@gjsify/cli 0.44.0 → 0.45.0

package/lib/commands/trust.d.ts

@@ -20,6 +20,12 @@ export interface TrustRequestResult {
     status: number;
     json: unknown;
     text: string;
+    /**
+     * Response headers, so a caller can honour npm's own `Retry-After` on a 429
+     * instead of guessing a backoff. Optional because test doubles construct this
+     * shape by hand and a missing header is a well-defined "it said nothing".
+     */
+    headers?: Headers;
 }
 /** A `(method, url, body?) => TrustRequestResult` function bound to a registry auth + OTP context. */
 export type TrustRequester = (method: string, url: string, body?: unknown) => Promise<TrustRequestResult>;

package/lib/commands/trust.js

@@ -279,7 +279,7 @@ export function createTrustRequester(ctx) {
         catch {
             /* non-JSON body — leave json undefined */
         }
-        return { status: res.status, json, text };
+        return { status: res.status, json, text, headers: res.headers };
     };
 }
 function firstLine(s) {

package/lib/types/config-data.d.ts

@@ -430,7 +430,15 @@ export interface ConfigDataShip extends AppMetadata {
     release?: string;
     /** `Maintainer:` / `Packager:` as `Name <email>`. Default: `package.json#author`. */
     maintainer?: string;
-    /** Formats to build when `--target` is not given. Default `['deb', 'rpm']`. */
+    /**
+     * Formats to build when `--target` is not given. Default `['deb', 'rpm']`.
+     *
+     * A project-level DEFAULT, so it is filtered to the layout `gjsify ship <os>`
+     * assembles rather than refused against it — a name here that wraps another
+     * OS's layout is dropped, and `gjsify ship` prints which. A `--target` on the
+     * command line is a claim about ONE run and is refused instead. Without that
+     * split, declaring this key made `gjsify ship darwin --stage` impossible.
+     */
     targets?: string[];
     /** Output root, relative to the project. Default `'ship'`. */
     outDir?: string;
@@ -457,6 +465,18 @@ export interface ConfigDataShip extends AppMetadata {
      * start.
      */
     minGjsVersion?: string;
+    /**
+     * Minimum Node major the emitted dependency asks for, when the payload is a
+     * `--app node` bundle. Default `'24'` — the LTS line the
+     * `@gjsify/node-runtime-*` packages bundle for macOS and Windows.
+     *
+     * Lower it only if the bundle genuinely runs on an older Node. The default
+     * excludes every current DEB stable/LTS (trixie 20, Ubuntu 24.04 18, Ubuntu
+     * 26.04 22), so it makes a `.deb` that apt refuses there rather than one that
+     * installs and then dies on the first unsupported syntax — the same trade
+     * `minGjsVersion` makes, and `gjsify ship` warns about it either way.
+     */
+    minNodeVersion?: string;
     /**
      * Runtime dependencies appended to the set derived from the bundle's
      * `gi://` imports — the escape hatch for a namespace the table does not
@@ -519,6 +539,48 @@ export interface ConfigDataShip extends AppMetadata {
      * NOT move, is `utils/ship/flatpak-config.ts`.
      */
     flatpak?: ShipFlatpakOptions;
+    /**
+     * The signing identity this project uses by default, per OS.
+     *
+     * `--sign <identity>` on the command line wins. Absent means unsigned, which
+     * is the default path and a legitimate output (ADR 0024 § A13).
+     */
+    sign?: ShipSignOptions;
+}
+/**
+ * `gjsify.ship.sign` — an IDENTITY per OS, and never a certificate.
+ *
+ * KEYED PER OS, and the two keys must not be one field: a Developer ID string
+ * and an Authenticode subject name live in different namespaces, and the value
+ * that resolves is chosen by the LAYOUT being packed (`FormatDescriptor.layoutOs`
+ * and the stage manifest's `target.os`), not by the host doing the packing
+ * (ADR 0024 § A12).
+ *
+ * `linux` is deliberately absent: a `.deb` and an `.rpm` carry no per-file
+ * signature — the artifact is signed as a whole by the repository that serves
+ * it, with that repository's key. A key here would look like it did something.
+ *
+ * WHAT IS NOT HERE, and each is a decision rather than an omission:
+ *  - a certificate, a `.p12` path or a password. `codesign` and `signtool` are
+ *    handed a NAME and resolve the private key themselves, so `gjsify ship`
+ *    never sees a secret and nothing on this surface has to be redacted from a
+ *    log line (§ A14).
+ *  - an `entitlements` key. § A16 leaves library validation vs. hardened runtime
+ *    explicitly unmeasured, and a config key for an unmeasured mechanism is a
+ *    promise the implementation cannot keep.
+ *  - a notarisation credential. That is a per-RUN account credential, not a
+ *    machine-held identity, and a config key for one is an invitation to commit
+ *    it — `--notarize <keychain-profile>` is the only way to pass it.
+ */
+export interface ShipSignOptions {
+    /** `codesign --sign <identity>`. `'-'` is ad-hoc and needs no developer identity. */
+    darwin?: {
+        identity?: string;
+    };
+    /** `signtool sign /n <identity>` — the certificate's SUBJECT NAME in a Windows store. */
+    win32?: {
+        identity?: string;
+    };
 }
 /**
  * The Flatpak knobs `gjsify ship` reads. Every one has a derived default.

