@intentius/chant 0.124.46 → 0.124.48

package/dist/workspace/check.schema.json

@@ -65,6 +65,13 @@
                   ],
                   "description": "The declared name, or null when the declaration can't be read."
                 },
+                "repo": {
+                  "type": [
+                    "string",
+                    "null"
+                  ],
+                  "description": "Added in contract 1 by #3168. The repository the document came from: the URL of the remote origin of the git repository that holds the workspace, with any user name or password removed, or null when there is no origin or the workspace is outside git. With name, root and the revision, it says which repository's workspace a document describes, so a reader that gathers several repositories' documents, such as an org workspace's repo members, tells them apart."
+                },
                 "root": {
                   "type": "string",
                   "description": "The workspace root relative to the git root, with / separators, \".\" for the git root itself. An absolute path outside a git repository."
@@ -341,7 +348,8 @@
             "ci-workflow-ungated-env",
             "ci-workflow-pipeline-missing",
             "ci-workflow-pipeline-differs",
-            "ci-workflow-publish-missing"
+            "ci-workflow-publish-missing",
+            "ci-branch-route-differs"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         }
@@ -463,7 +471,8 @@
             "ci-workflow-ungated-env",
             "ci-workflow-pipeline-missing",
             "ci-workflow-pipeline-differs",
-            "ci-workflow-publish-missing"
+            "ci-workflow-publish-missing",
+            "ci-branch-route-differs"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         },

package/dist/workspace/checks/ci-branch.d.ts

@@ -0,0 +1,44 @@
+/**
+ * WSP152 (#4325): a member's generated pull-request pipeline targets the
+ * branch `ci.branches` routes the member to.
+ *
+ * `chant build --pr-loop` refuses a branch that disagrees with the route
+ * (../member-pipeline.ts), but only when it writes the file. A route changed
+ * after the pipeline was generated, or a pipeline edited by hand, goes
+ * unnoticed until a push to the wrong branch applies nothing. This check
+ * reads the files each member's generated-file record lists and compares what
+ * they target with the route. It reads files and never runs them.
+ *
+ * A pipeline names its target in two places: the `--branch` its record and
+ * apply commands carry, and the `branches` of its `push` and `pull_request`
+ * triggers. A routed member's pipeline names the route in both. A member with
+ * no route may name a branch `ci.branches` does not list, and not one it
+ * lists, since that branch applies only the members its globs match.
+ */
+import type { WorkspaceCheck } from "../checks.js";
+export declare const WSP_CI_BRANCH_ROUTE = "WSP152";
+/** The finding code WSP152 reports. */
+export declare const CI_BRANCH_FINDING_CODES: readonly ["ci-branch-route-differs"];
+/** What a pipeline file says it targets. */
+export interface PipelineTargets {
+    /** The `--branch` of each record or apply command, by line; null for a command with none. */
+    jobs: {
+        line: number;
+        branch: string | null;
+    }[];
+    /** The branches its `push` and `pull_request` triggers list, by trigger. Absent for a trigger with no list. */
+    triggers: {
+        trigger: "push" | "pull_request";
+        branches: string[];
+    }[];
+}
+/** The branches a pipeline file targets, read from its text. */
+export declare function pipelineTargets(text: string): PipelineTargets;
+/**
+ * What differs between `targets` and the branch `own` the member is routed to
+ * (null when it has no route), as sentences. `listed` is every branch
+ * `ci.branches` names.
+ */
+export declare function routeDifferences(targets: PipelineTargets, own: string | null, listed: readonly string[], member: string): string[];
+export declare const CI_BRANCH_CHECKS: readonly WorkspaceCheck[];
+//# sourceMappingURL=ci-branch.d.ts.map

package/dist/workspace/checks/ci-branch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-branch.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/ci-branch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAQrE,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,uCAAuC;AACvC,eAAO,MAAM,uBAAuB,YAAI,yBAAyB,CAAU,CAAC;AAQ5E,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,6FAA6F;IAC7F,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAChD,+GAA+G;IAC/G,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;CACtE;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAuB7D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAelI;AAcD,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAmCrD,CAAC"}

