@sverka/compiler 0.0.0 → 0.1.1

package/dist/index.mjs

@@ -0,0 +1,3206 @@
+import { stringify } from "yaml";
+import { expandPipelineCalls } from "@sverka/workflow";
+//#region src/plugin/errors.ts
+var PluginError = class extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.name = "PluginError";
+		this.code = code;
+		this.cause = cause;
+	}
+};
+//#endregion
+//#region src/plugin/capabilities.ts
+const SUPPORT_LEVELS = [
+	"native",
+	"lowered",
+	"emulated",
+	"connector",
+	"partial",
+	"unsupported"
+];
+const PRIORITY = {
+	native: 6,
+	lowered: 5,
+	connector: 4,
+	emulated: 3,
+	partial: 2,
+	unsupported: 1
+};
+/**
+* Validate that a value is a valid capability support level.
+*/
+function validateSupport(value) {
+	if (typeof value !== "string" || !SUPPORT_LEVELS.includes(value)) throw new PluginError(`invalid capability support level: ${String(value)}`, "INVALID_CAPABILITY");
+	return value;
+}
+/**
+* Validate a capability manifest object.
+*/
+function validateCapabilityManifest(manifest) {
+	if (typeof manifest !== "object" || manifest === null || Array.isArray(manifest)) throw new PluginError("capability manifest must be an object", "INVALID_CAPABILITY");
+	const obj = manifest;
+	for (const [key, value] of Object.entries(obj)) validateManifestEntry(key, value);
+}
+function validateManifestEntry(key, value) {
+	if (typeof value === "string") {
+		validateSupport(value);
+		return;
+	}
+	if (typeof value === "object" && value !== null) {
+		validateManifestDetail(key, value);
+		return;
+	}
+	throw new PluginError(`capability '${key}' must be a support string or CapabilityDetail object`, "INVALID_CAPABILITY");
+}
+function validateManifestDetail(key, detail) {
+	validateSupport(detail.support);
+	if (detail.via !== void 0 && typeof detail.via !== "string") throw new PluginError(`capability '${key}' has invalid via: must be a string`, "INVALID_CAPABILITY");
+	if (detail.notes !== void 0 && typeof detail.notes !== "string") throw new PluginError(`capability '${key}' has invalid notes: must be a string`, "INVALID_CAPABILITY");
+}
+/**
+* Detect capabilities used by a single step.
+*/
+function detectStepCapabilities(step, caps) {
+	detectRuntimeCapabilities(step, caps);
+	detectRunnerCapabilities(step, caps);
+	detectIdentityCapabilities(step, caps);
+	detectRuleCapabilities(step, caps);
+	detectServiceCapabilities(step, caps);
+	detectEnvironmentCapabilities(step, caps);
+	detectCacheCapabilities(step, caps);
+	detectConcurrencyCapabilities(step, caps);
+	detectSpecialStepCapabilities(step, caps);
+	const outputFlags = {
+		scalar: false,
+		artifact: false
+	};
+	for (const op of step.operations) detectOperationCapabilities(op, caps, outputFlags);
+	detectOutputTypeCapabilities(step.outputs, outputFlags);
+	if (step.dependencies.length > 0) caps.add("graph.dependencies");
+	if (step.condition !== void 0) caps.add("graph.conditions");
+	if (outputFlags.scalar) caps.add("output.scalar");
+	if (outputFlags.artifact) caps.add("output.artifact");
+	detectMatrixCapabilities(step.matrix, caps);
+	detectScriptCapabilities(step, caps);
+}
+/**
+* Detect capabilities for special step kinds: call, component, child pipeline,
+* downstream, and delay.
+*/
+function detectSpecialStepCapabilities(step, caps) {
+	if (step.call !== void 0) caps.add("reusable.pipeline");
+	if (step.component !== void 0) caps.add("reusable.component");
+	if (step.childPipeline !== void 0) caps.add("reusable.childPipeline");
+	if (step.downstream !== void 0) caps.add("reusable.downstream");
+	if (step.delay !== void 0) caps.add("scheduling.delay");
+}
+function detectMatrixCapabilities(matrix, caps) {
+	if (!matrix) return;
+	caps.add("graph.matrix");
+	if (matrix.include && matrix.include.length > 0) caps.add("matrix.include");
+	if (matrix.exclude && matrix.exclude.length > 0) caps.add("matrix.exclude");
+	if (matrix.failFast !== void 0) caps.add("matrix.failFast");
+	if (matrix.maxParallel !== void 0) caps.add("matrix.maxParallel");
+}
+function detectScriptCapabilities(step, caps) {
+	if (step.beforeScript && step.beforeScript.length > 0) caps.add("step.beforeScript");
+	if (step.afterScript && step.afterScript.length > 0) caps.add("step.afterScript");
+	if (step.continueOnError !== void 0) caps.add("step.continueOnError");
+	if (step.retry !== void 0) caps.add("policy.retry");
+	if (step.timeout !== void 0) caps.add("policy.timeout");
+}
+function detectRuntimeCapabilities(step, caps) {
+	const mode = step.runtime?.mode ?? "host";
+	caps.add(`runtime.${mode}`);
+	if (step.runtime?.workingDir) caps.add("execution.workdir");
+	if (step.runtime?.shell) caps.add("execution.shell");
+	if (step.runtime?.env && Object.keys(step.runtime.env).length > 0) caps.add("environment.variables");
+	if (step.runtime?.secrets && step.runtime.secrets.length > 0) caps.add("secrets.runtime");
+	if (step.interruptible === true) caps.add("concurrency.interruptible");
+}
+function detectRunnerCapabilities(step, caps) {
+	if (step.runner === void 0) return;
+	caps.add("runner.selection");
+	if (step.runner.group !== void 0) caps.add("runner.group");
+}
+function detectIdentityCapabilities(step, caps) {
+	if (step.identity === void 0) return;
+	caps.add("secrets.oidc");
+	const audiences = /* @__PURE__ */ new Set();
+	for (const token of Object.values(step.identity.tokens ?? {})) audiences.add(token.audience);
+	if (audiences.size > 1) caps.add("secrets.oidc.multiAudience");
+}
+function detectRuleCapabilities(step, caps) {
+	if (step.rules === void 0 || step.rules.length === 0) return;
+	caps.add("workflow.rules");
+	for (const rule of step.rules) {
+		if (rule.changes !== void 0) caps.add("workflow.rules.changes");
+		if (rule.exists !== void 0) caps.add("workflow.rules.exists");
+	}
+}
+function detectServiceCapabilities(step, caps) {
+	if (step.services === void 0 || step.services.length === 0) return;
+	caps.add("environment.services");
+	for (const service of step.services) if (service.ports !== void 0 && service.ports.length > 0) caps.add("environment.services.ports");
+}
+function detectEnvironmentCapabilities(step, caps) {
+	if (step.environment === void 0) return;
+	caps.add("deployment.environment");
+	if (step.environment.action !== void 0) caps.add("deployment.environment.action");
+	if (step.environment.tier !== void 0) caps.add("deployment.environment.tier");
+}
+function detectCacheCapabilities(step, caps) {
+	if (step.cache === void 0) return;
+	caps.add("cache");
+	if (step.cache.policy !== void 0) caps.add("cache.policy");
+	if (step.cache.restoreKeys !== void 0 && step.cache.restoreKeys.length > 0) caps.add("cache.fallbackKeys");
+}
+function detectConcurrencyCapabilities(step, caps) {
+	if (step.concurrency === void 0) return;
+	caps.add("concurrency.group");
+	if (step.concurrency.cancelInProgress !== void 0) caps.add("concurrency.cancelInProgress");
+}
+function detectOperationCapabilities(op, caps, outputFlags) {
+	switch (op.kind) {
+		case "shell":
+			caps.add("operation.shell");
+			break;
+		case "exportOutput":
+			outputFlags.scalar = true;
+			break;
+		case "exportArtifact":
+			detectExportArtifactCapabilities(op, caps, outputFlags);
+			break;
+		case "importArtifact":
+			caps.add("operation.import");
+			break;
+		case "report": detectReportCapabilities(op, caps);
+	}
+}
+function detectExportArtifactCapabilities(op, caps, outputFlags) {
+	outputFlags.artifact = true;
+	if (op.retention !== void 0) caps.add("artifact.retention");
+	if (op.access !== void 0) caps.add("artifact.access");
+}
+function detectReportCapabilities(op, caps) {
+	caps.add("artifact.report");
+	if (op.spec?.type !== void 0) caps.add(`artifact.report.${op.spec.type}`);
+}
+function detectOutputTypeCapabilities(outputs, outputFlags) {
+	for (const output of outputs) if (output.type === "artifact") outputFlags.artifact = true;
+	else outputFlags.scalar = true;
+}
+/**
+* Detect capabilities used by a single pipeline.
+*/
+function detectPipelineCapabilities(pipeline, caps) {
+	detectTriggerCapabilities(pipeline.entries, caps);
+	if (pipeline.permissions !== void 0) caps.add("environment.permissions");
+	detectInputCapabilities(pipeline.inputs, caps);
+	if (pipeline.defaults !== void 0) detectDefaultCapabilities(pipeline.defaults, caps);
+	if (pipeline.concurrency !== void 0) {
+		caps.add("concurrency.group");
+		if (pipeline.concurrency.cancelInProgress !== void 0) caps.add("concurrency.cancelInProgress");
+	}
+	if (pipeline.rules !== void 0 && pipeline.rules.length > 0) caps.add("workflow.rules");
+	for (const step of pipeline.steps) detectStepCapabilities(step, caps);
+}
+function detectTriggerCapabilities(entries, caps) {
+	for (const entry of entries) caps.add(`trigger.${entry.trigger.kind}`);
+}
+function detectInputCapabilities(inputs, caps) {
+	if (inputs === void 0 || Object.keys(inputs).length === 0) return;
+	caps.add("workflow.inputs");
+	for (const input of Object.values(inputs)) {
+		if (input.secret) caps.add("secrets.pipeline-input");
+		if (input.type === "choice") caps.add("workflow.inputs.choice");
+		if (input.type === "array") caps.add("workflow.inputs.array");
+		if (input.pattern !== void 0) caps.add("workflow.inputs.pattern");
+	}
+}
+function detectDefaultCapabilities(defaults, caps) {
+	caps.add("workflow.defaults");
+	const defaultCaps = [
+		[defaults.shell, "workflow.defaults.shell"],
+		[defaults.workdir, "workflow.defaults.workdir"],
+		[defaults.env, "workflow.defaults.env"],
+		[defaults.beforeScript, "workflow.defaults.beforeScript"],
+		[defaults.afterScript, "workflow.defaults.afterScript"],
+		[defaults.timeout, "workflow.defaults.timeout"],
+		[defaults.retry, "workflow.defaults.retry"],
+		[defaults.interruptible, "workflow.defaults.interruptible"]
+	];
+	for (const [value, cap] of defaultCaps) if (value !== void 0) caps.add(cap);
+}
+/**
+* Detect capabilities used by a Definition Graph.
+* Returns a set of capability identifiers (e.g., "trigger.push").
+*/
+function detectCapabilities(graph) {
+	const caps = /* @__PURE__ */ new Set();
+	for (const pipeline of graph.project.pipelines) detectPipelineCapabilities(pipeline, caps);
+	return caps;
+}
+/**
+* Get the support level from a manifest entry.
+*/
+function getSupportLevel(entry) {
+	if (typeof entry === "string") return validateSupport(entry);
+	if (entry === null || typeof entry !== "object") throw new PluginError("capability entry must be a string or CapabilityDetail", "INVALID_CAPABILITY");
+	return validateSupport(entry.support);
+}
+/**
+* Find the best support level for a capability across all manifests.
+* "native" > "lowered" > "connector" > "emulated" > "partial" > "unsupported".
+*/
+function findBestSupport(capability, manifests) {
+	let best = "unsupported";
+	for (const manifest of manifests) {
+		const entry = manifest[capability];
+		if (entry === void 0) continue;
+		const level = getSupportLevel(entry);
+		if (PRIORITY[level] > PRIORITY[best]) best = level;
+	}
+	return best;
+}
+/**
+* Map a support level to a diagnostic severity.
+*/
+function severityFor(support) {
+	switch (support) {
+		case "unsupported": return "error";
+		case "emulated":
+		case "partial": return "warning";
+		case "connector": return "info";
+		default: return "info";
+	}
+}
+/**
+* Analyze a Definition Graph against capability manifests.
+* Returns diagnostics for capabilities that are not natively or lowered
+* supported.
