@intentius/chant 0.124.46 → 0.124.49

package/dist/workspace/check.schema.json

@@ -65,6 +65,13 @@
                   ],
                   "description": "The declared name, or null when the declaration can't be read."
                 },
+                "repo": {
+                  "type": [
+                    "string",
+                    "null"
+                  ],
+                  "description": "Added in contract 1 by #3168. The repository the document came from: the URL of the remote origin of the git repository that holds the workspace, with any user name or password removed, or null when there is no origin or the workspace is outside git. With name, root and the revision, it says which repository's workspace a document describes, so a reader that gathers several repositories' documents, such as an org workspace's repo members, tells them apart."
+                },
                 "root": {
                   "type": "string",
                   "description": "The workspace root relative to the git root, with / separators, \".\" for the git root itself. An absolute path outside a git repository."
@@ -341,7 +348,9 @@
             "ci-workflow-ungated-env",
             "ci-workflow-pipeline-missing",
             "ci-workflow-pipeline-differs",
-            "ci-workflow-publish-missing"
+            "ci-workflow-publish-missing",
+            "ci-branch-route-differs",
+            "gate-approval-unbased"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         }
@@ -463,7 +472,9 @@
             "ci-workflow-ungated-env",
             "ci-workflow-pipeline-missing",
             "ci-workflow-pipeline-differs",
-            "ci-workflow-publish-missing"
+            "ci-workflow-publish-missing",
+            "ci-branch-route-differs",
+            "gate-approval-unbased"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         },

package/dist/workspace/checks/ci-branch.d.ts

@@ -0,0 +1,44 @@
+/**
+ * WSP152 (#4325): a member's generated pull-request pipeline targets the
+ * branch `ci.branches` routes the member to.
+ *
+ * `chant build --pr-loop` refuses a branch that disagrees with the route
+ * (../member-pipeline.ts), but only when it writes the file. A route changed
+ * after the pipeline was generated, or a pipeline edited by hand, goes
+ * unnoticed until a push to the wrong branch applies nothing. This check
+ * reads the files each member's generated-file record lists and compares what
+ * they target with the route. It reads files and never runs them.
+ *
+ * A pipeline names its target in two places: the `--branch` its record and
+ * apply commands carry, and the `branches` of its `push` and `pull_request`
+ * triggers. A routed member's pipeline names the route in both. A member with
+ * no route may name a branch `ci.branches` does not list, and not one it
+ * lists, since that branch applies only the members its globs match.
+ */
+import type { WorkspaceCheck } from "../checks.js";
+export declare const WSP_CI_BRANCH_ROUTE = "WSP152";
+/** The finding code WSP152 reports. */
+export declare const CI_BRANCH_FINDING_CODES: readonly ["ci-branch-route-differs"];
+/** What a pipeline file says it targets. */
+export interface PipelineTargets {
+    /** The `--branch` of each record or apply command, by line; null for a command with none. */
+    jobs: {
+        line: number;
+        branch: string | null;
+    }[];
+    /** The branches its `push` and `pull_request` triggers list, by trigger. Absent for a trigger with no list. */
+    triggers: {
+        trigger: "push" | "pull_request";
+        branches: string[];
+    }[];
+}
+/** The branches a pipeline file targets, read from its text. */
+export declare function pipelineTargets(text: string): PipelineTargets;
+/**
+ * What differs between `targets` and the branch `own` the member is routed to
+ * (null when it has no route), as sentences. `listed` is every branch
+ * `ci.branches` names.
+ */
+export declare function routeDifferences(targets: PipelineTargets, own: string | null, listed: readonly string[], member: string): string[];
+export declare const CI_BRANCH_CHECKS: readonly WorkspaceCheck[];
+//# sourceMappingURL=ci-branch.d.ts.map

package/dist/workspace/checks/ci-branch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-branch.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/ci-branch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAQrE,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,uCAAuC;AACvC,eAAO,MAAM,uBAAuB,YAAI,yBAAyB,CAAU,CAAC;AAQ5E,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,6FAA6F;IAC7F,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAChD,+GAA+G;IAC/G,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;CACtE;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAuB7D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAelI;AAcD,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAmCrD,CAAC"}

