@intentius/chant 0.124.45 → 0.124.48

package/dist/workspace/checks/org.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Org scope (#3168): members of kind `repo`, which name another repository's
+ * workspace by URL and pinned revision, and the org-level workspace that
+ * holds only such members.
+ *
+ * | Id | Check |
+ * |---|---|
+ * | WSP013 | an org workspace holds only repo members |
+ * | WSP014 | every repository the forge lists is declared (with `--forge-repos`) |
+ * | WSP015 | every declared repository is one the forge lists (with `--forge-repos`) |
+ * | WSP016 | no repo member's URL carries a password or token |
+ *
+ * The forge's list is input, never fetched here: a warden enumerates the
+ * org's repositories from its own API and hands the list to
+ * `chant workspace check --forge-repos <file>`, so the check stays offline.
+ */
+import type { WorkspaceCheck } from "../checks.js";
+/** One repository the forge lists. */
+export interface ForgeRepo {
+    url: string;
+    /** An archived repository need not be declared, and declaring one is not a drop. */
+    archived: boolean;
+}
+/** The forge's repository list for `--forge-repos` (#3168), as a warden writes it. */
+export interface ForgeRepoList {
+    /** The file it was read from, for messages. */
+    source: string;
+    repos: ForgeRepo[];
+}
+/**
+ * Parse a forge repository list. Three shapes are read: `{ "repos": [...] }`
+ * (a warden may add `forge` and `org` beside it), a bare array, and, for each
+ * repository, a URL string or `{ "url", "archived"? }`. Throws an Error that
+ * says what is wrong.
+ */
+export declare function parseForgeRepos(text: string, source: string): ForgeRepoList;
+/**
+ * A repository URL reduced to what names the repository, so the forge's
+ * https URL and a declaration's ssh or scp-style URL compare equal:
+ * `host/owner/repo`, lowercased, with no scheme, user, port, `.git` or
+ * trailing slash. A local path or file URL becomes its absolute path,
+ * resolved from `base`.
+ */
+export declare function repoKey(url: string, base?: string): string;
+/** Whether a URL carries a password or token, which a declaration must never hold. */
+export declare function urlCredential(url: string): boolean;
+export declare const ORG_CHECKS: readonly WorkspaceCheck[];
+//# sourceMappingURL=org.d.ts.map

package/dist/workspace/checks/org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/org.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAErE,sCAAsC;AACtC,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,CAiB3E;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,MAAsB,GAAG,MAAM,CAmBzE;AAMD,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CASlD;AAQD,eAAO,MAAM,UAAU,EAAE,SAAS,cAAc,EA0D/C,CAAC"}