+*/
+function analyzeCapabilities(graph, manifests) {
+	for (const manifest of manifests) validateCapabilityManifest(manifest);
+	const used = detectCapabilities(graph);
+	const diagnostics = [];
+	for (const capability of used) {
+		const support = findBestSupport(capability, manifests);
+		if (support === "native" || support === "lowered") continue;
+		diagnostics.push({
+			capability,
+			support,
+			severity: severityFor(support),
+			message: `capability '${capability}' is ${support}`
+		});
+	}
+	return diagnostics;
+}
+//#endregion
+//#region src/plugin/factory.ts
+/**
+* Define a Sverka plugin. The factory function receives optional options
+* and meta, and returns a SverkaPlugin object.
+*
+* @example
+* const plugin = defineSverkaPlugin(() => ({
+*   name: "github",
+*   apiVersion: "sverka.dev/v1",
+*   capabilities: { "trigger.push": "native" },
+* }));
+*/
+function defineSverkaPlugin(factory, options) {
+	const plugin = factory(options, { version: "1.0.0" });
+	validatePlugin(plugin);
+	return snapshotPlugin(plugin);
+}
+/**
+* Store a validated, defensive copy of a plugin so callers cannot mutate
+* the registry's internal state after registration.
+*/
+function snapshotPlugin(plugin) {
+	const copy = {
+		name: plugin.name,
+		apiVersion: plugin.apiVersion
+	};
+	if (plugin.capabilities) copy.capabilities = snapshotCapabilityManifest(plugin.capabilities);
+	if (plugin.model) copy.model = [...plugin.model];
+	if (plugin.transforms) copy.transforms = [...plugin.transforms];
+	if (plugin.validators) copy.validators = [...plugin.validators];
+	if (plugin.targets) copy.targets = [...plugin.targets];
+	if (plugin.importers) copy.importers = [...plugin.importers];
+	if (plugin.engines) copy.engines = [...plugin.engines];
+	if (plugin.connectors) copy.connectors = [...plugin.connectors];
+	if (plugin.extensions) copy.extensions = [...plugin.extensions];
+	if (plugin.tools) copy.tools = plugin.tools;
+	return copy;
+}
+function snapshotCapabilityManifest(manifest) {
+	const copy = {};
+	for (const [capability, value] of Object.entries(manifest)) copy[capability] = typeof value === "string" ? value : { ...value };
+	return copy;
+}
+/**
+* Validate a plugin has required fields and a valid capabilities manifest.
+*/
+function validatePlugin(plugin) {
+	if (!plugin || typeof plugin !== "object") throw new PluginError("plugin must be an object", "INVALID_PLUGIN");
+	if (typeof plugin.name !== "string" || plugin.name.length === 0) throw new PluginError("plugin must have a non-empty name", "INVALID_PLUGIN");
+	if (typeof plugin.apiVersion !== "string" || plugin.apiVersion.length === 0) throw new PluginError("plugin must have an apiVersion", "INVALID_PLUGIN");
+	if (plugin.capabilities !== void 0) validateCapabilityManifest(plugin.capabilities);
+}
+/**
+* Create a plugin registry.
+*/
+function createPluginRegistry() {
+	const plugins = [];
+	const names = /* @__PURE__ */ new Set();
+	return {
+		register(plugin) {
+			validatePlugin(plugin);
+			if (names.has(plugin.name)) throw new PluginError(`plugin '${plugin.name}' is already registered`, "DUPLICATE_PLUGIN");
+			names.add(plugin.name);
+			plugins.push(snapshotPlugin(plugin));
+		},
+		get plugins() {
+			return plugins.map((p) => snapshotPlugin(p));
+		},
+		getCapabilities() {
+			return plugins.filter((p) => p.capabilities !== void 0).map((p) => snapshotCapabilityManifest(p.capabilities));
+		}
+	};
+}
+//#endregion
+//#region src/github/capabilities.ts
+const githubCapabilities = {
+	"trigger.push": "native",
+	"trigger.changeRequest": "native",
+	"trigger.manual": "native",
+	"runtime.host": "native",
+	"runtime.container": "native",
+	"operation.shell": "native",
+	"operation.import": "lowered",
+	"output.scalar": "lowered",
+	"output.artifact": "native",
+	"graph.dependencies": "native",
+	"graph.conditions": "native",
+	"graph.matrix": "native",
+	"matrix.include": "native",
+	"matrix.exclude": "native",
+	"matrix.failFast": "native",
+	"matrix.maxParallel": "native",
+	"trigger.schedule": "native",
+	"step.beforeScript": "native",
+	"step.afterScript": "native",
+	"step.continueOnError": "native",
+	"policy.retry": "emulated",
+	"policy.compensation": "emulated",
+	"execution.workdir": "native",
+	"execution.shell": "native",
+	"environment.variables": "native",
+	"secrets.runtime": "native",
+	"secrets.pipeline-input": "native",
+	"concurrency.interruptible": "partial",
+	"environment.permissions": "native",
+	"runner.selection": "native",
+	"runner.group": "native",
+	"secrets.oidc": "native",
+	"secrets.oidc.multiAudience": "unsupported",
+	"workflow.rules": "partial",
+	"workflow.rules.changes": "unsupported",
+	"workflow.rules.exists": "unsupported",
+	"workflow.defaults": "native",
+	"workflow.defaults.shell": "native",
+	"workflow.defaults.workdir": "native",
+	"workflow.defaults.env": "unsupported",
+	"workflow.defaults.beforeScript": "lowered",
+	"workflow.defaults.afterScript": "lowered",
+	"workflow.defaults.timeout": "unsupported",
+	"workflow.defaults.retry": "unsupported",
+	"workflow.defaults.interruptible": "unsupported",
+	"artifact.report": "emulated",
+	"artifact.report.junit": "emulated",
+	"artifact.report.coverage": "emulated",
+	"artifact.report.dotenv": "emulated",
+	"artifact.report.sast": "emulated",
+	"artifact.report.dast": "emulated",
+	"artifact.report.dependencyScanning": "emulated",
+	"artifact.report.containerScanning": "emulated",
+	"artifact.report.licenseScanning": "emulated",
+	"artifact.report.performance": "emulated",
+	"artifact.report.metrics": "emulated",
+	"artifact.report.terraform": "emulated",
+	"artifact.report.quality": "emulated",
+	"artifact.report.sarif": "emulated",
+	"workflow.inputs": "native",
+	"workflow.inputs.choice": "native",
+	"workflow.inputs.array": "unsupported",
+	"workflow.inputs.pattern": "unsupported",
+	"environment.services": "native",
+	"environment.services.ports": "native",
+	"deployment.environment": "native",
+	"deployment.environment.action": "unsupported",
+	"deployment.environment.tier": "unsupported",
+	"artifact.retention": "native",
+	"artifact.access": "unsupported",
+	"cache": "lowered",
+	"cache.policy": "lowered",
+	"cache.fallbackKeys": "lowered",
+	"concurrency.group": "native",
+	"concurrency.cancelInProgress": "native",
+	"reusable.pipeline": "native",
+	"reusable.pipeline.inputs": "native",
+	"reusable.pipeline.outputs": "native",
+	"reusable.component": "native",
+	"reusable.component.versioning": "native",
+	"reusable.childPipeline": "unsupported",
+	"reusable.downstream": "emulated",
+	"deployment.release": "emulated",
+	"deployment.pages": "native",
+	"import.github": "native",
+	"import.include": "emulated",
+	"scheduling.delay": "emulated",
+	"execution.background": "emulated",
+	"runtime.network": "emulated",
+	"step.permissions": "native",
+	"agent.step": "emulated",
+	"run.query": "emulated"
+};
+//#endregion
+//#region src/github/errors.ts
+var GithubTargetError = class extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.name = "GithubTargetError";
+		this.code = code;
+		this.cause = cause;
+	}
+};
+//#endregion
+//#region src/stdout-capture.ts
+/**
+* Quote a literal string using single quotes for a POSIX shell.
+*/
+function shellQuoteSingle(value) {
+	return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/**
+* Wrap a shell command line so its stdout is also written to the declared
+* artifact file(s), matching the runtime's exportStdout semantics. The
+* capture must work under POSIX sh (no pipefail), so the command's stdout is
+* redirected to the file and replayed with cat; the original exit code is
+* re-raised so a failing check still fails the job.
+*
+* Background commands (`cmd &`) detach before stdout can be captured; the
+* runtime records an empty artifact for them, so empty files are created.
+*/
+function wrapStdoutCaptureLine(command, names) {
+	const quoted = names.map(shellQuoteSingle);
+	if (command.endsWith(" &")) return [command, `touch ${quoted.join(" ")}`].join("\n");
+	const [first, ...rest] = quoted;
+	const teeRest = rest.length > 0 ? ` | tee ${rest.join(" ")}` : "";
+	return [
+		"sverka_rc=0",
+		`{ ${command}`,
+		`} > ${first} || sverka_rc=$?`,
+		`cat ${first}${teeRest}`,
+		`if [ "$sverka_rc" -gt 0 ]; then exit "$sverka_rc"; fi`
+	].join("\n");
+}
+//#endregion
+//#region src/github/lower.ts
+/**
+* Lower a Definition Graph to one or more GithubTargetGraphs.
+* - Each pipeline with entries → a root workflow with its triggers.
+* - Each pipeline referenced by a call step → a reusable workflow with
+*   `on: workflow_call` (+ its own triggers if it also has entries).
+* - Call steps become `uses:` jobs.
+* Single-pipeline graphs (no calls) are unchanged (backward compat).
+*/
+function lowerGithub(graph) {
+	if (graph.project.pipelines.length === 0) throw new GithubTargetError("graph has no pipelines", "INVALID_GRAPH");
+	if (graph.project.pipelines.length === 1) {
+		const pipeline = graph.project.pipelines[0];
+		if (!pipeline.steps.some((s) => s.call || s.component || s.childPipeline || s.downstream)) return lowerSinglePipeline(pipeline);
+	}
+	return lowerMultiPipeline(graph);
+}
+/**
+* Lower a single pipeline (no calls) — original v0 behavior.
+*/
+function lowerSinglePipeline(pipeline) {
+	const reachableSteps = filterReachableSteps$1(pipeline);
+	const jobIdMap = buildJobIdMap$1(reachableSteps);
+	return assemblePipelineTarget(pipeline, lowerTriggers$1(pipeline.entries, pipeline.inputs), lowerStepsWithCalls(reachableSteps, jobIdMap, pipeline.id));
+}
+/**
+* Assemble a GithubTargetGraph from a pipeline, its triggers, and jobs.
+* Shared by lowerSinglePipeline and lowerMultiPipeline.
+*/
+function assemblePipelineTarget(pipeline, triggers, jobs) {
+	return {
+		name: pipeline.id,
+		on: triggers,
+		jobs,
+		env: collectEnv(pipeline),
+		...pipeline.permissions !== void 0 ? { permissions: pipeline.permissions } : {},
+		...pipeline.defaults !== void 0 ? { defaults: lowerDefaults(pipeline.defaults) } : {},
+		...pipeline.concurrency !== void 0 ? { concurrency: pipeline.concurrency } : {}
+	};
+}
+/**
+* Lower pipeline defaults to GitHub defaults.run (shell + working-directory only).
+*/
+function lowerDefaults(defaults) {
+	return { run: {
+		...defaults.shell !== void 0 ? { shell: defaults.shell } : {},
+		...defaults.workdir !== void 0 ? { "working-directory": defaults.workdir } : {}
+	} };
+}
+/**
+* Lower a multi-pipeline graph. Each pipeline that has entries OR is referenced
+* by a call step gets its own workflow file.
+*/
+function lowerMultiPipeline(graph) {
+	const pipelines = graph.project.pipelines;
+	const calledPipelineIds = collectCalledPipelineIds(pipelines);
+	const result = [];
+	for (const pipeline of pipelines) {
+		const target = lowerPipelineInGraph(pipeline, calledPipelineIds.has(pipeline.id));
+		if (target !== void 0) result.push(target);
+	}
+	return result;
+}
+/**
+* Collect the set of pipeline IDs that are referenced by at least one call step.
+*/
+function collectCalledPipelineIds(pipelines) {
+	const called = /* @__PURE__ */ new Set();
+	for (const p of pipelines) for (const step of p.steps) if (step.call) called.add(step.call.callee);
+	return called;
+}
+/**
+* Lower a single pipeline within a multi-pipeline graph.
+* Returns undefined if the pipeline is neither a root nor a callee.
+*/
+function lowerPipelineInGraph(pipeline, isCalled) {
+	const hasEntries = pipeline.entries.length > 0;
+	if (!hasEntries && !isCalled) return void 0;
+	const reachableSteps = hasEntries ? filterReachableSteps$1(pipeline) : pipeline.steps;
+	const jobIdMap = buildJobIdMap$1(reachableSteps);
+	let triggers = lowerTriggers$1(pipeline.entries, pipeline.inputs);
+	if (isCalled) triggers = addWorkflowCall(triggers, pipeline.inputs);
+	const jobs = lowerStepsWithCalls(reachableSteps, jobIdMap, pipeline.id);
+	return assemblePipelineTarget(pipeline, triggers, jobs);
+}
+/**
+* Add workflow_call trigger with inputs to a GithubTriggers object.
