@intentius/chant-lexicon-gitlab 0.6.0 → 0.8.0

package/dist/migrate/from-github/composites/patterns.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Pattern recognisers for `chant migrate --use-composites`.
+ *
+ * Each pattern walks the GitLab IR looking for a recognisable shape
+ * (e.g. NodePipeline-shaped 2-job setup) and rewrites the matched
+ * resources into a sentinel IR type (`GitLab::Composite::NodePipeline`)
+ * that the GitLab generator (`lexicons/gitlab/src/import/generator.ts`)
+ * will emit as `NodePipeline({...})` instead of raw `new Job(...)`.
+ */
+import type { TemplateIR, ResourceIR } from "@intentius/chant/import/parser";
+import type { ProvenanceRecord } from "../provenance.js";
+export interface CompositePattern {
+    name: string;
+    match(ir: TemplateIR): MatchResult | null;
+    rewrite(ir: TemplateIR, match: MatchResult): {
+        ir: TemplateIR;
+        provenance: ProvenanceRecord[];
+    };
+}
+export interface MatchResult {
+    /** Resource logicalIds to remove */
+    removed: string[];
+    /** New composite resource to add */
+    added: ResourceIR;
+}
+export declare const PATTERNS: CompositePattern[];
+//# sourceMappingURL=patterns.d.ts.map

package/dist/migrate/from-github/composites/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../../src/migrate/from-github/composites/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC;IAC1C,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG;QAAE,EAAE,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;CACjG;AAED,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oCAAoC;IACpC,KAAK,EAAE,UAAU,CAAC;CACnB;AA0ID,eAAO,MAAM,QAAQ,EAAE,gBAAgB,EAItC,CAAC"}

package/dist/migrate/from-github/composites/rewriter.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `--use-composites` orchestrator: walks the registered patterns and
+ * applies the first match. Patterns are tried in declaration order
+ * (NodePipeline before NodeCI so the 2-job shape wins over the 1-job
+ * shape when both could match).
+ */
+import type { TemplateIR } from "@intentius/chant/import/parser";
+import type { ProvenanceRecord } from "../provenance.js";
+import { type CompositePattern } from "./patterns.js";
+export declare function applyComposites(ir: TemplateIR, registry?: CompositePattern[]): {
+    ir: TemplateIR;
+    provenance: ProvenanceRecord[];
+};
+//# sourceMappingURL=rewriter.d.ts.map

package/dist/migrate/from-github/composites/rewriter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewriter.d.ts","sourceRoot":"","sources":["../../../../src/migrate/from-github/composites/rewriter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAY,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE7D,wBAAgB,eAAe,CAC7B,EAAE,EAAE,UAAU,EACd,QAAQ,GAAE,gBAAgB,EAAa,GACtC;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAcpD"}

package/dist/migrate/from-github/diagnostics.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Convert ProvenanceRecord[] into LintDiagnostic[] for SARIF output.
+ *
+ * Mapping:
+ *   - category "needs-review"   → severity "warning" (or "error" if --strict)
+ *   - category "skipped"        → severity "info"
+ *   - category "action-map" tier 3 → severity "warning"
+ *   - all others                → no diagnostic (clean translation)
+ */
+import type { LintDiagnostic } from "@intentius/chant/lint/rule";
+import type { ProvenanceRecord } from "./provenance.js";
+export interface DiagnosticOptions {
+    /** When true, needs-review records become errors instead of warnings */
+    strict?: boolean;
+}
+export declare function provenanceToDiagnostics(records: ProvenanceRecord[], opts?: DiagnosticOptions): LintDiagnostic[];
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/migrate/from-github/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-github/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,gBAAgB,EAAE,EAC3B,IAAI,GAAE,iBAAsB,GAC3B,cAAc,EAAE,CAyClB"}

package/dist/migrate/from-github/emit-yaml.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Direct GitLab TemplateIR → `.gitlab-ci.yml` text emission.
+ *
+ * We deliberately bypass the existing `gitlabSerializer.serialize()` because
+ * that path consumes `Map<string, Declarable>` (entity instances built by
+ * user TS code), not a raw IR. Going through entity instances would require
+ * runtime construction of typed objects we don't have. Direct emission is
+ * ~60 LOC.
+ */
+import type { TemplateIR } from "@intentius/chant/import/parser";
+/**
+ * Convert a GitLab `TemplateIR` (produced by the GH→GL transformer) into
+ * `.gitlab-ci.yml` text.
+ */
+export declare function emitGitlabYaml(ir: TemplateIR): string;
+//# sourceMappingURL=emit-yaml.d.ts.map