package/dist/workspace/checks/ci-branch.js

@@ -0,0 +1,133 @@
+/**
+ * WSP152 (#4325): a member's generated pull-request pipeline targets the
+ * branch `ci.branches` routes the member to.
+ *
+ * `chant build --pr-loop` refuses a branch that disagrees with the route
+ * (../member-pipeline.ts), but only when it writes the file. A route changed
+ * after the pipeline was generated, or a pipeline edited by hand, goes
+ * unnoticed until a push to the wrong branch applies nothing. This check
+ * reads the files each member's generated-file record lists and compares what
+ * they target with the route. It reads files and never runs them.
+ *
+ * A pipeline names its target in two places: the `--branch` its record and
+ * apply commands carry, and the `branches` of its `push` and `pull_request`
+ * triggers. A routed member's pipeline names the route in both. A member with
+ * no route may name a branch `ci.branches` does not list, and not one it
+ * lists, since that branch applies only the members its globs match.
+ */
+import { routedBranch } from "../ci-branches.js";
+import { GENERATED_RECORD_FILE } from "../member-pipeline.js";
+import { joinPath } from "../tree.js";
+import { parseYAMLDocument } from "../../yaml.js";
+import { read } from "./security.js";
+export const WSP_CI_BRANCH_ROUTE = "WSP152";
+/** The finding code WSP152 reports. */
+export const CI_BRANCH_FINDING_CODES = ["ci-branch-route-differs"];
+const memberDir = (dir) => (dir === "." ? "" : dir);
+/** A record or apply command of the pull-request loop: `ci run record|apply`, or `components pr-record|pr-apply`. */
+const JOB = /\bci\s+run\s+(?:record|apply)\b|\bcomponents\s+pr-(?:record|apply)\b/;
+const BRANCH_FLAG = /--branch(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))/;
+/** The branches a pipeline file targets, read from its text. */
+export function pipelineTargets(text) {
+    const jobs = [];
+    text.split("\n").forEach((line, i) => {
+        if (!JOB.test(line))
+            return;
+        const m = BRANCH_FLAG.exec(line);
+        jobs.push({ line: i + 1, branch: m ? (m[1] ?? m[2] ?? m[3] ?? null) : null });
+    });
+    const triggers = [];
+    try {
+        const doc = parseYAMLDocument(text);
+        // YAML 1.1 reads a bare `on` key as true.
+        const on = doc && typeof doc === "object" ? (doc.on ?? doc.true) : undefined;
+        if (on && typeof on === "object" && !Array.isArray(on)) {
+            for (const trigger of ["push", "pull_request"]) {
+                const t = on[trigger];
+                const branches = t && typeof t === "object" ? t.branches : undefined;
+                if (Array.isArray(branches))
+                    triggers.push({ trigger, branches: branches.filter((b) => typeof b === "string") });
+            }
+        }
+    }
+    catch {
+        // A file that is not YAML has no triggers to compare; its commands still are.
+    }
+    return { jobs, triggers };
+}
+/**
+ * What differs between `targets` and the branch `own` the member is routed to
+ * (null when it has no route), as sentences. `listed` is every branch
+ * `ci.branches` names.
+ */
+export function routeDifferences(targets, own, listed, member) {
+    const out = [];
+    const said = (b) => (b === null ? "the default branch (it passes no --branch)" : b);
+    for (const j of targets.jobs) {
+        if (own !== null && j.branch !== own)
+            out.push(`line ${j.line} targets ${said(j.branch)}, and ci.branches routes member ${member} to ${own}`);
+        else if (own === null && j.branch !== null && listed.includes(j.branch))
+            out.push(`line ${j.line} targets ${j.branch}, which ci.branches reserves for the members its globs match, and member ${member} is not one`);
+    }
+    for (const t of targets.triggers) {
+        if (own !== null && !(t.branches.length === 1 && t.branches[0] === own))
+            out.push(`its ${t.trigger} trigger lists ${t.branches.join(", ") || "no branch"}, and ci.branches routes member ${member} to ${own}`);
+        else if (own === null) {
+            const reserved = t.branches.filter((b) => listed.includes(b));
+            if (reserved.length > 0)
+                out.push(`its ${t.trigger} trigger lists ${reserved.join(", ")}, which ci.branches reserves for the members its globs match, and member ${member} is not one`);
+        }
+    }
+    return out;
+}
+/** The files a member's generated-file record lists, which are pipelines the check can read. */
+function recordedFiles(ctx, member) {
+    const text = read(ctx.tree, joinPath(memberDir(member.dir), GENERATED_RECORD_FILE));
+    if (text === null)
+        return [];
+    try {
+        const parsed = JSON.parse(text);
+        return (parsed.files ?? []).flatMap((f) => (typeof f.path === "string" && /\.ya?ml$/.test(f.path) ? [f.path] : []));
+    }
+    catch {
+        return [];
+    }
+}
+export const CI_BRANCH_CHECKS = [
+    {
+        id: WSP_CI_BRANCH_ROUTE,
+        name: "ci-branch-route",
+        description: "A member's generated pull-request pipeline targets the branch ci.branches routes the member to, in its record and apply commands and its push and pull_request triggers.",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            const branches = ctx.declaration.ci?.branches;
+            if (!branches || Object.keys(branches).length === 0)
+                return [];
+            const listed = Object.keys(branches);
+            const out = [];
+            for (const member of ctx.declaration.members) {
+                const own = routedBranch(branches, member.name);
+                for (const path of recordedFiles(ctx, member)) {
+                    const text = read(ctx.tree, path);
+                    if (text === null)
+                        continue;
+                    for (const why of routeDifferences(pipelineTargets(text), own, listed, member.name)) {
+                        out.push({
+                            checkId: this.id,
+                            severity: this.severity,
+                            code: CI_BRANCH_FINDING_CODES[0],
+                            message: `WSP152: ${path}: ${why}; regenerate it with chant build --components --generate <forge> --pr-loop`,
+                            pointer: "/ci/branches",
+                            entity: member.name,
+                            treeFile: path,
+                            line: 1,
+                            column: 1,
+                        });
+                    }
+                }
+            }
+            return out;
+        },
+    },
+];