package/dist/workspace/checks/org.js

@@ -0,0 +1,156 @@
+/**
+ * Org scope (#3168): members of kind `repo`, which name another repository's
+ * workspace by URL and pinned revision, and the org-level workspace that
+ * holds only such members.
+ *
+ * | Id | Check |
+ * |---|---|
+ * | WSP013 | an org workspace holds only repo members |
+ * | WSP014 | every repository the forge lists is declared (with `--forge-repos`) |
+ * | WSP015 | every declared repository is one the forge lists (with `--forge-repos`) |
+ * | WSP016 | no repo member's URL carries a password or token |
+ *
+ * The forge's list is input, never fetched here: a warden enumerates the
+ * org's repositories from its own API and hands the list to
+ * `chant workspace check --forge-repos <file>`, so the check stays offline.
+ */
+import { isAbsolute, resolve } from "node:path";
+import { REPO_KIND } from "../kinds.js";
+/**
+ * Parse a forge repository list. Three shapes are read: `{ "repos": [...] }`
+ * (a warden may add `forge` and `org` beside it), a bare array, and, for each
+ * repository, a URL string or `{ "url", "archived"? }`. Throws an Error that
+ * says what is wrong.
+ */
+export function parseForgeRepos(text, source) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (err) {
+        throw new Error(`${source} is not JSON (${err.message})`);
+    }
+    const list = Array.isArray(raw) ? raw : raw !== null && typeof raw === "object" && Array.isArray(raw.repos) ? raw.repos : undefined;
+    if (!list)
+        throw new Error(`${source} is neither an array of repositories nor an object with a repos array`);
+    const repos = list.map((r, i) => {
+        if (typeof r === "string" && r.length > 0)
+            return { url: r, archived: false };
+        if (r !== null && typeof r === "object" && typeof r.url === "string") {
+            return { url: r.url, archived: r.archived === true };
+        }
+        throw new Error(`${source}: repos[${i}] is neither a URL nor an object with a url`);
+    });
+    return { source, repos };
+}
+/**
+ * A repository URL reduced to what names the repository, so the forge's
+ * https URL and a declaration's ssh or scp-style URL compare equal:
+ * `host/owner/repo`, lowercased, with no scheme, user, port, `.git` or
+ * trailing slash. A local path or file URL becomes its absolute path,
+ * resolved from `base`.
+ */
+export function repoKey(url, base = process.cwd()) {
+    const trimmed = url.trim();
+    const scp = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/\/)(.+)$/.exec(trimmed);
+    let hostPath;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)) {
+        let u;
+        try {
+            u = new URL(trimmed);
+        }
+        catch {
+            return trimmed.toLowerCase();
+        }
+        if (u.protocol === "file:")
+            return stripGit(decodeURIComponent(u.pathname));
+        hostPath = `${u.hostname}${u.pathname}`;
+    }
+    else if (scp && !isAbsolute(trimmed) && !/^[a-z]:[\\/]/i.test(trimmed)) {
+        hostPath = `${scp[1]}/${scp[2]}`;
+    }
+    else {
+        return stripGit(resolve(base, trimmed));
+    }
+    return stripGit(hostPath.replace(/\/+/g, "/")).toLowerCase();
+}
+function stripGit(path) {
+    return path.replace(/\/+$/, "").replace(/\.git$/, "");
+}
+/** Whether a URL carries a password or token, which a declaration must never hold. */
+export function urlCredential(url) {
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(url))
+        return false;
+    try {
+        const u = new URL(url);
+        // ssh://git@host is a user name, not a secret; a password, or any user on http(s), is one.
+        return u.password !== "" || (u.username !== "" && /^https?:$/.test(u.protocol));
+    }
+    catch {
+        return false;
+    }
+}
+const repoMembers = (ctx) => ctx.declaration.members.filter((m) => m.kind === REPO_KIND && m.repo !== null);
+function finding(check, message, pointer, entity) {
+    return { checkId: check.id, severity: check.severity, message, pointer, ...(entity !== undefined ? { entity } : {}) };
+}
+export const ORG_CHECKS = [
+    {
+        id: "WSP013",
+        name: "org-member-local",
+        description: "An org workspace (scope org) holds only members of kind repo, each a reference to another repository's workspace (#3168).",
+        severity: "error",
+        configurable: false,
+        check(ctx) {
+            if (ctx.declaration.scope !== "org")
+                return [];
+            return ctx.declaration.entries
+                .filter((e) => e.kind !== REPO_KIND)
+                .map((e) => finding(this, `${e.type === "group" ? "example group" : "member"} ${e.name} is kind ${e.kind}, and an org workspace holds only repo members; move it into a repository's own workspace and reference that`, `${e.pointer}/kind`, e.name));
+        },
+    },
+    {
+        id: "WSP014",
+        name: "org-repo-undeclared",
+        description: "With --forge-repos, every repository the forge lists, archived ones aside, is named by a repo member (#3168).",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            const forge = ctx.facts?.forgeRepos;
+            if (!forge)
+                return [];
+            const declared = new Set(repoMembers(ctx).map((m) => repoKey(m.repo.url)));
+            return forge.repos
+                .filter((r) => !r.archived && !declared.has(repoKey(r.url)))
+                .map((r) => finding(this, `the forge lists ${r.url} (${forge.source}), and no repo member names it; add a member of kind repo with its url and pinned rev`, "/members"));
+        },
+    },
+    {
+        id: "WSP015",
+        name: "org-repo-dropped",
+        description: "With --forge-repos, every repository a repo member names is one the forge still lists (#3168).",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const forge = ctx.facts?.forgeRepos;
+            if (!forge)
+                return [];
+            const listed = new Set(forge.repos.map((r) => repoKey(r.url)));
+            return repoMembers(ctx)
+                .filter((m) => !listed.has(repoKey(m.repo.url)))
+                .map((m) => finding(this, `member ${m.name} names ${m.repo.url}, which the forge no longer lists (${forge.source}); remove the member or say why it stays`, `${m.pointer}/repo/url`, m.name));
+        },
+    },
+    {
+        id: "WSP016",
+        name: "repo-url-credential",
+        description: "No repo member's URL carries a password or token: the declaration is committed, and git's own credential helpers supply access (#3168).",
+        severity: "error",
+        configurable: false,
+        check(ctx) {
+            return repoMembers(ctx)
+                .filter((m) => urlCredential(m.repo.url))
+                .map((m) => finding(this, `member ${m.name}'s repo url carries a credential; name the repository without one and let git's credential helper supply access`, `${m.pointer}/repo/url`, m.name));
+        },
+    },
+];