package/dist/migrate/from-github/emit-yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit-yaml.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-github/emit-yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AA6CjE;;;GAGG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,UAAU,GAAG,MAAM,CAoErD"}

package/dist/migrate/from-github/expressions.d.ts

@@ -0,0 +1,65 @@
+/**
+ * GitHub Actions expression substitution.
+ *
+ * Translates `${{ github.X }}`, `${{ runner.X }}`, `${{ secrets.X }}`,
+ * `${{ env.X }}`, `${{ vars.X }}`, `${{ inputs.X }}`, `${{ matrix.X }}`,
+ * and a small set of expression functions (`always()`, `failure()`, etc.)
+ * to their GitLab CI predefined-variable equivalents.
+ *
+ * Source: the upstream `github-actions-to-gitlab-ci` skill's
+ * `references/syntax-mapping.md` "github.* context expressions" tables.
+ */
+import type { ProvenanceRecord } from "./provenance.js";
+/**
+ * Map a GitHub `if:` boolean function to a GitLab `when:` value or rule.
+ *
+ * Returned tuple is `[gitlabExpression, isWhenClause]` — when `isWhenClause`
+ * is true, the caller should emit `when: <expr>` rather than `if: <expr>`.
+ */
+export declare function translateIfFunction(expr: string): {
+    expression: string;
+    whenClause?: string;
+    needsReview?: boolean;
+};
+/**
+ * Substitute all `${{ ... }}` template expressions in a string with their
+ * GitLab equivalents. Returns the substituted string plus any provenance
+ * records describing which substitutions happened (or which need review).
+ */
+export declare function substituteExpressions(input: string, ctx: {
+    gitlabPath: string;
+    sourceKey?: string;
+    sourceFile?: string;
+}): {
+    output: string;
+    provenance: ProvenanceRecord[];
+};
+/**
+ * Substitute GitHub identifiers (e.g. `github.ref`) appearing anywhere
+ * in a string with their GitLab predefined-variable equivalents.
+ * Used for if-conditions, concurrency.group values, and other places
+ * where identifiers appear without `${{ }}` wrapping.
+ */
+export declare function substituteIdentifiers(input: string, ctx: {
+    gitlabPath: string;
+    sourceKey?: string;
+    sourceFile?: string;
+}): {
+    output: string;
+    provenance: ProvenanceRecord[];
+};
+/**
+ * Translate a GitHub `if:` condition expression (without `${{ }}` wrapping)
+ * into a GitLab `rules:if:` expression. Returns substituted expression and
+ * any whenClause hint extracted from boolean function calls.
+ */
+export declare function translateIfCondition(rawIf: string, ctx: {
+    gitlabPath: string;
+    sourceKey?: string;
+    sourceFile?: string;
+}): {
+    ifExpression: string;
+    whenClause?: string;
+    provenance: ProvenanceRecord[];
+};
+//# sourceMappingURL=expressions.d.ts.map

package/dist/migrate/from-github/expressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expressions.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-github/expressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAyCrD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,GACX;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,CASpE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAwGpD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAmEpD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,gBAAgB,EAAE,CAAA;CAAE,CA6B/E"}

