@intentius/chant-lexicon-forgejo 0.23.0 → 0.25.0

package/README.md

@@ -112,5 +112,16 @@ export default {
   reused github-lexicon entities (which are tagged `lexicon: "github"`). Its
   rule prefix is `WFJ` to keep Forgejo diagnostics namespaced apart from
   github's `GHA`.
-- No codegen: this lexicon has no spec of its own. Run `chant generate` in the
-  github lexicon if you need to refresh entities.
+- No entity codegen: this lexicon has no spec of its own, so `chant generate`
+  in this package is a no-op — run it in the github lexicon if you need to
+  refresh entities. `npm run generate`/`npm run bundle` still exist and
+  produce a (deliberately empty) `dist/manifest.json` and `dist/meta.json` so
+  forgejo packages like every other lexicon; see `src/codegen/generate.ts`.
+- LSP completions/hover are delegated, not duplicated: `.completionProvider()`
+  and `.hoverProvider()` forward straight to `githubPlugin`'s
+  (`src/lsp/completions.ts`, `src/lsp/hover.ts`). Lint rules are wrapped, not
+  re-exported verbatim: `forgejoPlugin.lintRules()` returns every github rule
+  with its `id` prefixed `WFJ-` (e.g. `WFJ-GHA001`) and its check logic
+  untouched (`src/lint/rules/delegate-to-github.ts`) — a plain re-export would
+  collide by id the moment something loads the github and forgejo plugins
+  together (`chant audit` does exactly that).

package/dist/codegen/docs-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=docs-cli.d.ts.map

package/dist/codegen/docs-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs-cli.d.ts","sourceRoot":"","sources":["../../src/codegen/docs-cli.ts"],"names":[],"mappings":""}

package/dist/codegen/docs.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Generate documentation site for the Forgejo lexicon.
+ */
+export declare function generateDocs(options?: {
+    verbose?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=docs.d.ts.map

package/dist/codegen/docs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAoFA;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BjF"}

package/dist/codegen/generate-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=generate-cli.d.ts.map

package/dist/codegen/generate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-cli.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-cli.ts"],"names":[],"mappings":""}

package/dist/codegen/generate.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Forgejo lexicon "generation" step.
+ *
+ * Forgejo has no spec of its own — every entity, property type, and enum a
+ * forgejo project uses comes from `@intentius/chant-lexicon-github` (see
+ * src/index.ts). There is nothing to fetch or parse here; this module exists
+ * only so `packagePipeline` (./package.ts) has a `GenerateResult` to build
+ * dist/manifest.json from. Refresh github's entities by running `chant
+ * generate` in the github lexicon, not here.
+ */
+import type { GenerateResult } from "@intentius/chant/codegen/generate";
+export type { GenerateResult };
+export declare function generate(opts?: {
+    verbose?: boolean;
+    force?: boolean;
+}): Promise<GenerateResult>;
+//# sourceMappingURL=generate.d.ts.map

package/dist/codegen/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAExE,YAAY,EAAE,cAAc,EAAE,CAAC;AAW/B,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAarG"}

package/dist/codegen/package-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=package-cli.d.ts.map

package/dist/codegen/package-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-cli.d.ts","sourceRoot":"","sources":["../../src/codegen/package-cli.ts"],"names":[],"mappings":""}

package/dist/codegen/package.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Forgejo lexicon packaging — delegates to core packagePipeline.
+ *
+ * Bundles what forgejo actually ships (its post-synth checks, its skill,
+ * an empty resource catalog) into dist/manifest.json + dist/meta.json so
+ * the lexicon has a real, versioned package manifest like every other
+ * lexicon — see ./generate.ts for why the catalog itself is empty.
+ */
+import { type PackageOptions, type PackageResult } from "@intentius/chant/codegen/package";
+export type { PackageOptions, PackageResult };
+/**
+ * Package the Forgejo lexicon into a distributable BundleSpec.
+ */
+export declare function packageLexicon(opts?: PackageOptions): Promise<PackageResult>;
+//# sourceMappingURL=package.d.ts.map

package/dist/codegen/package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../../src/codegen/package.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAG1C,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AAM9C;;GAEG;AACH,wBAAsB,cAAc,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CA6BtF"}

package/dist/integrity.json

@@ -0,0 +1,13 @@
+{
+  "algorithm": "sha256",
+  "artifacts": {
+    "manifest.json": "3d55bd2014e74805aed971d37f12b2f619f0b37a0047c0fb77f8fcce534becaf",
+    "meta.json": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
+    "types/index.d.ts": "66204549b2a864ab5489e3f02c1878e73ab4b3c9d938cfb480b66f71543a43de",
+    "rules/delegate-to-github.ts": "1060cda40f4b73d6cca3ba3fa13b80b4886147d4034c88584c2d80c5510dbe5e",
+    "rules/wfj010.ts": "f32834f8b8d0a8dd2a8e19f456df7e44aa63084cce3022ccb13f58f4a9f4f75c",
+    "rules/wfj011.ts": "fcb8bf6685d744af20ad804ce929488257995c74b9a3353b2eacae3768d1c83e",
+    "skills/chant-forgejo.md": "a1a560429db736c187e0b34cf8dd9efc6ad771afefcbf6f802d160d3d5274257"
+  },
+  "composite": "429b0e4fc00c62677ea22d4414e60a87471bd6ae300a79f85cdc7923ef4f81d0"
+}