package/dist/workspace/checks.d.ts

@@ -21,7 +21,8 @@
  *
  * | Ids | Checks |
  * |---|---|
- * | WSP001 to WSP011 | the declaration and member kinds (this file) |
+ * | WSP001 to WSP012 | the declaration and member kinds (this file), and a member's file against its kind's schema (#3672) |
+ * | WSP013 to WSP016 | org scope: repo members and the org workspace, checked against the forge's list with `--forge-repos` (#3168) |
  * | WSP071, WSP072 | member ledgers |
  * | WSP081 to WSP083 | recorded pipelines |
  * | WSP091 to WSP099 | member links (#2539, #2558), and those a kind's reader finds in a member's files (#3932) |
@@ -38,6 +39,7 @@
  * | WSP141, WSP142 | member links resolved against a live read, with `--live` (#2549) |
  * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
  * | WSP151 | what a member under `ci.workflow` still lacks (#4168 step 6) |
+ * | WSP152 | a member's generated pipeline targets the branch `ci.branches` routes it to (#4325) |
  * | WSP161 to WSP165 | the security groups the declaration opts into: what each still lacks (#4168 step 7) |
  */
 import type { LintDiagnostic, LintRule, Severity } from "../lint/rule.js";
@@ -53,9 +55,11 @@ import { type MemberLedgerFacts } from "./checks/ledgers.js";
 import { type MemberPipelineFacts } from "./checks/pipelines.js";
 import { type LiveLinkFacts } from "./checks/live.js";
 import { type RecordFacts } from "./checks/records.js";
+import { type ForgeRepoList } from "./checks/org.js";
 import { type DeclaredKind } from "./declared-kinds.js";
 import { type ResolvedBoxIntent } from "./box-intent.js";
 import { type MemberLexiconOutputs } from "./lexicon-outputs.js";
+import type { KindLinkRead } from "./kind-link-readers.js";
 /**
  * What the checks beyond the declaration read, gathered from the checkout
  * before any check runs. A field left out was not gathered, and the checks
@@ -78,6 +82,10 @@ export interface WorkspaceFacts {
     boxIntents?: readonly ResolvedBoxIntent[];
     /** The outputs linked members' lexicons report about their declarations, read by folding their source (#3931). */
     lexiconOutputs?: ReadonlyMap<string, MemberLexiconOutputs>;
+    /** The links members' lexicons read from their declarations, such as an otel clickhouse exporter's tables (#4397). */
+    lexiconLinks?: ReadonlyMap<string, KindLinkRead>;
+    /** The forge's repository list, from `--forge-repos` (#3168). */
+    forgeRepos?: ForgeRepoList;
 }
 /** What every declaration check reads. */
 export interface WorkspaceCheckContext {
@@ -195,6 +203,8 @@ export interface DeclarationCheckOptions {
         env: string;
         onStderr?: (text: string) => void;
     };
+    /** The forge's repository list, from `--forge-repos` (#3168), for WSP014 and WSP015. Read under `--at` too: it is input, not the tree. */
+    forgeRepos?: ForgeRepoList;
 }
 /**
  * Gather {@link WorkspaceFacts} for the declaration in `root`. Member

package/dist/workspace/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAKnE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAqMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAA6F,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7J,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMnE,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAA4C,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACxG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC3D,sHAAsH;IACtH,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjD,iEAAiE;IACjE,UAAU,CAAC,EAAE,aAAa,CAAC;CAC5B;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EA4OrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IAC1D,0IAA0I;IAC1I,UAAU,CAAC,EAAE,aAAa,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CA4EjC"}

