@intentius/chant-lexicon-gitlab 0.7.0 → 0.8.1

package/dist/lint/post-synth/wgl039.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WGL039: Secret Echoed to Job Logs
+ *
+ * Flags a `script:` command that prints a secret-like variable (`echo`,
+ * `printf`, `print`, `cat`) — even masked variables leak when transformed
+ * (base64, reversed) before printing, and job logs are broadly readable.
+ * Remove the debug print or pipe the value where it is needed without echoing it.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl039: PostSynthCheck;
+//# sourceMappingURL=wgl039.d.ts.map

package/dist/lint/post-synth/wgl039.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl039.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl039.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/wgl040.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WGL040: Hardcoded Credential in a Registry Login
+ *
+ * Flags a `docker login` (or compatible) in a `script:` that passes a literal
+ * password via `-p` / `--password` instead of a variable or `--password-stdin`.
+ * An inlined credential sits in the committed pipeline and the job log. Use a
+ * masked CI/CD variable and `--password-stdin`. Extends WGL016 to scripts.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl040: PostSynthCheck;
+//# sourceMappingURL=wgl040.d.ts.map

package/dist/lint/post-synth/wgl040.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl040.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl040.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/wgl041.d.ts

@@ -0,0 +1,13 @@
+/**
+ * WGL041: Logically Unsound rules:if Condition
+ *
+ * Flags a `rules:if` that reads like a gate but is a constant — both sides of an
+ * `==`/`!=` are identical, so the condition is always true or always false.
+ * Generalizes WGL011 (rules that always evaluate to never) to tautological
+ * conditions presented as gates.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/** Classify an `if:` expression as a tautology, returning a reason or undefined. */
+export declare function tautologyReason(expr: string): string | undefined;
+export declare const wgl041: PostSynthCheck;
+//# sourceMappingURL=wgl041.d.ts.map

package/dist/lint/post-synth/wgl041.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl041.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl041.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAO9G,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOhE;AAED,eAAO,MAAM,MAAM,EAAE,cA8BpB,CAAC"}

package/dist/lint/post-synth/wgl042.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WGL042: Unreachable rules After an Unconditional Match
+ *
+ * GitLab evaluates `rules:` top-down and the first match wins. A rule with no
+ * `if:` (and not `when: never`) matches every pipeline, so any rule listed after
+ * it is dead — it can never be reached. Such dead rules usually mean the gate
+ * the author intended is not actually applied. Reorder so specific rules precede
+ * the catch-all.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl042: PostSynthCheck;
+//# sourceMappingURL=wgl042.d.ts.map

package/dist/lint/post-synth/wgl042.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl042.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl042.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAgCpB,CAAC"}

package/dist/lint/post-synth/wgl043.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WGL043: Match-Anything Regex Gate
+ *
+ * Flags a `rules:if` whose regex match (`=~`) uses a pattern that matches every
+ * value — an empty regex, dot-star, or an anchored dot-star. The condition reads
+ * like a filter on a ref or variable but admits everything, so it gates nothing.
+ * This is how an unsound condition is obscured behind a regex. Tighten the
+ * pattern or remove the gate.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl043: PostSynthCheck;
+//# sourceMappingURL=wgl043.d.ts.map

package/dist/lint/post-synth/wgl043.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl043.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl043.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/post-synth/wgl044.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WGL044: Public Artifacts
+ *
+ * Flags `artifacts:public: true`. Public artifacts are downloadable by anyone,
+ * including unauthenticated users for public projects, exposing build output and
+ * anything swept into it. Keep artifacts private unless they are deliberately
+ * meant to be world-readable.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl044: PostSynthCheck;
+//# sourceMappingURL=wgl044.d.ts.map

package/dist/lint/post-synth/wgl044.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl044.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl044.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/wgl045.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WGL045: Credential-Bearing Artifact Path
+ *
+ * Flags an `artifacts:paths:` entry that looks like it would sweep a credential
+ * or sensitive file into the artifact (`.env`, `*.pem`, `id_rsa`, `*.key`,
+ * `.npmrc`, `.netrc`, `credentials`). Artifacts flow to later stages and are
+ * downloadable, so a captured credential leaks across the boundary. Exclude the
+ * sensitive file from the artifact path.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl045: PostSynthCheck;
+//# sourceMappingURL=wgl045.d.ts.map