package/lib/utils/msgfmt-merge.d.ts

@@ -0,0 +1,35 @@
+/** Which of msgfmt's two template writers to run. */
+export type MsgfmtMergeMode = '--desktop' | '--xml';
+/** One catalogue: the language tag msgfmt is TOLD, and the `.po` holding it. */
+export interface MsgfmtCatalogue {
+    /** Passed as `--locale=`. Named explicitly so no `LINGUAS` file is needed — constraint 2. */
+    locale: string;
+    /** Path to a `.po`. msgfmt reads only this format here: a `.mo` gives `syntax error`, exit 1. */
+    po: string;
+}
+export interface MsgfmtMergeOptions {
+    mode: MsgfmtMergeMode;
+    /** The file the FIRST call substitutes into. Every later call substitutes into the previous output. */
+    template: string;
+    /** The suffix every intermediate keeps — load-bearing for `--xml`, see constraint 4. */
+    extension: string;
+    catalogues: readonly MsgfmtCatalogue[];
+    /** A directory this function may fill with intermediates; the caller owns its removal. */
+    workDir: string;
+    /** Called with each msgfmt argv, for `--verbose`. */
+    onCall?: (args: readonly string[]) => void;
+}
+/**
+ * Fold every catalogue into one file, chaining `msgfmt` once per language.
+ *
+ * Returns the PATH of the last file written — the caller decides whether to read
+ * it, post-process it or copy it. With no catalogues that is `template` itself,
+ * so a project with nothing to merge never spawns msgfmt at all.
+ *
+ * `stdio: 'pipe'` so a failure's stderr survives on the thrown error rather than
+ * going to the terminal and leaving the caller with an exit code.
+ *
+ * Throws when two catalogues name the same locale — constraint 5, which msgfmt
+ * itself reports as two successes and one invalid file.
+ */
+export declare function mergeCatalogues(options: MsgfmtMergeOptions): string;