+*/
+function addWorkflowCall(triggers, inputs) {
+	const inputEntries = Object.entries(inputs);
+	if (inputEntries.length === 0) return {
+		...triggers,
+		workflow_call: null
+	};
+	const workflowInputs = {};
+	for (const [name, input] of inputEntries) {
+		let type = "string";
+		if (input.type === "number") type = "number";
+		else if (input.type === "boolean") type = "boolean";
+		const ghInput = {
+			type,
+			required: input.required ?? false
+		};
+		if (input.default !== void 0) ghInput.default = input.default;
+		if (input.description !== void 0) ghInput.description = input.description;
+		workflowInputs[name] = ghInput;
+	}
+	return {
+		...triggers,
+		workflow_call: { inputs: workflowInputs }
+	};
+}
+/**
+* Return the steps reachable from any entry root by following dependencies.
+*/
+function filterReachableSteps$1(pipeline) {
+	if (pipeline.steps.length === 0) {
+		const invalidRoot = pipeline.entries.flatMap((e) => e.roots).find((root) => root.length > 0);
+		if (invalidRoot) throw new GithubTargetError(`entry references unknown root step '${invalidRoot}'`, "INVALID_GRAPH");
+		return [];
+	}
+	const byId = new Map(pipeline.steps.map((step) => [step.id, step]));
+	const reachable = /* @__PURE__ */ new Set();
+	const queue = [];
+	for (const entry of pipeline.entries) enqueueRoots(entry.roots, byId, reachable, queue);
+	while (queue.length > 0) {
+		const id = queue.shift();
+		const step = byId.get(id);
+		if (!step) continue;
+		enqueueDependencies(step, byId, reachable, queue);
+	}
+	return pipeline.steps.filter((step) => reachable.has(step.id));
+}
+function enqueueRoots(roots, byId, reachable, queue) {
+	for (const root of roots) {
+		if (!byId.has(root)) throw new GithubTargetError(`entry references unknown root step '${root}'`, "INVALID_GRAPH");
+		enqueueIfNew(root, reachable, queue);
+	}
+}
+function enqueueDependencies(step, byId, reachable, queue) {
+	for (const dep of step.dependencies) {
+		const producer = dep.producer;
+		if (!byId.has(producer)) throw new GithubTargetError(`step depends on unknown producer '${producer}'`, "INVALID_GRAPH");
+		enqueueIfNew(producer, reachable, queue);
+	}
+}
+function enqueueIfNew(id, reachable, queue) {
+	if (!reachable.has(id)) {
+		reachable.add(id);
+		queue.push(id);
+	}
+}
+/**
+* Build a mapping from full step IDs (e.g., "ci/lint") to GitHub-safe
+* job IDs (e.g., "lint"). If there are collisions, append a suffix.
+*/
+function buildJobIdMap$1(steps) {
+	const map = /* @__PURE__ */ new Map();
+	const used = /* @__PURE__ */ new Set();
+	for (const step of steps) {
+		const shortId = step.id.includes("/") ? step.id.split("/").pop() : step.id;
+		let jobId = shortId;
+		let suffix = 1;
+		while (used.has(jobId)) {
+			jobId = `${shortId}-${suffix}`;
+			suffix++;
+		}
+		used.add(jobId);
+		map.set(step.id, jobId);
+	}
+	return map;
+}
+/**
+* Map Sverka triggers to GitHub triggers.
+* Multiple entries of the same kind have their filters merged.
+*/
+function lowerTriggers$1(entries, inputs) {
+	const pushBranches = /* @__PURE__ */ new Set();
+	const pushTags = /* @__PURE__ */ new Set();
+	const pushPaths = /* @__PURE__ */ new Set();
+	let pushAll = false;
+	const prBranches = /* @__PURE__ */ new Set();
+	const prPaths = /* @__PURE__ */ new Set();
+	let prAll = false;
+	let hasManual = false;
+	const scheduleEntries = [];
+	for (const entry of entries) {
+		const t = entry.trigger;
+		switch (t.kind) {
+			case "push":
+				collectFilters(t, pushBranches, pushTags, pushPaths, () => pushAll = true);
+				break;
+			case "changeRequest":
+				collectFilters(t, prBranches, void 0, prPaths, () => prAll = true);
+				break;
+			case "manual":
+				hasManual = true;
+				break;
+			case "schedule":
+				scheduleEntries.push({
+					cron: t.cron,
+					...t.timezone ? { timezone: t.timezone } : {}
+				});
+				break;
+			default: throw new GithubTargetError(`unsupported trigger kind: ${JSON.stringify(t.kind)}`, "UNSUPPORTED_TRIGGER");
+		}
+	}
+	return assembleTriggers({
+		pushAll,
+		pushBranches,
+		pushTags,
+		pushPaths,
+		prAll,
+		prBranches,
+		prPaths,
+		hasManual,
+		scheduleEntries,
+		inputs
+	});
+}
+function collectFilters(t, branches, tags, paths, markAll) {
+	if (t.kind === "schedule") {
+		markAll();
+		return;
+	}
+	const filter = t.filter;
+	const hasBranches = filter?.branches && filter.branches.length > 0;
+	const hasTags = filter?.tags && filter.tags.length > 0;
+	const hasPaths = filter?.paths && filter.paths.length > 0;
+	if (hasTags && tags === void 0) throw new GithubTargetError("tag filters are not supported on change-request triggers", "UNSUPPORTED_TRIGGER");
+	if (hasBranches) addAll(branches, filter.branches);
+	if (hasTags && tags) addAll(tags, filter.tags);
+	if (hasPaths) addAll(paths, filter.paths);
+	if (!hasBranches && !hasTags && !hasPaths) markAll();
+}
+/** Add all items from a readonly array to a Set. */
+function addAll(set, items) {
+	for (const item of items) set.add(item);
+}
+function assembleTriggers(f) {
+	const triggers = {};
+	const push = assemblePushTrigger(f);
+	if (push) triggers.push = push;
+	const pr = assemblePullRequestTrigger(f);
+	if (pr) triggers.pull_request = pr;
+	if (f.hasManual) {
+		const loweredInputs = lowerInputs(f.inputs);
+		triggers.workflow_dispatch = loweredInputs !== void 0 ? { inputs: loweredInputs } : null;
+	}
+	if (f.scheduleEntries.length > 0) triggers.schedule = f.scheduleEntries;
+	return triggers;
+}
+function assemblePushTrigger(f) {
+	if (f.pushAll) return {};
+	if (f.pushBranches.size === 0 && f.pushTags.size === 0 && f.pushPaths.size === 0) return null;
+	const push = {};
+	if (f.pushBranches.size > 0) push.branches = [...f.pushBranches];
+	if (f.pushTags.size > 0) push.tags = [...f.pushTags];
+	if (f.pushPaths.size > 0) push.paths = [...f.pushPaths];
+	return push;
+}
+function assemblePullRequestTrigger(f) {
+	if (f.prAll) return {};
+	if (f.prBranches.size === 0 && f.prPaths.size === 0) return null;
+	const pr = {};
+	if (f.prBranches.size > 0) pr.branches = [...f.prBranches];
+	if (f.prPaths.size > 0) pr.paths = [...f.prPaths];
+	return pr;
+}
+/**
+* Lower pipeline inputs to GitHub workflow_dispatch inputs.
+* Returns undefined if no inputs are present.
+* Maps Sverka types to GitHub types: choice→choice, array→unsupported (dropped),
+* others map directly. pattern is dropped (unsupported on GitHub).
+*/
+function lowerInputs(inputs) {
+	if (Object.keys(inputs).length === 0) return void 0;
+	const result = {};
+	for (const [name, input] of Object.entries(inputs)) result[name] = {
+		type: input.type === "array" ? "string" : input.type,
+		...input.description !== void 0 ? { description: input.description } : {},
+		...input.required !== void 0 ? { required: input.required } : {},
+		...input.default !== void 0 && typeof input.default !== "object" ? { default: input.default } : {},
+		...input.options !== void 0 ? { options: input.options } : {}
+	};
+	return result;
+}
+/**
+* Lower reachable steps to GitHub jobs. One job per step.
+* Call steps become `uses:` jobs (reusable workflow calls).
+* Component steps become `uses:` jobs (composite action calls).
+*/
+function lowerStepsWithCalls(steps, jobIdMap, pipelineId) {
+	return steps.map((step) => {
+		if (step.call) return lowerCallStep(step, jobIdMap, pipelineId);
+		if (step.component) return lowerComponentStep(step, jobIdMap);
+		if (step.childPipeline) return lowerChildPipelineStep$1(step, jobIdMap);
+		if (step.downstream) return lowerDownstreamStep$1(step, jobIdMap);
+		return lowerStep$1(step, jobIdMap);
+	});
+}
+/**
+* Lower a Reference value to a GitHub expression string.
+* Returns the expression if `value` is a Reference, otherwise `undefined`
+* (meaning the value is a literal the caller should handle itself).
+* Context references are mapped through GITHUB_CONTEXT_MAP so that Sverka
+* namespaces (e.g. `git.sha`) become valid GitHub expressions (e.g.
+* `github.sha`).
+*
+* Secret references are sink-specific:
+* - In `with:` inputs (`forWithInput = true`): `${{ secrets.FIELD }}`.
+*   GitHub Actions does not expand `$FIELD` in `with:` values — it treats it
+*   as a literal string. The `secrets` context is the correct syntax here.
+* - In `run:` commands (`forWithInput = false`, default): `$FIELD`.
+*   The shell expands the env var, and this avoids exposing the secret value
+*   in workflow logs.
+*/
+function lowerReferenceExpr(value, jobIdMap, forWithInput = false) {
+	if (typeof value === "object" && value !== null && !Array.isArray(value) && "kind" in value) {
+		const ref = value;
+		if (ref.kind === "step") return `\${{ needs.${jobIdMap.get(ref.step) ?? ref.step}.outputs.${ref.output} }}`;
+		if (ref.kind === "context") return translateContextRef(ref.namespace, ref.field, false, forWithInput);
+	}
+}
+/**
+* Lower a call step to a GitHub reusable workflow call job.
+*/
+function lowerCallStep(step, jobIdMap, pipelineId) {
+	const jobId = jobIdMap.get(step.id) ?? step.id;
+	const needs = lowerDependencies$1(step.dependencies, jobIdMap);
+	const call = step.call;
+	const callee = call.callee;
+	const withMap = {};
+	for (const [name, value] of Object.entries(call.inputs)) withMap[name] = lowerReferenceExpr(value, jobIdMap, true) ?? value;
+	return {
+		id: jobId,
+		name: jobId,
+		runsOn: "ubuntu-latest",
+		needs,
+		steps: [],
+		uses: `./.github/workflows/${callee}.yml`,
+		...Object.keys(withMap).length > 0 ? { with: withMap } : {},
+		secrets: "inherit"
+	};
+}
+/**
+* Lower a component step to a GitHub composite action call job.
+* F-32: component → uses: org/component@version with `with:` inputs.
+*/
+function lowerComponentStep(step, jobIdMap) {
+	const jobId = jobIdMap.get(step.id) ?? step.id;
+	const needs = lowerDependencies$1(step.dependencies, jobIdMap);
+	const comp = step.component;
+	const withMap = {};
+	for (const [name, value] of Object.entries(comp.inputs)) withMap[name] = lowerReferenceExpr(value, jobIdMap, true) ?? value;
+	if (!comp.name.startsWith("./")) return {
+		id: jobId,
+		name: jobId,
+		runsOn: resolveRunsOn(step),
+		needs,
+		steps: [{
+			name: "Checkout",
+			uses: "actions/checkout@v4"
+		}, {
+			name: `Component ${comp.name}`,
+			uses: `${comp.name}@${comp.version}`,
+			...Object.keys(withMap).length > 0 ? { with: withMap } : {}
+		}]
+	};
+	return {
+		id: jobId,
+		name: jobId,
+		runsOn: "ubuntu-latest",
+		needs,
+		steps: [],
+		uses: `${comp.name}@${comp.version}`,
+		...Object.keys(withMap).length > 0 ? { with: withMap } : {}
+	};
+}
+/**
+* Lower a child pipeline step to a GitHub job.
+* F-33: GitHub does not natively support dynamic child pipelines.
+* We emit a no-op job with a warning comment. The native engine handles
+* the actual dynamic generation.
+*/
+function lowerChildPipelineStep$1(step, jobIdMap) {
+	const jobId = jobIdMap.get(step.id) ?? step.id;
+	const needs = lowerDependencies$1(step.dependencies, jobIdMap);
+	return {
+		id: jobId,
+		name: jobId,
+		runsOn: resolveRunsOn(step),
+		needs,
+		steps: [{
+			name: "Dynamic child pipeline (not natively supported on GitHub)",
+			run: `echo "WARNING: Dynamic child pipelines are not supported by GitHub Actions. Generator: ${step.childPipeline.generator}, artifact: ${step.childPipeline.artifact}"`
+		}]
+	};
+}
+/**
+* Lower a downstream step to a GitHub job.