package/dist/workspace/checks.js

@@ -21,7 +21,8 @@
  *
  * | Ids | Checks |
  * |---|---|
- * | WSP001 to WSP011 | the declaration and member kinds (this file) |
+ * | WSP001 to WSP012 | the declaration and member kinds (this file), and a member's file against its kind's schema (#3672) |
+ * | WSP013 to WSP016 | org scope: repo members and the org workspace, checked against the forge's list with `--forge-repos` (#3168) |
  * | WSP071, WSP072 | member ledgers |
  * | WSP081 to WSP083 | recorded pipelines |
  * | WSP091 to WSP099 | member links (#2539, #2558), and those a kind's reader finds in a member's files (#3932) |
@@ -38,13 +39,14 @@
  * | WSP141, WSP142 | member links resolved against a live read, with `--live` (#2549) |
  * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
  * | WSP151 | what a member under `ci.workflow` still lacks (#4168 step 6) |
+ * | WSP152 | a member's generated pipeline targets the branch `ci.branches` routes it to (#4325) |
  * | WSP161 to WSP165 | the security groups the declaration opts into: what each still lacks (#4168 step 7) |
  */
 import { realpathSync } from "node:fs";
 import { relative, sep } from "node:path";
 import { readDeclaration, resolveGroups, WorkspaceReadError } from "./declaration.js";
 import { parseJsonText, pointerToken } from "./jsonc.js";
-import { loadKindRegistry, probeKind, resolveKind, resolveMemberFields } from "./kinds.js";
+import { checkMemberFile, loadKindRegistry, probeKind, REPO_KIND, resolveKind, resolveMemberFields } from "./kinds.js";
 import { coreClassRegistry, loadClassRegistry, unknownScopeClasses } from "./principal-classes.js";
 import { gitTop, workingTree } from "./tree.js";
 import { LINK_CHECKS, linkTable } from "./checks/links.js";
@@ -57,9 +59,11 @@ import { BOX_CHECKS } from "./checks/boxes.js";
 import { DIAGRAM_CHECKS } from "./checks/diagrams.js";
 import { SECURITY_CHECKS } from "./checks/security.js";
 import { CI_WORKFLOW_CHECKS } from "./checks/ci-workflow.js";
+import { CI_BRANCH_CHECKS } from "./checks/ci-branch.js";
+import { ORG_CHECKS } from "./checks/org.js";
 import { loadDeclaredKinds } from "./declared-kinds.js";
 import { resolveBoxIntents } from "./box-intent.js";
-import { gatherLexiconOutputs } from "./lexicon-outputs.js";
+import { gatherLexiconLinks, gatherLexiconOutputs } from "./lexicon-outputs.js";
 const HELP = "https://intentius.io/chant/cli/workspace-check/#declaration-checks";
 const memberDir = (dir) => (dir === "." ? "" : dir);
 function entryFinding(check, entry, field, message) {
@@ -71,9 +75,9 @@ function entryFinding(check, entry, field, message) {
         pointer: field ? `${entry.pointer}/${field}` : entry.pointer,
     };
 }
-/** The dir exists and the kind is known: the members every probe check reads. */
+/** The dir exists and the kind is known: the members every probe check reads. A repo member has no directory here (#3168). */
 function readableMembers(ctx) {
-    return ctx.declaration.members.filter((m) => ctx.tree.stat(memberDir(m.dir)) === "dir" && ctx.kinds.get(m.kind) !== undefined);
+    return ctx.declaration.members.filter((m) => m.kind !== REPO_KIND && ctx.tree.stat(memberDir(m.dir)) === "dir" && ctx.kinds.get(m.kind) !== undefined);
 }
 /** The first id of the read failure, used by {@link runDeclarationChecks} when the declaration can't be read. */
 export const UNREADABLE_CHECK_ID = "WSP001";
@@ -136,7 +140,7 @@ export const WORKSPACE_CHECKS = [
         configurable: true,
         check(ctx) {
             return ctx.declaration.members
-                .filter((m) => ctx.tree.stat(memberDir(m.dir)) !== "dir")
+                .filter((m) => m.kind !== REPO_KIND && ctx.tree.stat(memberDir(m.dir)) !== "dir")
                 .map((m) => entryFinding(this, m, "dir", `member ${m.name}'s directory ${m.dir} does not exist${ctx.tree.label}`));
         },
     },
@@ -258,6 +262,45 @@ export const WORKSPACE_CHECKS = [
             return out;
         },
     },
+    {
+        id: "WSP012",
+        name: "member-file-invalid",
+        description: "Every member of a kind that names a member file has that file, and it passes the kind's JSON Schema (#3672).",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            const out = [];
+            for (const m of readableMembers(ctx)) {
+                const kind = ctx.kinds.get(m.kind);
+                const mf = kind.memberFile;
+                if (!mf)
+                    continue;
+                const file = memberDir(m.dir) === "" ? mf.path : `${memberDir(m.dir)}/${mf.path}`;
+                if (!mf.validate) {
+                    out.push(entryFinding(this, m, "kind", `member ${m.name}'s ${mf.path} can't be checked: kind ${m.kind}'s schema ${mf.schema} did not load (see WSP002)`));
+                    continue;
+                }
+                if (ctx.tree.stat(file) !== "file") {
+                    out.push(entryFinding(this, m, "dir", `member ${m.name} (${m.dir}) has no ${mf.path}, which kind ${m.kind} requires${ctx.tree.label}`));
+                    continue;
+                }
+                let text;
+                try {
+                    text = ctx.tree.read(file);
+                }
+                catch (err) {
+                    out.push(entryFinding(this, m, "dir", `member ${m.name}'s ${mf.path} can't be read: ${err.message}`));
+                    continue;
+                }
+                for (const p of checkMemberFile(mf, mf.path, text)) {
+                    out.push({ ...entryFinding(this, m, null, `member ${m.name}'s ${mf.path} fails kind ${m.kind}'s schema ${mf.schema}: ${p.message}`), treeFile: file, line: 1, column: 1 });
+                }
+            }
+            return out;
+        },
+    },
+    // Org scope (#3168), WSP013 to WSP016.
+    ...ORG_CHECKS,
     // Member ledgers (#2538).
     ...LEDGER_CHECKS,
     // Recorded pipelines (#2542).
@@ -276,6 +319,8 @@ export const WORKSPACE_CHECKS = [
     ...LIVE_CHECKS,
     // What a member under ci.workflow still lacks (#4168 step 6), WSP151.
     ...CI_WORKFLOW_CHECKS,
+    // A member's pipeline targets the branch ci.branches routes it to (#4325), WSP152.
+    ...CI_BRANCH_CHECKS,
     // The security groups the declaration opts into (#4168 step 7), WSP161 to WSP165.
     ...SECURITY_CHECKS,
 ];
@@ -399,11 +444,18 @@ export async function runDeclarationChecks(root, display = (f) => f, options = {
     // A box's intent is read from the working tree's records, so not under --at (#2850).
     const boxIntents = declaredKinds && !options.tree ? await resolveBoxIntents(declaration, root, declaredKinds) : undefined;
     // A linked member's lexicons name its tables and columns as outputs (#3931); reading them folds its source, never runs it.
-    const lexiconOutputs = options.gather === false ? undefined : await gatherLexiconOutputs(root, declaration, options.tree ? workingTree(root) : tree, groups, registry, { atRevision: options.tree !== undefined });
+    // A member's lexicons may also read other members' outputs from its declarations (#4397); their targets are read too.
+    const outputsTree = options.tree ? workingTree(root) : tree;
+    const lexiconLinks = options.gather === false ? undefined : await gatherLexiconLinks(root, declaration, outputsTree, groups, registry, { atRevision: options.tree !== undefined });
+    const lexiconOutputs = options.gather === false
+        ? undefined
+        : await gatherLexiconOutputs(root, declaration, outputsTree, groups, registry, { atRevision: options.tree !== undefined, ...(lexiconLinks ? { lexiconLinks } : {}) });
     const facts = {
         ...(lexiconOutputs && lexiconOutputs.size > 0 ? { lexiconOutputs } : {}),
+        ...(lexiconLinks && lexiconLinks.size > 0 ? { lexiconLinks } : {}),
         ...gathered,
         ...(options.records ? { records: options.records } : {}),
+        ...(options.forgeRepos ? { forgeRepos: options.forgeRepos } : {}),
         ...(declaredKinds ? { declaredKinds } : {}),
         ...(boxIntents ? { boxIntents } : {}),
         ...(options.live && !options.tree ? { live: await gatherLiveLinkFacts(root, declaration, registry, options.live.env, options.live.onStderr) } : {}),