package/lib/utils/msgfmt-merge.js

@@ -0,0 +1,102 @@
+// Merging gettext catalogues INTO a template — the `msgfmt --desktop` / `--xml` half.
+//
+// Two callers need this and they are not variants of each other: `gjsify gettext`
+// substitutes a template a user wrote, `gjsify ship` substitutes metadata it just
+// rendered. What they share is every constraint below, all five measured against
+// GNU gettext 0.26, and each one fails a DIFFERENT way — two of them silently.
+// Written twice, the silent ones are the copies that lose them.
+//
+//  1. `--desktop` and `--xml` REQUIRE `--template`:
+//     `msgfmt: --desktop requires a "--template template" specification`, exit 1.
+//     Neither format can be produced from `.po` files alone, so a caller without a
+//     template has nothing to ask for.
+//
+//  2. The bulk form (`-d <podir>`) fails SILENTLY. With no `LINGUAS` file beside
+//     the `.po` files:
+//         msgfmt --desktop --template=app.desktop.in -d po -o out.desktop
+//         exit 0 · stderr `po/LINGUAS does not exist` · out.desktop UNTRANSLATED
+//     and `desktop-file-validate out.desktop` then exits 0 as well. Exit 0, an
+//     English file and a passing oracle is the worst of the three outcomes, which
+//     is why this module names each language with `--locale=` instead: that form
+//     needs no `LINGUAS` and cannot degrade to a no-op without a non-zero exit.
+//
+//  3. The template and the output must never be the SAME path. msgfmt truncates
+//     `--output-file` before it reads the template, so chaining in place destroys
+//     it: measured, `--desktop` wrote a 0-byte file and exited 0, `--xml` printed
+//     `cannot read <file>: Document is empty` and died on SIGSEGV (exit 139).
+//     Hence the numbered intermediates below rather than one file rewritten.
+//
+//  4. `--xml` finds its ITS rules by FILENAME PATTERN, not by reading the document.
+//     gettext walks `/usr/share/gettext/its/*.loc`, where each rule pairs a glob
+//     with a root element; AppStream's is `pattern="*.metainfo.xml"` +
+//     `localName="component"`, so the same bytes named `foo.xml` die with
+//     `msgfmt: cannot locate ITS rules for foo.xml` (exit 1). `extension` is
+//     therefore part of this function's contract, not a temp-file detail.
+//
+//     Stated as "`--xml` needs a `.metainfo.xml` name" the rule would be wrong in
+//     the direction that matters next: `shared-mime-info.loc` pairs `pattern="*.xml"`
+//     with `localName="mime-info"`, so a MIME package needs no suffix care at all.
+//     The constraint belongs to the AppStream rule, not to `--xml`.
+//
+//  5. A locale may appear at most ONCE in a chain. Two calls naming the same
+//     `--locale` both APPEND — neither replaces the other's key — and the result
+//     is a file BOTH oracles reject, from two exit-0 msgfmt calls:
+//         msgfmt --desktop --template=app.desktop.in --locale=de -o d0 a.po  # 0
+//         msgfmt --desktop --template=d0             --locale=de -o d1 b.po  # 0
+//         desktop-file-validate d1
+//           → error: file contains multiple keys named "Name[de]"            # 1
+//         appstreamcli validate --no-net x1.metainfo.xml   (same shape, --xml)
+//           → E: tag-duplicated name (lang=de) · Validation failed           # 3
+//     So this is worse than constraint 2: not an untranslated file that installs
+//     fine, but an INVALID one, produced without a single non-zero exit. It is
+//     refused here rather than deduplicated here, because the caller holding two
+//     catalogues for one language is the only party that can say which
+//     translation wins — `utils/ship/localize-metadata.ts` answers it with
+//     `msgcat --use-first`.
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+/**
+ * Fold every catalogue into one file, chaining `msgfmt` once per language.
+ *
+ * Returns the PATH of the last file written — the caller decides whether to read
+ * it, post-process it or copy it. With no catalogues that is `template` itself,
+ * so a project with nothing to merge never spawns msgfmt at all.
+ *
+ * `stdio: 'pipe'` so a failure's stderr survives on the thrown error rather than
+ * going to the terminal and leaving the caller with an exit code.
+ *
+ * Throws when two catalogues name the same locale — constraint 5, which msgfmt
+ * itself reports as two successes and one invalid file.
+ */
+export function mergeCatalogues(options) {
+    let current = options.template;
+    // BEFORE the first spawn, so a caller that got this wrong is told rather than
+    // handed a half-written chain to clean up. `seen` is a Set of the locale, not
+    // of the catalogue: the same language reached through two `.po` files is
+    // exactly the case that produces the duplicate key.
+    const seen = new Set();
+    for (const { locale } of options.catalogues) {
+        if (seen.has(locale)) {
+            throw new Error(`mergeCatalogues: two catalogues both claim locale "${locale}". msgfmt APPENDS each ` +
+                `--locale, so the chain would emit a duplicate key (desktop-file-validate: ` +
+                `"multiple keys named Name[${locale}]"; appstreamcli: "tag-duplicated") from two ` +
+                'exit-0 calls. Merge them into one .po first (msgcat --use-first) and pass that.');
+        }
+        seen.add(locale);
+    }
+    for (const [index, catalogue] of options.catalogues.entries()) {
+        const next = join(options.workDir, `${index}${options.extension}`);
+        const args = [
+            options.mode,
+            `--template=${current}`,
+            `--locale=${catalogue.locale}`,
+            `--output-file=${next}`,
+            catalogue.po,
+        ];
+        options.onCall?.(args);
+        execFileSync('msgfmt', args, { stdio: 'pipe' });
+        // Every language after the first merges INTO what the previous one wrote.
+        current = next;
+    }
+    return current;
+}