+* F-34: GitHub emulates downstream project triggers via repository_dispatch API.
+*/
+function lowerDownstreamStep$1(step, jobIdMap) {
+	const jobId = jobIdMap.get(step.id) ?? step.id;
+	const needs = lowerDependencies$1(step.dependencies, jobIdMap);
+	const ds = step.downstream;
+	const payloadObj = {};
+	if (ds.inputs) for (const [name, value] of Object.entries(ds.inputs)) payloadObj[name] = lowerReferenceExpr(value, jobIdMap) ?? String(value);
+	const env = { CLIENT_PAYLOAD: JSON.stringify(payloadObj) };
+	if (ds.branch) env.DOWNSTREAM_BRANCH = ds.branch;
+	const refPart = ds.branch ? ` -f ref="$DOWNSTREAM_BRANCH"` : "";
+	return {
+		id: jobId,
+		name: jobId,
+		runsOn: resolveRunsOn(step),
+		needs,
+		steps: [{
+			name: `Trigger downstream: ${ds.project}`,
+			env,
+			run: `gh api repos/${ds.project}/dispatches -f event_type=sverka-trigger -f client_payload="$CLIENT_PAYLOAD"${refPart}`
+		}]
+	};
+}
+/**
+* Lower a single Step to a GitHub job.
+*/
+function lowerStep$1(step, jobIdMap) {
+	const needs = lowerDependencies$1(step.dependencies, jobIdMap);
+	const rawSteps = lowerOperations$1(step, jobIdMap);
+	if (step.continueOnError !== void 0 && typeof step.continueOnError !== "boolean") throw new GithubTargetError("GitHub does not support exit-code continueOnError; use a boolean value", "UNSUPPORTED_FEATURE");
+	const steps = step.continueOnError !== void 0 ? rawSteps.map((s) => s.run !== void 0 ? {
+		...s,
+		continueOnError: typeof step.continueOnError === "boolean" ? step.continueOnError : true
+	} : s) : [...rawSteps];
+	const jobId = jobIdMap.get(step.id) ?? step.id;
+	applyDelay(steps, step);
+	const runtime = step.runtime;
+	const mode = runtime.mode ?? "host";
+	return assembleGithubJob({
+		jobId,
+		steps,
+		needs,
+		step,
+		runsOn: resolveRunsOn(step),
+		container: resolveContainer(step, mode),
+		jobEnv: collectJobEnv(runtime),
+		jobIdMap
+	});
+}
+/**
+* Insert a sleep step to emulate delay (GitHub has no native delayed execution).
+*/
+function applyDelay(steps, step) {
+	if (!step.delay) return;
+	const sleepSeconds = parseDurationToSeconds(step.delay);
+	if (steps.length > 0) steps.splice(1, 0, {
+		name: `Delay (${step.delay})`,
+		run: `sleep ${sleepSeconds}`
+	});
+}
+/**
+* Collect scalar output names for the job's `outputs:` mapping.
+* GitHub Actions requires outputs to be declared at the job level for
+* `needs.<job>.outputs.<name>` expressions to work.
+*/
+function collectJobOutputs(step) {
+	const jobOutputs = {};
+	for (const op of step.operations) if (op.kind === "exportOutput") jobOutputs[op.name] = `\${{ steps.output.outputs.${op.name} }}`;
+	return jobOutputs;
+}
+/**
+* Build the job's `steps` array, inserting a cache step after checkout when
+* caching is enabled. Checkout is always the first step.
+*/
+function resolveJobSteps(steps, step) {
+	if (step.cache === void 0) return steps;
+	return [
+		steps[0],
+		lowerCacheStep(step.cache),
+		...steps.slice(1)
+	];
+}
+/**
+* Resolve the job-level `if` expression.
+*
+* Rules take precedence over condition when both are present, matching
+* GitHub's behavior where workflow rules override step conditions. Multiple
+* rules are OR'd: GitHub's job-level `if` is a single expression, so we
+* combine all rule `if` conditions with `||`.
+*/
+function resolveJobIf(step, jobIdMap) {
+	if (step.rules !== void 0 && step.rules.length > 0) return { if: lowerRulesIf(step.rules) };
+	if (step.condition !== void 0) return { if: lowerCondition(step.condition, jobIdMap) };
+	return {};
+}
+/**
+* Resolve job-level permissions and environment for Pages deploys and
+* identity-token requests.
+*
+* GitHub Pages jobs need pages:write and id-token:write permissions.
+* Safe-outputs (Spec 25): steps with permissions.write get a scoped
+* permissions block from write kinds. Steps without writes get
+* permissions: {} (read-only). deployPages/identity take precedence.
+*/
+const WRITE_KIND_TO_GHA_PERMISSION = {
+	"pull-request": "pull-requests: write",
+	"comment": "issues: write",
+	"deploy": "deployments: write",
+	"push": "contents: write",
+	"id-token": "id-token: write",
+	"pages": "pages: write"
+};
+function resolveJobPermissions(step) {
+	if (step.operations.some((op) => op.kind === "deployPages")) return {
+		permissions: {
+			"pages": "write",
+			"id-token": "write"
+		},
+		environment: { name: "github-pages" }
+	};
+	if (step.identity !== void 0) return { permissions: { "id-token": "write" } };
+	if (step.permissions !== void 0) {
+		const writes = step.permissions.write;
+		if (writes && writes.length > 0) {
+			const perms = {};
+			for (const decl of writes) {
+				const mapped = WRITE_KIND_TO_GHA_PERMISSION[decl.kind];
+				if (mapped !== void 0) {
+					const [scope, level] = mapped.split(": ");
+					perms[scope] = level;
+				} else perms["contents"] = "read";
+			}
+			return { permissions: perms };
+		}
+		return { permissions: {} };
+	}
+	return {};
+}
+/**
+* Assemble the final GithubJob object from its constituent parts.
+*/
+function assembleGithubJob(parts) {
+	const { jobId, steps, needs, step, runsOn, container, jobEnv, jobIdMap } = parts;
+	const jobOutputs = collectJobOutputs(step);
+	const jobIf = resolveJobIf(step, jobIdMap);
+	const jobPermissions = resolveJobPermissions(step);
+	return {
+		id: jobId,
+		name: jobId,
+		runsOn,
+		needs,
+		...Object.keys(jobOutputs).length > 0 ? { outputs: jobOutputs } : {},
+		steps: resolveJobSteps(steps, step),
+		...step.timeout !== void 0 ? { timeoutMinutes: Math.ceil(step.timeout / 6e4) } : {},
+		...Object.keys(jobEnv).length > 0 ? { env: jobEnv } : {},
+		...container ? { container } : {},
+		...step.matrix !== void 0 ? { strategy: lowerStrategy(step.matrix) } : {},
+		...jobIf,
+		...jobPermissions,
+		...resolveJobServices(step),
+		...resolveJobEnvironment(step),
+		...step.concurrency !== void 0 ? { concurrency: step.concurrency } : {}
+	};
+}
+/** Resolve job-level services field from step services. */
+function resolveJobServices(step) {
+	if (step.services === void 0 || step.services.length === 0) return {};
+	return { services: lowerServices(step.services) };
+}
+/** Resolve job-level environment field from step environment spec. */
+function resolveJobEnvironment(step) {
+	if (step.environment === void 0) return {};
+	return { environment: {
+		name: step.environment.name,
+		...step.environment.url !== void 0 ? { url: step.environment.url } : {}
+	} };
+}
+/**
+* Lower a cache spec to a GitHub cache step.
+* pull-push → actions/cache@v4
+* pull → actions/cache/restore@v4
+* push → actions/cache/save@v4
+*/
+function lowerCacheStep(cache) {
+	const policy = cache.policy ?? "pull-push";
+	let action = "actions/cache@v4";
+	if (policy === "pull") action = "actions/cache/restore@v4";
+	else if (policy === "push") action = "actions/cache/save@v4";
+	const withMap = {
+		path: cache.paths.length === 1 ? cache.paths[0] : cache.paths.join("\n"),
+		key: cache.key
+	};
+	if (cache.restoreKeys !== void 0 && cache.restoreKeys.length > 0) withMap["restore-keys"] = cache.restoreKeys.length === 1 ? cache.restoreKeys[0] : cache.restoreKeys.join("\n");
+	return {
+		name: "Restore cache",
+		uses: action,
+		with: withMap
+	};
+}
+/**
+* Lower service containers to GitHub services map (keyed by name).
+*/
+function lowerServices(services) {
+	const result = {};
+	for (const svc of services) {
+		const options = [];
+		if (svc.entrypoint !== void 0) options.push(`--entrypoint=${svc.entrypoint[0] ?? ""}`);
+		const service = {
+			image: svc.image,
+			...svc.env !== void 0 ? { env: { ...svc.env } } : {},
+			...svc.ports !== void 0 ? { ports: svc.ports.map((p) => `${p}:${p}`) } : {},
+			...options.length > 0 ? { options: options.join(" ") } : {}
+		};
+		result[svc.name] = service;
+	}
+	return result;
+}
+function resolveRunsOn(step) {
+	if (step.runner === void 0) return "ubuntu-latest";
+	const { labels, group } = step.runner;
+	if (group !== void 0) return {
+		group,
+		labels
+	};
+	if (labels.length === 1) return labels[0];
+	return labels;
+}
+/**
+* Parse a duration string (e.g. "5m", "30s", "1h") to seconds.
+* F-48: used for GitHub sleep emulation.
+*/
+function parseDurationToSeconds(duration) {
+	const match = /^(\d+)\s*(s|m|h|seconds?|minutes?|hours?)?$/i.exec(duration);
+	if (!match) throw new GithubTargetError(`invalid delay duration '${duration}'`, "LOWER_FAILED");
+	const value = Number.parseInt(match[1], 10);
+	const unit = (match[2] ?? "s").toLowerCase();
+	if (unit.startsWith("h")) return value * 3600;
+	if (unit.startsWith("m")) return value * 60;
+	return value;
+}
+function resolveContainer(step, mode) {
+	if (mode === "container" && !step.runtime.image) throw new GithubTargetError(`step '${step.id}' uses container mode without an image`, "LOWER_FAILED");
+	return mode === "container" ? step.runtime.image : void 0;
+}
+function collectJobEnv(runtime) {
+	const jobEnv = {};
+	if (runtime.env) Object.assign(jobEnv, runtime.env);
+	if (runtime.secrets) for (const secret of runtime.secrets) jobEnv[secret] = `\${{ secrets.${secret} }}`;
+	return jobEnv;
+}
+/**
+* Map dependencies to job needs.
+* All dependency kinds create needs (GitHub jobs can't share values without artifacts).
+*/
+function lowerDependencies$1(deps, jobIdMap) {
+	const needs = /* @__PURE__ */ new Set();
+	for (const dep of deps) {
+		const jobId = jobIdMap.get(dep.producer);
+		if (!jobId) throw new GithubTargetError(`step depends on unknown producer '${dep.producer}'`, "INVALID_GRAPH");
+		needs.add(jobId);
+	}
+	return [...needs];
+}
+/**
+* Map operations to GitHub steps in original order.
+* Consecutive shell/exportOutput operations are combined into one run step.