package/dist/workspace/checks/ci-branch.js

@@ -0,0 +1,133 @@
+/**
+ * WSP152 (#4325): a member's generated pull-request pipeline targets the
+ * branch `ci.branches` routes the member to.
+ *
+ * `chant build --pr-loop` refuses a branch that disagrees with the route
+ * (../member-pipeline.ts), but only when it writes the file. A route changed
+ * after the pipeline was generated, or a pipeline edited by hand, goes
+ * unnoticed until a push to the wrong branch applies nothing. This check
+ * reads the files each member's generated-file record lists and compares what
+ * they target with the route. It reads files and never runs them.
+ *
+ * A pipeline names its target in two places: the `--branch` its record and
+ * apply commands carry, and the `branches` of its `push` and `pull_request`
+ * triggers. A routed member's pipeline names the route in both. A member with
+ * no route may name a branch `ci.branches` does not list, and not one it
+ * lists, since that branch applies only the members its globs match.
+ */
+import { routedBranch } from "../ci-branches.js";
+import { GENERATED_RECORD_FILE } from "../member-pipeline.js";
+import { joinPath } from "../tree.js";
+import { parseYAMLDocument } from "../../yaml.js";
+import { read } from "./security.js";
+export const WSP_CI_BRANCH_ROUTE = "WSP152";
+/** The finding code WSP152 reports. */
+export const CI_BRANCH_FINDING_CODES = ["ci-branch-route-differs"];
+const memberDir = (dir) => (dir === "." ? "" : dir);
+/** A record or apply command of the pull-request loop: `ci run record|apply`, or `components pr-record|pr-apply`. */
+const JOB = /\bci\s+run\s+(?:record|apply)\b|\bcomponents\s+pr-(?:record|apply)\b/;
+const BRANCH_FLAG = /--branch(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))/;
+/** The branches a pipeline file targets, read from its text. */
+export function pipelineTargets(text) {
+    const jobs = [];
+    text.split("\n").forEach((line, i) => {
+        if (!JOB.test(line))
+            return;
+        const m = BRANCH_FLAG.exec(line);
+        jobs.push({ line: i + 1, branch: m ? (m[1] ?? m[2] ?? m[3] ?? null) : null });
+    });
+    const triggers = [];
+    try {
+        const doc = parseYAMLDocument(text);
+        // YAML 1.1 reads a bare `on` key as true.
+        const on = doc && typeof doc === "object" ? (doc.on ?? doc.true) : undefined;
+        if (on && typeof on === "object" && !Array.isArray(on)) {
+            for (const trigger of ["push", "pull_request"]) {
+                const t = on[trigger];
+                const branches = t && typeof t === "object" ? t.branches : undefined;
+                if (Array.isArray(branches))
+                    triggers.push({ trigger, branches: branches.filter((b) => typeof b === "string") });
+            }
+        }
+    }
+    catch {
+        // A file that is not YAML has no triggers to compare; its commands still are.
+    }
+    return { jobs, triggers };
+}
+/**
+ * What differs between `targets` and the branch `own` the member is routed to
+ * (null when it has no route), as sentences. `listed` is every branch
+ * `ci.branches` names.
+ */
+export function routeDifferences(targets, own, listed, member) {
+    const out = [];
+    const said = (b) => (b === null ? "the default branch (it passes no --branch)" : b);
+    for (const j of targets.jobs) {
+        if (own !== null && j.branch !== own)
+            out.push(`line ${j.line} targets ${said(j.branch)}, and ci.branches routes member ${member} to ${own}`);
+        else if (own === null && j.branch !== null && listed.includes(j.branch))
+            out.push(`line ${j.line} targets ${j.branch}, which ci.branches reserves for the members its globs match, and member ${member} is not one`);
+    }
+    for (const t of targets.triggers) {
+        if (own !== null && !(t.branches.length === 1 && t.branches[0] === own))
+            out.push(`its ${t.trigger} trigger lists ${t.branches.join(", ") || "no branch"}, and ci.branches routes member ${member} to ${own}`);
+        else if (own === null) {
+            const reserved = t.branches.filter((b) => listed.includes(b));
+            if (reserved.length > 0)
+                out.push(`its ${t.trigger} trigger lists ${reserved.join(", ")}, which ci.branches reserves for the members its globs match, and member ${member} is not one`);
+        }
+    }
+    return out;
+}
+/** The files a member's generated-file record lists, which are pipelines the check can read. */
+function recordedFiles(ctx, member) {
+    const text = read(ctx.tree, joinPath(memberDir(member.dir), GENERATED_RECORD_FILE));
+    if (text === null)
+        return [];
+    try {
+        const parsed = JSON.parse(text);
+        return (parsed.files ?? []).flatMap((f) => (typeof f.path === "string" && /\.ya?ml$/.test(f.path) ? [f.path] : []));
+    }
+    catch {
+        return [];
+    }
+}
+export const CI_BRANCH_CHECKS = [
+    {
+        id: WSP_CI_BRANCH_ROUTE,
+        name: "ci-branch-route",
+        description: "A member's generated pull-request pipeline targets the branch ci.branches routes the member to, in its record and apply commands and its push and pull_request triggers.",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            const branches = ctx.declaration.ci?.branches;
+            if (!branches || Object.keys(branches).length === 0)
+                return [];
+            const listed = Object.keys(branches);
+            const out = [];
+            for (const member of ctx.declaration.members) {
+                const own = routedBranch(branches, member.name);
+                for (const path of recordedFiles(ctx, member)) {
+                    const text = read(ctx.tree, path);
+                    if (text === null)
+                        continue;
+                    for (const why of routeDifferences(pipelineTargets(text), own, listed, member.name)) {
+                        out.push({
+                            checkId: this.id,
+                            severity: this.severity,
+                            code: CI_BRANCH_FINDING_CODES[0],
+                            message: `WSP152: ${path}: ${why}; regenerate it with chant build --components --generate <forge> --pr-loop`,
+                            pointer: "/ci/branches",
+                            entity: member.name,
+                            treeFile: path,
+                            line: 1,
+                            column: 1,
+                        });
+                    }
+                }
+            }
+            return out;
+        },
+    },
+];