package/dist/migrate/from-github/index.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Public entry point for the GitHub Actions → GitLab CI migration tool.
+ *
+ * Lazy-imports `@intentius/chant-lexicon-github` so users who don't need
+ * migration don't pay the install cost (the github lexicon is an optional
+ * peer dependency of `@intentius/chant-lexicon-gitlab`).
+ */
+import type { TemplateIR } from "@intentius/chant/import/parser";
+import type { LintDiagnostic } from "@intentius/chant/lint/rule";
+import { type ProvenanceRecord } from "./provenance.js";
+import type { ActionMappingRegistry } from "./actions/registry.js";
+import "./actions/index.js";
+export interface MigrateOptions {
+    /** Output format. */
+    emit?: "yaml" | "ts";
+    /** Enable composite-pattern recognition (Node patterns in v1). */
+    useComposites?: boolean;
+    /** Source file path for provenance (display only). */
+    sourceFile?: string;
+    /** Inject a custom action mapping registry for testing. */
+    registry?: ActionMappingRegistry;
+    /** Escalate needs-review diagnostics to errors. */
+    strict?: boolean;
+    /**
+     * Security-aware migration (#306): classify each security property's fate
+     * across the edge and run the GitLab security post-synth checks against the
+     * migrated YAML. Enabled by the CLI's `--validate` path.
+     */
+    security?: boolean;
+}
+export interface MigrationResult {
+    /** GitLab IR (consumed by `chant import`-style tools downstream). */
+    ir: TemplateIR;
+    /** Rendered output (YAML by default, TS when emit: "ts"). */
+    output: string;
+    /** Per-key provenance records. */
+    provenance: ProvenanceRecord[];
+    /** SARIF-shaped diagnostics derived from provenance. */
+    diagnostics: LintDiagnostic[];
+    /** Inferred stage list. */
+    stages: string[];
+    /** Markdown "Security posture" section (#306). */
+    securityPosture: string;
+}
+/**
+ * Migrate a GitHub Actions workflow YAML into GitLab CI.
+ *
+ * @param yamlContent raw .github/workflows/*.yml content
+ * @param opts        migration options
+ */
+export declare function transform(yamlContent: string, opts?: MigrateOptions): Promise<MigrationResult>;
+/**
+ * Lightweight detector: does this YAML look like a GitHub Actions workflow?
+ * Used by the plugin's `migrationSource("github")` extension.
+ */
+export declare function detectGitHubWorkflow(content: string): boolean;
+export { ProvenanceAccumulator } from "./provenance.js";
+export type { ProvenanceRecord, ProvenanceCategory } from "./provenance.js";
+export type { ActionMapping, ActionMapCtx, ActionMappedResult, ActionMappingRegistry } from "./actions/registry.js";
+export { createRegistry, getDefaultRegistry, lookupAction } from "./actions/registry.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/migrate/from-github/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-github/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAO5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAIhE,OAAO,iBAAiB,CAAC;AAEzB,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,mDAAmD;IACnD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,EAAE,EAAE,UAAU,CAAC;IACf,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B,wDAAwD;IACxD,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,2BAA2B;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,eAAe,CAAC,CAiE1B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI7D;AAED,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/migrate/from-github/provenance.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Per-node provenance for GitHub Actions → GitLab CI migration.
+ *
+ * Returned as a side channel from `transform()` so the IR stays clean
+ * (re-usable by `chant import`) while still capturing per-key migration
+ * history for SARIF/Markdown reporting.
+ */
+export type ProvenanceCategory = "literal" | "rewrite" | "synthesis" | "needs-review" | "skipped" | "action-map";
+export interface ProvenanceRecord {
+    /** Where this lives in the output (GitLab IR) — e.g. "jobs.test.script[2]" */
+    gitlabPath: string;
+    /** Resource logicalId in the GitLab IR, if applicable */
+    gitlabLogicalId?: string;
+    /** Source file name (for SARIF) */
+    sourceFile?: string;
+    /** 1-based source line (best effort) */
+    sourceLine?: number;
+    /** 1-based source column (best effort) */
+    sourceColumn?: number;
+    /** YAML path in the source (e.g. "jobs.test.steps[1].uses") */
+    sourceKey?: string;
+    /** What category of translation happened */
+    category: ProvenanceCategory;
+    /** Rule ID (e.g. "MIG-TRIGGER-001", "ACT-actions-checkout") */
+    rule: string;
+    /** Free-form explanation for human readers */
+    note?: string;
+    /** Original action reference (e.g. "actions/checkout@v4") for action-map records */
+    actionRef?: string;
+    /** Tier 1/2/3 for action-map records */
+    mappingTier?: 1 | 2 | 3;
+    /** Security classification, when this record concerns a security property. */
+    security?: SecurityProvenance;
+}
+/**
+ * Fate of a security property as it crosses the GitHub → GitLab boundary,
+ * mirroring the functional provenance categories.
+ */
+export type SecurityFate = "translated" | "approximated" | "needs-review" | "lost";
+/**
+ * Security classification attached to a provenance record — tracks whether a
+ * security-relevant property survived migration, alongside the functional one.
+ */
+export interface SecurityProvenance {
+    /** Human label for the property (e.g. "Pinned action SHA"). */
+    property: string;
+    /** What happened to the property across the migration edge. */
+    fate: SecurityFate;
+    /** Diagnostic severity for this finding. */
+    severity: "error" | "warning" | "info";
+    /** Cross-reference to the endpoint that re-establishes the property. */
+    reestablish?: string;
+}
+/**
+ * Accumulator passed through the transformer pipeline so any step can
+ * append to the same provenance list without threading return values.
+ */
+export declare class ProvenanceAccumulator {
+    private records;
+    push(record: ProvenanceRecord): void;
+    pushAll(records: ProvenanceRecord[]): void;
+    all(): ProvenanceRecord[];
+    byCategory(category: ProvenanceCategory): ProvenanceRecord[];
+    needsReviewCount(): number;
+    /** Records carrying a security classification. */
+    securityRecords(): ProvenanceRecord[];
+}
+//# sourceMappingURL=provenance.d.ts.map