package/dist/lint/post-synth/wgl045.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl045.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl045.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAyCpB,CAAC"}

package/dist/lint/post-synth/wgl046.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WGL046: Cache Populated in a Merge-Request Pipeline (Poisoning Risk)
+ *
+ * Flags a job that writes a cache (`cache:` with a push policy) and is reachable
+ * from merge-request pipelines. An outside contributor's MR can populate the
+ * cache; a later protected run that restores the same key then executes
+ * attacker-influenced contents. Restrict cache writes to protected refs, or
+ * scope cache keys so MR pipelines cannot write entries a protected run reads.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl046: PostSynthCheck;
+//# sourceMappingURL=wgl046.d.ts.map

package/dist/lint/post-synth/wgl046.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl046.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl046.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA6BpB,CAAC"}

package/dist/lint/post-synth/wgl047.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WGL047: Software Fetched and Executed at Runtime Without Verification
+ *
+ * Flags a `script:` command that pipes a network download straight into a shell
+ * (`curl ... | bash`, `wget ... | sh`). The fetched script is unpinned and
+ * unverified, so whoever controls the URL controls what runs in the job.
+ * Download to a file, verify a checksum/signature, then execute it.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl047: PostSynthCheck;
+//# sourceMappingURL=wgl047.d.ts.map

package/dist/lint/post-synth/wgl047.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl047.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl047.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/wgl048.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WGL048: Pipeline Without a Name
+ *
+ * Flags a pipeline that defines a `workflow:` block but no `workflow:name:`.
+ * A pipeline name shows up in the GitLab UI and audit output; naming pipelines
+ * makes runs easier to identify and review. Only flags pipelines that already
+ * customize `workflow:` (where a name is cheap to add and most useful).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl048: PostSynthCheck;
+//# sourceMappingURL=wgl048.d.ts.map

package/dist/lint/post-synth/wgl048.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl048.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl048.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/lint/post-synth/yaml-helpers.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Helpers for parsing serialized GitLab CI YAML in post-synth checks.
+ *
+ * Since GitLab CI output is YAML (not JSON like CloudFormation), we parse
+ * the YAML sections structurally using simple regex/string parsing. The
+ * serializer emits a predictable format so we can extract what we need
+ * without a full YAML parser dependency.
+ */
+export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+/**
+ * Parse a serialized GitLab CI YAML into a structured object.
+ * Returns null if the output can't be parsed.
+ */
+export interface ParsedGitLabCI {
+    stages: string[];
+    jobs: Map<string, ParsedJob>;
+}
+export interface ParsedJob {
+    name: string;
+    stage?: string;
+    rules?: ParsedRule[];
+    needs?: string[];
+    extends?: string[];
+}
+export interface ParsedRule {
+    when?: string;
+    if?: string;
+}
+/**
+ * Extract stages list from serialized YAML.
+ */
+export declare function extractStages(yaml: string): string[];
+/**
+ * Extract job names and their stage values from serialized YAML.
+ */
+export declare function extractJobs(yaml: string): Map<string, ParsedJob>;
+/**
+ * Check whether the YAML contains an `include:` directive.
+ * When includes are present, `needs:` and `extends:` may reference
+ * jobs/templates from included files, so checks should be lenient.
+ */
+export declare function hasInclude(yaml: string): boolean;
+/**
+ * Extract global variables from serialized YAML.
+ */
+export declare function extractGlobalVariables(yaml: string): Map<string, string>;
+/**
+ * Extract the full section text for a given job name.
+ */
+export declare function extractJobSection(yaml: string, jobName: string): string | null;
+/**
+ * Extract rules from a job section.
+ */
+export declare function extractJobRules(section: string): ParsedRule[];
+/** A container image reference (job/default `image:` or a `services:` entry). */
+export interface ImageRef {
+    /** Owning job name, or "default" for the global image. */
+    job: string;
+    /** The image reference (e.g. `node:20`). */
+    image: string;
+    /** Where the image was declared. */
+    source: "image" | "service";
+}
+/**
+ * Extract container image references from `image:` and `services:` across the
+ * pipeline. Handles both the object form (`image:\n  name: ...`) and the inline
+ * string form (`image: ...`).
+ */
+export declare function extractImageRefs(yaml: string): ImageRef[];
+/** An `include:` entry from the top-level include block. */
+export interface IncludeEntry {
+    kind: "project" | "remote" | "component" | "local" | "template" | "string";
+    /** The primary value (project path, URL, component address, …). */
+    value: string;
+    /** `ref:` for project includes, if present. */
+    ref?: string;
+}
+/**
+ * Parse the top-level `include:` block into structured entries.
+ */
+export declare function extractIncludes(yaml: string): IncludeEntry[];
+/** True if a git ref is an immutable pin (40-hex SHA or a vN.N.N-style tag). */
+export declare function isPinnedRef(ref: string): boolean;
+/** An `id_tokens:` OIDC token declaration within a job. */
+export interface IdTokenDecl {
+    job: string;
+    /** Token variable name (e.g. `GCP_ID_TOKEN`). */
+    name: string;
+    /** Declared audiences (`aud:`), empty if none. */
+    aud: string[];
+}
+/**
+ * Extract `id_tokens:` declarations (OIDC) per job, with their audiences.
+ */
+export declare function extractIdTokens(yaml: string): IdTokenDecl[];
+/** True if a job section's rules make it reachable from merge-request pipelines. */
+export declare function isMergeRequestReachable(section: string): boolean;
+/** A shell command line from a `script:` / `before_script:` / `after_script:`. */
+export interface ScriptCommand {
+    job: string;
+    command: string;
+}
+/**
+ * Extract shell command lines from all `script:` family blocks, per job.
+ */
+export declare function extractScriptCommands(yaml: string): ScriptCommand[];
+//# sourceMappingURL=yaml-helpers.d.ts.map