package/dist/workspace/ci-branches.d.ts

@@ -27,6 +27,22 @@ export declare function routeConflicts(branches: MemberGlobs | undefined, member
     member: string;
     branches: string[];
 }>;
+/**
+ * The branches `chant ci serve` polls (#4325), and the ones among them a job
+ * is told with `--branch`.
+ *
+ * - A routed member polls its route alone. A `named` branch that differs
+ *   from the route is refused, as `chant build --pr-loop` refuses it.
+ * - An unrouted member polls `fallback`, which may not be a routed branch.
+ * - Where no member is in play (the workspace root), `fallback` and then each
+ *   routed branch, so every branch a member applies from is watched.
+ *
+ * `fallback` is the branch `--branch` names, else the default branch.
+ */
+export declare function servedBranches(branches: MemberGlobs | undefined, member: string | undefined, fallback: string, named: boolean): {
+    served: string[];
+    routed: string[];
+};
 /**
  * Whether a push to `pushed` applies `member`, with a line that says why.
  * A routed member applies only from its branch. Any other member applies

package/dist/workspace/ci-branches.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-branches.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-branches.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAItE,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnF;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7F;AAED,oGAAoG;AACpG,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAE3I;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAWjI;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAO/I;AAED,mIAAmI;AACnI,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,GAAG,SAAS,CAE7G"}
+{"version":3,"file":"ci-branches.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-branches.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAItE,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnF;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7F;AAED,oGAAoG;AACpG,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAE3I;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,GACb;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAYxC;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAWjI;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAO/I;AAED,mIAAmI;AACnI,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,GAAG,SAAS,CAE7G"}