package/lib/utils/npm-otp.d.ts

@@ -31,6 +31,23 @@ export declare class OtpProvider {
     private cached;
     private readonly promptFn;
     private readonly registry;
+    /**
+     * Bumped every time a NEW code becomes current. Concurrent callers compare the
+     * epoch they last saw against this one to tell "my code was rejected" from
+     * "somebody already replaced it while I was waiting" — the second needs no
+     * prompt, it needs the other one's code.
+     */
+    private generation;
+    /**
+     * The prompt currently on screen, if any. THE fix for a sweep that probes with
+     * concurrency > 1: `promptLine` puts the terminal in RAW mode and echoes each
+     * keystroke by hand (utils/prompt.ts), so two live prompts mean two `data`
+     * listeners on the same stdin and every digit is echoed TWICE. Measured on a
+     * real 703-package sweep at the default concurrency of 4: five prompts stacked
+     * up and the typed code came back as `666644440000999944444444` — four echoes
+     * per keystroke. Whoever arrives second awaits this promise instead.
+     */
+    private pending;
     /**
      * @param seed     Initial cached code (from `--otp`), or undefined.
      * @param promptFn How to read a fresh code. Defaults to the TTY-aware
@@ -41,17 +58,25 @@ export declare class OtpProvider {
     constructor(seed?: string, promptFn?: OtpPromptFn, options?: OtpProviderOptions);
     /** The currently cached OTP code, if any. */
     current(): string | undefined;
+    /**
+     * How many times a new code has become current. Capture it before an attempt
+     * and hand it back to {@link refresh} / {@link invalidate} so a concurrent
+     * caller neither prompts for a code somebody already typed nor throws that
+     * code away on its own stale rejection.
+     */
+    epoch(): number;
     /**
      * Prompt for a fresh code, cache it (in-process + file cache), and return the
      * trimmed input — `''` when nothing was entered, which callers read as "give up".
      */
-    refresh(question?: string): Promise<string>;
+    refresh(question?: string, sinceEpoch?: number): Promise<string>;
+    private promptOnce;
     /**
      * Drop the cached code (in-process AND the cross-invocation file entry) after npm
      * rejects it, so the NEXT command re-prompts instead of replaying a single-use
      * code the registry already burned.
      */
-    invalidate(): void;
+    invalidate(sinceEpoch?: number): void;
 }
 export interface OtpRetryOptions {
     /**