+*/
+function lowerOperations$1(step, jobIdMap) {
+	const steps = [];
+	const shortStepId = step.id.includes("/") ? step.id.split("/").pop() : step.id;
+	steps.push({
+		name: "Checkout",
+		uses: "actions/checkout@v4"
+	});
+	if (step.runtime.network && step.runtime.network.allowed.length > 0) steps.push({
+		name: "Sverka network allowlist",
+		run: `echo "# sverka:network-allowlist: ${step.runtime.network.allowed.join(",")}"`
+	});
+	if (step.beforeScript) for (const cmd of step.beforeScript) steps.push({ run: cmd });
+	let runLines = [];
+	let runHasOutput = false;
+	let stdoutTargetIndex;
+	let stdoutNames = [];
+	let stdoutUploadNames = [];
+	function sealStdoutCapture() {
+		if (stdoutTargetIndex === void 0 || stdoutNames.length === 0) return;
+		runLines[stdoutTargetIndex] = wrapStdoutCaptureLine(runLines[stdoutTargetIndex], stdoutNames);
+		stdoutUploadNames.push(...stdoutNames);
+		stdoutNames = [];
+	}
+	function flushRun() {
+		sealStdoutCapture();
+		if (runLines.length === 0) return;
+		const translated = translateCommand(runLines.join("\n"), step.inputs, jobIdMap);
+		steps.push({
+			...runHasOutput ? { id: "output" } : {},
+			run: translated,
+			...step.runtime.workingDir ? { workingDirectory: step.runtime.workingDir } : {},
+			...step.runtime.shell ? { shell: step.runtime.shell } : {}
+		});
+		for (const name of stdoutUploadNames) steps.push({
+			name: `Upload ${name}`,
+			if: "always()",
+			uses: "actions/upload-artifact@v4",
+			with: {
+				name: artifactName(shortStepId, name),
+				path: step.runtime.workingDir ? `${step.runtime.workingDir}/${name}` : name
+			}
+		});
+		runLines = [];
+		runHasOutput = false;
+		stdoutTargetIndex = void 0;
+		stdoutUploadNames = [];
+	}
+	for (const op of step.operations) {
+		if (op.kind === "exportOutput") runHasOutput = true;
+		switch (op.kind) {
+			case "shell":
+				sealStdoutCapture();
+				runLines.push(op.background ? `${op.command} &` : op.command);
+				stdoutTargetIndex = runLines.length - 1;
+				break;
+			case "exportStdout":
+				if (stdoutTargetIndex === void 0) throw new GithubTargetError(`step '${step.id}' declares stdout artifact '${op.name}' but no shell output was captured`, "LOWER_FAILED");
+				if (step.runtime.shell !== void 0 && !isPosixShell(step.runtime.shell)) throw new GithubTargetError(`step '${step.id}' declares stdout artifact '${op.name}' but shell '${step.runtime.shell}' is not POSIX-compatible`, "LOWER_FAILED");
+				stdoutNames.push(op.name);
+				break;
+			default: lowerOperation$1(op, shortStepId, steps, runLines, flushRun);
+		}
+	}
+	flushRun();
+	if (step.afterScript) for (const cmd of step.afterScript) steps.push({
+		run: cmd,
+		if: "always()"
+	});
+	return steps;
+}
+/** Shells whose run scripts understand POSIX syntax (brace groups, `||`, `[ ]`). */
+const POSIX_SHELLS = /* @__PURE__ */ new Set([
+	"sh",
+	"bash",
+	"dash",
+	"ash",
+	"zsh",
+	"ksh"
+]);
+function isPosixShell(shell) {
+	const space = shell.indexOf(" ");
+	return POSIX_SHELLS.has(space === -1 ? shell : shell.slice(0, space));
+}
+function lowerOperation$1(op, shortStepId, steps, runLines, flushRun) {
+	switch (op.kind) {
+		case "exportOutput":
+			runLines.push(`echo "${op.name}=\${${op.name}}" >> "$GITHUB_OUTPUT"`);
+			break;
+		case "exportArtifact":
+			flushRun();
+			steps.push({
+				name: `Upload ${op.name}`,
+				uses: "actions/upload-artifact@v4",
+				with: {
+					name: artifactName(shortStepId, op.name),
+					path: op.path,
+					...op.retention !== void 0 ? { "retention-days": parseRetentionDays(op.retention) } : {}
+				}
+			});
+			break;
+		case "importArtifact":
+			lowerImportArtifact(op, steps, flushRun);
+			break;
+		case "diagnostic":
+			lowerDiagnostic(op, steps, flushRun);
+			break;
+		case "report":
+			flushRun();
+			steps.push(lowerReport$1(op.spec));
+			break;
+		case "release":
+			lowerRelease(op, steps, flushRun);
+			break;
+		case "deployPages":
+			lowerDeployPages$1(op, steps, flushRun);
+			break;
+		default: throw new GithubTargetError(`unsupported operation kind: ${JSON.stringify(op.kind)}`, "LOWER_FAILED");
+	}
+}
+/**
+* Lower a release operation to a GitHub release step.
+* F-39: uses softprops/action-gh-release@v2.
+*/
+function lowerRelease(op, steps, flushRun) {
+	flushRun();
+	const withMap = { tag_name: op.tag };
+	if (op.name) withMap.name = op.name;
+	if (op.description) withMap.body = op.description;
+	if (op.assets && op.assets.length > 0) withMap.files = op.assets.join("\n");
+	if (op.draft !== void 0) withMap.draft = op.draft;
+	if (op.prerelease !== void 0) withMap.prerelease = op.prerelease;
+	steps.push({
+		name: `Release ${op.tag}`,
+		uses: "softprops/action-gh-release@v2",
+		with: withMap
+	});
+}
+/**
+* Lower a deployPages operation to GitHub Pages deployment steps.
+* F-40: uses actions/upload-pages-artifact + actions/deploy-pages.
+*/
+function lowerDeployPages$1(op, steps, flushRun) {
+	flushRun();
+	steps.push({
+		name: "Upload Pages artifact",
+		uses: "actions/upload-pages-artifact@v3",
+		with: { path: op.path }
+	}, {
+		name: "Deploy to GitHub Pages",
+		uses: "actions/deploy-pages@v4",
+		id: "deployment"
+	});
+}
+function lowerImportArtifact(op, steps, flushRun) {
+	flushRun();
+	const fromShort = op.from.includes("/") ? op.from.split("/").pop() : op.from;
+	steps.push({
+		name: `Download ${op.output}`,
+		uses: "actions/download-artifact@v4",
+		with: {
+			name: artifactName(fromShort, op.output),
+			path: op.output
+		}
+	});
+}
+function lowerDiagnostic(op, steps, flushRun) {
+	flushRun();
+	const severityFlag = severityFlagFor(op.severity);
+	const escapedMessage = op.message.replace(/%/g, "%25").replace(/\r\n/g, "%0D%0A").replace(/\n/g, "%0A").replace(/\r/g, "%0D");
+	steps.push({
+		env: { SVERKA_DIAGNOSTIC_MESSAGE: escapedMessage },
+		run: String.raw`printf '%s\n' "::${severityFlag}::$SVERKA_DIAGNOSTIC_MESSAGE"`
+	});
+}
+/**
+* Generate a deterministic artifact name from step ID and output name.
+*/
+function artifactName(stepId, outputName) {
+	return `${stepId}-${outputName}`;
+}
+/**
+* Parse a duration string (e.g., "7d", "1h", "30m", "never") into days.
+* Returns undefined for "never" (no retention limit).
+*/
+function parseRetentionDays(retention) {
+	if (retention === "never") return void 0;
+	const match = /^(\d+)([dhm])$/.exec(retention);
+	if (match === null) return void 0;
+	const value = Number.parseInt(match[1], 10);
+	const unit = match[2];
+	if (unit === "d") return value;
+	if (unit === "h") return Math.ceil(value / 24);
+	if (unit === "m") return Math.ceil(value / 1440);
+}
+/**
+* Lower a report spec to a GitHub action step.
+* Maps report types to known GitHub actions.
+*/
+function lowerReport$1(spec) {
+	switch (spec.type) {
+		case "junit": return {
+			name: `Report ${spec.type}`,
+			uses: "dorny/test-reporter@v1",
+			with: {
+				name: "Tests",
+				path: spec.path,
+				reporter: "java-junit"
+			}
+		};
+		case "sarif":
+		case "sast": return {
+			name: `Upload ${spec.type}`,
+			uses: "github/codeql-action/upload-sarif@v3",
+			with: { sarif_file: spec.path }
+		};
+		default: return {
+			name: `Upload ${spec.type} report`,
+			uses: "actions/upload-artifact@v4",
+			with: {
+				name: `${spec.type}-report`,
+				path: spec.path
+			}
+		};
+	}
+}
+/**
+* Collect pipeline-level env vars from inputs.
+* Secret inputs are referenced via `${{ secrets.<name> }}` instead of
+* literal defaults.
+*/
+function collectEnv(pipeline) {
+	const env = {};
+	for (const [name, input] of Object.entries(pipeline.inputs)) if (input.secret) env[name] = `\${{ secrets.${name} }}`;
+	else if (input.default !== void 0) env[name] = String(input.default);
+	return env;
+}
+function severityFlagFor(severity) {
+	if (severity === "error") return "error";
+	if (severity === "warn") return "warning";
+	return "notice";
+}
+/**
+* Lower a MatrixSpec to a GitHub strategy object.
+* dimensions → matrix variables, include → include:, exclude → exclude:.
+* failFast → fail-fast, maxParallel → max-parallel.
+*/
+function lowerStrategy(spec) {
+	const matrix = {};
+	for (const [key, values] of Object.entries(spec.dimensions)) matrix[key] = [...values];
+	if (spec.include && spec.include.length > 0) matrix.include = spec.include.map((entry) => ({ ...entry }));
+	if (spec.exclude && spec.exclude.length > 0) matrix.exclude = spec.exclude.map((entry) => ({ ...entry }));
+	return {
+		matrix,
+		...spec.failFast !== void 0 ? { failFast: spec.failFast } : {},
+		...spec.maxParallel !== void 0 ? (() => {
+			if (!Number.isInteger(spec.maxParallel) || spec.maxParallel <= 0) throw new GithubTargetError(`maxParallel must be a positive integer, got ${spec.maxParallel}`, "INVALID_MATRIX");
+			return { maxParallel: spec.maxParallel };
+		})() : {}
+	};
+}
+const GITHUB_CONTEXT_MAP = {
+	"git.sha": "github.sha",
+	"git.branch": "github.ref_name",
+	"git.tag": "github.ref_name",
+	"change.id": "github.event.pull_request.number",
+	"change.source": "github.event_name",
+	"change.target": "github.base_ref",
+	"change.draft": "github.event.pull_request.draft",
+	"event.type": "github.event_name",
+	"run.id": "github.run_id",
+	"run.attempt": "github.run_attempt"
+};
+/**
+* Translate a context ref (namespace.field) to GitHub expression syntax.
+* Secrets are sink-specific:
+* - In `with:` inputs (`forWithInput = true`): `${{ secrets.FIELD }}`.
+*   GitHub Actions does not expand `$FIELD` in `with:` values — it treats it
+*   as a literal string. The `secrets` context is the correct syntax here.
+* - In `run:` commands (`forWithInput = false`): `$FIELD` (env var, avoids
+*   exposing secret values in run logs).
+* In conditions, secrets are not supported by GitHub's if: context and are
+* emitted as env var references instead.
+*/
+function translateContextRef(namespace, field, inCondition = false, forWithInput = false) {
+	const key = `${namespace}.${field}`;
+	const mapped = GITHUB_CONTEXT_MAP[key];
+	if (mapped) return `\${{ ${mapped} }}`;
+	if (namespace === "env") return `\${{ env.${field} }}`;
+	if (namespace === "matrix") return `\${{ matrix.${field} }}`;
+	if (namespace === "inputs") return `\${{ env.${field} }}`;
+	if (namespace === "secrets") {
+		if (inCondition) return `\${{ env.${field} }}`;
+		if (forWithInput) return `\${{ secrets.${field} }}`;
+		return `$${field}`;
+	}
+	throw new GithubTargetError(`unsupported context namespace '${namespace}' in GitHub lowering`, "LOWER_FAILED");
+}
+/**
+* Translate a step ref to GitHub needs.<jobId>.outputs.<output> syntax.
+* Each Sverka step is lowered to a separate GitHub job, so cross-step
+* references must use the 'needs' context, not 'steps'.
+*/
+function translateStepRef(ref, jobIdMap) {
+	return `\${{ needs.${jobIdMap.get(ref.step) ?? ref.step}.outputs.${ref.output} }}`;
+}
+/**
+* Build a lookup map from placeholder key ("namespace.field" or "step.output")
+* to the Reference from the step's inputs array.
+*/
+function buildInputLookup(inputs) {
+	const map = /* @__PURE__ */ new Map();
+	for (const ref of inputs) if (ref.kind === "context") map.set(`${ref.namespace}.${ref.field}`, ref);
+	else if (ref.kind === "step") map.set(`${ref.step}.${ref.output}`, ref);
+	return map;
+}
+/**
+* Translate ${...} placeholders in a command string to GitHub expression syntax.
+* Placeholders matching a known input ref are translated; others are left as-is.
+*/
+function translateCommand(command, inputs, jobIdMap) {
+	const lookup = buildInputLookup(inputs);
+	return command.replace(/\$\{([^{}]+)\}/g, (_, key) => {
+		const ref = lookup.get(key);
+		if (ref === void 0) return `\${${key}}`;
+		if (ref.kind === "context") return translateContextRef(ref.namespace, ref.field, false);
+		return translateStepRef(ref, jobIdMap);
+	});
+}
+/**
+* Lower step rules to a single GitHub `if:` expression.
+* Multiple rules are OR'd with `||`. Rules with `when: never` produce `false`.
+* Rules without an `if` but with `when: always` produce `true`.