package/dist/workspace/ci-branches.js

@@ -31,6 +31,33 @@ export function routedBranch(branches, member) {
 export function routeConflicts(branches, members) {
     return members.map((member) => ({ member, branches: keysMatching(branches, member) })).filter((c) => c.branches.length > 1);
 }
+/**
+ * The branches `chant ci serve` polls (#4325), and the ones among them a job
+ * is told with `--branch`.
+ *
+ * - A routed member polls its route alone. A `named` branch that differs
+ *   from the route is refused, as `chant build --pr-loop` refuses it.
+ * - An unrouted member polls `fallback`, which may not be a routed branch.
+ * - Where no member is in play (the workspace root), `fallback` and then each
+ *   routed branch, so every branch a member applies from is watched.
+ *
+ * `fallback` is the branch `--branch` names, else the default branch.
+ */
+export function servedBranches(branches, member, fallback, named) {
+    const keys = Object.keys(branches ?? {});
+    if (member === undefined)
+        return { served: [fallback, ...keys.filter((k) => k !== fallback)], routed: keys };
+    const own = routedBranch(branches, member);
+    if (own !== null) {
+        if (named && fallback !== own)
+            throw new Error(`--branch ${fallback}: ci.branches routes member ${member} to ${own}, so ci serve polls ${own}`);
+        return { served: [own], routed: [own] };
+    }
+    if (keys.includes(fallback)) {
+        throw new Error(`--branch ${fallback}: ci.branches applies only the members its globs match from ${fallback}, and member ${member} is not one`);
+    }
+    return { served: [fallback], routed: [] };
+}
 /**
  * Whether a push to `pushed` applies `member`, with a line that says why.
  * A routed member applies only from its branch. Any other member applies

package/dist/workspace/ci-green-cli.js

@@ -30,10 +30,10 @@ import { findWorkspaceRoot } from "../project-root.js";
 import { ciList, ciTick, CiGreenError, formatList, formatTick, lastGreen, RUNNER_KEY_ENV } from "./ci-green.js";
 import { ciForgeFromEnv } from "./ci-green-forge.js";
 import { ACTIONS_NAME, buildTriggerEdits, CI_GREEN_WORKFLOW_FILE, ciGreenHeader, readWorkflowSources, renderCiGreenWorkflow, workflowsHolding, writeWorkflowFile } from "./ci-green-workflow.js";
-import { readDeclaration, readerVersion, WorkspaceReadError } from "./declaration.js";
+import { greenBranches, readDeclaration, readerVersion, WorkspaceReadError } from "./declaration.js";
 import { recordGeneratedFiles, resolveMemberContext, shellArg } from "./member-pipeline.js";
 import { gitTop, workingTree } from "./tree.js";
-const USAGE = "chant ci last-green [--json] [--from <rev>] | ci list [--json] [--limit <n>] [--since <rev>] [--forge github] [--source checks|runs] | ci tick [--dry-run] [--forge github] [--source checks|runs] [--key <runner key.pem>] | " +
+const USAGE = "chant ci last-green [--json] [--from <rev>] [--branch <branch>] | ci list [--json] [--branch <branch>] [--limit <n>] [--since <rev>] [--forge github] [--source checks|runs] | ci tick [--dry-run] [--forge github] [--source checks|runs] [--key <runner key.pem>] | " +
     "ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>] [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>] [--runner-key-secret <NAME>]";
 export { RUNNER_KEY_ENV };
 /** `--source`, checked (#4044): `checks` or `runs`, or undefined to follow `ci.green.source`. */
@@ -51,7 +51,7 @@ function warnIgnored(ignored) {
         console.error(`warning: ignored ${t.tag} (${t.status}): ${t.reason}`);
 }
 export async function runCiLastGreen(ctx) {
-    const doc = lastGreen({ cwd: process.cwd(), ...(ctx.args.migrateFrom !== undefined ? { from: ctx.args.migrateFrom } : {}) });
+    const doc = lastGreen({ cwd: process.cwd(), ...(ctx.args.branch !== undefined ? { branch: ctx.args.branch } : {}), ...(ctx.args.migrateFrom !== undefined ? { from: ctx.args.migrateFrom } : {}) });
     if (ctx.args.json) {
         console.log(JSON.stringify(doc, null, 2));
         return "error" in doc ? 1 : 0;
@@ -76,7 +76,7 @@ export async function runCiList(ctx) {
         // Only an explicit --forge reaches the network; without it the list reads local refs and tags.
         const forge = ctx.args.forge !== undefined ? ciForgeFromEnv(ctx.args.forge) : undefined;
         const source = sourceOf(ctx.args);
-        const doc = await ciList({ cwd: process.cwd(), limit, since: ctx.args.since, forge, ...(source ? { source } : {}) });
+        const doc = await ciList({ cwd: process.cwd(), ...(ctx.args.branch !== undefined ? { branch: ctx.args.branch } : {}), limit, since: ctx.args.since, forge, ...(source ? { source } : {}) });
         if (ctx.args.json) {
             console.log(JSON.stringify(doc, null, 2));
             return "error" in doc ? 1 : 0;
@@ -192,14 +192,14 @@ export async function runCiWorkflow(ctx) {
         const written = writeWorkflowFile(target, ciGreenHeader(command, member ? "member" : "root") + yaml);
         if (member)
             recordGeneratedFiles(member.memberRoot, [{ path: fromRepo, command }]);
-        console.log(`Wrote ${written}: ticks when ${workflows.join(", ")} complete${workflows.length === 1 ? "s" : ""} on ${green.branch}${compose ? " or a chant/compose/ branch" : ""}, and every 15 minutes.`);
+        console.log(`Wrote ${written}: ticks when ${workflows.join(", ")} complete${workflows.length === 1 ? "s" : ""} on ${greenBranches(green).join(", ")}${compose ? " or a chant/compose/ branch" : ""}, and every 15 minutes.`);
         for (const e of edits) {
             if (!e.changed)
                 continue;
             const path = writeWorkflowFile(join(repoRoot, e.path), e.text);
             console.log(e.build === "newest"
-                ? `Wrote ${path}'s triggers and concurrency: ${e.phases.join(", ")} build${e.phases.length === 1 ? "s" : ""} the newest commit on ${green.branch} when a run ends, and a ci/build/<sha> tag by hand.`
-                : `Wrote ${path}'s triggers and concurrency: ${e.phases.join(", ")} build${e.phases.length === 1 ? "s" : ""} every commit on ${green.branch}, none cancelled, and a ci/build/<sha> tag by hand when the forge ran nothing.`);
+                ? `Wrote ${path}'s triggers and concurrency: ${e.phases.join(", ")} build${e.phases.length === 1 ? "s" : ""} the newest commit on ${greenBranches(green).join(", ")} when a run ends, and a ci/build/<sha> tag by hand.`
+                : `Wrote ${path}'s triggers and concurrency: ${e.phases.join(", ")} build${e.phases.length === 1 ? "s" : ""} every commit on ${greenBranches(green).join(", ")}, none cancelled, and a ci/build/<sha> tag by hand when the forge ran nothing.`);
         }
         return 0;
     }

