@intentius/chant-lexicon-forgejo 0.6.0 → 0.8.0

package/dist/actions.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Forgejo `uses:` action-reference resolver.
+ *
+ * GitHub Actions resolves a bare `uses: actions/checkout@v4` against the GitHub
+ * Marketplace. Forgejo / Codeberg / Gitea runners have no Marketplace, so such a
+ * ref must be rewritten to a form their runner can fetch — a full repository URL,
+ * or a path under a configured actions root that mirrors the action.
+ *
+ * The resolver rewrites a built-in set of common actions and reports anything it
+ * can't place as a diagnostic (never dropping or silently passing it through).
+ */
+/**
+ * Default actions root. `code.forgejo.org` hosts the Forgejo `actions/*` mirror
+ * (checkout, setup-*, cache, upload/download-artifact, …). Override per project
+ * via `forgejo.actionsRoot` in `chant.config.ts`.
+ */
+export declare const DEFAULT_ACTIONS_ROOT = "https://code.forgejo.org";
+/**
+ * Where a known action resolves:
+ *  - `mirror`: `<actionsRoot>/<repo>` — follows the configured actions root.
+ *  - `url`:    an absolute base URL — independent of the actions root (used for
+ *              actions not carried by the Forgejo mirror, e.g. `docker/*`).
+ */
+export type ActionTarget = {
+    kind: "mirror";
+    repo: string;
+} | {
+    kind: "url";
+    url: string;
+};
+/** Built-in mapping of GitHub action `owner/repo` → Forgejo-resolvable target. */
+export declare const KNOWN_ACTIONS: Record<string, ActionTarget>;
+export interface ActionResolveOptions {
+    /** Base for `mirror` targets; defaults to {@link DEFAULT_ACTIONS_ROOT}. */
+    actionsRoot?: string;
+    /** Mapping table to use; defaults to {@link KNOWN_ACTIONS}. */
+    known?: Record<string, ActionTarget>;
+}
+export interface ActionResolveResult {
+    /** The rewritten (or unchanged) `uses:` ref. */
+    rewritten: string;
+    /** Set when the ref could not be resolved — surfaced as a build warning. */
+    warning?: string;
+}
+/**
+ * Resolve a single `uses:` action ref to a Forgejo-resolvable form.
+ */
+export declare function resolveActionRef(ref: string, options?: ActionResolveOptions): ActionResolveResult;
+//# sourceMappingURL=actions.d.ts.map

package/dist/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAkBtD,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAaD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,mBAAmB,CA2BrG"}

package/dist/dialect.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Forgejo dialect transform.
+ *
+ * Forgejo Actions (the engine behind Codeberg, self-hosted Forgejo, and Gitea)
+ * runs GitHub-Actions-compatible YAML, so the github lexicon's serializer emits
+ * the right shape. The dialect differs in three small ways, all handled here as
+ * a pre-pass over the resolved entity graph before the github serializer runs:
+ *
+ *  1. `permissions` and `continue-on-error` are silently ignored by the Forgejo
+ *     runner — we drop them from the output and warn per occurrence.
+ *  2. GitHub-hosted runner labels (`ubuntu-latest`, …) have no fixed meaning on
+ *     Forgejo — we map them to a default Forgejo label, overridable per project.
+ *  3. Anything we can't place (an unmapped runner label) passes through with a
+ *     warning rather than being dropped.
+ *
+ * Operating on the entity graph (rather than string-munging YAML) keeps the
+ * transform faithful: the github serializer still does the actual emission.
+ */
+import { type Declarable } from "@intentius/chant/declarable";
+/**
+ * Default GitHub-hosted runner label → Forgejo label mapping. `docker` is the
+ * label a freshly-registered Forgejo `act_runner` exposes, and the one used
+ * throughout the Forgejo Actions docs, so it is the safest default target.
+ * Override per project via `forgejo.runnerLabels` in `chant.config.ts`.
+ */
+export declare const DEFAULT_RUNNER_LABELS: Record<string, string>;
+export interface ForgejoDialectOptions {
+    /** Project-supplied label overrides, merged over {@link DEFAULT_RUNNER_LABELS}. */
+    runnerLabels?: Record<string, string>;
+    /** Base for resolving mirrored `uses:` action refs (see ./actions). */
+    actionsRoot?: string;
+}
+export interface ForgejoDialectResult {
+    /** The transformed entity map (clones; originals are not mutated). */
+    entities: Map<string, Declarable>;
+    /** One warning per dropped key and per unmapped runner label. */
+    warnings: string[];
+}
+export interface TransformObjectResult {
+    /** The transformed plain value (clone; the input is not mutated). */
+    value: unknown;
+    /** One warning per dropped key, unmapped label, and unresolved action ref. */
+    warnings: string[];
+}
+/**
+ * Apply the Forgejo dialect to a plain object — e.g. a parsed GitHub Actions
+ * workflow during migration, rather than the resolved entity graph. Same
+ * rules as {@link applyForgejoDialect}: drop ignored keys, remap runner
+ * labels, resolve `uses:` refs.
+ */
+export declare function transformWorkflowObject(obj: unknown, options?: ForgejoDialectOptions): TransformObjectResult;
+/**
+ * Apply the Forgejo dialect to a resolved entity map. Returns transformed
+ * clones plus the diagnostics produced (dropped keys, unmapped labels).
+ */
+export declare function applyForgejoDialect(entities: Map<string, Declarable>, options?: ForgejoDialectOptions): ForgejoDialectResult;
+//# sourceMappingURL=dialect.d.ts.map