package/dist/workspace/checks/links.d.ts

@@ -22,6 +22,9 @@
  * Links a kind's reader finds in a member's own files (#3932), such as a dbt
  * project's sources, are checked by WSP093 to WSP095 like declared ones, and
  * their findings name the member's file and line instead of the declaration.
+ * Links a member's lexicon reads from its declarations (#4397), such as the
+ * tables an otel `clickhouse` exporter writes, are checked the same way, with
+ * the reader named `lexicon <name>`.
  */
 import type { WorkspaceCheck, WorkspaceCheckContext } from "../checks.js";
 import { type LinkTableRow } from "../links.js";

package/dist/workspace/checks/links.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"links.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAuB,MAAM,WAAW,CAAC;AAI5F,OAAO,EAAwH,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAenK,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,GAAG,EAAE,qBAAqB,GAAG,YAAY,EAAE,CAOpE;AAoBD,eAAO,MAAM,WAAW,EAAE,SAAS,cAAc,EAmLhD,CAAC"}
+{"version":3,"file":"links.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAuB,MAAM,WAAW,CAAC;AAI5F,OAAO,EAAwH,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAuBnK,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,GAAG,EAAE,qBAAqB,GAAG,YAAY,EAAE,CAOpE;AAoBD,eAAO,MAAM,WAAW,EAAE,SAAS,cAAc,EAmLhD,CAAC"}

package/dist/workspace/checks/links.js

@@ -22,17 +22,28 @@
  * Links a kind's reader finds in a member's own files (#3932), such as a dbt
  * project's sources, are checked by WSP093 to WSP095 like declared ones, and
  * their findings name the member's file and line instead of the declaration.
+ * Links a member's lexicon reads from its declarations (#4397), such as the
+ * tables an otel `clickhouse` exporter writes, are checked the same way, with
+ * the reader named `lexicon <name>`.
  */
 import { sourceMemberHandles } from "../member-handles.js";
 import { readKindLinks } from "../kind-link-readers.js";
 import { DEFAULT_LINK_KIND, LINK_KINDS, TELEMETRY_LINK_KIND, linkTargetProblem, resolveLinks } from "../links.js";
 const tables = new WeakMap();
 const reads = new WeakMap();
-/** What each member's kind reader found (#3932), read once per check run. */
+/**
+ * What each member's kind reader found (#3932), and the links its lexicons
+ * read from its declarations (#4397), read once per check run.
+ */
 function kindReads(ctx) {
     let read = reads.get(ctx);
     if (!read) {
         read = readKindLinks(ctx.declaration, ctx.tree, ctx.kinds);
+        for (const [member, lexicon] of ctx.facts?.lexiconLinks ?? []) {
+            const prev = read.get(member);
+            // resolveLinks names one reader per member; the lexicon's links keep their file and line.
+            read.set(member, prev ? { ...prev, links: [...prev.links, ...lexicon.links], gaps: [...prev.gaps, ...lexicon.gaps] } : lexicon);
+        }
         reads.set(ctx, read);
     }
     return read;