package/dist/workspace/checks/gate-approval.d.ts

@@ -0,0 +1,58 @@
+/**
+ * WSP153 (#4404): an Op gate's `approval` block that `identity.gates` does
+ * not back at base.
+ *
+ * A run reads a gate's `quorum`, `policy`, `mode` and `context` from
+ * `identity.gates.<gate>` in the declaration at base (#4324, #4404). A field
+ * the entry leaves out is read from the Op being run, which the change under
+ * review can edit, so a pull request can lower a quorum or switch a policy to
+ * `log-only` and be judged by its own edit. The Op-side fallback stays so an
+ * existing Op does not drop to one approval overnight. This check names each
+ * gate that still leans on it, and the fields it leans on.
+ *
+ * It reads each member's built Ops (`dist/ops/<name>/op.json`) and runs
+ * nothing. An Op that has not been built is not seen.
+ */
+import type { WorkspaceCheck } from "../checks.js";
+export declare const WSP_GATE_APPROVAL_UNBASED = "WSP153";
+/** The finding code WSP153 reports. */
+export declare const GATE_APPROVAL_FINDING_CODES: readonly ["gate-approval-unbased"];
+interface GateUse {
+    gate: string;
+    /** What the Op's `approval` block sets. Context is the keys it sets. */
+    quorum: boolean;
+    policy: boolean;
+    mode: boolean;
+    context: string[];
+}
+interface StepJson {
+    kind?: string;
+    gate?: string;
+    signalName?: string;
+    approval?: {
+        quorum?: unknown;
+        policy?: unknown;
+        mode?: unknown;
+        context?: Record<string, unknown>;
+    };
+    steps?: StepJson[];
+}
+/** The gates of a built Op that declare an `approval` block, with the fields it sets. A gate that asks a decision point has none. */
+export declare function gateUses(op: {
+    phases?: {
+        steps?: StepJson[];
+    }[];
+    onFailure?: {
+        steps?: StepJson[];
+    }[];
+}): GateUse[];
+/** The fields of `use` that `entry` (the gate's `identity.gates` entry, or undefined) does not set, as phrases. Empty when base backs every one. */
+export declare function unbasedFields(use: GateUse, entry: {
+    quorum: unknown;
+    policy: unknown;
+    mode: unknown;
+    context: Record<string, unknown> | null;
+} | undefined): string[];
+export declare const GATE_APPROVAL_CHECKS: readonly WorkspaceCheck[];
+export {};
+//# sourceMappingURL=gate-approval.d.ts.map