package/dist/lint/post-synth/yaml-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/yaml-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAUpD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAkFhE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS9E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,CA8C7D;AAED,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CA8BzD;AAED,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC3E,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAmC5D;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAKhD;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAkD3D;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CA8BnE"}

package/dist/lint/rules/artifact-no-expiry.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WGL004: Artifacts without expiry
+ *
+ * Artifacts without `expireIn` (or `expire_in`) will be kept indefinitely,
+ * wasting storage. Always set an expiry for job artifacts.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const artifactNoExpiryRule: LintRule;
+//# sourceMappingURL=artifact-no-expiry.d.ts.map

package/dist/lint/rules/artifact-no-expiry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-no-expiry.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/artifact-no-expiry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF,eAAO,MAAM,oBAAoB,EAAE,QAmDlC,CAAC"}

package/dist/lint/rules/data/known-include-sources.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Vendored snapshot of well-known GitLab CI include/component source projects,
+ * used by the look-alike check (WGL032) as the reference set: an `include` or
+ * `component` source that is a near-miss (edit distance 1–2) of one of these —
+ * but not an exact match — is likely a typo or an impersonation.
+ *
+ * Advisory only. Refresh source: GitLab-maintained CI templates and the popular
+ * CI/CD Catalog components. Accept staleness — a stale entry only weakens
+ * look-alike detection, it never blocks a build.
+ */
+export declare const KNOWN_INCLUDE_SOURCES: readonly string[];
+/** Levenshtein edit distance, capped: returns early once it exceeds `max`. */
+export declare function editDistance(a: string, b: string, max: number): number;
+//# sourceMappingURL=known-include-sources.d.ts.map

package/dist/lint/rules/data/known-include-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-include-sources.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/known-include-sources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAUlD,CAAC;AAEF,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAiBtE"}