package/dist/workspace/checks/org.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Org scope (#3168): members of kind `repo`, which name another repository's
+ * workspace by URL and pinned revision, and the org-level workspace that
+ * holds only such members.
+ *
+ * | Id | Check |
+ * |---|---|
+ * | WSP013 | an org workspace holds only repo members |
+ * | WSP014 | every repository the forge lists is declared (with `--forge-repos`) |
+ * | WSP015 | every declared repository is one the forge lists (with `--forge-repos`) |
+ * | WSP016 | no repo member's URL carries a password or token |
+ *
+ * The forge's list is input, never fetched here: a warden enumerates the
+ * org's repositories from its own API and hands the list to
+ * `chant workspace check --forge-repos <file>`, so the check stays offline.
+ */
+import type { WorkspaceCheck } from "../checks.js";
+/** One repository the forge lists. */
+export interface ForgeRepo {
+    url: string;
+    /** An archived repository need not be declared, and declaring one is not a drop. */
+    archived: boolean;
+}
+/** The forge's repository list for `--forge-repos` (#3168), as a warden writes it. */
+export interface ForgeRepoList {
+    /** The file it was read from, for messages. */
+    source: string;
+    repos: ForgeRepo[];
+}
+/**
+ * Parse a forge repository list. Three shapes are read: `{ "repos": [...] }`
+ * (a warden may add `forge` and `org` beside it), a bare array, and, for each
+ * repository, a URL string or `{ "url", "archived"? }`. Throws an Error that
+ * says what is wrong.
+ */
+export declare function parseForgeRepos(text: string, source: string): ForgeRepoList;
+/**
+ * A repository URL reduced to what names the repository, so the forge's
+ * https URL and a declaration's ssh or scp-style URL compare equal:
+ * `host/owner/repo`, lowercased, with no scheme, user, port, `.git` or
+ * trailing slash. A local path or file URL becomes its absolute path,
+ * resolved from `base`.
+ */
+export declare function repoKey(url: string, base?: string): string;
+/** Whether a URL carries a password or token, which a declaration must never hold. */
+export declare function urlCredential(url: string): boolean;
+export declare const ORG_CHECKS: readonly WorkspaceCheck[];
+//# sourceMappingURL=org.d.ts.map

package/dist/workspace/checks/org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/org.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAErE,sCAAsC;AACtC,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,CAiB3E;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,MAAsB,GAAG,MAAM,CAmBzE;AAMD,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CASlD;AAQD,eAAO,MAAM,UAAU,EAAE,SAAS,cAAc,EA0D/C,CAAC"}