package/dist/workspace/checks/gate-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-approval.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/gate-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAIrE,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAElD,uCAAuC;AACvC,eAAO,MAAM,2BAA2B,YAAI,uBAAuB,CAAU,CAAC;AAM9E,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,UAAU,QAAQ;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACrG,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED,qIAAqI;AACrI,wBAAgB,QAAQ,CAAC,EAAE,EAAE;IAAE,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAA;KAAE,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAA;KAAE,EAAE,CAAA;CAAE,GAAG,OAAO,EAAE,CAiBnH;AAED,oJAAoJ;AACpJ,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAOrK;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EA4CzD,CAAC"}

package/dist/workspace/checks/gate-approval.js

@@ -0,0 +1,103 @@
+/**
+ * WSP153 (#4404): an Op gate's `approval` block that `identity.gates` does
+ * not back at base.
+ *
+ * A run reads a gate's `quorum`, `policy`, `mode` and `context` from
+ * `identity.gates.<gate>` in the declaration at base (#4324, #4404). A field
+ * the entry leaves out is read from the Op being run, which the change under
+ * review can edit, so a pull request can lower a quorum or switch a policy to
+ * `log-only` and be judged by its own edit. The Op-side fallback stays so an
+ * existing Op does not drop to one approval overnight. This check names each
+ * gate that still leans on it, and the fields it leans on.
+ *
+ * It reads each member's built Ops (`dist/ops/<name>/op.json`) and runs
+ * nothing. An Op that has not been built is not seen.
+ */
+import { joinPath } from "../tree.js";
+import { read } from "./security.js";
+export const WSP_GATE_APPROVAL_UNBASED = "WSP153";
+/** The finding code WSP153 reports. */
+export const GATE_APPROVAL_FINDING_CODES = ["gate-approval-unbased"];
+const memberDir = (dir) => (dir === "." ? "" : dir);
+/** The gates of a built Op that declare an `approval` block, with the fields it sets. A gate that asks a decision point has none. */
+export function gateUses(op) {
+    const out = [];
+    const visit = (step) => {
+        if (step.kind === "gate" && step.approval && typeof step.approval === "object") {
+            const a = step.approval;
+            out.push({
+                gate: step.gate ?? step.signalName ?? "",
+                quorum: a.quorum !== undefined,
+                policy: a.policy !== undefined,
+                mode: a.mode !== undefined,
+                context: a.context && typeof a.context === "object" ? Object.keys(a.context) : [],
+            });
+        }
+        if (step.kind === "effect")
+            (step.steps ?? []).forEach(visit);
+    };
+    for (const p of [...(op.phases ?? []), ...(op.onFailure ?? [])])
+        (p.steps ?? []).forEach(visit);
+    return out;
+}
+/** The fields of `use` that `entry` (the gate's `identity.gates` entry, or undefined) does not set, as phrases. Empty when base backs every one. */
+export function unbasedFields(use, entry) {
+    const out = [];
+    const has = (f) => entry?.[f] !== null && entry?.[f] !== undefined;
+    for (const f of ["quorum", "policy", "mode"])
+        if (use[f] && !has(f))
+            out.push(f);
+    const loose = use.context.filter((k) => !(k in (entry?.context ?? {})));
+    if (loose.length > 0)
+        out.push(`context (${loose.join(", ")})`);
+    return out;
+}
+export const GATE_APPROVAL_CHECKS = [
+    {
+        id: WSP_GATE_APPROVAL_UNBASED,
+        name: "gate-approval-unbased",
+        description: "An Op gate declares an approval block whose quorum, policy, mode or context identity.gates does not set at base, so the change being run can edit it.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const out = [];
+            const gates = ctx.declaration.identity?.gates ?? {};
+            for (const member of ctx.declaration.members) {
+                const opsDir = joinPath(memberDir(member.dir), "dist", "ops");
+                for (const entry of ctx.tree.list(opsDir) ?? []) {
+                    if (entry.type !== "dir")
+                        continue;
+                    const path = joinPath(opsDir, entry.name, "op.json");
+                    const text = read(ctx.tree, path);
+                    if (text === null)
+                        continue;
+                    let op;
+                    try {
+                        op = JSON.parse(text);
+                    }
+                    catch {
+                        continue;
+                    }
+                    for (const use of gateUses(op)) {
+                        const base = gates[use.gate];
+                        const missing = unbasedFields(use, base);
+                        if (missing.length === 0)
+                            continue;
+                        out.push({
+                            checkId: this.id,
+                            severity: this.severity,
+                            code: GATE_APPROVAL_FINDING_CODES[0],
+                            message: `WSP153: gate "${use.gate}" in Op ${op.name ?? entry.name} sets ${missing.join(", ")} in its approval block, and ${base ? `identity.gates.${use.gate}` : "identity.gates"} sets ${base ? "none of them" : `no entry for it`} at base, so a change can edit ${missing.length === 1 ? "it" : "them"} for its own run; declare ${base ? "them" : `identity.gates.${use.gate}`} in chant.workspace.json`,
+                            pointer: base ? base.pointer : "/identity",
+                            entity: use.gate,
+                            treeFile: path,
+                            line: 1,
+                            column: 1,
+                        });
+                    }
+                }
+            }
+            return out;
+        },
+    },
+];