+*/
+function lowerRulesIf(rules) {
+	const parts = [];
+	for (const rule of rules) if (rule.when === "never") parts.push("${{ false }}");
+	else if (rule.if !== void 0) parts.push(rule.if);
+	else if (rule.when === "always") parts.push("${{ true }}");
+	if (parts.length === 0) return "${{ true }}";
+	if (parts.length === 1) return parts[0];
+	return parts.map((p) => p.replace(/^\$\{\{|\}\}$/g, "").trim()).join(" || ");
+}
+/**
+* Lower a step condition to a GitHub if: expression.
+*/
+function lowerCondition(condition, jobIdMap) {
+	if (condition.kind === "status") {
+		if (condition.status === "always") return "${{ always() }}";
+		if (condition.status === "never") return "${{ false }}";
+		if (condition.status === "failure") return "${{ failure() }}";
+		return "${{ success() }}";
+	}
+	if (condition.kind === "context") return `\${{ ${stripBraces(translateContextRef(condition.namespace, condition.field, true))} }}`;
+	if (condition.kind === "step") return translateStepRef(condition, jobIdMap);
+	const lookup = buildInputLookup(condition.refs);
+	return `\${{ ${condition.template.replace(/\$\{([^{}]+)\}/g, (_, key) => {
+		const ref = lookup.get(key);
+		if (ref === void 0) return `\${${key}}`;
+		if (ref.kind === "context") return stripBraces(translateContextRef(ref.namespace, ref.field, true));
+		return stripBraces(translateStepRef(ref, jobIdMap));
+	})} }}`;
+}
+/** Strip the `${{ ... }}` wrapper, returning the inner expression. */
+function stripBraces(s) {
+	if (!s.startsWith("${{") || !s.endsWith("}}")) return s;
+	return s.slice(3, -2).trim();
+}
+//#endregion
+//#region src/github/emit.ts
+/**
+* Emit one or more GithubTargetGraphs as YAML artifacts.
+* Produces one .github/workflows/<name>.yml file per target graph.
+*/
+function emitGithub(targetGraph, options) {
+	return (Array.isArray(targetGraph) ? targetGraph : [targetGraph]).map((g) => ({
+		path: `.github/workflows/${sanitizeWorkflowName(g.name)}.yml`,
+		content: stringifyTargetGraph$1(g, options)
+	}));
+}
+/**
+* Sanitize a graph name for use as a workflow filename.
+* GitHub workflow filenames must be valid path segments; replace
+* characters that could break path resolution.
+*/
+function sanitizeWorkflowName(name) {
+	return name.replace(/[^a-zA-Z0-9._-]/g, "-");
+}
+/**
+* Convert a GithubTargetGraph to a YAML string.
+*/
+function stringifyTargetGraph$1(graph, options) {
+	const doc = {
+		name: graph.name,
+		on: graph.on
+	};
+	if (Object.keys(graph.env).length > 0) doc.env = graph.env;
+	if (graph.permissions) doc.permissions = graph.permissions;
+	if (graph.defaults) doc.defaults = graph.defaults;
+	if (graph.concurrency) doc.concurrency = concurrencyToYaml(graph.concurrency);
+	const jobs = {};
+	for (const job of graph.jobs) jobs[job.id] = jobToYaml$1(job, options);
+	doc.jobs = jobs;
+	return stringify(doc, { sortMapEntries: false });
+}
+/**
+* Convert a GithubJob to a YAML-compatible object.
+*/
+function jobToYaml$1(job, options) {
+	const result = { name: job.name };
+	if (job.uses) return reusableJobToYaml(job, result, options);
+	result["runs-on"] = job.runsOn;
+	if (job.needs.length > 0) result.needs = job.needs.length === 1 ? job.needs[0] : [...job.needs];
+	if (job.timeoutMinutes !== void 0) result["timeout-minutes"] = job.timeoutMinutes;
+	if (job.container) result.container = job.container;
+	if (job.env) result.env = job.env;
+	if (job.strategy) result.strategy = strategyToYaml(job.strategy);
+	if (job.permissions) result.permissions = job.permissions;
+	if (job.if) result.if = job.if;
+	if (job.services) result.services = job.services;
+	if (job.environment) result.environment = job.environment;
+	if (job.concurrency) result.concurrency = concurrencyToYaml(job.concurrency);
+	result.steps = job.steps.map((step, i) => stepToYaml(step, i, options));
+	return result;
+}
+/**
+* Convert a job strategy spec to a YAML-compatible object.
+*/
+function strategyToYaml(strategy) {
+	const strat = { matrix: strategy.matrix };
+	if (strategy.failFast !== void 0) strat["fail-fast"] = strategy.failFast;
+	if (strategy.maxParallel !== void 0) strat["max-parallel"] = strategy.maxParallel;
+	return strat;
+}
+/**
+* Convert a reusable workflow call job (uses) to a YAML-compatible object.
+*/
+function reusableJobToYaml(job, result, options) {
+	result.uses = options?.pinUses ? options.pinUses(job.uses) : job.uses;
+	if (job.needs.length > 0) result.needs = job.needs.length === 1 ? job.needs[0] : [...job.needs];
+	if (job.with && Object.keys(job.with).length > 0) result.with = job.with;
+	if (job.secrets) result.secrets = job.secrets;
+	return result;
+}
+/**
+* Convert a concurrency spec to a YAML-compatible object.
+*/
+function concurrencyToYaml(conc) {
+	const result = { group: conc.group };
+	if (conc.cancelInProgress !== void 0) result["cancel-in-progress"] = conc.cancelInProgress;
+	return result;
+}
+/**
+* Convert a GithubStep to a YAML-compatible object.
+*/
+function stepToYaml(step, index, options) {
+	const result = {};
+	if (step.id) result.id = step.id;
+	if (step.name) result.name = step.name;
+	else if (!step.uses && !step.run) result.name = `Step ${index + 1}`;
+	if (step.uses) result.uses = options?.pinUses ? options.pinUses(step.uses) : step.uses;
+	if (step.run) result.run = step.run;
+	if (step.with) result.with = step.with;
+	if (step.env) result.env = step.env;
+	if (step.workingDirectory) result["working-directory"] = step.workingDirectory;
+	if (step.shell) result.shell = step.shell;
+	if (step.if) result.if = step.if;
+	if (step.continueOnError !== void 0) result["continue-on-error"] = step.continueOnError;
+	return result;
+}
+//#endregion
+//#region src/github/pinned-actions.json
+var pinned_actions_default = {
+	"actions/checkout@v4": "11d5960a326750d5838078e36cf38b85af677262",
+	"actions/setup-node@v4": "49933ea5288caeca8642d1e84afbd3f7d6820020",
+	"actions/upload-artifact@v4": "ea165f8d65b6e75b540449e92b4886f43607fa02",
+	"actions/download-artifact@v4": "d3f86a106a0bac45b974a628896c90dbdf5c8093",
+	"actions/cache@v4": "0057852bfaa89a56745cba8c7296529d2fc39830",
+	"actions/cache/restore@v4": "0057852bfaa89a56745cba8c7296529d2fc39830",
+	"actions/cache/save@v4": "0057852bfaa89a56745cba8c7296529d2fc39830",
+	"oven-sh/setup-bun@v2": "0c5077e51419868618aeaa5fe8019c62421857d6",
+	"softprops/action-gh-release@v2": "3bb12739c298aeb8a4eeaf626c5b8d85266b0e65",
+	"actions/upload-pages-artifact@v3": "56afc609e74202658d3ffba0e8f6dda462b719fa",
+	"actions/deploy-pages@v4": "d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e",
+	"dorny/test-reporter@v1": "3eeb9fc888e82e8be2fb356bbeec2750231672bc",
+	"github/codeql-action/upload-sarif@v3": "6f5948dfacef28e207b48d0905cf90c03365536d"
+};
+//#endregion
+//#region src/github/pinning.ts
+const SHA_RE$1 = /^[0-9a-f]{40}$/;
+/**
+* Pin a single `uses:` ref to its commit SHA.
+*
+* Rules (spec 22 §"Data models"):
+* 1. Local action (`./…`) → unchanged.
+* 2. Already pinned (`@<40 hex>`) → unchanged.
+* 3. `org/name@vN` in registry → `org/name@<sha> # vN`.
+* 4. `org/name@vN` not in registry → unchanged (caller emits a diagnostic).
+*
+* Refs without `@` (malformed) are returned unchanged.
+*/
+function pinActionRef(ref, registry) {
+	if (ref.startsWith("./")) return ref;
+	const at = ref.lastIndexOf("@");
+	if (at < 0) return ref;
+	const head = ref.slice(0, at);
+	const tail = ref.slice(at + 1);
+	if (SHA_RE$1.test(tail)) return ref;
+	const sha = registry[ref];
+	if (!sha) return ref;
+	return `${head}@${sha} # ${tail}`;
+}
+/**
+* Load the bundled `pinned-actions.json` registry.
+*/
+function loadBundledRegistry() {
+	return pinned_actions_default;
+}
+//#endregion
+//#region src/github/target.ts
+const SHA_RE = /^[0-9a-f]{40}$/;
+/**
+* GitHub Actions target — native lowering from Definition Graph.
+* Implements the Target contract: analyze → lower → emit.
+*/
+var GithubTarget = class {
+	name = "github";
+	capabilities = githubCapabilities;
+	pinningMode;
+	pinningRegistry;
+	constructor(config) {
+		const pinning = config?.pinning;
+		this.pinningMode = pinning?.mode ?? "off";
+		this.pinningRegistry = pinning?.registry ?? loadBundledRegistry();
+	}
+	/**
+	* Analyze a Definition Graph against the GitHub capability manifest.
+	* Returns diagnostics for unsupported or emulated capabilities, plus
+	* `unpinned-action` diagnostics (spec 22) for third-party `uses:` refs
+	* that are not pinned in the emitted output.
+	*/
+	analyze(graph) {
+		const capDiags = analyzeCapabilities(graph, [this.capabilities]);
+		const targetGraph = this.lower(graph);
+		const pinDiags = this.pinningDiagnostics(targetGraph);
+		return [...capDiags, ...pinDiags];
+	}
+	/**
+	* Lower a Definition Graph to one or more GithubTargetGraphs.
+	* Single-pipeline graphs return one target graph; multi-pipeline graphs
+	* with reusable workflow calls return one per pipeline.
+	*/
+	lower(graph) {
+		return lowerGithub(graph);
+	}
+	/**
+	* Emit one or more GithubTargetGraphs as YAML artifacts.
+	* Produces .github/workflows/<name>.yml files. When pinning is on (strict),
+	* every `uses:` ref is routed through `pinActionRef`.
+	*/
+	emit(targetGraph) {
+		return emitGithub(targetGraph, this.pinningMode === "strict" ? { pinUses: (ref) => pinActionRef(ref, this.pinningRegistry) } : void 0);
+	}
+	/**
+	* Compile a Definition Graph to generated artifacts and diagnostics.
+	*/
+	compile(graph) {
+		const targetGraph = this.lower(graph);
+		const capDiags = analyzeCapabilities(graph, [this.capabilities]);
+		const pinDiags = this.pinningDiagnostics(targetGraph);
+		return {
+			artifacts: this.emit(targetGraph),
+			diagnostics: [...capDiags, ...pinDiags]
+		};
+	}
+	/**
+	* Scan a lowered target graph for third-party `uses:` refs and emit
+	* `unpinned-action` diagnostics (spec 22). A ref is "unpinned" when it
+	* remains on a mutable version tag in the emitted output:
+	* - strict mode + missing registry entry → error
+	* - off mode + missing registry entry → warning
+	* - malformed ref (no `@`) → warning (both modes)
+	* Refs in the registry produce no diagnostic (they are pinnable; strict
+	* pins them, off leaves them unchanged by choice).
+	*/
+	pinningDiagnostics(targetGraph) {
+		const diags = [];
+		const graphs = Array.isArray(targetGraph) ? targetGraph : [targetGraph];
+		const seen = /* @__PURE__ */ new Set();
+		for (const g of graphs) for (const job of g.jobs) for (const ref of collectUsesRefs(job)) {
+			if (seen.has(ref)) continue;
+			seen.add(ref);
+			const diag = this.diagnosticFor(ref, job.id);
+			if (diag) diags.push(diag);
+		}
+		return diags;
+	}
+	diagnosticFor(ref, jobId) {
+		if (ref.startsWith("./")) return void 0;
+		const at = ref.lastIndexOf("@");
+		if (at < 0) return {
+			capability: "unpinned-action",
+			support: "unsupported",
+			severity: "warning",
+			message: `Action ref "${ref}" is malformed (no @version) and cannot be pinned.`,
+			stepId: jobId
+		};
+		const tail = ref.slice(at + 1);
+		if (SHA_RE.test(tail)) return void 0;
+		if (this.pinningRegistry[ref]) return void 0;
+		return {
+			capability: "unpinned-action",
+			support: "unsupported",
+			severity: this.pinningMode === "strict" ? "error" : "warning",
+			message: `Action "${ref}" is not pinned to a commit SHA (no registry entry).`,
+			stepId: jobId
+		};
+	}
+};
+/** Collect every `uses:` ref from a job (step-level + reusable-job-level). */
+function collectUsesRefs(job) {
+	const refs = [];
+	if (job.uses) refs.push(job.uses);
+	for (const step of job.steps) if (step.uses) refs.push(step.uses);
+	return refs;
+}
+/**
+* Convenience function: analyze → lower → emit in one call.