package/lib/utils/npm-otp.js

@@ -14,6 +14,15 @@
 import { promptLine } from './prompt.js';
 import { clearCachedOtp, readCachedOtp, writeCachedOtp } from './npm-otp-cache.js';
 const DEFAULT_QUESTION = 'This operation requires a one-time password.\nEnter OTP: ';
+/**
+ * The question for every prompt AFTER the first one in a run.
+ *
+ * A long sweep outlives a TOTP window (npm codes last ~30 s), so it legitimately
+ * asks again — but repeating the first-time wording makes that read as "it did
+ * not take my code" rather than "that code has aged out". The user then retypes
+ * the SAME digits, which is the one answer guaranteed not to work.
+ */
+const RENEW_QUESTION = 'The previous one-time password is no longer valid (npm codes last about 30 seconds).\nEnter a NEW OTP: ';
 /**
  * True when a response is an npm OTP / 2FA challenge (401 + a `www-authenticate`
  * header naming `otp`, or a body mentioning a one-time password / `EOTP`).
@@ -44,6 +53,23 @@ export class OtpProvider {
     cached;
     promptFn;
     registry;
+    /**
+     * Bumped every time a NEW code becomes current. Concurrent callers compare the
+     * epoch they last saw against this one to tell "my code was rejected" from
+     * "somebody already replaced it while I was waiting" — the second needs no
+     * prompt, it needs the other one's code.
+     */
+    generation = 0;
+    /**
+     * The prompt currently on screen, if any. THE fix for a sweep that probes with
+     * concurrency > 1: `promptLine` puts the terminal in RAW mode and echoes each
+     * keystroke by hand (utils/prompt.ts), so two live prompts mean two `data`
+     * listeners on the same stdin and every digit is echoed TWICE. Measured on a
+     * real 703-package sweep at the default concurrency of 4: five prompts stacked
+     * up and the typed code came back as `666644440000999944444444` — four echoes
+     * per keystroke. Whoever arrives second awaits this promise instead.
+     */
+    pending;
     /**
      * @param seed     Initial cached code (from `--otp`), or undefined.
      * @param promptFn How to read a fresh code. Defaults to the TTY-aware
@@ -71,14 +97,46 @@ export class OtpProvider {
     current() {
         return this.cached;
     }
+    /**
+     * How many times a new code has become current. Capture it before an attempt
+     * and hand it back to {@link refresh} / {@link invalidate} so a concurrent
+     * caller neither prompts for a code somebody already typed nor throws that
+     * code away on its own stale rejection.
+     */
+    epoch() {
+        return this.generation;
+    }
     /**
      * Prompt for a fresh code, cache it (in-process + file cache), and return the
      * trimmed input — `''` when nothing was entered, which callers read as "give up".
      */
-    async refresh(question = DEFAULT_QUESTION) {
+    async refresh(question, sinceEpoch) {
+        // Somebody supplied a newer code than this caller last saw. Its own attempt
+        // failed against the OLD code, so the answer is that code, not a prompt.
+        if (sinceEpoch !== undefined && this.generation > sinceEpoch && this.cached) {
+            return this.cached;
+        }
+        // Single-flight: one prompt at a time, ever. Two raw-mode prompts on one
+        // stdin double every echoed keystroke, and the user is being asked twice
+        // for a code that is shared anyway.
+        if (this.pending)
+            return this.pending;
+        // The provider is the only thing that knows whether a code has already
+        // been supplied in this run, so it owns the wording. An explicit
+        // `question` from the caller always wins.
+        this.pending = this.promptOnce(question ?? (this.generation > 0 ? RENEW_QUESTION : DEFAULT_QUESTION));
+        try {
+            return await this.pending;
+        }
+        finally {
+            this.pending = undefined;
+        }
+    }
+    async promptOnce(question) {
         const code = (await this.promptFn(question)).trim();
         if (code) {
             this.cached = code;
+            this.generation++;
             if (this.registry)
                 writeCachedOtp(this.registry, code);
         }
@@ -89,7 +147,13 @@ export class OtpProvider {
      * rejects it, so the NEXT command re-prompts instead of replaying a single-use
      * code the registry already burned.
      */
-    invalidate() {
+    invalidate(sinceEpoch) {
+        // Only the caller whose own code was rejected may clear it. Without this
+        // guard the first rejection in a concurrent burst wipes a code another
+        // worker just typed, and every remaining worker prompts again — the same
+        // stacked-prompt pile-up from the other direction.
+        if (sinceEpoch !== undefined && this.generation !== sinceEpoch)
+            return;
         this.cached = undefined;
         if (this.registry)
             clearCachedOtp(this.registry);
@@ -107,34 +171,45 @@ export class OtpProvider {
  */
 export async function withOtpRetry(doFetch, provider, opts = {}) {
     const maxPrompts = opts.maxPrompts ?? 2;
-    const question = opts.question ?? DEFAULT_QUESTION;
+    // Deliberately NOT defaulted here: `undefined` is what lets the provider pick
+    // between the first-time wording and the "your previous code aged out" one.
+    const question = opts.question;
     const cached = provider.current();
     const seededFirst = opts.seedFirstAttempt === true && cached !== undefined;
+    // Every invalidate/refresh below is scoped to the epoch of the code THIS call
+    // actually tried. Concurrent callers share the provider, so an unscoped
+    // `invalidate()` discards a code a sibling typed a millisecond ago and sends
+    // everyone back to the prompt.
+    let epoch = provider.epoch();
     let res = await doFetch(seededFirst ? cached : undefined);
     if (!(await isOtpChallenge(res)))
         return res;
     // The seeded code was rejected/consumed — drop it so it is not replayed and the
     // cross-invocation cache entry is cleared.
     if (seededFirst)
-        provider.invalidate();
+        provider.invalidate(epoch);
     if (!seededFirst && provider.current() !== undefined) {
+        epoch = provider.epoch();
         res = await doFetch(provider.current());
         if (!(await isOtpChallenge(res)))
             return res;
         // Stale seed, or a sibling command already burned the file-cached single-use
         // code.
-        provider.invalidate();
+        provider.invalidate(epoch);
     }
     for (let i = 0; i < maxPrompts; i++) {
-        const fresh = await provider.refresh(question);
+        // `refresh` with the epoch: if another concurrent caller has already typed a
+        // newer code, this returns THAT code and shows no prompt.
+        const fresh = await provider.refresh(question, epoch);
         if (!fresh)
             return res; // no input — hand the challenge back to the caller
+        epoch = provider.epoch();
         res = await doFetch(fresh);
         if (!(await isOtpChallenge(res)))
             return res;
         // Clear a rejected fresh code before re-prompting, so a wedged sequence never
         // leaves a burned code in the file cache.
-        provider.invalidate();
+        provider.invalidate(epoch);
     }
     return res;
 }