package/dist/lint/rules/delegate-to-github.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Forgejo lint rules — wrapped from github, not duplicated.
+ *
+ * Forgejo has no lint rules of its own: entities, composites, and every
+ * expression helper a forgejo project imports are the exact same github
+ * classes (see src/index.ts's `export * from "@intentius/chant-lexicon-github"`).
+ * A forgejo workflow is TypeScript indistinguishable in shape from an
+ * equivalent github workflow, so github's lint rules (GHA001-GHA058 — typed
+ * composites, secret detection, supply-chain checks, etc.) apply to it
+ * unmodified. Re-implementing or forking any of them here would drift from
+ * github's the first time either side changed.
+ *
+ * Each rule is wrapped rather than re-exported verbatim under github's own
+ * id: `chant lint`/`chant audit` can load the github and forgejo plugins in
+ * the same process (e.g. `chant audit` scans a repo without knowing its CI
+ * provider up front — see packages/core/src/audit/core.ts's
+ * `defaultChecksProvider`, which already loads forgejo+github together for
+ * post-synth checks), and `loadPlugins`' cross-lexicon conflict check
+ * (packages/core/src/cli/conflict-check.ts) hard-fails on two plugins
+ * claiming the same rule id. Prefixing with `WFJ-` — forgejo's existing
+ * post-synth namespace — keeps every id globally unique while leaving the
+ * check (and fix, where one exists) exactly as github wrote it; only the
+ * `id` field changes.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+/** Wrap a github lint rule under forgejo's `WFJ-` namespace, unmodified otherwise. */
+export declare function wrapGithubRule(rule: LintRule): LintRule;
+export declare const forgejoLintRules: LintRule[];
+//# sourceMappingURL=delegate-to-github.d.ts.map

package/dist/lint/rules/delegate-to-github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegate-to-github.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/delegate-to-github.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAG3D,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAEvD;AAED,eAAO,MAAM,gBAAgB,EAAE,QAAQ,EAA2D,CAAC"}

package/dist/lint/rules/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * All lint rules provided by the Forgejo lexicon — delegated to github, see
+ * ./delegate-to-github.
+ */
+export { forgejoLintRules } from "./delegate-to-github.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/lsp/completions.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Forgejo LSP completions — delegated to github, not duplicated.
+ *
+ * Forgejo reuses github's entire authoring surface (entities, composites) —
+ * there is no forgejo-specific resource catalog to index. This forwards
+ * straight to `githubPlugin`'s own completion provider, which already reads
+ * github's generated entity catalog; forking a second copy of it here would
+ * only drift the moment github's catalog regenerates.
+ */
+import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
+export declare function forgejoCompletions(ctx: CompletionContext): CompletionItem[];
+//# sourceMappingURL=completions.d.ts.map

package/dist/lsp/completions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGpF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAE3E"}

package/dist/lsp/hover.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Forgejo LSP hover — delegated to github, not duplicated.
+ *
+ * Same reasoning as ./completions.ts: forgejo authors against github's
+ * exact classes, so hover information for them is github's hover
+ * information, unmodified.
+ */
+import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
+export declare function forgejoHover(ctx: HoverContext): HoverInfo | undefined;
+//# sourceMappingURL=hover.d.ts.map

package/dist/lsp/hover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAG1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAErE"}

package/dist/manifest.json

@@ -0,0 +1,8 @@
+{
+  "name": "forgejo",
+  "version": "0.25.0",
+  "chantVersion": ">=0.1.0",
+  "namespace": "Forgejo",
+  "intrinsics": [],
+  "pseudoParameters": {}
+}

package/dist/meta.json

@@ -0,0 +1 @@
+{}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAoC,MAAM,0BAA0B,CAAC;AAahG,eAAO,MAAM,aAAa,EAAE,aA4J3B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAoC,MAAM,0BAA0B,CAAC;AAiBhG,eAAO,MAAM,aAAa,EAAE,aA6L3B,CAAC"}

package/dist/rules/delegate-to-github.ts

@@ -0,0 +1,34 @@
+/**
+ * Forgejo lint rules — wrapped from github, not duplicated.
+ *
+ * Forgejo has no lint rules of its own: entities, composites, and every
+ * expression helper a forgejo project imports are the exact same github
+ * classes (see src/index.ts's `export * from "@intentius/chant-lexicon-github"`).
+ * A forgejo workflow is TypeScript indistinguishable in shape from an
+ * equivalent github workflow, so github's lint rules (GHA001-GHA058 — typed
+ * composites, secret detection, supply-chain checks, etc.) apply to it
+ * unmodified. Re-implementing or forking any of them here would drift from
+ * github's the first time either side changed.
+ *
+ * Each rule is wrapped rather than re-exported verbatim under github's own
+ * id: `chant lint`/`chant audit` can load the github and forgejo plugins in
+ * the same process (e.g. `chant audit` scans a repo without knowing its CI
+ * provider up front — see packages/core/src/audit/core.ts's
+ * `defaultChecksProvider`, which already loads forgejo+github together for
+ * post-synth checks), and `loadPlugins`' cross-lexicon conflict check
+ * (packages/core/src/cli/conflict-check.ts) hard-fails on two plugins
+ * claiming the same rule id. Prefixing with `WFJ-` — forgejo's existing
+ * post-synth namespace — keeps every id globally unique while leaving the
+ * check (and fix, where one exists) exactly as github wrote it; only the
+ * `id` field changes.
+ */
+
+import type { LintRule } from "@intentius/chant/lint/rule";
+import { githubPlugin } from "@intentius/chant-lexicon-github";
+
+/** Wrap a github lint rule under forgejo's `WFJ-` namespace, unmodified otherwise. */
+export function wrapGithubRule(rule: LintRule): LintRule {
+  return { ...rule, id: `WFJ-${rule.id}` };
+}
+
+export const forgejoLintRules: LintRule[] = (githubPlugin.lintRules?.() ?? []).map(wrapGithubRule);

