@intentius/chant 0.100.0 → 0.101.0

package/src/workspace/changes.schema.json

@@ -28,6 +28,7 @@
         "paths",
         "findings",
         "summary",
+        "scope",
         "ok"
       ],
       "properties": {
@@ -198,9 +199,20 @@
             }
           }
         },
+        "scope": {
+          "description": "The write scope check (#2548, ws-067): each commit in the range, merges left out, judged against the writeScope and agents of the declaration at the range's base, with the trust policy read there. Null when the base has no declaration, or one with no writeScope block and no agents. Every finding fails the check, whatever severity says.",
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/scope"
+            }
+          ]
+        },
         "ok": {
           "type": "boolean",
-          "description": "False only when severity is fail and there is a finding."
+          "description": "False when severity is fail and there is a finding, or when scope has a finding."
         }
       }
     },
@@ -467,6 +479,172 @@
         },
         "paths": false
       }
+    },
+    "scope": {
+      "type": "object",
+      "required": [
+        "base",
+        "restricted",
+        "agents",
+        "commits",
+        "findings"
+      ],
+      "properties": {
+        "base": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40,64}$",
+          "description": "The commit the declaration and the trust policy were read at: the range's base."
+        },
+        "restricted": {
+          "type": "array",
+          "items": {
+            "enum": [
+              "human",
+              "agent",
+              "runner",
+              "service"
+            ]
+          },
+          "description": "The principal classes with a writeScope entry, and agent when any agent session is declared."
+        },
+        "agents": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The agent sessions the declaration at base names."
+        },
+        "commits": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/scopeCommit"
+          }
+        },
+        "findings": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/scopeFinding"
+          }
+        }
+      }
+    },
+    "scopeCommit": {
+      "type": "object",
+      "required": [
+        "commit",
+        "subject",
+        "principal",
+        "attested",
+        "class",
+        "agent",
+        "paths"
+      ],
+      "properties": {
+        "commit": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40,64}$"
+        },
+        "subject": {
+          "type": "string"
+        },
+        "principal": {
+          "type": "string",
+          "description": "The signer that attests the commit under the policy at base, or else the author's email, which the commit only claims."
+        },
+        "attested": {
+          "type": "boolean",
+          "description": "Whether principal is an attested signer."
+        },
+        "class": {
+          "enum": [
+            "human",
+            "agent",
+            "runner",
+            "service"
+          ],
+          "description": "agent for a commit naming a session with a Chant-Agent trailer or by a principal a session lists; otherwise the class the principal's role grants at base give."
+        },
+        "agent": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The agent session, or null."
+        },
+        "paths": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "How many paths in the workspace the commit writes."
+        }
+      }
+    },
+    "scopeFinding": {
+      "type": "object",
+      "required": [
+        "id",
+        "code",
+        "commit",
+        "path",
+        "principal",
+        "class",
+        "agent",
+        "verb",
+        "message"
+      ],
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "code": {
+          "enum": [
+            "write-scope-member",
+            "write-scope-kind",
+            "agent-unknown"
+          ]
+        },
+        "commit": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40,64}$"
+        },
+        "path": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "From the workspace root; null for agent-unknown, a finding on the whole commit."
+        },
+        "principal": {
+          "type": "string"
+        },
+        "class": {
+          "enum": [
+            "human",
+            "agent",
+            "runner",
+            "service"
+          ]
+        },
+        "agent": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "verb": {
+          "enum": [
+            "new",
+            "amend",
+            "review",
+            "close",
+            "delete",
+            null
+          ],
+          "description": "For a record file of a kind the declaration at base names: how the commit wrote it. A modified record is review when only its reviews (or a session's verdicts) changed, close when a session entered a closed state, and amend otherwise."
+        },
+        "message": {
+          "type": "string"
+        }
+      }
     }
   }
 }