package/dist/workspace/checks/links.d.ts

@@ -22,6 +22,9 @@
  * Links a kind's reader finds in a member's own files (#3932), such as a dbt
  * project's sources, are checked by WSP093 to WSP095 like declared ones, and
  * their findings name the member's file and line instead of the declaration.
+ * Links a member's lexicon reads from its declarations (#4397), such as the
+ * tables an otel `clickhouse` exporter writes, are checked the same way, with
+ * the reader named `lexicon <name>`.
  */
 import type { WorkspaceCheck, WorkspaceCheckContext } from "../checks.js";
 import { type LinkTableRow } from "../links.js";

package/dist/workspace/checks/links.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"links.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAuB,MAAM,WAAW,CAAC;AAI5F,OAAO,EAAwH,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAenK,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,GAAG,EAAE,qBAAqB,GAAG,YAAY,EAAE,CAOpE;AAoBD,eAAO,MAAM,WAAW,EAAE,SAAS,cAAc,EAmLhD,CAAC"}
+{"version":3,"file":"links.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAuB,MAAM,WAAW,CAAC;AAI5F,OAAO,EAAwH,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAuBnK,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,GAAG,EAAE,qBAAqB,GAAG,YAAY,EAAE,CAOpE;AAoBD,eAAO,MAAM,WAAW,EAAE,SAAS,cAAc,EAmLhD,CAAC"}

package/dist/workspace/checks/links.js

@@ -22,17 +22,28 @@
  * Links a kind's reader finds in a member's own files (#3932), such as a dbt
  * project's sources, are checked by WSP093 to WSP095 like declared ones, and
  * their findings name the member's file and line instead of the declaration.
+ * Links a member's lexicon reads from its declarations (#4397), such as the
+ * tables an otel `clickhouse` exporter writes, are checked the same way, with
+ * the reader named `lexicon <name>`.
  */
 import { sourceMemberHandles } from "../member-handles.js";
 import { readKindLinks } from "../kind-link-readers.js";
 import { DEFAULT_LINK_KIND, LINK_KINDS, TELEMETRY_LINK_KIND, linkTargetProblem, resolveLinks } from "../links.js";
 const tables = new WeakMap();
 const reads = new WeakMap();
-/** What each member's kind reader found (#3932), read once per check run. */
+/**
+ * What each member's kind reader found (#3932), and the links its lexicons
+ * read from its declarations (#4397), read once per check run.
+ */
 function kindReads(ctx) {
     let read = reads.get(ctx);
     if (!read) {
         read = readKindLinks(ctx.declaration, ctx.tree, ctx.kinds);
+        for (const [member, lexicon] of ctx.facts?.lexiconLinks ?? []) {
+            const prev = read.get(member);
+            // resolveLinks names one reader per member; the lexicon's links keep their file and line.
+            read.set(member, prev ? { ...prev, links: [...prev.links, ...lexicon.links], gaps: [...prev.gaps, ...lexicon.gaps] } : lexicon);
+        }
         reads.set(ctx, read);
     }
     return read;