package/dist/rules/wfj010.ts

@@ -0,0 +1,38 @@
+/**
+ * WFJ010: Unresolved action reference.
+ *
+ * After the forgejo dialect runs, every `uses:` should be a Forgejo-resolvable
+ * form (a full URL, a local `./` action, or `docker://`). A bare `owner/repo@ref`
+ * that survives into the output won't resolve — Forgejo has no GitHub
+ * Marketplace. Flags it so it's caught in `chant lint` / `forgejo:checks`, not
+ * only as a build-time warning.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+import { extractActionRefs } from "@intentius/chant-lexicon-github/lint/post-synth/yaml-helpers";
+import { resolveActionRef } from "../../actions";
+
+export const wfj010: PostSynthCheck = {
+  id: "WFJ010",
+  description: "Unresolved action reference (won't resolve on Forgejo)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const ref of extractActionRefs(yaml)) {
+        if (resolveActionRef(ref.ref).warning) {
+          diagnostics.push({
+            checkId: "WFJ010",
+            severity: "warning",
+            message: `Job "${ref.job}" references '${ref.ref}', which has no Forgejo-resolvable form. Use a full repository URL or map it under forgejo.actionsRoot.`,
+            entity: ref.job,
+            lexicon: "forgejo",
+          });
+        }
+      }
+    }
+    return diagnostics;
+  },
+};

package/dist/rules/wfj011.ts

@@ -0,0 +1,41 @@
+/**
+ * WFJ011: GitHub-hosted runner label.
+ *
+ * `runs-on` labels like `macos-latest` / `windows-latest` name GitHub-hosted
+ * runners that don't exist on Forgejo, and `ubuntu-*` labels that the dialect
+ * didn't map (e.g. when mapping is overridden away) won't be advertised by a
+ * default Forgejo runner. Flags any such label that survives into the output.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+import { extractRunsOnByJob } from "@intentius/chant-lexicon-github/lint/post-synth/yaml-helpers";
+
+/** Labels that name a GitHub-hosted runner image (no fixed Forgejo equivalent). */
+const GITHUB_HOSTED = /^(ubuntu|macos|windows)-/;
+
+export const wfj011: PostSynthCheck = {
+  id: "WFJ011",
+  description: "GitHub-hosted runner label with no Forgejo equivalent",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job, labels] of extractRunsOnByJob(yaml)) {
+        for (const label of labels) {
+          if (GITHUB_HOSTED.test(label)) {
+            diagnostics.push({
+              checkId: "WFJ011",
+              severity: "warning",
+              message: `Job "${job}" runs on '${label}', a GitHub-hosted runner label with no Forgejo equivalent. Map it via forgejo.runnerLabels or target a label your Forgejo runners advertise.`,
+              entity: job,
+              lexicon: "forgejo",
+            });
+          }
+        }
+      }
+    }
+    return diagnostics;
+  },
+};

package/dist/skills/chant-forgejo.md

@@ -0,0 +1,68 @@
+# chant-forgejo
+
+Forgejo / Codeberg / Gitea Actions with chant.
+
+Forgejo runs **GitHub-Actions-compatible** workflows, so the forgejo lexicon is
+a thin dialect of the github lexicon. You author exactly as you would for GitHub
+Actions — same `Workflow`, `Job`, `Step`, and composites — but import from
+`@intentius/chant-lexicon-forgejo`. The dialect applies on build.
+
+## Authoring
+
+```ts
+import { Workflow, Job, Step, Checkout, SetupNode } from "@intentius/chant-lexicon-forgejo";
+
+export const workflow = new Workflow({
+  name: "CI",
+  on: { push: { branches: ["main"] } },
+});
+
+export const build = new Job({
+  "runs-on": "ubuntu-latest",
+  steps: [
+    Checkout({}).step,
+    SetupNode({ nodeVersion: "22", cache: "npm" }).step,
+    new Step({ name: "Test", run: "npm test" }),
+  ],
+});
+```
+
+## Build
+
+Forgejo reads workflows from `.forgejo/workflows/` (or `.gitea/workflows/` for
+Gitea):
+
+```sh
+chant build src -o .forgejo/workflows/ci.yml
+```
+
+## What the dialect does on build
+
+- **Drops keys the Forgejo runner ignores** — `permissions` and
+  `continue-on-error` are removed (each emits a build warning).
+- **Maps runner labels** — `ubuntu-latest` → `docker` by default; override via
+  `forgejo.runnerLabels` in `chant.config.ts`. Unmapped labels warn.
+- **Resolves `uses:` refs** — common `actions/*` rewrite under
+  `forgejo.actionsRoot` (default `https://code.forgejo.org`); `docker/*` pin to
+  their GitHub URL; unmapped refs warn.
+
+## Migrating from GitHub Actions
+
+```sh
+chant migrate .github/workflows/ci.yml --to forgejo -o .forgejo/workflows/ci.yml --validate
+```
+
+`--validate` prints a **Security posture** report: what survives the move and
+what Forgejo silently drops (`permissions`/`continue-on-error` → lost,
+unresolved `uses:` / unmapped runner labels → needs-review). The same view is
+the `forgejo:compare` MCP tool.
+
+## Read-only context tools (MCP)
+
+- `forgejo:workflow` — triggers and jobs as written
+- `forgejo:references` — external actions/images and whether each is SHA-pinned
+- `forgejo:affected` — jobs that re-run downstream of a given job
+- `forgejo:checks` — Forgejo-specific findings (WFJ010/011)
+- `forgejo:source` / `forgejo:owns` — where a job came from / whether it's declared here
+- `forgejo:workflow-yaml` — the generated YAML
+- `forgejo:compare` — the github→forgejo migration safety view