package/dist/workspace/ci-green-workflow.d.ts

@@ -44,7 +44,7 @@
  * the command runs in records it in its generated-file record, so `WSP081`
  * allows one declarer.
  */
-import type { CiBuild, CiGreen } from "./declaration.js";
+import { type CiBuild, type CiGreen } from "./declaration.js";
 /** Where the workflow goes, relative to the repository root. */
 export declare const CI_GREEN_WORKFLOW_FILE = ".github/workflows/chant-ci-green.yml";
 export declare const CI_GREEN_WORKFLOW_NAME = "chant-ci-green";

package/dist/workspace/ci-green-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-green-workflow.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAKtD,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAC7E,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,yHAAyH;AACzH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAYnD;AAYD,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sDAAsD;IACtD,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChD,+CAA+C;IAC/C,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,YAAY,CAyBjG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG;IAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkBlK;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CASpF;AAID,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8GAA8G;IAC9G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,iEAAiE;AACjE,eAAO,MAAM,gBAAgB,qBAA+B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,4GAA4G;AAC5G,eAAO,MAAM,YAAY,QAA6B,CAAC;AAEvD,mHAAmH;AACnH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CA4ElE;AAED,iGAAiG;AACjG,eAAO,MAAM,aAAa,UAAW,OAAO,YAAoD,CAAC;AACjG,sEAAsE;AACtE,eAAO,MAAM,YAAY,UAAW,OAAO,YAAqF,CAAC;AAIjI,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,kGAAkG,CAAC;AAElI,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,gBAAgB,EAAE,CAwD7I;AAUD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,CAe1G;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAE/E;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAItE"}
+{"version":3,"file":"ci-green-workflow.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAOH,OAAO,EAAiB,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAK1E,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAC7E,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,yHAAyH;AACzH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAYnD;AAYD,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sDAAsD;IACtD,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChD,+CAA+C;IAC/C,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,YAAY,CAyBjG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG;IAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkBlK;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CASpF;AAID,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8GAA8G;IAC9G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,iEAAiE;AACjE,eAAO,MAAM,gBAAgB,qBAA+B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,4GAA4G;AAC5G,eAAO,MAAM,YAAY,QAA6B,CAAC;AAEvD,mHAAmH;AACnH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CA4ElE;AAED,iGAAiG;AACjG,eAAO,MAAM,aAAa,UAAW,OAAO,YAAoD,CAAC;AACjG,sEAAsE;AACtE,eAAO,MAAM,YAAY,UAAW,OAAO,YAAqF,CAAC;AAIjI,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,kGAAkG,CAAC;AAElI,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,gBAAgB,EAAE,CA2D7I;AAUD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,CAe1G;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAE/E;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAItE"}