package/dist/dialect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAgBjF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAuFD,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,qBAA0B,GAClC,qBAAqB,CAKvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAWtB"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { forgejoSerializer } from "./serializer.js";
+export { forgejoPlugin } from "./plugin.js";
+export { applyForgejoDialect, transformWorkflowObject, DEFAULT_RUNNER_LABELS, type ForgejoDialectOptions, type ForgejoDialectResult, type TransformObjectResult, } from "./dialect.js";
+export { transform, detectGitHubWorkflow, type MigrateOptions, type MigrationResult, } from "./migrate/from-github/index.js";
+export { analyzeForgejoSecurity, renderSecurityPosture, type SecurityFate, type SecurityRecord, } from "./migrate/from-github/security.js";
+export { resolveActionRef, DEFAULT_ACTIONS_ROOT, KNOWN_ACTIONS, type ActionTarget, type ActionResolveOptions, type ActionResolveResult, } from "./actions.js";
+export * from "@intentius/chant-lexicon-github";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGjD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,WAAW,CAAC;AAInB,cAAc,iCAAiC,CAAC"}

package/dist/lint/post-synth/index.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const postSynthChecks: PostSynthCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/post-synth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAIvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAG3C,CAAC"}

package/dist/lint/post-synth/wfj010.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WFJ010: Unresolved action reference.
+ *
+ * After the forgejo dialect runs, every `uses:` should be a Forgejo-resolvable
+ * form (a full URL, a local `./` action, or `docker://`). A bare `owner/repo@ref`
+ * that survives into the output won't resolve — Forgejo has no GitHub
+ * Marketplace. Flags it so it's caught in `chant lint` / `forgejo:checks`, not
+ * only as a build-time warning.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wfj010: PostSynthCheck;
+//# sourceMappingURL=wfj010.d.ts.map

package/dist/lint/post-synth/wfj010.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wfj010.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wfj010.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAsBpB,CAAC"}

package/dist/lint/post-synth/wfj011.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WFJ011: GitHub-hosted runner label.
+ *
+ * `runs-on` labels like `macos-latest` / `windows-latest` name GitHub-hosted
+ * runners that don't exist on Forgejo, and `ubuntu-*` labels that the dialect
+ * didn't map (e.g. when mapping is overridden away) won't be advertised by a
+ * default Forgejo runner. Flags any such label that survives into the output.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wfj011: PostSynthCheck;
+//# sourceMappingURL=wfj011.d.ts.map