package/dist/types/index.d.ts

@@ -0,0 +1,4 @@
+// forgejo has no resource types of its own. Every entity a forgejo
+// project imports is declared in @intentius/chant-lexicon-github and
+// re-exported from this package's main entry point.
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -53,11 +53,14 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.23.0",
-    "@intentius/chant-lexicon-github": "^0.23.0"
+    "@intentius/chant": "^0.25.0",
+    "@intentius/chant-lexicon-github": "^0.25.0"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete",
-    "prepack": "npm run build"
+    "generate": "tsx src/codegen/generate-cli.ts",
+    "bundle": "tsx src/codegen/package-cli.ts",
+    "docs": "tsx src/codegen/docs-cli.ts",
+    "prepack": "npm run generate && npm run bundle && npm run build",
+    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
   }
 }

package/src/codegen/docs-cli.ts

@@ -0,0 +1,7 @@
+#!/usr/bin/env tsx
+/**
+ * CLI entry point for `npm run docs` in lexicon-forgejo.
+ */
+import { generateDocs } from "./docs";
+
+await generateDocs({ verbose: true });

package/src/codegen/docs.ts

@@ -0,0 +1,116 @@
+import { docsPipeline, writeDocsSite } from "@intentius/chant/codegen/docs";
+
+const DIALECT_CONTENT = `Forgejo (the forge behind Codeberg, self-hosted Forgejo, and Gitea) runs
+GitHub-Actions-compatible workflows. You author exactly as you would for
+GitHub Actions — same \`Workflow\`, \`Job\`, \`Step\`, and composites, imported
+from \`@intentius/chant-lexicon-forgejo\` instead of the github package:
+
+\`\`\`ts
+import { Workflow, Job, Step, Checkout, SetupNode } from "@intentius/chant-lexicon-forgejo";
+
+export const workflow = new Workflow({
+  name: "CI",
+  on: { push: { branches: ["main"] } },
+});
+
+export const build = new Job({
+  "runs-on": "ubuntu-latest",
+  steps: [
+    Checkout({}).step,
+    SetupNode({ nodeVersion: "22", cache: "npm" }).step,
+    new Step({ name: "Test", run: "npm test" }),
+  ],
+});
+\`\`\`
+
+On build, the dialect:
+
+- **Drops keys Forgejo ignores** — \`permissions\` and \`continue-on-error\` are
+  silently ignored by the Forgejo runner, so they are removed from the output
+  and reported as build warnings (emitting them is misleading).
+- **Maps runner labels** — GitHub-hosted labels like \`ubuntu-latest\` have no
+  fixed meaning on Forgejo. They are mapped to a default Forgejo label
+  (\`docker\`), overridable per project. Unmapped labels pass through with a
+  warning.
+- **Resolves \`uses:\` action refs** — Forgejo has no GitHub Marketplace, so a
+  bare \`uses: actions/checkout@v4\` is rewritten to a resolvable form. Common
+  \`actions/*\` are mapped under an actions root (\`https://code.forgejo.org\` by
+  default, overridable via \`forgejo.actionsRoot\`); \`docker/*\` are pinned to
+  their full GitHub URL. Local (\`./...\`), \`docker://\`, and full-URL refs pass
+  through untouched. Anything else passes through **and is reported** as a
+  warning so it's never silently unresolvable.
+
+Everything else is emitted by the github serializer, which already produces
+the exact YAML shape Forgejo executes.
+
+## Lint rules and editor support
+
+Forgejo has no lint rules or LSP completions/hover of its own — a forgejo
+workflow is TypeScript indistinguishable in shape from an equivalent github
+one, so \`chant lint\` and editor tooling run github's checks and catalog
+against forgejo source unmodified (\`completionProvider()\` and
+\`hoverProvider()\` forward straight to \`githubPlugin\`'s). Lint rules are
+wrapped rather than re-exported verbatim — each GHA0xx rule appears under a
+\`WFJ-\` prefix (e.g. \`WFJ-GHA001\`) with its check logic untouched, so a
+project (or \`chant audit\`) can load the github and forgejo plugins together
+without an id collision. See the
+[github lexicon's Lint Rules page](/chant/lexicons/github/lint-rules/) for
+the full GHA0xx catalog.
+
+## Migrating from GitHub Actions
+
+Because github → forgejo YAML is near-identical, the migration is thin — it
+applies the same dialect as a build. Its real value is the **compare**: what
+the move costs.
+
+\`\`\`sh
+chant migrate .github/workflows/ci.yml --to forgejo -o .forgejo/workflows/ci.yml --validate
+\`\`\`
+
+\`--validate\` prints a **security posture** report classifying each property's
+fate across the edge:
+
+| Fate | Meaning |
+|---|---|
+| \`translated\` | carried across as-is |
+| \`approximated\` | carried with a close equivalent |
+| \`needs-review\` | confirm/adjust on Forgejo (unresolved \`uses:\`, unmapped runner label) |
+| \`lost\` | the Forgejo runner ignores it (\`permissions\`, \`continue-on-error\`) |
+
+The same view is available to agents as the \`forgejo:compare\` MCP tool, which
+takes a workflow file and returns per-property fates plus summary counts —
+read-only.
+`;
+
+/**
+ * Generate documentation site for the Forgejo lexicon.
+ */
+export async function generateDocs(options?: { verbose?: boolean }): Promise<void> {
+  const config = {
+    name: "forgejo",
+    displayName: "Forgejo",
+    description: "Forgejo / Codeberg / Gitea Actions lexicon documentation — a thin GitHub Actions dialect",
+    distDir: "./dist",
+    outDir: "./docs",
+    basePath: process.env.DOCS_BASE_PATH ?? "/chant/lexicons/forgejo/",
+    overview:
+      "Forgejo Actions is a thin dialect of the GitHub Actions lexicon (chant #338): every entity, composite, and expression helper you write for a Forgejo workflow is the same class you'd import from the github lexicon — this package supplies only what's genuinely Forgejo-specific: the serializer dialect (dropped GitHub-only keys, `uses:` action resolution, runner-label mapping) and a github → forgejo migration path.",
+    outputFormat:
+      "The Forgejo lexicon serializes entities into the same YAML shape as GitHub Actions, then applies the Forgejo dialect (see [The Forgejo Dialect](/chant/lexicons/forgejo/dialect/)) before writing to `.forgejo/workflows/*.yml` (or `.gitea/workflows/*.yml` for Gitea).",
+    extraPages: [
+      {
+        slug: "dialect",
+        title: "The Forgejo Dialect",
+        description: "What changes when a GitHub Actions workflow serializes to Forgejo, and how migration works",
+        content: DIALECT_CONTENT,
+      },
+    ],
+  };
+
+  const result = docsPipeline(config);
+  writeDocsSite(config, result);
+
+  if (options?.verbose) {
+    console.error("Documentation generated");
+  }
+}