package/dist/lint/rules/data/untrusted-variables.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Vendored snapshot of GitLab CI predefined variables whose values are
+ * attacker-controllable — branch/tag names, commit and merge-request titles and
+ * descriptions, author identity. Interpolating these into a `script:` (or using
+ * them as a gate) lets a crafted branch name or commit title influence what runs.
+ *
+ * Source: GitLab "Predefined CI/CD variables" reference, filtered to the values
+ * an outside contributor can set on a fork or merge request. Advisory and
+ * necessarily incomplete; editing this list is the refresh mechanism.
+ */
+export declare const UNTRUSTED_CI_VARIABLES: readonly string[];
+/** Reference forms a variable can take in a script: `$VAR` or `${VAR}`. */
+export declare function variableReferenced(text: string, name: string): boolean;
+//# sourceMappingURL=untrusted-variables.d.ts.map

package/dist/lint/rules/data/untrusted-variables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-variables.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/untrusted-variables.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAcnD,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtE"}

package/dist/lint/rules/deprecated-only-except.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WGL001: Deprecated only/except keywords
+ *
+ * Flags usage of `only:` and `except:` in GitLab CI jobs.
+ * These keywords are deprecated in favor of `rules:` which provides
+ * more flexible conditional execution.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const deprecatedOnlyExceptRule: LintRule;
+//# sourceMappingURL=deprecated-only-except.d.ts.map

package/dist/lint/rules/deprecated-only-except.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated-only-except.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/deprecated-only-except.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF,eAAO,MAAM,wBAAwB,EAAE,QAyCtC,CAAC"}

package/dist/lint/rules/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * GitLab CI/CD lint rules
+ */
+export { deprecatedOnlyExceptRule } from "./deprecated-only-except.js";
+export { missingScriptRule } from "./missing-script.js";
+export { missingStageRule } from "./missing-stage.js";
+export { artifactNoExpiryRule } from "./artifact-no-expiry.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/lint/rules/missing-script.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WGL002: Missing script
+ *
+ * A GitLab CI job must have `script`, `trigger`, or `run` defined.
+ * Jobs without any of these will fail pipeline validation.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const missingScriptRule: LintRule;
+//# sourceMappingURL=missing-script.d.ts.map

package/dist/lint/rules/missing-script.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-script.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-script.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAKxF,eAAO,MAAM,iBAAiB,EAAE,QAoD/B,CAAC"}

package/dist/lint/rules/missing-stage.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WGL003: Missing stage
+ *
+ * Jobs should declare a `stage` property. Without it, the job defaults
+ * to the "test" stage which may not be the intended behavior.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const missingStageRule: LintRule;
+//# sourceMappingURL=missing-stage.d.ts.map

package/dist/lint/rules/missing-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-stage.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-stage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF,eAAO,MAAM,gBAAgB,EAAE,QAmD9B,CAAC"}

package/dist/lsp/completions.d.ts

@@ -0,0 +1,6 @@
+import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
+/**
+ * Provide GitLab CI completions based on context.
+ */
+export declare function gitlabCompletions(ctx: CompletionContext): CompletionItem[];
+//# sourceMappingURL=completions.d.ts.map

package/dist/lsp/completions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAE1E"}

package/dist/lsp/hover.d.ts

@@ -0,0 +1,6 @@
+import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
+/**
+ * Provide hover information for GitLab CI entity types.
+ */
+export declare function gitlabHover(ctx: HoverContext): HoverInfo | undefined;
+//# sourceMappingURL=hover.d.ts.map

package/dist/lsp/hover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa1E;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEpE"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/dist/mcp/context-tools.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Read-only MCP tools that expose what `chant build` already computes about a
+ * GitLab pipeline — its stages and jobs, what it pulls in from outside, its
+ * security findings — so an agent can ask about a change *before it runs or
+ * merges* (#327, #328).
+ *
+ * Every tool here builds from source and returns data. None of them touch the
+ * live GitLab instance, read run history, or write anything — that boundary is
+ * what keeps chant a context producer and not a copy of the live tooling.
+ */
+import type { McpToolContribution } from "@intentius/chant/mcp/types";
+/** Is a component address (`host/group/comp@version`) pinned to a fixed version? */
+export declare function componentPinned(value: string): boolean;
+/** The YAML job name a build entity serializes to (camelCase → kebab-case). */
+export declare function jobNameOf(entityName: string): string;
+/** Jobs that would re-run because they depend (transitively) on `job`. */
+export declare function downstreamJobs(yaml: string, job: string): string[];
+/** The read-only context tools for the GitLab lexicon. */
+export declare function gitlabContextTools(): McpToolContribution[];
+//# sourceMappingURL=context-tools.d.ts.map