package/dist/migrate/from-github/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-github/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,SAAS,GACT,WAAW,GACX,cAAc,GACd,SAAS,GACT,YAAY,CAAC;AAEjB,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,cAAc,GAAG,cAAc,GAAG,MAAM,CAAC;AAEnF;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,IAAI,EAAE,YAAY,CAAC;IACnB,4CAA4C;IAC5C,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,OAAO,CAA0B;IAEzC,IAAI,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAIpC,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,IAAI;IAI1C,GAAG,IAAI,gBAAgB,EAAE;IAIzB,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAG,gBAAgB,EAAE;IAI5D,gBAAgB,IAAI,MAAM;IAI1B,kDAAkD;IAClD,eAAe,IAAI,gBAAgB,EAAE;CAGtC"}

package/dist/migrate/from-github/rules.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Static LintRule metadata for SARIF enrichment.
+ *
+ * Each rule fired by the transformer (provenance.rule field) gets a
+ * corresponding entry here so SARIF output carries description + helpUri.
+ *
+ * These rules don't actually run a `check()` — the work has already been
+ * done by the transformer. They're metadata-only.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const MIGRATION_RULES: LintRule[];
+//# sourceMappingURL=rules.d.ts.map

package/dist/migrate/from-github/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-github/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAe3D,eAAO,MAAM,eAAe,EAAE,QAAQ,EA+DrC,CAAC"}

package/dist/migrate/from-github/security.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Security-aware migration (#306).
+ *
+ * Migration is the edge between the two security endpoints (#296 ↔ #305).
+ * Security properties don't translate 1:1 — some are silently preserved, some
+ * lost, some need re-establishing on the GitLab side. This module classifies
+ * each security-relevant property's fate as it crosses the boundary and runs
+ * the GitLab security post-synth checks against the migrated output so anything
+ * lost in translation is caught on the target side.
+ */
+import type { ProvenanceRecord } from "./provenance.js";
+/**
+ * Classify the fate of security-relevant properties as they migrate from a
+ * GitHub Actions workflow to GitLab CI. Returns provenance records carrying a
+ * `security` classification (which flow into diagnostics, SARIF, and the report
+ * like any other provenance record).
+ */
+export declare function analyzeSecurity(sourceYaml: string, opts?: {
+    sourceFile?: string;
+}): ProvenanceRecord[];
+/**
+ * Run the GitLab security post-synth checks against the migrated `.gitlab-ci.yml`
+ * and return their findings as provenance records — *migrate, then prove the
+ * output clears the GitLab security bar*. Anything lost in translation that
+ * lands as a concrete weakness on the target is caught here.
+ */
+export declare function runSecurityChecks(gitlabYaml: string, opts?: {
+    sourceFile?: string;
+}): Promise<ProvenanceRecord[]>;
+/**
+ * Render a "Security posture" Markdown section from the security provenance
+ * records (those carrying a `security` classification).
+ */
+export declare function renderSecurityPosture(records: ProvenanceRecord[]): string;
+//# sourceMappingURL=security.d.ts.map