package/dist/workspace/checks/org.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Org scope (#3168): members of kind `repo`, which name another repository's
+ * workspace by URL and pinned revision, and the org-level workspace that
+ * holds only such members.
+ *
+ * | Id | Check |
+ * |---|---|
+ * | WSP013 | an org workspace holds only repo members |
+ * | WSP014 | every repository the forge lists is declared (with `--forge-repos`) |
+ * | WSP015 | every declared repository is one the forge lists (with `--forge-repos`) |
+ * | WSP016 | no repo member's URL carries a password or token |
+ *
+ * The forge's list is input, never fetched here: a warden enumerates the
+ * org's repositories from its own API and hands the list to
+ * `chant workspace check --forge-repos <file>`, so the check stays offline.
+ */
+import type { WorkspaceCheck } from "../checks.js";
+/** One repository the forge lists. */
+export interface ForgeRepo {
+    url: string;
+    /** An archived repository need not be declared, and declaring one is not a drop. */
+    archived: boolean;
+}
+/** The forge's repository list for `--forge-repos` (#3168), as a warden writes it. */
+export interface ForgeRepoList {
+    /** The file it was read from, for messages. */
+    source: string;
+    repos: ForgeRepo[];
+}
+/**
+ * Parse a forge repository list. Three shapes are read: `{ "repos": [...] }`
+ * (a warden may add `forge` and `org` beside it), a bare array, and, for each
+ * repository, a URL string or `{ "url", "archived"? }`. Throws an Error that
+ * says what is wrong.
+ */
+export declare function parseForgeRepos(text: string, source: string): ForgeRepoList;
+/**
+ * A repository URL reduced to what names the repository, so the forge's
+ * https URL and a declaration's ssh or scp-style URL compare equal:
+ * `host/owner/repo`, lowercased, with no scheme, user, port, `.git` or
+ * trailing slash. A local path or file URL becomes its absolute path,
+ * resolved from `base`.
+ */
+export declare function repoKey(url: string, base?: string): string;
+/** Whether a URL carries a password or token, which a declaration must never hold. */
+export declare function urlCredential(url: string): boolean;
+export declare const ORG_CHECKS: readonly WorkspaceCheck[];
+//# sourceMappingURL=org.d.ts.map

package/dist/workspace/checks/org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/org.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAErE,sCAAsC;AACtC,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,CAiB3E;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,MAAsB,GAAG,MAAM,CAmBzE;AAMD,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CASlD;AAQD,eAAO,MAAM,UAAU,EAAE,SAAS,cAAc,EA0D/C,CAAC"}