package/dist/mcp/context-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-tools.d.ts","sourceRoot":"","sources":["../../src/mcp/context-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAyBtE,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGtD;AAED,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEpD;AAkBD,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBlE;AASD,0DAA0D;AAC1D,wBAAgB,kBAAkB,IAAI,mBAAmB,EAAE,CAkL1D"}

package/dist/migrate/from-github/actions/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Action mapping registry — public surface.
+ *
+ * Tier 1 mappings auto-register into the default registry on import of
+ * this module. Tier 2 and Tier 3 are added in #88.
+ */
+export type { ActionMapping, ActionMapCtx, ActionMappedResult, ActionMappingRegistry, } from "./registry.js";
+export { createRegistry, getDefaultRegistry, lookupAction, setDefaultRegistry } from "./registry.js";
+import { registerTier1 } from "./tier-1.js";
+import { registerTier2 } from "./tier-2.js";
+import { registerTier3 } from "./tier-3.js";
+export { registerTier1, registerTier2, registerTier3 };
+//# sourceMappingURL=index.d.ts.map

package/dist/migrate/from-github/actions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/migrate/from-github/actions/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAElG,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AASzC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC"}

package/dist/migrate/from-github/actions/registry.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ActionMapping registry for GitHub Actions → GitLab CI translation.
+ *
+ * Each marketplace action gets a typed mapping that returns the GitLab-side
+ * effects (script lines, image substitution, services, cache, artifacts,
+ * job-level variables) plus provenance records.
+ *
+ * v1 ships a built-in registry covering 33 actions (Tier 1/2/3, see
+ * `tier-1.ts`/`tier-2.ts`/`tier-3.ts`). Users can inject their own
+ * mappings via `MigrateOptions.registry`.
+ */
+import type { ProvenanceRecord } from "../provenance.js";
+export interface ActionMapCtx {
+    /** GitLab IR job logicalId */
+    logicalId: string;
+    /** Original GitHub job name (kebab-case) */
+    jobName: string;
+    /** Source file (for provenance) */
+    sourceFile?: string;
+    /** 0-based step index within the job */
+    stepIndex: number;
+}
+export interface ActionMappedResult {
+    /** Lines appended to the GitLab job `script:` */
+    scriptLines: string[];
+    /** Lines prepended to the GitLab job `before_script:` */
+    beforeScript?: string[];
+    /** Job-level image override (last write wins) */
+    image?: string;
+    /** Job-level services to add */
+    services?: unknown[];
+    /** Job-level cache config */
+    cache?: Record<string, unknown>;
+    /** Job-level artifacts config */
+    artifacts?: Record<string, unknown>;
+    /** Job-level variables to merge */
+    variables?: Record<string, unknown>;
+    /** Provenance records for this mapping firing */
+    provenance: ProvenanceRecord[];
+}
+export interface ActionMapping {
+    /** Action name without version, e.g. "actions/checkout" */
+    actionName: string;
+    /** Optional version filter (matches against major version) */
+    majorVersions?: string[];
+    /** Tier (1: must-have, 2: common, 3: niche) */
+    tier: 1 | 2 | 3;
+    /** Apply the mapping to a step */
+    translate(step: Record<string, unknown>, ctx: ActionMapCtx): ActionMappedResult;
+}
+export interface ActionMappingRegistry {
+    register(mapping: ActionMapping): void;
+    lookup(actionRef: string): ActionMapping | undefined;
+}
+export declare function getDefaultRegistry(): ActionMappingRegistry;
+/**
+ * Test-only: replace the default registry. Used by `lookupAction` callers
+ * that pass `opts.registry` to inject a stub. Reset to undefined to restore.
+ */
+export declare function setDefaultRegistry(registry: ActionMappingRegistry | undefined): void;
+export declare function createRegistry(): ActionMappingRegistry;
+export declare function lookupAction(actionRef: string, registry?: ActionMappingRegistry): ActionMapping | undefined;
+//# sourceMappingURL=registry.d.ts.map