package/dist/workspace/checks/org.js

@@ -0,0 +1,156 @@
+/**
+ * Org scope (#3168): members of kind `repo`, which name another repository's
+ * workspace by URL and pinned revision, and the org-level workspace that
+ * holds only such members.
+ *
+ * | Id | Check |
+ * |---|---|
+ * | WSP013 | an org workspace holds only repo members |
+ * | WSP014 | every repository the forge lists is declared (with `--forge-repos`) |
+ * | WSP015 | every declared repository is one the forge lists (with `--forge-repos`) |
+ * | WSP016 | no repo member's URL carries a password or token |
+ *
+ * The forge's list is input, never fetched here: a warden enumerates the
+ * org's repositories from its own API and hands the list to
+ * `chant workspace check --forge-repos <file>`, so the check stays offline.
+ */
+import { isAbsolute, resolve } from "node:path";
+import { REPO_KIND } from "../kinds.js";
+/**
+ * Parse a forge repository list. Three shapes are read: `{ "repos": [...] }`
+ * (a warden may add `forge` and `org` beside it), a bare array, and, for each
+ * repository, a URL string or `{ "url", "archived"? }`. Throws an Error that
+ * says what is wrong.
+ */
+export function parseForgeRepos(text, source) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (err) {
+        throw new Error(`${source} is not JSON (${err.message})`);
+    }
+    const list = Array.isArray(raw) ? raw : raw !== null && typeof raw === "object" && Array.isArray(raw.repos) ? raw.repos : undefined;
+    if (!list)
+        throw new Error(`${source} is neither an array of repositories nor an object with a repos array`);
+    const repos = list.map((r, i) => {
+        if (typeof r === "string" && r.length > 0)
+            return { url: r, archived: false };
+        if (r !== null && typeof r === "object" && typeof r.url === "string") {
+            return { url: r.url, archived: r.archived === true };
+        }
+        throw new Error(`${source}: repos[${i}] is neither a URL nor an object with a url`);
+    });
+    return { source, repos };
+}
+/**
+ * A repository URL reduced to what names the repository, so the forge's
+ * https URL and a declaration's ssh or scp-style URL compare equal:
+ * `host/owner/repo`, lowercased, with no scheme, user, port, `.git` or
+ * trailing slash. A local path or file URL becomes its absolute path,
+ * resolved from `base`.
+ */
+export function repoKey(url, base = process.cwd()) {
+    const trimmed = url.trim();
+    const scp = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/\/)(.+)$/.exec(trimmed);
+    let hostPath;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)) {
+        let u;
+        try {
+            u = new URL(trimmed);
+        }
+        catch {
+            return trimmed.toLowerCase();
+        }
+        if (u.protocol === "file:")
+            return stripGit(decodeURIComponent(u.pathname));
+        hostPath = `${u.hostname}${u.pathname}`;
+    }
+    else if (scp && !isAbsolute(trimmed) && !/^[a-z]:[\\/]/i.test(trimmed)) {
+        hostPath = `${scp[1]}/${scp[2]}`;
+    }
+    else {
+        return stripGit(resolve(base, trimmed));
+    }
+    return stripGit(hostPath.replace(/\/+/g, "/")).toLowerCase();
+}
+function stripGit(path) {
+    return path.replace(/\/+$/, "").replace(/\.git$/, "");
+}
+/** Whether a URL carries a password or token, which a declaration must never hold. */
+export function urlCredential(url) {
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(url))
+        return false;
+    try {
+        const u = new URL(url);
+        // ssh://git@host is a user name, not a secret; a password, or any user on http(s), is one.
+        return u.password !== "" || (u.username !== "" && /^https?:$/.test(u.protocol));
+    }
+    catch {
+        return false;
+    }
+}
+const repoMembers = (ctx) => ctx.declaration.members.filter((m) => m.kind === REPO_KIND && m.repo !== null);
+function finding(check, message, pointer, entity) {
+    return { checkId: check.id, severity: check.severity, message, pointer, ...(entity !== undefined ? { entity } : {}) };
+}
+export const ORG_CHECKS = [
+    {
+        id: "WSP013",
+        name: "org-member-local",
+        description: "An org workspace (scope org) holds only members of kind repo, each a reference to another repository's workspace (#3168).",
+        severity: "error",
+        configurable: false,
+        check(ctx) {
+            if (ctx.declaration.scope !== "org")
+                return [];
+            return ctx.declaration.entries
+                .filter((e) => e.kind !== REPO_KIND)
+                .map((e) => finding(this, `${e.type === "group" ? "example group" : "member"} ${e.name} is kind ${e.kind}, and an org workspace holds only repo members; move it into a repository's own workspace and reference that`, `${e.pointer}/kind`, e.name));
+        },
+    },
+    {
+        id: "WSP014",
+        name: "org-repo-undeclared",
+        description: "With --forge-repos, every repository the forge lists, archived ones aside, is named by a repo member (#3168).",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            const forge = ctx.facts?.forgeRepos;
+            if (!forge)
+                return [];
+            const declared = new Set(repoMembers(ctx).map((m) => repoKey(m.repo.url)));
+            return forge.repos
+                .filter((r) => !r.archived && !declared.has(repoKey(r.url)))
+                .map((r) => finding(this, `the forge lists ${r.url} (${forge.source}), and no repo member names it; add a member of kind repo with its url and pinned rev`, "/members"));
+        },
+    },
+    {
+        id: "WSP015",
+        name: "org-repo-dropped",
+        description: "With --forge-repos, every repository a repo member names is one the forge still lists (#3168).",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const forge = ctx.facts?.forgeRepos;
+            if (!forge)
+                return [];
+            const listed = new Set(forge.repos.map((r) => repoKey(r.url)));
+            return repoMembers(ctx)
+                .filter((m) => !listed.has(repoKey(m.repo.url)))
+                .map((m) => finding(this, `member ${m.name} names ${m.repo.url}, which the forge no longer lists (${forge.source}); remove the member or say why it stays`, `${m.pointer}/repo/url`, m.name));
+        },
+    },
+    {
+        id: "WSP016",
+        name: "repo-url-credential",
+        description: "No repo member's URL carries a password or token: the declaration is committed, and git's own credential helpers supply access (#3168).",
+        severity: "error",
+        configurable: false,
+        check(ctx) {
+            return repoMembers(ctx)
+                .filter((m) => urlCredential(m.repo.url))
+                .map((m) => finding(this, `member ${m.name}'s repo url carries a credential; name the repository without one and let git's credential helper supply access`, `${m.pointer}/repo/url`, m.name));
+        },
+    },
+];