+*/
+function compileGithub(graph) {
+	return new GithubTarget().compile(graph);
+}
+//#endregion
+//#region src/gitlab/capabilities.ts
+const gitlabCapabilities = {
+	"trigger.push": "native",
+	"trigger.changeRequest": "native",
+	"trigger.manual": "native",
+	"runtime.host": "native",
+	"runtime.container": "native",
+	"operation.shell": "native",
+	"operation.import": "lowered",
+	"output.scalar": "lowered",
+	"output.artifact": "native",
+	"graph.dependencies": "native",
+	"graph.conditions": "partial",
+	"graph.matrix": "native",
+	"matrix.include": "lowered",
+	"matrix.exclude": "emulated",
+	"matrix.failFast": "unsupported",
+	"matrix.maxParallel": "unsupported",
+	"trigger.schedule": "native",
+	"step.beforeScript": "native",
+	"step.afterScript": "native",
+	"step.continueOnError": "native",
+	"policy.retry": "native",
+	"policy.compensation": "emulated",
+	"execution.workdir": "emulated",
+	"execution.shell": "unsupported",
+	"environment.variables": "native",
+	"secrets.runtime": "native",
+	"secrets.pipeline-input": "native",
+	"concurrency.interruptible": "native",
+	"environment.permissions": "unsupported",
+	"runner.selection": "native",
+	"runner.group": "unsupported",
+	"secrets.oidc": "native",
+	"secrets.oidc.multiAudience": "native",
+	"workflow.rules": "native",
+	"workflow.rules.changes": "native",
+	"workflow.rules.exists": "native",
+	"workflow.defaults": "native",
+	"workflow.defaults.shell": "unsupported",
+	"workflow.defaults.workdir": "unsupported",
+	"workflow.defaults.env": "unsupported",
+	"workflow.defaults.beforeScript": "native",
+	"workflow.defaults.afterScript": "native",
+	"workflow.defaults.timeout": "native",
+	"workflow.defaults.retry": "native",
+	"workflow.defaults.interruptible": "native",
+	"workflow.inputs": "native",
+	"workflow.inputs.choice": "native",
+	"workflow.inputs.array": "native",
+	"workflow.inputs.pattern": "native",
+	"environment.services": "native",
+	"environment.services.ports": "unsupported",
+	"deployment.environment": "native",
+	"deployment.environment.action": "native",
+	"deployment.environment.tier": "native",
+	"artifact.retention": "native",
+	"artifact.access": "native",
+	"cache": "native",
+	"cache.policy": "native",
+	"cache.fallbackKeys": "native",
+	"concurrency.group": "native",
+	"concurrency.cancelInProgress": "unsupported",
+	"reusable.pipeline": "lowered",
+	"reusable.pipeline.inputs": "native",
+	"reusable.pipeline.outputs": "native",
+	"reusable.component": "native",
+	"reusable.component.versioning": "native",
+	"reusable.childPipeline": "native",
+	"reusable.downstream": "native",
+	"deployment.release": "native",
+	"deployment.pages": "native",
+	"import.gitlab": "native",
+	"import.include": "native",
+	"scheduling.delay": "native",
+	"execution.background": "emulated",
+	"runtime.network": "emulated",
+	"step.permissions": "native",
+	"agent.step": "emulated",
+	"run.query": "emulated"
+};
+//#endregion
+//#region src/gitlab/errors.ts
+var GitlabTargetError = class extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.name = "GitlabTargetError";
+		this.code = code;
+		this.cause = cause;
+	}
+};
+//#endregion
+//#region src/gitlab/lower.ts
+const DOTENV_REPORT_FILE = "sverka.env";
+/**
+* Lower a Definition Graph to a GitlabTargetGraph.
+* One GitLab job per reachable Step. Stages derived from dependency depth.
+* F-31: pipeline-call steps are inlined as namespaced jobs (v1; include:
+* file-reuse deferred).
+*/
+function lowerGitlab(graph) {
+	if (graph.project.pipelines.length === 0) throw new GitlabTargetError("graph has no pipelines", "INVALID_GRAPH");
+	const rootPipelines = graph.project.pipelines.filter((p) => p.entries.length > 0);
+	if (rootPipelines.length === 0) throw new GitlabTargetError("graph has no root pipelines (with entries)", "INVALID_GRAPH");
+	if (rootPipelines.length > 1) {
+		const dropped = rootPipelines.slice(1).map((p) => p.id);
+		console.warn(`GitLab lowering: dropping ${dropped.length} additional root pipeline(s): ${dropped.join(", ")}. Multi-root GitLab support is not yet implemented.`);
+	}
+	const pipeline = rootPipelines[0];
+	const reachableSteps = filterReachableSteps(pipeline);
+	const expandedSteps = expandPipelineCalls(graph, reachableSteps);
+	const includes = [];
+	const stepsForJobs = expandedSteps.filter((step) => {
+		if (step.component) {
+			includes.push(lowerComponentInclude(step.component));
+			return false;
+		}
+		return true;
+	});
+	const jobIdMap = buildJobIdMap(stepsForJobs);
+	const { stageMap, stages } = computeStages(stepsForJobs, jobIdMap);
+	const jobs = lowerSteps(stepsForJobs, jobIdMap, stageMap, buildJobRulesMap(pipeline, stepsForJobs, jobIdMap));
+	const workflowRules = lowerWorkflowRules(pipeline);
+	const localIncludes = lowerLocalIncludes(pipeline);
+	if (pipeline.concurrency !== void 0) {
+		const group = pipeline.concurrency.group;
+		for (const job of jobs) if (job.resourceGroup === void 0) job.resourceGroup = group;
+	}
+	const autoCancel = jobs.some((job) => job.interruptible === true);
+	return {
+		name: pipeline.id,
+		stages,
+		jobs,
+		variables: collectVariables(pipeline),
+		...autoCancel ? { autoCancel: true } : {},
+		...pipeline.defaults !== void 0 ? { default: lowerDefault(pipeline.defaults) } : {},
+		...Object.keys(pipeline.inputs).length > 0 ? { specInputs: lowerSpecInputs(pipeline.inputs) } : {},
+		includes,
+		...localIncludes.length > 0 ? { localIncludes } : {},
+		...workflowRules.length > 0 ? { workflowRules } : {}
+	};
+}
+/**
+* Lower pipeline inputs to GitLab spec:inputs.
+* choice type → type: string with options.
+*/
+function lowerSpecInputs(inputs) {
+	const result = {};
+	for (const [name, input] of Object.entries(inputs)) result[name] = {
+		type: input.type === "choice" ? "string" : input.type,
+		...input.description !== void 0 ? { description: input.description } : {},
+		...input.default !== void 0 && !input.secret ? { default: input.default } : {},
+		...input.options !== void 0 ? { options: input.options } : {},
+		...input.pattern !== void 0 ? { regex: input.pattern } : {}
+	};
+	return result;
+}
+/**
+* Lower pipeline defaults to GitLab default keyword.
+* shell/workdir are not supported by GitLab and are dropped.
+*/
+function lowerDefault(defaults) {
+	return {
+		...defaults.beforeScript !== void 0 ? { beforeScript: defaults.beforeScript } : {},
+		...defaults.afterScript !== void 0 ? { afterScript: defaults.afterScript } : {},
+		...defaults.timeout !== void 0 ? { timeout: `${Math.ceil(defaults.timeout / 6e4)}m` } : {},
+		...defaults.retry !== void 0 ? { retry: defaults.retry } : {},
+		...defaults.interruptible !== void 0 ? { interruptible: defaults.interruptible } : {}
+	};
+}
+/**
+* Lower pipeline-level includes to GitLab local include directives.
+* F-44: includes → include: - local: <path>
+*/
+function lowerLocalIncludes(pipeline) {
+	if (!pipeline.includes || pipeline.includes.length === 0) return [];
+	return pipeline.includes.map((inc) => ({
+		local: inc.path,
+		...inc.inputs ? { inputs: { ...inc.inputs } } : {}
+	}));
+}
+/**
+* Lower pipeline-level rules to GitLab workflow:rules.
+* F-42: direct 1:1 mapping since GitLab has native support.
+*/
+function lowerWorkflowRules(pipeline) {
+	if (!pipeline.rules || pipeline.rules.length === 0) return [];
+	return pipeline.rules.map((rule) => ({
+		...rule.if ? { if: rule.if } : {},
+		...rule.changes ? { changes: [...rule.changes] } : {},
+		...rule.exists ? { exists: [...rule.exists] } : {},
+		...rule.variables ? { variables: { ...rule.variables } } : {},
+		...rule.when ? { when: rule.when } : {}
+	}));
+}
+/**
+* Lower a ComponentRef to a GitLab CI/CD component include entry.
+*/
+function lowerComponentInclude(ref) {
+	const inputs = {};
+	for (const [name, value] of Object.entries(ref.inputs)) if (typeof value === "object" && value !== null && !Array.isArray(value) && "kind" in value) {
+		const r = value;
+		if (r.kind === "step") inputs[name] = `$CI_JOB_${r.step.replace(/-/g, "_").toUpperCase()}_OUTPUT_${r.output}`;
+		else if (r.kind === "context") inputs[name] = `$${r.field.toUpperCase()}`;
+	} else inputs[name] = value;
+	return {
+		component: `${ref.name}@${ref.version}`,
+		inputs
+	};
+}
+/**
+* Return the ids of all producer steps referenced by a step, including
+* explicit dependencies and artifact imports.
+*/
+function producerIds(step) {
+	const ids = [];
+	for (const dep of step.dependencies) ids.push(dep.producer);
+	for (const op of step.operations) if (op.kind === "importArtifact") ids.push(op.from);
+	return ids;
+}
+/**
+* Compute the set of step IDs reachable from the given roots.
+* Throws INVALID_GRAPH for unknown roots or producers.
+*/
+function reachableStepIds(roots, pipeline) {
+	const byId = new Map(pipeline.steps.map((step) => [step.id, step]));
+	const reachable = /* @__PURE__ */ new Set();
+	const queue = [];
+	for (const root of roots) {
+		if (!byId.has(root)) throw new GitlabTargetError(`entry references unknown root step '${root}'`, "INVALID_GRAPH");
+		if (!reachable.has(root)) {
+			reachable.add(root);
+			queue.push(root);
+		}
+	}
+	let head = 0;
+	while (head < queue.length) {
+		const id = queue[head];
+		head++;
+		const step = byId.get(id);
+		if (!step) continue;
+		for (const producer of producerIds(step)) {
+			if (!byId.has(producer)) throw new GitlabTargetError(`step '${step.id}' references unknown producer '${producer}'`, "INVALID_GRAPH");
+			if (!reachable.has(producer)) {
+				reachable.add(producer);
+				queue.push(producer);
+			}
+		}
+	}
+	return reachable;
+}
+/**
+* Return the steps reachable from any entry root by following dependencies
+* and artifact imports.
+*/
+function filterReachableSteps(pipeline) {
+	if (pipeline.steps.length === 0) {
+		for (const entry of pipeline.entries) if (entry.roots.length > 0) throw new GitlabTargetError(`entry '${entry.id}' references root steps but pipeline has no steps`, "INVALID_GRAPH");
+		return [];
+	}
+	const reachable = reachableStepIds(pipeline.entries.flatMap((entry) => [...entry.roots]), pipeline);
+	return pipeline.steps.filter((step) => reachable.has(step.id));
+}
+/**
+* Build a map from each job ID to the rules of entries that reach that job.
+*/
+function buildJobRulesMap(pipeline, reachableSteps, jobIdMap) {
+	const map = /* @__PURE__ */ new Map();
+	const entryReachable = /* @__PURE__ */ new Map();
+	for (const entry of pipeline.entries) entryReachable.set(entry.id, reachableStepIds(entry.roots, pipeline));
+	for (const step of reachableSteps) {
+		const rules = [];
+		for (const entry of pipeline.entries) if (entryReachable.get(entry.id)?.has(step.id)) rules.push(...lowerTriggers([entry]));
+		const jobId = jobIdMap.get(step.id);
+		map.set(jobId, rules);
+	}
+	return map;
+}
+/**
+* Build a mapping from full step IDs to GitLab-safe job IDs.