package/dist/lint/post-synth/wfj011.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wfj011.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wfj011.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAO9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/mcp/context-tools.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Read-only MCP tools for the forgejo lexicon.
+ *
+ * The forgejo counterpart to the github/gitlab context tools (#327): expose
+ * what `chant build` already computes about a Forgejo workflow — its triggers
+ * and jobs, what it pulls in from outside, its findings, where each job came
+ * from in source — plus `forgejo:compare`, the migration safety view. Because
+ * Forgejo emits GitHub-style YAML, the parsing reuses the github lexicon's
+ * yaml-helpers.
+ *
+ * Every tool builds from source and returns data. None touch a live forge,
+ * read run history, or write anything.
+ */
+import type { McpToolContribution } from "@intentius/chant/mcp/types";
+/** Is a `uses:` ref pinned to a full commit SHA (the only immutable form)? */
+export declare function actionPinned(ref: string): boolean;
+/** The YAML job name a build entity serializes to (camelCase → kebab-case). */
+export declare function jobNameOf(entityName: string): string;
+/** Jobs that would re-run because they depend (transitively) on `job`. */
+export declare function downstreamJobs(yaml: string, job: string): string[];
+/** The read-only context tools for the forgejo lexicon. */
+export declare function forgejoContextTools(): McpToolContribution[];
+//# sourceMappingURL=context-tools.d.ts.map

package/dist/mcp/context-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-tools.d.ts","sourceRoot":"","sources":["../../src/mcp/context-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AA6BtE,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEpD;AAkBD,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAsBlE;AAkBD,2DAA2D;AAC3D,wBAAgB,mBAAmB,IAAI,mBAAmB,EAAE,CAgJ3D"}

package/dist/migrate/from-github/index.d.ts

@@ -0,0 +1,48 @@
+/**
+ * github → forgejo migration entry point.
+ *
+ * Thin by design: Forgejo Actions YAML *is* GitHub Actions YAML, so the
+ * migration applies the same dialect as a `chant build` (drop ignored keys,
+ * resolve `uses:` refs, map runner labels) and emits the result. No stage
+ * inference, job→script rewrite, or `!reference` intrinsic like the gitlab
+ * migration needs. The differentiated value is the security-fate **compare**
+ * (see ./security).
+ */
+import type { LintDiagnostic } from "@intentius/chant/lint/rule";
+import { type SecurityRecord } from "./security.js";
+export interface MigrateOptions {
+    /** Output format. Defaults to "yaml". */
+    emit?: "yaml" | "ts";
+    /** Source file path (display only). */
+    sourceFile?: string;
+    /** Escalate needs-review/lost findings to errors. */
+    strict?: boolean;
+    /** Accepted for parity with the core MigrationSource contract; forgejo
+     *  always runs the (cheap) security analysis. */
+    security?: boolean;
+    /** Accepted for parity; forgejo has no composite rewriter. */
+    useComposites?: boolean;
+}
+export interface MigrationResult {
+    /** Rendered output (forgejo YAML by default, chant TS when emit: "ts"). */
+    output: string;
+    /** Per-property security-fate records. */
+    provenance: SecurityRecord[];
+    /** SARIF-shaped diagnostics derived from the records. */
+    diagnostics: LintDiagnostic[];
+    /** Markdown "Security posture" section. */
+    securityPosture: string;
+}
+/**
+ * Migrate a GitHub Actions workflow into a Forgejo workflow.
+ *
+ * @param content raw .github/workflows/*.yml content
+ * @param opts    migration options
+ */
+export declare function transform(content: string, opts?: MigrateOptions): Promise<MigrationResult>;
+/**
+ * Lightweight detector: does this content look like a GitHub Actions workflow?
+ * Used by the plugin's `migrationSource("github")`.
+ */
+export declare function detectGitHubWorkflow(content: string): boolean;
+//# sourceMappingURL=index.d.ts.map

package/dist/migrate/from-github/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-github/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGjE,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;qDACiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,yDAAyD;IACzD,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,2CAA2C;IAC3C,eAAe,EAAE,MAAM,CAAC;CACzB;AAyBD;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkBpG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAG7D"}