package/dist/workspace/checks.d.ts

@@ -21,7 +21,8 @@
  *
  * | Ids | Checks |
  * |---|---|
- * | WSP001 to WSP011 | the declaration and member kinds (this file) |
+ * | WSP001 to WSP012 | the declaration and member kinds (this file), and a member's file against its kind's schema (#3672) |
+ * | WSP013 to WSP016 | org scope: repo members and the org workspace, checked against the forge's list with `--forge-repos` (#3168) |
  * | WSP071, WSP072 | member ledgers |
  * | WSP081 to WSP083 | recorded pipelines |
  * | WSP091 to WSP099 | member links (#2539, #2558), and those a kind's reader finds in a member's files (#3932) |
@@ -38,6 +39,7 @@
  * | WSP141, WSP142 | member links resolved against a live read, with `--live` (#2549) |
  * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
  * | WSP151 | what a member under `ci.workflow` still lacks (#4168 step 6) |
+ * | WSP152 | a member's generated pipeline targets the branch `ci.branches` routes it to (#4325) |
  * | WSP161 to WSP165 | the security groups the declaration opts into: what each still lacks (#4168 step 7) |
  */
 import type { LintDiagnostic, LintRule, Severity } from "../lint/rule.js";
@@ -53,9 +55,11 @@ import { type MemberLedgerFacts } from "./checks/ledgers.js";
 import { type MemberPipelineFacts } from "./checks/pipelines.js";
 import { type LiveLinkFacts } from "./checks/live.js";
 import { type RecordFacts } from "./checks/records.js";
+import { type ForgeRepoList } from "./checks/org.js";
 import { type DeclaredKind } from "./declared-kinds.js";
 import { type ResolvedBoxIntent } from "./box-intent.js";
 import { type MemberLexiconOutputs } from "./lexicon-outputs.js";
+import type { KindLinkRead } from "./kind-link-readers.js";
 /**
  * What the checks beyond the declaration read, gathered from the checkout
  * before any check runs. A field left out was not gathered, and the checks
@@ -78,6 +82,10 @@ export interface WorkspaceFacts {
     boxIntents?: readonly ResolvedBoxIntent[];
     /** The outputs linked members' lexicons report about their declarations, read by folding their source (#3931). */
     lexiconOutputs?: ReadonlyMap<string, MemberLexiconOutputs>;
+    /** The links members' lexicons read from their declarations, such as an otel clickhouse exporter's tables (#4397). */
+    lexiconLinks?: ReadonlyMap<string, KindLinkRead>;
+    /** The forge's repository list, from `--forge-repos` (#3168). */
+    forgeRepos?: ForgeRepoList;
 }
 /** What every declaration check reads. */
 export interface WorkspaceCheckContext {
@@ -195,6 +203,8 @@ export interface DeclarationCheckOptions {
         env: string;
         onStderr?: (text: string) => void;
     };
+    /** The forge's repository list, from `--forge-repos` (#3168), for WSP014 and WSP015. Read under `--at` too: it is input, not the tree. */
+    forgeRepos?: ForgeRepoList;
 }
 /**
  * Gather {@link WorkspaceFacts} for the declaration in `root`. Member

package/dist/workspace/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAKnE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAqMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAA6F,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7J,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMnE,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAA4C,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACxG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC3D,sHAAsH;IACtH,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjD,iEAAiE;IACjE,UAAU,CAAC,EAAE,aAAa,CAAC;CAC5B;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EA4OrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IAC1D,0IAA0I;IAC1I,UAAU,CAAC,EAAE,aAAa,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CA4EjC"}