package/dist/migrate/from-github/actions/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/migrate/from-github/actions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,YAAY;IAC3B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,6BAA6B;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,iDAAiD;IACjD,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,+CAA+C;IAC/C,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,kCAAkC;IAClC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,YAAY,GAAG,kBAAkB,CAAC;CACjF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IACvC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;CACtD;AAgCD,wBAAgB,kBAAkB,IAAI,qBAAqB,CAK1D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,SAAS,GAAG,IAAI,CAEpF;AAED,wBAAgB,cAAc,IAAI,qBAAqB,CAEtD;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,qBAAqB,GAAG,aAAa,GAAG,SAAS,CAE3G"}

package/dist/migrate/from-github/actions/tier-1.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Tier 1 marketplace action mappings — the 14 most-used GitHub Actions
+ * marketplace actions, per the upstream skill's `references/marketplace-actions.md`.
+ *
+ * Each mapping returns:
+ *   - scriptLines: appended to job.script
+ *   - image: job-level image override (last write wins)
+ *   - services: docker:dind etc.
+ *   - cache / artifacts: native GitLab keywords
+ *   - provenance: per-step records
+ */
+import type { ActionMapping } from "./registry.js";
+declare const TIER_1_MAPPINGS: ActionMapping[];
+/**
+ * Register all Tier 1 mappings into the given registry (or default).
+ * Idempotent — call before `lookupAction` is first invoked.
+ */
+export declare function registerTier1(registry?: import("./registry.js").ActionMappingRegistry): void;
+export { TIER_1_MAPPINGS };
+//# sourceMappingURL=tier-1.d.ts.map

package/dist/migrate/from-github/actions/tier-1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier-1.d.ts","sourceRoot":"","sources":["../../../../src/migrate/from-github/actions/tier-1.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAoC,MAAM,YAAY,CAAC;AA6RlF,QAAA,MAAM,eAAe,EAAE,aAAa,EAenC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,6CAAuB,GAAG,IAAI,CAInE;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/migrate/from-github/actions/tier-2.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Tier 2 marketplace action mappings — 14 common actions from the
+ * upstream skill's `references/marketplace-actions.md`.
+ */
+import type { ActionMapping } from "./registry.js";
+declare const TIER_2_MAPPINGS: ActionMapping[];
+export declare function registerTier2(registry?: import("./registry.js").ActionMappingRegistry): void;
+export { TIER_2_MAPPINGS };
+//# sourceMappingURL=tier-2.d.ts.map

package/dist/migrate/from-github/actions/tier-2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier-2.d.ts","sourceRoot":"","sources":["../../../../src/migrate/from-github/actions/tier-2.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAoC,MAAM,YAAY,CAAC;AA2QlF,QAAA,MAAM,eAAe,EAAE,aAAa,EAenC,CAAC;AAEF,wBAAgB,aAAa,CAAC,QAAQ,6CAAuB,GAAG,IAAI,CAInE;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/migrate/from-github/actions/tier-3.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Tier 3 marketplace action mappings — 5 niche actions. Several map to
+ * native GitLab keywords (rules:changes, retry:) rather than scripts.
+ */
+import type { ActionMapping } from "./registry.js";
+declare const TIER_3_MAPPINGS: ActionMapping[];
+export declare function registerTier3(registry?: import("./registry.js").ActionMappingRegistry): void;
+export { TIER_3_MAPPINGS };
+//# sourceMappingURL=tier-3.d.ts.map

package/dist/migrate/from-github/actions/tier-3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier-3.d.ts","sourceRoot":"","sources":["../../../../src/migrate/from-github/actions/tier-3.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAoC,MAAM,YAAY,CAAC;AAwGlF,QAAA,MAAM,eAAe,EAAE,aAAa,EAMnC,CAAC;AAEF,wBAAgB,aAAa,CAAC,QAAQ,6CAAuB,GAAG,IAAI,CAInE;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}