package/dist/migrate/from-github/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-github/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAiBrD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,gBAAgB,EAAE,CA0F1G;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAwC3H;AAUD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAqBzE"}

package/dist/migrate/from-github/stages.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Stage inference for GitHub jobs → GitLab stages.
+ *
+ * GitHub Actions has no `stages:` concept; jobs only declare optional
+ * `needs:` edges. GitLab CI requires every job to belong to a stage.
+ *
+ * Approach (Kahn topological sort on the `needs:` DAG):
+ *   1. Build adjacency from `needs:` (jobs without `needs:` are depth 0).
+ *   2. Peel zero-indegree nodes; assign stage by depth + name heuristic.
+ *   3. Map depths to stage names:
+ *      depth 0 → "lint" / "build" (by name heuristic, default "build")
+ *      depth 1 → "test"
+ *      depth 2 → "deploy"
+ *      depth N>2 → `post-${N-2}`
+ *   4. If a cycle is detected, place each remaining job in its own stage
+ *      and append a needs-review record so the user notices.
+ */
+import type { ProvenanceRecord } from "./provenance.js";
+export interface GhJobSummary {
+    logicalId: string;
+    needs: string[];
+    /** Original GH job key (kebab-case) for name heuristics */
+    originalName: string;
+}
+export interface StageInferenceResult {
+    /** Map from job logicalId to assigned stage name */
+    stageByJob: Map<string, string>;
+    /** Ordered list of distinct stages, declaration-order */
+    stages: string[];
+    /** Any provenance records (cycles, synthesis events) */
+    provenance: ProvenanceRecord[];
+}
+export declare function inferStages(jobs: GhJobSummary[]): StageInferenceResult;
+//# sourceMappingURL=stages.d.ts.map

package/dist/migrate/from-github/stages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-github/stages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,oDAAoD;IACpD,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,yDAAyD;IACzD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wDAAwD;IACxD,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAuBD,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,oBAAoB,CAuHtE"}

package/dist/migrate/from-github/transformer.d.ts

@@ -0,0 +1,26 @@
+/**
+ * GitHub Actions → GitLab CI transformer.
+ *
+ * Takes a GitHub TemplateIR (produced by `GitHubActionsParser.parse`)
+ * and rewrites it into a GitLab TemplateIR (consumed by the existing
+ * `GitLabGenerator` for TS emit, or by `emit-yaml.ts` for direct YAML).
+ *
+ * Per-key provenance is collected in a side-channel `ProvenanceAccumulator`
+ * so the IR stays clean (re-usable by `chant import`).
+ */
+import type { TemplateIR } from "@intentius/chant/import/parser";
+import type { ProvenanceAccumulator } from "./provenance.js";
+import { type ActionMappingRegistry } from "./actions/registry.js";
+export interface TransformOptions {
+    /** Source file path for provenance (best-effort, no parse) */
+    sourceFile?: string;
+    /** Optional registry override for testability */
+    registry?: ActionMappingRegistry;
+    /** Provenance accumulator to write to */
+    provenance: ProvenanceAccumulator;
+}
+export declare function transformIR(ghIR: TemplateIR, opts: TransformOptions): Promise<{
+    ir: TemplateIR;
+    stages: string[];
+}>;
+//# sourceMappingURL=transformer.d.ts.map

package/dist/migrate/from-github/transformer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transformer.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-github/transformer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAG1D,OAAO,EAAgB,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAwB9E,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,yCAAyC;IACzC,UAAU,EAAE,qBAAqB,CAAC;CACnC;AAwiBD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAqH/C"}

package/dist/package-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=package-cli.d.ts.map

package/dist/package-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-cli.d.ts","sourceRoot":"","sources":["../src/package-cli.ts"],"names":[],"mappings":""}

package/dist/plugin.d.ts

@@ -0,0 +1,9 @@
+/**
+ * GitLab CI/CD lexicon plugin.
+ *
+ * Provides serializer, template detection, and code generation
+ * for GitLab CI/CD pipelines.
+ */
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+export declare const gitlabPlugin: LexiconPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAiB7F,eAAO,MAAM,YAAY,EAAE,aA2f1B,CAAC"}

package/dist/rules/wgl011.ts

@@ -21,10 +21,10 @@ export const wgl011: PostSynthCheck = {
 
     for (const [entityName, entity] of ctx.entities) {
       if (isPropertyDeclarable(entity)) continue;
-      const entityType = (entity as Record<string, unknown>).entityType as string;
+      const entityType = (entity as unknown as Record<string, unknown>).entityType as string;
       if (entityType !== "GitLab::CI::Job") continue;
 