package/lib/utils/onboard-discovery.d.ts

@@ -0,0 +1,68 @@
+import { type Workspace } from '@gjsify/workspace';
+/** One enumeration source and how much it contributed. */
+export interface DiscoverySource {
+    /** `workspaces` (root manifest globs) | `packages` (--packages globs) | `scanned-dirs`. */
+    kind: 'workspaces' | 'packages' | 'scanned-dirs';
+    /** The globs this source used, when it had any. */
+    patterns?: readonly string[];
+    /** How many packages this source contributed AFTER dedupe against earlier sources. */
+    count: number;
+}
+export interface PackageSet {
+    packages: Workspace[];
+    sources: DiscoverySource[];
+}
+/**
+ * The directory the globs and the workspace manifest are resolved against.
+ *
+ * A workspace root wins, because that is what `discoverWorkspaces` needs. When
+ * there is none, the GIT top level is the answer and the cwd is only the last
+ * resort: `--packages '*'` run from anywhere inside a non-workspace monorepo
+ * must mean the same set every time, and resolving it against the cwd would
+ * quietly mean "the packages below wherever I happen to stand".
+ */
+export declare function resolveRepoRoot(cwd: string): string;
+/**
+ * Every `--packages` glob must match at least one directory holding a
+ * `package.json` with a name. Throws with the unmatched patterns otherwise.
+ *
+ * Mirrors `gjsify foreach`'s `--include` rule, and matters more here: foreach's
+ * empty selection runs no scripts, while onboard's empty selection is a sweep
+ * that reports itself complete having examined nothing.
+ */
+export declare function assertEveryPatternMatches(root: string, patterns: readonly string[]): void;
+/**
+ * Collect the publishable package set from every source that applies.
+ *
+ * Order is precedence: a real workspace beats a `--packages` hit beats a scanned
+ * directory, deduped by package NAME, so the manifest a build would use is the
+ * manifest the sweep publishes.
+ */
+export declare function collectOnboardPackages(root: string, cwd: string, options?: {
+    patterns?: readonly string[];
+}): PackageSet;
+/** One-line rendering of where the package set came from. */
+export declare function describeSources(sources: readonly DiscoverySource[]): string;
+/** The `owner/repo` a package's own manifest claims, or null if it claims none. */
+export declare function declaredRepository(ws: Workspace): string | null;
+/**
+ * Refuse to configure a Trusted Publisher for a package whose OWN manifest says
+ * it lives in a different repository.
+ *
+ * This replaces a hardcoded `exclude: ['@girs/*']`, and it is worth more than
+ * the thing it replaces. Measured: `gjsify onboard` in `gjsify/ts-for-gir`
+ * selects 716 packages, ~703 of them the generated `@girs/*` under
+ * `types-dev/*` — which are workspaces there, but are PUBLISHED FROM
+ * `gjsify/types`. Trusting them for `gjsify/ts-for-gir`'s `release.yml` would
+ * point their OIDC exchange at a workflow that never publishes them, i.e. break
+ * the release the sweep exists to protect.
+ *
+ * A name pattern only ever covered the one case somebody had already been bitten
+ * by. The manifest's `repository` is the package's own claim about where it
+ * comes from, so this covers every monorepo that has another project's packages
+ * inside it — vendored, submoduled, or generated.
+ *
+ * Silence is the only safe default in the other direction: a package that
+ * declares NO repository is not evidence of a mismatch, so it passes.
+ */
+export declare function assertRepositoryAgreement(selected: readonly Workspace[], repository: string): void;