package/src/workspace/changes.ts

@@ -40,17 +40,18 @@ import { execFileSync } from "node:child_process";
 import { relative, resolve, sep } from "node:path";
 // @ts-ignore — picomatch has no types declaration
 import picomatch from "picomatch";
-import { declaredRecordKinds, readDeclaration, readerVersion, WORKSPACE_ERROR_CODES, WorkspaceReadError, type ChangeSeverity } from "./declaration";
+import { declaredRecordKinds, readDeclaration, readerVersion, WORKSPACE_ERROR_CODES, WorkspaceReadError, type ChangeSeverity, type Declaration } from "./declaration";
 import { declaredKindFile } from "./declared-kinds";
 import { isGeneratedPath } from "./generated-files";
 import { parseRegion } from "./intent";
 import { constraintCovers, isWorkspacePath, memberHolding } from "./record-assets";
-import { RecordReadError, type LoadedRecordKind, type RecordEntry } from "./records";
+import { loadRecordKind, RecordReadError, type LoadedRecordKind, type RecordEntry } from "./records";
 import { readRecordsFor } from "./records-cli";
 import type { ReasonCode } from "./reason-codes";
 import { joinPath } from "./tree";
 import { locateWorkspace } from "./which-chant";
 import { idList, isDecided } from "./work";
+import { checkWriteScope, type CheckKind, type ScopeReport } from "./write-scope";
 
 /** The version of the `changes` document this chant writes. */
 export const CHANGES_CONTRACT_VERSION = 1;
@@ -172,7 +173,13 @@ export type ChangesDocument =
       paths: ChangedPath[];
       findings: ChangeFinding[];
       summary: { paths: number; covered: number; uncovered: number; outOfScope: number; ignored: number; records: number };
-      /** False only when severity is fail and there are findings. */
+      /**
+       * The write scope check (#2548): each commit in the range judged
+       * against the writeScope and agents the declaration at base gives,
+       * or null when that declaration restricts no one.
+       */
+      scope: ScopeReport | null;
+      /** False when severity is fail and there are findings, or when a commit writes outside its writer's scope. */
       ok: boolean;
     })
   | (Head & { error: { code: ChangesErrorCode; message: string } });
@@ -463,6 +470,7 @@ async function run(query: ChangesQuery, head: Head): Promise<Exclude<ChangesDocu
     }
   }
   const count = (s: ChangeStatus) => paths.filter((p) => p.status === s).length;
+  const scope = await writeScopeAtBase(query, top, range, workspacePrefix);
   return {
     ...head,
     workspace: { name: declaration.name, root: located.root },
@@ -474,10 +482,56 @@ async function run(query: ChangesQuery, head: Head): Promise<Exclude<ChangesDocu
     paths,
     findings,
     summary: { paths: paths.length, covered: count("covered"), uncovered: count("uncovered"), outOfScope: count("out-of-scope"), ignored: count("ignored"), records: count("record") },
-    ok: !(severity === "fail" && findings.length > 0),
+    scope,
+    ok: !(severity === "fail" && findings.length > 0) && (scope === null || scope.findings.length === 0),
   };
 }
 
+/**
+ * The write scope check over the range (#2548), with the declaration, its
+ * record kinds and the trust policy read at the range's base, so a change
+ * can't widen its own scope. Null when the base has no declaration, or one
+ * that restricts no one. The base is read without the root-chant rule: a
+ * change may move the chant pin, and the scope is data either chant reads.
+ */
+async function writeScopeAtBase(query: ChangesQuery, top: string, range: { base: string; head: string }, prefix: string): Promise<ScopeReport | null> {
+  let located: ReturnType<typeof locateWorkspace>;
+  let declaration: Declaration;
+  try {
+    located = locateWorkspace(query.cwd, range.base);
+    declaration = readDeclaration(located.tree);
+  } catch (err) {
+    if (err instanceof WorkspaceReadError && err.code === "declaration-missing") return null;
+    throw err;
+  }
+  if (declaration.writeScope === null && declaration.agents.length === 0) return null;
+  const kinds: CheckKind[] = [];
+  for (const d of declaredRecordKinds(declaration)) {
+    let loaded: LoadedRecordKind;
+    try {
+      loaded = await loadRecordKind(declaredKindFile(d, located.rootOnDisk), query.cwd);
+    } catch (err) {
+      // A kind that doesn't load here: its files are judged as plain paths.
+      if (err instanceof RecordReadError) continue;
+      throw err;
+    }
+    const { kind } = loaded;
+    const session = kind.session;
+    kinds.push({
+      scoped: { name: kind.name, declaredName: d.name, member: d.member, declared: true },
+      dir: toPosix(relative(top, loaded.dir)) || ".",
+      match: new RegExp(kind.location.match),
+      reviewFields: [kind.reviews?.field, session?.verdicts].filter((f): f is string => typeof f === "string"),
+      session:
+        session && kind.stateField !== undefined
+          ? { stateField: kind.stateField, closed: kind.closedStates ?? [], fills: [session.openedRev].filter((f): f is string => typeof f === "string") }
+          : null,
+      format: kind.format,
+    });
+  }
+  return checkWriteScope({ top, base: range.base, head: range.head, prefix, declaration, kinds });
+}
+
 function finding(code: ChangesFindingCode, p: ChangedPath, severity: "warn" | "fail", message: string, records: string[]): ChangeFinding {
   return { id: `finding:${code}:${p.path}`, code, path: p.path, message, severity, records, triage: changeFindingSource({ code, path: p.path }) };
 }