-      const props = (entity as Record<string, unknown>).props as Record<string, unknown> | undefined;
+      const props = (entity as unknown as Record<string, unknown>).props as Record<string, unknown> | undefined;
       if (!props?.rules || !Array.isArray(props.rules)) continue;
 
       const rules = props.rules as Array<Record<string, unknown>>;

package/dist/rules/wgl012.ts

@@ -53,11 +53,11 @@ export function checkDeprecatedProperties(
   for (const [entityName, entity] of ctx.entities) {
     if (isPropertyDeclarable(entity)) continue;
 
-    const entityType = (entity as Record<string, unknown>).entityType as string;
+    const entityType = (entity as unknown as Record<string, unknown>).entityType as string;
     const deprProps = deprecated.get(entityType);
     if (!deprProps) continue;
 
-    const props = (entity as Record<string, unknown>).props as Record<string, unknown> | undefined;
+    const props = (entity as unknown as Record<string, unknown>).props as Record<string, unknown> | undefined;
     if (!props) continue;
 
     for (const propName of Object.keys(props)) {

package/dist/rules/wgl018.ts

@@ -17,10 +17,10 @@ export const wgl018: PostSynthCheck = {
 
     for (const [entityName, entity] of ctx.entities) {
       if (isPropertyDeclarable(entity)) continue;
-      const entityType = (entity as Record<string, unknown>).entityType as string;
+      const entityType = (entity as unknown as Record<string, unknown>).entityType as string;
       if (entityType !== "GitLab::CI::Job") continue;
 
-      const props = (entity as Record<string, unknown>).props as Record<string, unknown> | undefined;
+      const props = (entity as unknown as Record<string, unknown>).props as Record<string, unknown> | undefined;
       if (!props) continue;
 
       if (!props.timeout) {

package/dist/rules/wgl019.ts

@@ -19,10 +19,10 @@ export const wgl019: PostSynthCheck = {
 
     for (const [entityName, entity] of ctx.entities) {
       if (isPropertyDeclarable(entity)) continue;
-      const entityType = (entity as Record<string, unknown>).entityType as string;
+      const entityType = (entity as unknown as Record<string, unknown>).entityType as string;
       if (entityType !== "GitLab::CI::Job") continue;
 
-      const props = (entity as Record<string, unknown>).props as Record<string, unknown> | undefined;
+      const props = (entity as unknown as Record<string, unknown>).props as Record<string, unknown> | undefined;
       if (!props) continue;
 
       const stage = props.stage as string | undefined;

package/dist/rules/wgl022.ts

@@ -18,10 +18,10 @@ export const wgl022: PostSynthCheck = {
 
     for (const [entityName, entity] of ctx.entities) {
       if (isPropertyDeclarable(entity)) continue;
-      const entityType = (entity as Record<string, unknown>).entityType as string;
+      const entityType = (entity as unknown as Record<string, unknown>).entityType as string;
       if (entityType !== "GitLab::CI::Job") continue;
 
-      const props = (entity as Record<string, unknown>).props as Record<string, unknown> | undefined;
+      const props = (entity as unknown as Record<string, unknown>).props as Record<string, unknown> | undefined;
       if (!props?.artifacts) continue;
 
       const artifacts = props.artifacts as Record<string, unknown>;

package/dist/rules/wgl023.ts

@@ -18,10 +18,10 @@ export const wgl023: PostSynthCheck = {
 
     for (const [entityName, entity] of ctx.entities) {
       if (isPropertyDeclarable(entity)) continue;
-      const entityType = (entity as Record<string, unknown>).entityType as string;
+      const entityType = (entity as unknown as Record<string, unknown>).entityType as string;
       if (entityType !== "GitLab::CI::Job") continue;
 
