSchema,
+    additional_tools: zod_1.z.array(zod_1.z.string()).optional().describe("Additional tools to enable"),
+    denied_tools: zod_1.z.array(zod_1.z.string()).optional().describe("Tools to disable"),
+})
+    .strict();
+//# sourceMappingURL=types.js.map