package/src/workspace/check-live.test.ts

@@ -0,0 +1,192 @@
+/**
+ * `chant workspace check --live --env <env>` (#2549, ws-062): declared member
+ * links resolved against the live graph of each producer. A fake chant stands
+ * in for the member's own toolchain: it prints ir.json for a source read and
+ * live.json for `--live`, and records its command line in argv.txt.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterAll, afterEach, describe, expect, test, vi } from "vitest";
+import { cleanScratch, contract, declaration, repo } from "./__fixtures__/contract-repo";
+import { parseArgs } from "../cli/main";
+import schema from "./check.schema.json";
+import { workspaceGraph } from "./graph-cli";
+import { runChecks, runWorkspaceCheck } from "./lineage-check";
+import type { CheckDocument } from "./lineage-check";
+
+const { expectValid } = contract(schema);
+
+afterAll(() => cleanScratch());
+afterEach(() => vi.restoreAllMocks());
+
+const FAKE_CHANT = `#!/bin/sh
+[ "$1" = graph ] || { echo "Error: Unknown command: $1" >&2; exit 1; }
+printf '%s\\n' "$*" > ../argv.txt
+case " $* " in
+  *" --live "*) cat live.json ;;
+  *) cat ir.json ;;
+esac
+`;
+
+const graph = (exports: { name: string; value?: unknown }[]) => JSON.stringify({ version: 1, nodes: [], edges: [], groups: {}, exports });
+
+function workspace(live: { name: string; value?: unknown }[], links: unknown[], producerKind: "chant" | "other" = "chant", extra: Record<string, unknown> = {}) {
+  return repo({
+    "chant.workspace.json": declaration([
+      producerKind === "chant" ? { name: "api", dir: "api", kind: "chant" } : { name: "api", dir: "api", kind: "other", because: "a queue made by hand", outputs: ["QueueUrl"] },
+      { name: "web", dir: "web", kind: "other", because: "a static site", links },
+    ], extra),
+    "api/chant.config.ts": "export default {};\n",
+    "api/ir.json": graph([{ name: "QueueUrl" }, { name: "TopicArn" }]),
+    "api/live.json": graph(live),
+    "web/index.html": "",
+    ".gitignore": "node_modules\n",
+    "node_modules/.bin/chant": { text: FAKE_CHANT, mode: 0o755 },
+  });
+}
+
+async function live(root: string, env = "prod") {
+  const doc = (await runChecks(root, undefined, { live: { env } })) as Extract<CheckDocument, { workspace: unknown }>;
+  const diagnostics = doc.declaration!.diagnostics.filter((d) => d.ruleId === "WSP141" || d.ruleId === "WSP142");
+  return { doc, diagnostics, rows: doc.declaration!.live?.links ?? [] };
+}
+
+describe("check --live (#2549)", () => {
+  test("a link to an output the live graph publishes resolves, and the row says it resolved live", async () => {
+    const root = workspace([{ name: "QueueUrl", value: "https://q" }], [{ member: "api", output: "QueueUrl" }]);
+    const { doc, diagnostics, rows } = await live(root);
+    expect(diagnostics).toEqual([]);
+    expectValid(doc);
+    expect(doc.declaration!.live!.env).toBe("prod");
+    expect(rows).toMatchObject([{ consumer: "web", producer: "api", output: "QueueUrl", resolves: "live", status: "resolved", reason: null }]);
+    // The member ran as `chant graph --live --env prod`.
+    expect(readFileSync(join(root, "argv.txt"), "utf-8")).toContain("--env prod --live");
+  });
+
+  test("an output the producer declares but its estate does not publish is WSP141, a warning", async () => {
+    const root = workspace([{ name: "TopicArn", value: "arn" }], [{ member: "api", output: "QueueUrl" }]);