package/dist/workspace/checks/org.js

@@ -0,0 +1,156 @@
+/**
+ * Org scope (#3168): members of kind `repo`, which name another repository's
+ * workspace by URL and pinned revision, and the org-level workspace that
+ * holds only such members.
+ *
+ * | Id | Check |
+ * |---|---|
+ * | WSP013 | an org workspace holds only repo members |
+ * | WSP014 | every repository the forge lists is declared (with `--forge-repos`) |
+ * | WSP015 | every declared repository is one the forge lists (with `--forge-repos`) |
+ * | WSP016 | no repo member's URL carries a password or token |
+ *
+ * The forge's list is input, never fetched here: a warden enumerates the
+ * org's repositories from its own API and hands the list to
+ * `chant workspace check --forge-repos <file>`, so the check stays offline.
+ */
+import { isAbsolute, resolve } from "node:path";
+import { REPO_KIND } from "../kinds.js";
+/**
+ * Parse a forge repository list. Three shapes are read: `{ "repos": [...] }`
+ * (a warden may add `forge` and `org` beside it), a bare array, and, for each
+ * repository, a URL string or `{ "url", "archived"? }`. Throws an Error that
+ * says what is wrong.
+ */
+export function parseForgeRepos(text, source) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (err) {
+        throw new Error(`${source} is not JSON (${err.message})`);
+    }
+    const list = Array.isArray(raw) ? raw : raw !== null && typeof raw === "object" && Array.isArray(raw.repos) ? raw.repos : undefined;
+    if (!list)
+        throw new Error(`${source} is neither an array of repositories nor an object with a repos array`);
+    const repos = list.map((r, i) => {
+        if (typeof r === "string" && r.length > 0)
+            return { url: r, archived: false };
+        if (r !== null && typeof r === "object" && typeof r.url === "string") {
+            return { url: r.url, archived: r.archived === true };
+        }
+        throw new Error(`${source}: repos[${i}] is neither a URL nor an object with a url`);
+    });
+    return { source, repos };
+}
+/**
+ * A repository URL reduced to what names the repository, so the forge's
+ * https URL and a declaration's ssh or scp-style URL compare equal:
+ * `host/owner/repo`, lowercased, with no scheme, user, port, `.git` or
+ * trailing slash. A local path or file URL becomes its absolute path,
+ * resolved from `base`.
+ */
+export function repoKey(url, base = process.cwd()) {
+    const trimmed = url.trim();
+    const scp = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/\/)(.+)$/.exec(trimmed);
+    let hostPath;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)) {
+        let u;
+        try {
+            u = new URL(trimmed);
+        }
+        catch {
+            return trimmed.toLowerCase();
+        }
+        if (u.protocol === "file:")
+            return stripGit(decodeURIComponent(u.pathname));
+        hostPath = `${u.hostname}${u.pathname}`;
+    }
+    else if (scp && !isAbsolute(trimmed) && !/^[a-z]:[\\/]/i.test(trimmed)) {
+        hostPath = `${scp[1]}/${scp[2]}`;
+    }
+    else {
+        return stripGit(resolve(base, trimmed));
+    }
+    return stripGit(hostPath.replace(/\/+/g, "/")).toLowerCase();
+}
+function stripGit(path) {
+    return path.replace(/\/+$/, "").replace(/\.git$/, "");
+}
+/** Whether a URL carries a password or token, which a declaration must never hold. */
+export function urlCredential(url) {
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(url))
+        return false;
+    try {
+        const u = new URL(url);
+        // ssh://git@host is a user name, not a secret; a password, or any user on http(s), is one.
+        return u.password !== "" || (u.username !== "" && /^https?:$/.test(u.protocol));
+    }
+    catch {
+        return false;
+    }
+}
+const repoMembers = (ctx) => ctx.declaration.members.filter((m) => m.kind === REPO_KIND && m.repo !== null);
+function finding(check, message, pointer, entity) {
+    return { checkId: check.id, severity: check.severity, message, pointer, ...(entity !== undefined ? { entity } : {}) };
+}
+export const ORG_CHECKS = [
+    {
+        id: "WSP013",
+        name: "org-member-local",
+        description: "An org workspace (scope org) holds only members of kind repo, each a reference to another repository's workspace (#3168).",
+        severity: "error",
+        configurable: false,
+        check(ctx) {
+            if (ctx.declaration.scope !== "org")
+                return [];
+            return ctx.declaration.entries
+                .filter((e) => e.kind !== REPO_KIND)
+                .map((e) => finding(this, `${e.type === "group" ? "example group" : "member"} ${e.name} is kind ${e.kind}, and an org workspace holds only repo members; move it into a repository's own workspace and reference that`, `${e.pointer}/kind`, e.name));
+        },
+    },
+    {
+        id: "WSP014",
+        name: "org-repo-undeclared",
+        description: "With --forge-repos, every repository the forge lists, archived ones aside, is named by a repo member (#3168).",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            const forge = ctx.facts?.forgeRepos;
+            if (!forge)
+                return [];
+            const declared = new Set(repoMembers(ctx).map((m) => repoKey(m.repo.url)));
+            return forge.repos
+                .filter((r) => !r.archived && !declared.has(repoKey(r.url)))
+                .map((r) => finding(this, `the forge lists ${r.url} (${forge.source}), and no repo member names it; add a member of kind repo with its url and pinned rev`, "/members"));
+        },
+    },
+    {
+        id: "WSP015",
+        name: "org-repo-dropped",
+        description: "With --forge-repos, every repository a repo member names is one the forge still lists (#3168).",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const forge = ctx.facts?.forgeRepos;
+            if (!forge)
+                return [];
+            const listed = new Set(forge.repos.map((r) => repoKey(r.url)));
+            return repoMembers(ctx)
+                .filter((m) => !listed.has(repoKey(m.repo.url)))
+                .map((m) => finding(this, `member ${m.name} names ${m.repo.url}, which the forge no longer lists (${forge.source}); remove the member or say why it stays`, `${m.pointer}/repo/url`, m.name));
+        },
+    },
+    {
+        id: "WSP016",
+        name: "repo-url-credential",
+        description: "No repo member's URL carries a password or token: the declaration is committed, and git's own credential helpers supply access (#3168).",
+        severity: "error",
+        configurable: false,
+        check(ctx) {
+            return repoMembers(ctx)
+                .filter((m) => urlCredential(m.repo.url))
+                .map((m) => finding(this, `member ${m.name}'s repo url carries a credential; name the repository without one and let git's credential helper supply access`, `${m.pointer}/repo/url`, m.name));
+        },
+    },
+];