package/src/codegen/generate-cli.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env tsx
+/**
+ * CLI entry point for `npm run generate` in lexicon-forgejo.
+ */
+import { generate } from "./generate";
+
+const result = await generate({ verbose: true });
+console.error(`forgejo: ${result.resources} resources (reuses github's wholesale)`);

package/src/codegen/generate.ts

@@ -0,0 +1,38 @@
+/**
+ * Forgejo lexicon "generation" step.
+ *
+ * Forgejo has no spec of its own — every entity, property type, and enum a
+ * forgejo project uses comes from `@intentius/chant-lexicon-github` (see
+ * src/index.ts). There is nothing to fetch or parse here; this module exists
+ * only so `packagePipeline` (./package.ts) has a `GenerateResult` to build
+ * dist/manifest.json from. Refresh github's entities by running `chant
+ * generate` in the github lexicon, not here.
+ */
+
+import type { GenerateResult } from "@intentius/chant/codegen/generate";
+
+export type { GenerateResult };
+
+// No entities of forgejo's own — the catalog is intentionally empty.
+const LEXICON_JSON = "{}";
+
+const TYPES_DTS = `// forgejo has no resource types of its own. Every entity a forgejo
+// project imports is declared in @intentius/chant-lexicon-github and
+// re-exported from this package's main entry point.
+export {};
+`;
+
+export async function generate(opts?: { verbose?: boolean; force?: boolean }): Promise<GenerateResult> {
+  if (opts?.verbose) {
+    console.error("forgejo: no spec of its own — reuses the github lexicon's entities wholesale (0 own resources)");
+  }
+  return {
+    lexiconJSON: LEXICON_JSON,
+    typesDTS: TYPES_DTS,
+    indexTS: "",
+    resources: 0,
+    properties: 0,
+    enums: 0,
+    warnings: [],
+  };
+}

package/src/codegen/package-cli.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env tsx
+/**
+ * CLI entry point for `npm run bundle` in lexicon-forgejo.
+ */
+import { packageLexicon } from "./package";
+import { writeBundleSpec } from "@intentius/chant/codegen/package";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+
+const pkgDir = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+const { spec, stats } = await packageLexicon({ verbose: true });
+writeBundleSpec(spec, join(pkgDir, "dist"));
+
+console.error(`Packaged ${stats.resources} resources, ${stats.ruleCount} rules, ${stats.skillCount} skills`);

package/src/codegen/package.ts

@@ -0,0 +1,60 @@
+/**
+ * Forgejo lexicon packaging — delegates to core packagePipeline.
+ *
+ * Bundles what forgejo actually ships (its post-synth checks, its skill,
+ * an empty resource catalog) into dist/manifest.json + dist/meta.json so
+ * the lexicon has a real, versioned package manifest like every other
+ * lexicon — see ./generate.ts for why the catalog itself is empty.
+ */
+
+import { readFileSync } from "fs";
+import { forgejoPlugin } from "../plugin";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+import {
+  packagePipeline,
+  collectSkills,
+  type PackageOptions,
+  type PackageResult,
+} from "@intentius/chant/codegen/package";
+import { generate } from "./generate";
+
+export type { PackageOptions, PackageResult };
+
+// package.ts is at src/codegen/package.ts — 2 dirname calls reach src/
+// then join(pkgDir, "..") is the package root where package.json lives
+const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+
+/**
+ * Package the Forgejo lexicon into a distributable BundleSpec.
+ */
+export async function packageLexicon(opts: PackageOptions = {}): Promise<PackageResult> {
+  const pkgJson = JSON.parse(readFileSync(join(pkgDir, "..", "package.json"), "utf-8"));
+
+  return packagePipeline(
+    {
+      generate: (genOpts) => generate({ verbose: genOpts.verbose, force: genOpts.force }),
+
+      buildManifest: (_genResult) => {
+        return {
+          name: "forgejo",
+          version: pkgJson.version ?? "0.0.1",
+          chantVersion: ">=0.1.0",
+          namespace: "Forgejo",
+          intrinsics: [],
+          pseudoParameters: {},
+        };
+      },
+
+      srcDir: pkgDir,
+
+      collectSkills: () => {
+        const skillDefs = forgejoPlugin.skills?.() ?? [];
+        return collectSkills(skillDefs);
+      },
+
+      version: pkgJson.version ?? "0.0.1",
+    },
+    opts,
+  );
+}