+    const { diagnostics, rows } = await live(root);
+    expect(rows[0]).toMatchObject({ status: "missing", resolves: "live" });
+    expect(diagnostics).toHaveLength(1);
+    expect(diagnostics[0]).toMatchObject({ ruleId: "WSP141", severity: "warning", entity: "web" });
+    expect(diagnostics[0].message).toContain("does not resolve live in prod");
+    expect(diagnostics[0].message).toContain("TopicArn");
+  });
+
+  test("a live read that returned no outputs at all leaves the link unresolved, not missing", async () => {
+    const root = workspace([], [{ member: "api", output: "QueueUrl" }]);
+    const { diagnostics, rows } = await live(root);
+    expect(rows[0].status).toBe("unresolved");
+    expect(diagnostics).toMatchObject([{ ruleId: "WSP142", severity: "info" }]);
+    expect(diagnostics[0].message).toContain("returned no outputs");
+  });
+
+  test("a producer of a kind chant does not read live is kept unresolved, with the reason", async () => {
+    const root = workspace([], [{ member: "api", output: "QueueUrl" }], "other");
+    const { diagnostics, rows } = await live(root);
+    expect(rows[0]).toMatchObject({ status: "unresolved", resolves: "live" });
+    expect(diagnostics).toMatchObject([{ ruleId: "WSP142" }]);
+    expect(diagnostics[0].message).toContain("kind other");
+  });
+
+  test("a telemetry link is not resolved live", async () => {
+    const root = workspace([{ name: "QueueUrl" }], [{ member: "api", output: "traces", kind: "telemetry" }]);
+    const { rows } = await live(root);
+    expect(rows).toEqual([]);
+  });
+
+  test("severity settings apply to the live checks like any other", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration(
+        [
+          { name: "api", dir: "api", kind: "chant" },
+          { name: "web", dir: "web", kind: "other", because: "a static site", links: [{ member: "api", output: "QueueUrl" }], suppress: [{ check: "WSP141", because: "deployed next week" }] },
+        ],
+        { checks: { WSP141: "error" } },
+      ),
+      "api/chant.config.ts": "export default {};\n",
+      "api/ir.json": graph([{ name: "QueueUrl" }]),
+      "api/live.json": graph([{ name: "Other" }]),
+      "web/index.html": "",
+      ".gitignore": "node_modules\n",
+      "node_modules/.bin/chant": { text: FAKE_CHANT, mode: 0o755 },
+    });
+    const { doc, diagnostics } = await live(root);
+    expect(diagnostics).toEqual([]);
+    expect(doc.declaration!.suppressed.map((s) => s.ruleId)).toContain("WSP141");
+  });
+
+  test("without --live no member runs and the report has no live section", async () => {
+    const root = workspace([{ name: "QueueUrl" }], [{ member: "api", output: "QueueUrl" }]);
+    const doc = (await runChecks(root)) as Extract<CheckDocument, { workspace: unknown }>;
+    expect(doc.declaration!.live).toBeUndefined();
+    expect(existsSync(join(root, "argv.txt"))).toBe(false);
+  });
+});
+
+describe("the command (#2549)", () => {
+  async function run(root: string, argv: string[]) {
+    const out: string[] = [];
+    const err: string[] = [];
+    vi.spyOn(console, "log").mockImplementation((...a: unknown[]) => void out.push(a.join(" ")));
+    vi.spyOn(console, "error").mockImplementation((...a: unknown[]) => void err.push(a.join(" ")));
+    vi.spyOn(process, "cwd").mockReturnValue(root);
+    const code = await runWorkspaceCheck({ args: parseArgs(["workspace", "check", ...argv]), plugins: [] } as never);