package/dist/workspace/ci-green-workflow.js

@@ -47,7 +47,9 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { GENERATED_MARKER } from "../discovery/files.js";
+import { ACTION_PINS, tagComments, usesRef } from "../action-pins.js";
 import { emitYAMLEntry, parseYAMLDocument } from "../yaml.js";
+import { greenBranches } from "./declaration.js";
 import { matchesCheckRun } from "./ci-green.js";
 import { githubSecretOrJobToken } from "../ci-jobs.js";
 import { COMPOSE_BRANCH_PREFIX } from "../lifecycle/compose-refs.js";
@@ -165,7 +167,7 @@ export function renderCiGreenWorkflow(input) {
         ? [
             "      - name: Mint a GitHub App token that may push tags to commits that change workflows",
             "        id: app-token",
-            "        uses: actions/create-github-app-token@v2",
+            `        uses: ${usesRef(ACTION_PINS.createGithubAppToken2)}`,
             "        with:",
             `          app-id: \${{ vars.${push.appIdVar} }}`,
             `          private-key: \${{ secrets.${push.appKeySecret} }}`,
@@ -184,7 +186,7 @@ export function renderCiGreenWorkflow(input) {
         "    types:",
         "      - completed",
         "    branches:",
-        `      - ${q(green.branch)}`,
+        ...greenBranches(green).map((b) => `      - ${q(b)}`),
         // #4169: a build the tick asked for runs at a ci/build/<sha> tag, and its completion ticks too.
         ...(newestPhases(green) ? [`      - ${q("ci/build/**")}`] : []),
         // #4220: a composed commit's phases run on its chant/compose/<name> branch, and their completion ticks too.
@@ -210,12 +212,12 @@ export function renderCiGreenWorkflow(input) {
         "    timeout-minutes: 15",
         "    steps:",
         ...mint,
-        "      - uses: actions/checkout@v6",
+        `      - uses: ${usesRef(ACTION_PINS.checkout6)}`,
         "        with:",
         `          ref: ${q(green.branch)}`,
         "          fetch-depth: 0",
         ...token,
-        "      - uses: actions/setup-node@v6",
+        `      - uses: ${usesRef(ACTION_PINS.setupNode6)}`,
         "        with:",
         "          node-version: \"24\"",
         ...cache,
@@ -229,7 +231,7 @@ export function renderCiGreenWorkflow(input) {
         ...(input.runnerKeySecret ? [`          CHANT_RUNNER_KEY: \${{ secrets.${input.runnerKeySecret} }}`] : []),
         `        run: ${tick}`,
     ];
-    return lines.join("\n") + "\n";
+    return tagComments(lines.join("\n") + "\n");
 }
 /** Whether any phase sets `build` (#4169): then the tick may re-run jobs and start workflows. */
 export const declaresBuild = (green) => green.phases.some((p) => p.build !== undefined);
@@ -294,7 +296,7 @@ export function buildTriggerEdits(green, sources, options = {}) {
             delete on.schedule;
             const push = isObject(on.push) ? { ...on.push } : {};
             const branches = Array.isArray(push.branches) ? push.branches.filter((b) => typeof b === "string") : [];
-            const withBranch = branches.includes(green.branch) ? branches : [...branches, green.branch];
+            const withBranch = [...branches, ...greenBranches(green).filter((b) => !branches.includes(b))];
             push.branches = compose && !withBranch.includes(COMPOSE_BRANCHES) ? [...withBranch, COMPOSE_BRANCHES] : withBranch;
             const { push: _push, workflow_dispatch: dispatch, ...rest } = on;
             text = writeTopLevel(text, "on", { push, workflow_dispatch: dispatch ?? {}, ...rest });
@@ -315,8 +317,11 @@ export function buildTriggerEdits(green, sources, options = {}) {
             if (next !== on)
                 text = writeTopLevel(text, "on", next);
             // #4220: a compose branch's commits each get a verdict, so its runs are keyed by commit, as the trunk branch's are.
-            const keyed = compose ? `(github.ref == '${main}' || startsWith(github.ref, 'refs/heads/${COMPOSE_BRANCH_PREFIX}'))` : `github.ref == '${main}'`;
-            const unkeyed = compose ? `!${keyed}` : `github.ref != '${main}'`;
+            // #4325: each branch ci.green judges is keyed by commit.
+            const heads = greenBranches(green).map((b) => `github.ref == 'refs/heads/${b}'`);
+            const several = heads.length > 1;
+            const keyed = compose ? `(${[...heads, `startsWith(github.ref, 'refs/heads/${COMPOSE_BRANCH_PREFIX}')`].join(" || ")})` : several ? `(${heads.join(" || ")})` : `github.ref == '${main}'`;
+            const unkeyed = compose || several ? `!${keyed}` : `github.ref != '${main}'`;
             // Written as lines: the emitter would quote the expression, and GitHub reads it the same either way.
             text = writeTopLevel(text, "concurrency", [
                 "concurrency:",