package/src/lint/rules/delegate-to-github.test.ts

@@ -0,0 +1,42 @@
+import { describe, test, expect } from "vitest";
+import { forgejoLintRules, wrapGithubRule } from "./delegate-to-github";
+import { githubPlugin } from "@intentius/chant-lexicon-github";
+
+describe("forgejo lint rules — wrapped from github", () => {
+  test("returns a non-empty rule set", () => {
+    expect(Array.isArray(forgejoLintRules)).toBe(true);
+    expect(forgejoLintRules.length).toBeGreaterThan(0);
+  });
+
+  test("one wrapped rule per github rule, under the WFJ- namespace", () => {
+    const githubRules = githubPlugin.lintRules?.() ?? [];
+    expect(forgejoLintRules).toHaveLength(githubRules.length);
+    expect(forgejoLintRules.map((r) => r.id)).toEqual(githubRules.map((r) => `WFJ-${r.id}`));
+  });
+
+  test("does not collide with any github rule id", () => {
+    const githubIds = new Set((githubPlugin.lintRules?.() ?? []).map((r) => r.id));
+    for (const rule of forgejoLintRules) {
+      expect(githubIds.has(rule.id)).toBe(false);
+    }
+  });
+
+  test("includes WFJ-GHA001 (use typed action composites)", () => {
+    const ids = forgejoLintRules.map((r) => r.id);
+    expect(ids).toContain("WFJ-GHA001");
+  });
+
+  test("includes WFJ-GHA003 (no hardcoded secrets)", () => {
+    const ids = forgejoLintRules.map((r) => r.id);
+    expect(ids).toContain("WFJ-GHA003");
+  });
+
+  test("wrapGithubRule preserves check() behavior, only renaming id", () => {
+    const [githubRule] = githubPlugin.lintRules?.() ?? [];
+    const wrapped = wrapGithubRule(githubRule);
+    expect(wrapped.check).toBe(githubRule.check);
+    expect(wrapped.severity).toBe(githubRule.severity);
+    expect(wrapped.category).toBe(githubRule.category);
+    expect(wrapped.id).toBe(`WFJ-${githubRule.id}`);
+  });
+});

package/src/lint/rules/delegate-to-github.ts

@@ -0,0 +1,34 @@
+/**
+ * Forgejo lint rules — wrapped from github, not duplicated.
+ *
+ * Forgejo has no lint rules of its own: entities, composites, and every
+ * expression helper a forgejo project imports are the exact same github
+ * classes (see src/index.ts's `export * from "@intentius/chant-lexicon-github"`).
+ * A forgejo workflow is TypeScript indistinguishable in shape from an
+ * equivalent github workflow, so github's lint rules (GHA001-GHA058 — typed
+ * composites, secret detection, supply-chain checks, etc.) apply to it
+ * unmodified. Re-implementing or forking any of them here would drift from
+ * github's the first time either side changed.
+ *
+ * Each rule is wrapped rather than re-exported verbatim under github's own
+ * id: `chant lint`/`chant audit` can load the github and forgejo plugins in
+ * the same process (e.g. `chant audit` scans a repo without knowing its CI
+ * provider up front — see packages/core/src/audit/core.ts's
+ * `defaultChecksProvider`, which already loads forgejo+github together for
+ * post-synth checks), and `loadPlugins`' cross-lexicon conflict check
+ * (packages/core/src/cli/conflict-check.ts) hard-fails on two plugins
+ * claiming the same rule id. Prefixing with `WFJ-` — forgejo's existing
+ * post-synth namespace — keeps every id globally unique while leaving the
+ * check (and fix, where one exists) exactly as github wrote it; only the
+ * `id` field changes.
+ */
+
+import type { LintRule } from "@intentius/chant/lint/rule";
+import { githubPlugin } from "@intentius/chant-lexicon-github";
+
+/** Wrap a github lint rule under forgejo's `WFJ-` namespace, unmodified otherwise. */
+export function wrapGithubRule(rule: LintRule): LintRule {
+  return { ...rule, id: `WFJ-${rule.id}` };
+}
+
+export const forgejoLintRules: LintRule[] = (githubPlugin.lintRules?.() ?? []).map(wrapGithubRule);

package/src/lint/rules/index.ts

@@ -0,0 +1,6 @@
+/**
+ * All lint rules provided by the Forgejo lexicon — delegated to github, see
+ * ./delegate-to-github.
+ */
+
+export { forgejoLintRules } from "./delegate-to-github";

package/src/lsp/completions.test.ts

@@ -0,0 +1,36 @@
+import { describe, test, expect } from "vitest";
+import { forgejoCompletions } from "./completions";
+import type { CompletionContext } from "@intentius/chant/lsp/types";
+
+function makeCtx(overrides: Partial<CompletionContext>): CompletionContext {
+  return {
+    uri: "file:///test.ts",
+    content: "",
+    position: { line: 0, character: 0 },
+    wordAtCursor: "",
+    linePrefix: "",
+    ...overrides,
+  };
+}
+
+describe("forgejoCompletions", () => {
+  test("delegates to github's resource completions after `new `", () => {
+    const ctx = makeCtx({
+      linePrefix: "const build = new Job",
+      wordAtCursor: "Job",
+      content: "const build = new Job",
+      position: { line: 0, character: 22 },
+    });
+
+    const items = forgejoCompletions(ctx);
+    const jobItem = items.find((i) => i.label === "Job");
+    expect(jobItem).toBeDefined();
+    expect(jobItem?.kind).toBe("resource");
+    expect(jobItem?.detail).toContain("GitHub::Actions::Job");
+  });
+
+  test("returns [] outside a completion context", () => {
+    const ctx = makeCtx({});
+    expect(forgejoCompletions(ctx)).toEqual([]);
+  });
+});