+    return { code, out: out.join("\n"), err: err.join("\n") };
+  }
+
+  test("--live needs --env, and takes no --at, and runs no member when it refuses", async () => {
+    const root = workspace([{ name: "QueueUrl" }], [{ member: "api", output: "QueueUrl" }]);
+    const noEnv = await run(root, ["--live"]);
+    expect(noEnv.code).toBe(1);
+    expect(noEnv.err).toContain("--live needs an environment");
+    const atRev = await run(root, ["--live", "--env", "prod", "--at", "HEAD"]);
+    expect(atRev.code).toBe(1);
+    expect(atRev.err).toContain("--at");
+    expect(existsSync(join(root, "argv.txt"))).toBe(false);
+  });
+
+  test("--live --json prints the live section, and a WSP141 warning leaves the exit code 0", async () => {
+    // The fake producer's source lists no outputs, so the source check WSP093 is turned off; the live warning is the one under test.
+    const root = workspace([{ name: "TopicArn" }], [{ member: "api", output: "QueueUrl" }], "chant", { checks: { WSP093: "off" } });
+    const { code, out } = await run(root, ["--live", "--env", "prod", "--json"]);
+    const report = JSON.parse(out) as { declaration: { live: { env: string; links: { status: string }[] }; diagnostics: { ruleId: string }[] } };
+    expect(report.declaration.live).toMatchObject({ env: "prod", links: [{ status: "missing" }] });
+    expect(report.declaration.diagnostics.map((d) => d.ruleId)).toContain("WSP141");
+    expect(code).toBe(0);
+  });
+});
+
+describe("the design member kind (#2549, ws-062)", () => {
+  const designWorkspace = (extra: Record<string, unknown> = {}) =>
+    repo({
+      "chant.workspace.json": declaration([
+        { name: "design", dir: "design", kind: "design", outputs: ["screens/home.json"], ...extra },
+        { name: "web", dir: "web", kind: "other", because: "a static site", links: [{ member: "design", output: "screens/home.json" }] },
+      ]),
+      "design/screens/home.json": "{}\n",
+      "web/index.html": "",
+    });
+
+  test("is a declared kind: no WSP003, no WSP009, no `because` needed, and its listed outputs are link targets", async () => {
+    const doc = (await runChecks(designWorkspace())) as Extract<CheckDocument, { workspace: unknown }>;
+    const ids = doc.declaration!.diagnostics.map((d) => d.ruleId);
+    expect(ids).not.toContain("WSP003");
+    expect(doc.declaration!.diagnostics.filter((d) => d.entity === "design")).toEqual([]);
+    expect(doc.declaration!.links).toMatchObject([{ consumer: "web", producer: "design", output: "screens/home.json", status: "resolved" }]);
+  });
+
+  test("a data member: workspace graph reads it and builds nothing, saying so", async () => {
+    const { doc } = await workspaceGraph({ cwd: designWorkspace() });
+    if ("error" in doc) throw new Error(doc.error.message);
+    expect(doc.members.find((m) => m.name === "design")).toMatchObject({ kind: "design", status: "skipped", reason: { code: "kind-not-run" } });
+    expect(doc.members.find((m) => m.name === "design")!.reason!.message).toContain("data");
+  });
+
+  test("a design member's link is not resolved live: its files are not an estate", async () => {
+    const { rows, diagnostics } = await live(designWorkspace());
+    expect(rows[0]).toMatchObject({ status: "unresolved", resolves: "live" });
+    expect(diagnostics).toMatchObject([{ ruleId: "WSP142" }]);
+  });
+});