-      const props = (entity as Record<string, unknown>).props as Record<string, unknown> | undefined;
+      const props = (entity as unknown as Record<string, unknown>).props as Record<string, unknown> | undefined;
       if (!props?.rules || !Array.isArray(props.rules)) continue;
 
       const rules = props.rules as Array<Record<string, unknown>>;

package/dist/rules/wgl024.ts

@@ -18,10 +18,10 @@ export const wgl024: PostSynthCheck = {
 
     for (const [entityName, entity] of ctx.entities) {
       if (isPropertyDeclarable(entity)) continue;
-      const entityType = (entity as Record<string, unknown>).entityType as string;
+      const entityType = (entity as unknown as Record<string, unknown>).entityType as string;
       if (entityType !== "GitLab::CI::Job") continue;
 
-      const props = (entity as Record<string, unknown>).props as Record<string, unknown> | undefined;
+      const props = (entity as unknown as Record<string, unknown>).props as Record<string, unknown> | undefined;
       if (!props) continue;
 
       // Check top-level when: manual

package/dist/rules/wgl025.ts

@@ -18,10 +18,10 @@ export const wgl025: PostSynthCheck = {
 
     for (const [entityName, entity] of ctx.entities) {
       if (isPropertyDeclarable(entity)) continue;
-      const entityType = (entity as Record<string, unknown>).entityType as string;
+      const entityType = (entity as unknown as Record<string, unknown>).entityType as string;
       if (entityType !== "GitLab::CI::Job") continue;
 
-      const props = (entity as Record<string, unknown>).props as Record<string, unknown> | undefined;
+      const props = (entity as unknown as Record<string, unknown>).props as Record<string, unknown> | undefined;
       if (!props?.cache) continue;
 
       // Cache can be a single object or an array

package/dist/rules/wgl026.ts

@@ -24,10 +24,10 @@ export const wgl026: PostSynthCheck = {
 
     for (const [entityName, entity] of ctx.entities) {
       if (isPropertyDeclarable(entity)) continue;
-      const entityType = (entity as Record<string, unknown>).entityType as string;
+      const entityType = (entity as unknown as Record<string, unknown>).entityType as string;
       if (entityType !== "GitLab::CI::Job") continue;
 
-      const props = (entity as Record<string, unknown>).props as Record<string, unknown> | undefined;
+      const props = (entity as unknown as Record<string, unknown>).props as Record<string, unknown> | undefined;
       if (!props?.services || !Array.isArray(props.services)) continue;
 
       for (const service of props.services) {

package/dist/rules/wgl027.ts

@@ -17,10 +17,10 @@ export const wgl027: PostSynthCheck = {
 
     for (const [entityName, entity] of ctx.entities) {
       if (isPropertyDeclarable(entity)) continue;
-      const entityType = (entity as Record<string, unknown>).entityType as string;
+      const entityType = (entity as unknown as Record<string, unknown>).entityType as string;
       if (entityType !== "GitLab::CI::Job") continue;
 
-      const props = (entity as Record<string, unknown>).props as Record<string, unknown> | undefined;
+      const props = (entity as unknown as Record<string, unknown>).props as Record<string, unknown> | undefined;
       if (!props) continue;
 
       const script = props.script;

package/dist/serializer.d.ts

@@ -0,0 +1,14 @@
+/**
+ * GitLab CI YAML serializer.
+ *
+ * Converts Chant declarables to .gitlab-ci.yml YAML output.
+ * Uses snake_case keys (GitLab CI convention) and produces
+ * valid YAML without a library dependency — the CI schema is
+ * simple enough for a direct emitter.
+ */
+import type { Serializer } from "@intentius/chant/serializer";
+/**
+ * GitLab CI YAML serializer implementation.
+ */
+export declare const gitlabSerializer: Serializer;
+//# sourceMappingURL=serializer.d.ts.map

package/dist/serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AA0E9D;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAmF9B,CAAC"}

package/dist/testdata/create-fixture.d.ts

@@ -0,0 +1,7 @@
+#!/usr/bin/env tsx
+/**
+ * Script to create a minimal CI schema fixture for tests.
+ * Run once: npx tsx src/testdata/create-fixture.ts
+ */
+export {};
+//# sourceMappingURL=create-fixture.d.ts.map

package/dist/testdata/create-fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fixture.d.ts","sourceRoot":"","sources":["../../src/testdata/create-fixture.ts"],"names":[],"mappings":";AACA;;;GAGG"}