package/src/lsp/completions.ts

@@ -0,0 +1,16 @@
+/**
+ * Forgejo LSP completions — delegated to github, not duplicated.
+ *
+ * Forgejo reuses github's entire authoring surface (entities, composites) —
+ * there is no forgejo-specific resource catalog to index. This forwards
+ * straight to `githubPlugin`'s own completion provider, which already reads
+ * github's generated entity catalog; forking a second copy of it here would
+ * only drift the moment github's catalog regenerates.
+ */
+
+import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
+import { githubPlugin } from "@intentius/chant-lexicon-github";
+
+export function forgejoCompletions(ctx: CompletionContext): CompletionItem[] {
+  return githubPlugin.completionProvider?.(ctx) ?? [];
+}

package/src/lsp/hover.test.ts

@@ -0,0 +1,33 @@
+import { describe, test, expect } from "vitest";
+import { forgejoHover } from "./hover";
+import type { HoverContext } from "@intentius/chant/lsp/types";
+
+function makeCtx(overrides: Partial<HoverContext>): HoverContext {
+  return {
+    uri: "file:///test.ts",
+    content: "",
+    position: { line: 0, character: 0 },
+    word: "",
+    lineText: "",
+    ...overrides,
+  };
+}
+
+describe("forgejoHover", () => {
+  test("delegates to github's hover info for Job", () => {
+    const ctx = makeCtx({ word: "Job" });
+    const info = forgejoHover(ctx);
+    expect(info).toBeDefined();
+    expect(info!.contents).toContain("GitHub::Actions::Job");
+  });
+
+  test("returns undefined for an unknown word", () => {
+    const ctx = makeCtx({ word: "NotARealForgejoOrGithubThing12345" });
+    expect(forgejoHover(ctx)).toBeUndefined();
+  });
+
+  test("returns undefined for an empty word", () => {
+    const ctx = makeCtx({ word: "" });
+    expect(forgejoHover(ctx)).toBeUndefined();
+  });
+});

package/src/lsp/hover.ts

@@ -0,0 +1,14 @@
+/**
+ * Forgejo LSP hover — delegated to github, not duplicated.
+ *
+ * Same reasoning as ./completions.ts: forgejo authors against github's
+ * exact classes, so hover information for them is github's hover
+ * information, unmodified.
+ */
+
+import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
+import { githubPlugin } from "@intentius/chant-lexicon-github";
+
+export function forgejoHover(ctx: HoverContext): HoverInfo | undefined {
+  return githubPlugin.hoverProvider?.(ctx);
+}

package/src/plugin.test.ts

@@ -0,0 +1,111 @@
+/**
+ * Forgejo plugin tests.
+ */
+
+import { describe, expect, it } from "vitest";
+import { forgejoPlugin } from "./plugin";
+import { githubPlugin } from "@intentius/chant-lexicon-github";
+import { isLexiconPlugin } from "@intentius/chant/lexicon";
+import type { CompletionContext, HoverContext } from "@intentius/chant/lsp/types";
+
+describe("forgejo plugin", () => {
+  it("is a valid LexiconPlugin", () => {
+    expect(isLexiconPlugin(forgejoPlugin)).toBe(true);
+  });
+
+  it("has the correct name", () => {
+    expect(forgejoPlugin.name).toBe("forgejo");
+  });
+
+  it("has a serializer (name 'github' — serializes reused github entities)", () => {
+    expect(forgejoPlugin.serializer).toBeDefined();
+    expect(forgejoPlugin.serializer.name).toBe("github");
+  });
+
+  it("postSynthChecks() returns the WFJ checks", () => {
+    const checks = forgejoPlugin.postSynthChecks?.();
+    expect(Array.isArray(checks)).toBe(true);
+    const ids = checks?.map((c) => c.id).sort();
+    expect(ids).toEqual(["WFJ010", "WFJ011"]);
+  });
+
+  it("lintRules() wraps github's lint rules under a WFJ- namespace (no id collision)", () => {
+    const rules = forgejoPlugin.lintRules?.() ?? [];
+    const githubRules = githubPlugin.lintRules?.() ?? [];
+    expect(rules.length).toBe(githubRules.length);
+    expect(rules.map((r) => r.id)).toEqual(githubRules.map((r) => `WFJ-${r.id}`));
+    // Same check() behavior — only the id changes, so forgejo and github can
+    // load together (e.g. `chant audit`) without loadPlugins' cross-lexicon
+    // rule-id conflict check rejecting the pair.
+    expect(rules.map((r) => r.check)).toEqual(githubRules.map((r) => r.check));
+  });
+
+  it("completionProvider() delegates to github's completions", () => {
+    const ctx: CompletionContext = {
+      uri: "file:///t.ts",
+      content: "const j = new Job",
+      position: { line: 0, character: 18 },
+      wordAtCursor: "Job",
+      linePrefix: "const j = new Job",
+    };
+    const items = forgejoPlugin.completionProvider?.(ctx);
+    expect(items?.some((i) => i.label === "Job")).toBe(true);
+  });
+
+  it("hoverProvider() delegates to github's hover info", () => {
+    const ctx: HoverContext = {
+      uri: "file:///t.ts",
+      content: "",
+      position: { line: 0, character: 0 },
+      word: "Job",
+      lineText: "",
+    };
+    const info = forgejoPlugin.hoverProvider?.(ctx);
+    expect(info?.contents).toContain("GitHub::Actions::Job");
+  });
+
+  it("detectTemplate() recognizes github-actions-shaped data", () => {
+    expect(forgejoPlugin.detectTemplate?.({ on: {}, jobs: {} })).toBe(true);
+    expect(forgejoPlugin.detectTemplate?.({ build: { "runs-on": "ubuntu-latest" } })).toBe(true);
+    expect(forgejoPlugin.detectTemplate?.({})).toBe(false);
+    expect(forgejoPlugin.detectTemplate?.(null)).toBe(false);
+  });
+
+  it("migrationSource('github') detects a github workflow and rejects unrelated content", () => {
+    const src = forgejoPlugin.migrationSource?.("github");
+    expect(src).toBeDefined();
+    expect(src?.detect("on:\n  push: {}\njobs:\n  build:\n    runs-on: ubuntu-latest\n")).toBe(true);
+    expect(src?.detect("just some text")).toBe(false);
+  });
+
+  it("migrationSource() returns undefined for an unknown source", () => {
+    expect(forgejoPlugin.migrationSource?.("gitlab")).toBeUndefined();
+  });
+
+  it("mcpTools() includes the diff tool and context tools", () => {
+    const tools = forgejoPlugin.mcpTools?.();
+    expect(Array.isArray(tools)).toBe(true);
+    expect(tools?.some((t) => t.name === "forgejo:diff")).toBe(true);
+    expect(tools!.length).toBeGreaterThan(1);
+  });
+
+  it("skills() returns chant-forgejo", () => {
+    const skills = forgejoPlugin.skills?.();
+    expect(skills?.map((s) => s.name)).toContain("chant-forgejo");
+  });
+
+  describe("initTemplates", () => {
+    it("default template returns src with pipeline.ts", () => {
+      const result = forgejoPlugin.initTemplates?.();
+      expect(result?.src?.["pipeline.ts"]).toBeDefined();
+      expect(result?.src?.["pipeline.ts"]).toContain("@intentius/chant-lexicon-forgejo");
+    });
+
+    it("'docker-build' template returns a docker build workflow", () => {
+      const result = forgejoPlugin.initTemplates?.("docker-build");
+      const src = result?.src?.["pipeline.ts"] as string;
+      expect(src).toContain("Docker Build");
+      expect(src).toContain("docker build");
+    });
+  });
+});