package/dist/migrate/from-github/security.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Security-fate model for the github → forgejo migration edge.
+ *
+ * github → forgejo YAML is near-identical, so the migration itself is thin. The
+ * differentiated value is the **compare**: classifying what survives the move
+ * and what Forgejo silently drops. Most properties translate verbatim; the
+ * useful findings are the keys the Forgejo runner ignores (`permissions`,
+ * `continue-on-error` → `lost`) plus refs/labels that need attention
+ * (unresolved `uses:`, unmapped runner labels → `needs-review`).
+ *
+ * Mirrors the gitlab lexicon's fate model (translated / approximated /
+ * needs-review / lost) but for the Forgejo edge — kept local so the forgejo
+ * lexicon does not depend on the gitlab one.
+ */
+import type { LintDiagnostic } from "@intentius/chant/lint/rule";
+export type SecurityFate = "translated" | "approximated" | "needs-review" | "lost";
+export interface SecurityProvenance {
+    /** Human label for the property (e.g. "Least-privilege permissions"). */
+    property: string;
+    /** What happened to the property as it crossed the github → forgejo edge. */
+    fate: SecurityFate;
+    /** Diagnostic severity for this finding. */
+    severity: "error" | "warning" | "info";
+    /** How to re-establish the property on Forgejo, when it doesn't carry. */
+    reestablish?: string;
+}
+/** A migration provenance record carrying a security classification. */
+export interface SecurityRecord {
+    /** YAML-ish path in the source (e.g. "jobs.build.steps[1].uses"). */
+    sourceKey: string;
+    /** Source file name (for diagnostics). */
+    sourceFile?: string;
+    /** Functional category (forgejo migration only emits security records). */
+    category: "needs-review" | "skipped" | "synthesis";
+    /** Rule ID (MIG-FJ-*). */
+    rule: string;
+    /** Human-readable explanation. */
+    note?: string;
+    /** Security classification. */
+    security: SecurityProvenance;
+}
+/**
+ * Classify the fate of security-relevant properties in a parsed GitHub Actions
+ * workflow as it migrates to Forgejo. Walks the source object so occurrence
+ * counts (and paths) are precise.
+ */
+export declare function analyzeForgejoSecurity(workflow: unknown, opts?: {
+    sourceFile?: string;
+}): SecurityRecord[];
+/**
+ * Convert security records into SARIF-shaped diagnostics. Security findings
+ * always emit a diagnostic at their severity, escalated to `error` under
+ * `--strict` when the property was lost or needs review.
+ */
+export declare function provenanceToDiagnostics(records: SecurityRecord[], opts?: {
+    strict?: boolean;
+}): LintDiagnostic[];
+/** Render a "Security posture" Markdown section from the security records. */
+export declare function renderSecurityPosture(records: SecurityRecord[]): string;
+//# sourceMappingURL=security.d.ts.map

package/dist/migrate/from-github/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-github/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAIjE,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,cAAc,GAAG,cAAc,GAAG,MAAM,CAAC;AAEnF,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,IAAI,EAAE,YAAY,CAAC;IACnB,4CAA4C;IAC5C,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,QAAQ,EAAE,cAAc,GAAG,SAAS,GAAG,WAAW,CAAC;IACnD,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAMD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,OAAO,EACjB,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GACjC,cAAc,EAAE,CA6ElB;AAQD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,cAAc,EAAE,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,cAAc,EAAE,CAYlB;AASD,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAmBvE"}

package/dist/plugin.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Forgejo Actions lexicon plugin.
+ *
+ * Forgejo runs GitHub-Actions-compatible workflows, so this lexicon is a thin
+ * dialect of the github lexicon: it reuses github's generated entities and
+ * composites wholesale (re-exported from ./index) and overrides only the
+ * serializer. There is no own spec, so the codegen lifecycle methods are
+ * intentionally no-ops — they delegate the real work to the github lexicon.
+ */
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+export declare const forgejoPlugin: LexiconPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAoC,MAAM,0BAA0B,CAAC;AAWhG,eAAO,MAAM,aAAa,EAAE,aAsJ3B,CAAC"}