package/src/workspace/check.schema.json

@@ -146,6 +146,70 @@
         "ok": {
           "type": "boolean"
         },
+        "live": {
+          "description": "Present with --live --env (#2549, ws-062): the declared output links resolved against the live graph of the environment. Each member of kind chant ran chant graph --live. Added by chant 0.101.0.",
+          "type": "object",
+          "required": [
+            "env",
+            "links"
+          ],
+          "properties": {
+            "env": {
+              "type": "string"
+            },
+            "links": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "required": [
+                  "consumer",
+                  "producer",
+                  "output",
+                  "resolves",
+                  "status",
+                  "reason"
+                ],
+                "properties": {
+                  "consumer": {
+                    "type": "string"
+                  },
+                  "producer": {
+                    "type": "string"
+                  },
+                  "output": {
+                    "type": "string"
+                  },
+                  "kind": {
+                    "type": "string"
+                  },
+                  "origin": {
+                    "const": "declared"
+                  },
+                  "resolves": {
+                    "const": "live"
+                  },
+                  "status": {
+                    "enum": [
+                      "resolved",
+                      "missing",
+                      "unresolved",
+                      "invalid"
+                    ]
+                  },
+                  "reason": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "pointer": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
         "diagnostics": {
           "description": "Active findings, in the shape `chant lint --format json` prints, sorted by position.",
           "type": "array",

package/src/workspace/checks/links.ts

@@ -16,12 +16,13 @@
  * | WSP095 | an inferred join is ambiguous: a parameter matches two or more outputs |
  * | WSP096 | a consumer states the same link twice |
  * | WSP097 | an entry lists `outputs` for a kind that doesn't take them from the entry |
+ * | WSP098 | a link states a `protocol` and its kind is not `telemetry` (#2558) |
  */
 
 import type { WorkspaceCheck, WorkspaceCheckContext, WorkspaceDiagnostic } from "../checks";
 import type { Member } from "../declaration";
 import { sourceMemberHandles } from "../member-handles";
-import { DEFAULT_LINK_KIND, LINK_KINDS, linkTargetProblem, resolveLinks, type AmbiguousRow, type LinkRow, type LinkTableRow } from "../links";
+import { DEFAULT_LINK_KIND, LINK_KINDS, TELEMETRY_LINK_KIND, linkTargetProblem, resolveLinks, type AmbiguousRow, type LinkRow, type LinkTableRow } from "../links";
 
 const tables = new WeakMap<WorkspaceCheckContext, LinkTableRow[]>();
 
@@ -62,7 +63,7 @@ export const LINK_CHECKS: readonly WorkspaceCheck[] = [
   {
     id: "WSP092",
     name: "link-kind-unknown",
-    description: `Every member link's kind is one chant knows. Unknown link kinds fail closed; ${DEFAULT_LINK_KIND} is the default and the only one so far.`,
+    description: `Every member link's kind is one chant knows. Unknown link kinds fail closed; ${DEFAULT_LINK_KIND} is the default, and ${LINK_KINDS.filter((k) => k !== DEFAULT_LINK_KIND).join(", ")} is the other.`,
     severity: "error",
     configurable: false,
     check(ctx) {
@@ -180,4 +181,24 @@ export const LINK_CHECKS: readonly WorkspaceCheck[] = [
         });
     },
   },
+  {
+    id: "WSP098",
+    name: "link-protocol-misplaced",
+    description: "A link states a protocol only when it is a telemetry link: protocol is the OTLP protocol the consumer sends to the producer's collector, and no other link kind has one.",
+    severity: "error",
+    configurable: true,
+    check(ctx) {
+      return ctx.declaration.members.flatMap((m) =>
+        m.links
+          .filter((l) => l.protocol !== null && (l.kind ?? DEFAULT_LINK_KIND) !== TELEMETRY_LINK_KIND)
+          .map((l) => ({
+            checkId: this.id,
+            severity: this.severity,
+            message: `member ${m.name}'s link to ${l.member} output ${l.output} states protocol ${l.protocol}, and its kind is ${l.kind ?? DEFAULT_LINK_KIND}; protocol belongs to a ${TELEMETRY_LINK_KIND} link`,
+            entity: m.name,
+            pointer: `${l.pointer}/protocol`,
+          })),
+      );
+    },
+  },
 ];