package/src/plugin.ts

@@ -9,6 +9,7 @@
  */
 
 import type { LexiconPlugin, InitTemplateSet, MigrationSource } from "@intentius/chant/lexicon";
+import type { LintRule } from "@intentius/chant/lint/rule";
 import { postSynthChecks as postSynthCheckList } from "./lint/post-synth";
 import { forgejoAuditCatalog } from "./lint/audit-catalog";
 import { createSkillsLoader, createDiffTool } from "@intentius/chant/lexicon-plugin-helpers";
@@ -17,6 +18,9 @@ import { fileURLToPath } from "url";
 import { forgejoSerializer } from "./serializer";
 import { forgejoContextTools } from "./mcp/context-tools";
 import { generateForgejoPipeline } from "./components/generate-pipeline";
+import { forgejoLintRules } from "./lint/rules/delegate-to-github";
+import { forgejoCompletions } from "./lsp/completions";
+import { forgejoHover } from "./lsp/hover";
 
 const reuseNote =
   "forgejo reuses the github lexicon's entities — run `chant generate` in the github lexicon instead.";
@@ -133,6 +137,20 @@ export const build = new Job({
     return postSynthCheckList;
   },
 
+  // Lint rules and LSP support are delegated to github, not forked — see
+  // ./lint/rules/delegate-to-github.ts and ./lsp/{completions,hover}.ts.
+  lintRules(): LintRule[] {
+    return forgejoLintRules;
+  },
+
+  completionProvider(ctx: import("@intentius/chant/lsp/types").CompletionContext) {
+    return forgejoCompletions(ctx);
+  },
+
+  hoverProvider(ctx: import("@intentius/chant/lsp/types").HoverContext) {
+    return forgejoHover(ctx);
+  },
+
   mcpTools() {
     return [
       createDiffTool(forgejoSerializer, "Compare current build output against previous output for Forgejo Actions", "forgejo"),
@@ -174,7 +192,26 @@ export const build = new Job({
   async coverage(): Promise<void> {
     console.error(reuseNote);
   },
-  async package(): Promise<void> {
-    console.error(reuseNote);
+
+  // Packaging is real (unlike generate/validate/coverage above): forgejo
+  // ships its own dist/manifest.json — an empty resource catalog plus its
+  // own post-synth checks and skill — even though the catalog it packages
+  // is empty. See ./codegen/{generate,package}.ts.
+  async package(options?: { verbose?: boolean; force?: boolean }): Promise<void> {
+    const { packageLexicon } = await import("./codegen/package");
+    const { writeBundleSpec } = await import("@intentius/chant/codegen/package");
+    const { join: pathJoin, dirname: pathDirname } = await import("path");
+    const { fileURLToPath: toPath } = await import("url");
+
+    const { spec, stats } = await packageLexicon(options);
+    const pkgDir = pathDirname(pathDirname(toPath(import.meta.url)));
+    writeBundleSpec(spec, pathJoin(pkgDir, "dist"));
+
+    console.error(`Packaged ${stats.resources} resources, ${stats.ruleCount} rules, ${stats.skillCount} skills`);
+  },
+
+  async docs(options?: { verbose?: boolean }): Promise<void> {
+    const { generateDocs } = await import("./codegen/docs");
+    return generateDocs(options);
   },
 };