package/dist/serializer.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Forgejo Actions YAML serializer.
+ *
+ * A thin dialect of the github serializer: it applies the Forgejo dialect
+ * (see ./dialect) to the entity graph, then delegates emission to the github
+ * serializer, which already produces GitHub-Actions-compatible YAML — exactly
+ * what Forgejo / Codeberg / Gitea runners execute.
+ *
+ * The serializer's `name` is "github" on purpose: github-lexicon entities are
+ * tagged `lexicon: "github"`, and the build pipeline partitions and looks up
+ * serializers by that tag. A forgejo project loads only this serializer, so it
+ * claims that partition. The distinct `rulePrefix` ("WFJ") keeps Forgejo lint
+ * diagnostics namespaced apart from github's "GHA".
+ */
+import type { Serializer } from "@intentius/chant/serializer";
+/**
+ * Forgejo Actions YAML serializer implementation.
+ */
+export declare const forgejoSerializer: Serializer;
+//# sourceMappingURL=serializer.d.ts.map

package/dist/serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAoBlG;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAsB/B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -31,8 +31,21 @@
     "access": "public"
   },
   "exports": {
-    ".": "./src/index.ts",
-    "./*": "./src/*.ts"
+    ".": {
+      "development": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./src/index.ts"
+    },
+    "./*": {
+      "development": "./src/*.ts",
+      "types": "./dist/*.d.ts",
+      "default": "./src/*.ts"
+    },
+    "./lint/post-synth": {
+      "development": "./src/lint/post-synth/index.ts",
+      "types": "./dist/lint/post-synth/index.d.ts",
+      "default": "./src/lint/post-synth/index.ts"
+    }
   },
   "devDependencies": {
     "@intentius/chant": "*",
@@ -40,7 +53,11 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.1.0",
-    "@intentius/chant-lexicon-github": "^0.1.0"
+    "@intentius/chant": "^0.8.0",
+    "@intentius/chant-lexicon-github": "^0.8.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete",
+    "prepack": "npm run build"
   }
 }

package/src/lint/post-synth/index.ts

@@ -0,0 +1,9 @@
+// Code generated by chant generate. DO NOT EDIT.
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { wfj010 } from "./wfj010";
+import { wfj011 } from "./wfj011";
+
+export const postSynthChecks: PostSynthCheck[] = [
+  wfj010,
+  wfj011,
+];

package/src/mcp/context-tools.ts

@@ -14,12 +14,11 @@
 
 import { build, type BuildResult } from "@intentius/chant/build";
 import { runPostSynthChecks, getPrimaryOutput } from "@intentius/chant/lint/post-synth";
-import { discoverPostSynthChecks } from "@intentius/chant/lint/discover";
+import { postSynthChecks } from "../lint/post-synth";
 import { getProvenance } from "@intentius/chant/provenance";
 import type { McpToolContribution } from "@intentius/chant/mcp/types";
-import { dirname, join, relative, isAbsolute, resolve } from "path";
+import { relative, isAbsolute, resolve } from "path";
 import { readFile } from "fs/promises";
-import { fileURLToPath } from "url";
 import {
   extractJobs,
   extractActionRefs,
@@ -43,8 +42,7 @@ async function buildForgejo(path: string): Promise<{ yaml: string; result: Build
 
 /** Discover the forgejo post-synth checks without depending on the plugin. */
 function forgejoPostSynthChecks() {
-  const dir = join(dirname(fileURLToPath(import.meta.url)), "..", "lint", "post-synth");
-  return discoverPostSynthChecks(dir, import.meta.url);
+  return postSynthChecks;
 }
 
 /** Is a `uses:` ref pinned to a full commit SHA (the only immutable form)? */

package/src/plugin.ts

@@ -9,7 +9,7 @@
  */
 
 import type { LexiconPlugin, InitTemplateSet, MigrationSource } from "@intentius/chant/lexicon";
-import { discoverPostSynthChecks } from "@intentius/chant/lint/discover";
+import { postSynthChecks as postSynthCheckList } from "./lint/post-synth";
 import { createSkillsLoader, createDiffTool } from "@intentius/chant/lexicon-plugin-helpers";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
@@ -122,8 +122,7 @@ export const build = new Job({
   },
 
   postSynthChecks() {
-    const dir = join(dirname(fileURLToPath(import.meta.url)), "lint", "post-synth");
-    return discoverPostSynthChecks(dir, import.meta.url);
+    return postSynthCheckList;
   },
 
   mcpTools() {