+*/
+function buildJobIdMap(steps) {
+	const map = /* @__PURE__ */ new Map();
+	const used = /* @__PURE__ */ new Set();
+	for (const step of steps) {
+		const shortId = step.id.includes("/") ? step.id.split("/").pop() : step.id;
+		let jobId = shortId;
+		let suffix = 1;
+		while (used.has(jobId)) {
+			jobId = `${shortId}-${suffix}`;
+			suffix++;
+		}
+		used.add(jobId);
+		map.set(step.id, jobId);
+	}
+	return map;
+}
+/**
+* Compute stages by topological level.
+* Level 0 → "build", Level N → "stage-N".
+* Returns stages in dependency order (build first, then stage-1, etc.).
+* Throws when a dependency cycle is detected.
+*/
+function computeStages(steps, jobIdMap) {
+	return deriveStageResult(computeAllLevels(steps, jobIdMap, buildDepsByJob(steps, jobIdMap)));
+}
+function buildDepsByJob(steps, jobIdMap) {
+	const depsByJob = /* @__PURE__ */ new Map();
+	for (const step of steps) {
+		const jobId = jobIdMap.get(step.id) ?? step.id;
+		const deps = producerIds(step).map((id) => jobIdMap.get(id) ?? id);
+		depsByJob.set(jobId, deps);
+	}
+	return depsByJob;
+}
+function computeAllLevels(steps, jobIdMap, depsByJob) {
+	const levels = /* @__PURE__ */ new Map();
+	for (const step of steps) {
+		const jobId = jobIdMap.get(step.id) ?? step.id;
+		const level = computeLevel(jobId, depsByJob, levels, /* @__PURE__ */ new Set());
+		levels.set(jobId, level);
+	}
+	return levels;
+}
+function stageNameForLevel(level) {
+	return level === 0 ? "build" : `stage-${level}`;
+}
+function deriveStageResult(levels) {
+	const maxLevel = Math.max(0, ...levels.values());
+	const usedLevels = new Set(levels.values());
+	const stages = [];
+	for (let level = 0; level <= maxLevel; level++) if (usedLevels.has(level)) stages.push(stageNameForLevel(level));
+	const stageMap = /* @__PURE__ */ new Map();
+	for (const [jobId, level] of levels) stageMap.set(jobId, stageNameForLevel(level));
+	return {
+		stageMap,
+		stages
+	};
+}
+function computeLevel(jobId, depsByJob, levels, visiting) {
+	if (levels.has(jobId)) return levels.get(jobId);
+	if (visiting.has(jobId)) throw new GitlabTargetError(`dependency cycle detected involving job '${jobId}'`, "LOWER_FAILED");
+	visiting.add(jobId);
+	const deps = depsByJob.get(jobId) ?? [];
+	if (deps.length === 0) {
+		visiting.delete(jobId);
+		return 0;
+	}
+	let maxDepLevel = 0;
+	for (const dep of deps) {
+		const depLevel = computeLevel(dep, depsByJob, levels, visiting);
+		maxDepLevel = Math.max(maxDepLevel, depLevel);
+	}
+	visiting.delete(jobId);
+	return maxDepLevel + 1;
+}
+/**
+* Map Sverka triggers to GitLab rules.
+* Branch filters are preserved in the generated `if` expressions.
+*/
+function lowerTriggers(entries) {
+	const rules = [];
+	for (const entry of entries) {
+		const t = entry.trigger;
+		switch (t.kind) {
+			case "push":
+				rules.push(buildFilterRule("$CI_PIPELINE_SOURCE == \"push\"", t.filter, false));
+				break;
+			case "changeRequest":
+				rules.push(buildFilterRule("$CI_PIPELINE_SOURCE == \"merge_request_event\"", t.filter, true));
+				break;
+			case "manual":
+				rules.push({ if: "$CI_PIPELINE_SOURCE == \"web\"" });
+				break;
+			case "schedule":
+				rules.push({ if: "$CI_PIPELINE_SOURCE == \"schedule\"" });
+				break;
+			default: throw new GitlabTargetError(`unsupported trigger kind: ${JSON.stringify(t.kind)}`, "UNSUPPORTED_TRIGGER");
+		}
+	}
+	return rules;
+}
+/**
+* Build a GitLab rule from a source condition and a trigger filter.
+* For push triggers: branches → $CI_COMMIT_BRANCH, tags → $CI_COMMIT_TAG
+* For MR triggers: branches → $CI_MERGE_REQUEST_TARGET_BRANCH_NAME (target branch)
+* Paths → changes: [paths] on the rule
+*/
+function buildFilterRule(sourceCondition, filter, isMergeRequest) {
+	const conditions = [sourceCondition];
+	const refConditions = [];
+	if (filter?.branches && filter.branches.length > 0) {
+		const branchRef = isMergeRequest ? "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME" : "$CI_COMMIT_BRANCH";
+		refConditions.push(buildRefCondition(branchRef, filter.branches));
+	}
+	if (filter?.tags && filter.tags.length > 0 && !isMergeRequest) refConditions.push(buildRefCondition("$CI_COMMIT_TAG", filter.tags));
+	if (refConditions.length === 1) conditions.push(refConditions[0]);
+	else if (refConditions.length > 1) conditions.push(`(${refConditions.join(" || ")})`);
+	const rule = { if: conditions.join(" && ") };
+	if (filter?.paths && filter.paths.length > 0) return {
+		...rule,
+		changes: [...filter.paths]
+	};
+	return rule;
+}
+function buildRefCondition(ref, values) {
+	if (values.length === 1) return `${ref} == ${quoteJsonString(values[0])}`;
+	return `(${values.map((v) => `${ref} == ${quoteJsonString(v)}`).join(" || ")})`;
+}
+/**
+* Lower steps to GitLab jobs.
+*/
+function lowerSteps(steps, jobIdMap, stageMap, rulesMap) {
+	return steps.map((step) => {
+		if (step.childPipeline) return lowerChildPipelineStep(step, jobIdMap, stageMap, rulesMap);
+		if (step.downstream) return lowerDownstreamStep(step, jobIdMap, stageMap, rulesMap);
+		return lowerStep(step, jobIdMap, stageMap, rulesMap);
+	});
+}
+/**
+* Lower a child pipeline step to a GitLab trigger job.
+* F-33: childPipeline → trigger: include: [{ artifact: <path>, job: <generator> }]
+*/
+function lowerChildPipelineStep(step, jobIdMap, stageMap, rulesMap) {
+	const jobId = jobIdMap.get(step.id) ?? step.id;
+	const stage = stageMap.get(jobId) ?? "build";
+	const rules = rulesMap.get(jobId) ?? [];
+	const needs = step.dependencies.filter((d) => d.kind === "control").map((d) => jobIdMap.get(d.producer) ?? d.producer);
+	const cp = step.childPipeline;
+	const generatorJobId = jobIdMap.get(`${step.id.split("/").slice(0, -1).join("/")}/${cp.generator}`) ?? cp.generator;
+	const trigger = { include: [{
+		artifact: cp.artifact,
+		job: generatorJobId
+	}] };
+	return {
+		id: jobId,
+		stage,
+		needs,
+		script: [],
+		...rules.length > 0 ? { rules } : {},
+		trigger
+	};
+}
+/**
+* Lower a downstream step to a GitLab multi-project trigger job.
+* F-34: downstream → trigger: project: <project>, branch: <branch>, strategy: depend
+*/
+function lowerDownstreamStep(step, jobIdMap, stageMap, rulesMap) {
+	const jobId = jobIdMap.get(step.id) ?? step.id;
+	const stage = stageMap.get(jobId) ?? "build";
+	const rules = rulesMap.get(jobId) ?? [];
+	const needs = step.dependencies.filter((d) => d.kind === "control").map((d) => jobIdMap.get(d.producer) ?? d.producer);
+	const ds = step.downstream;
+	const trigger = {
+		project: ds.project,
+		...ds.branch ? { branch: ds.branch } : {},
+		strategy: "depend"
+	};
+	const variables = lowerDownstreamVariables(ds.inputs);
+	return {
+		id: jobId,
+		stage,
+		needs,
+		script: [],
+		...rules.length > 0 ? { rules } : {},
+		trigger,
+		...Object.keys(variables).length > 0 ? { variables } : {}
+	};
+}
+/**
+* Lower downstream step inputs to GitLab trigger variables.
+*/
+function lowerDownstreamVariables(inputs) {
+	const variables = {};
+	if (!inputs) return variables;
+	for (const [name, value] of Object.entries(inputs)) variables[name] = lowerReferenceOrLiteral(value);
+	return variables;
+}
+/**
+* Lower a reference binding or literal value to a GitLab variable string.
+* Reference bindings use GitLab variable interpolation; literals are stringified.
+*/
+function lowerReferenceOrLiteral(value) {
+	if (typeof value === "object" && value !== null && !Array.isArray(value) && "kind" in value) {
+		const r = value;
+		if (r.kind === "step") return `$CI_JOB_${r.step.replace(/-/g, "_").toUpperCase()}_OUTPUT_${r.output}`;
+		if (r.kind === "context") return `$${r.field.toUpperCase()}`;
+	}
+	return String(value);
+}
+/**
+* Lower a single Step to a GitLab job.
+*/
+function lowerStep(step, jobIdMap, stageMap, rulesMap) {
+	const jobId = jobIdMap.get(step.id) ?? step.id;
+	const stage = stageMap.get(jobId) ?? "build";
+	const mergedRules = mergeRules(rulesMap.get(jobId) ?? [], step.rules);
+	const { script, artifacts, needs: importNeeds, variables, release, pages } = lowerOperations(step, jobId, jobIdMap);
+	const needs = mergeNeeds(step, jobIdMap, importNeeds);
+	if (script.length === 0) script.push("echo 'no operations'");
+	const { image, variables: jobVariables } = lowerRuntime(step, variables);
+	const rules = applyStepCondition(mergedRules, step, jobIdMap);
+	const writeVariables = lowerWriteVariables(step);
+	return {
+		id: jobId,
+		stage,
+		needs,
+		script,
+		...buildJobFields({
+			image,
+			artifacts,
+			variables: {
+				...jobVariables,
+				...writeVariables
+			},
+			rules,
+			timeout: step.timeout,
+			interruptible: step.interruptible,
+			runner: step.runner,
+			identity: step.identity,
+			services: step.services,
+			environment: step.environment,
+			cache: step.cache,
+			concurrency: step.concurrency
+		}),
+		...step.matrix !== void 0 ? { parallel: { matrix: lowerGitlabMatrix(step.matrix) } } : {},
+		...step.beforeScript ? { beforeScript: step.beforeScript } : {},
+		...step.afterScript ? { afterScript: step.afterScript } : {},
+		...resolveContinueOnError(step),
+		...resolveRetryConfig(step),
+		...release ? { release } : {},
+		...pages ? { pages } : {},
+		...step.delay ? {
+			when: "delayed",
+			start_in: step.delay
+		} : {}
+	};
+}
+/**
+* If the step has a condition, apply it to the merged rules.
+*
+* Status conditions (success/failure/always/never) map to GitLab `when`
+* values, not `if:` expressions. GitLab's `if:` does not have equivalents for
+* `on_success`/`on_failure` — those are `when` semantics. Emitting empty `if:`
+* strings (as the previous code did for success/failure) produces invalid YAML.
+*
+* Step-output conditions reference dotenv variables from a producer job's
+* artifacts. GitLab evaluates all job rules during pipeline creation, before
+* any job runs — so dotenv variables are not available at that point. Reject
+* step-output conditions with an error until runtime-safe handling exists.
+*
+* Context and expression conditions are AND'd with each rule's `if` expression.
+* GitLab evaluates rules in order and stops at the first match, so appending
+* the condition as a separate rule would bypass it when a trigger rule matches.
+*/
+function applyStepCondition(mergedRules, step, jobIdMap) {
+	if (step.condition === void 0) return mergedRules;
+	if (step.condition.kind === "status") {
+		const when = statusToGitlabWhen(step.condition.status);
+		if (mergedRules.length === 0) return [{ when }];
+		return mergedRules.map((rule) => ({
+			...rule,
+			when
+		}));
+	}
+	if (step.condition.kind === "step") throw new GitlabTargetError(`step '${step.id}' has a step-output condition (${step.condition.step}.${step.condition.output}), which GitLab cannot evaluate during pipeline creation — dotenv variables from producer jobs are not available when rules are evaluated`, "LOWER_FAILED");
+	const condExpr = lowerGitlabConditionExpr(step.condition, jobIdMap);
+	let rules = mergedRules.map((rule) => {
+		if (condExpr === void 0) return rule;
+		const ifExpr = rule.if !== void 0 ? `(${rule.if}) && (${condExpr})` : condExpr;
+		return {
+			...rule,
+			if: ifExpr
+		};
+	});
+	if (rules.length === 0 && condExpr !== void 0) rules = [{ if: condExpr }];
+	return rules;
+}
+/**
+* Map a Sverka step status condition to a GitLab rules `when` value.
+* - success → on_success (run only if all parent jobs succeed — GitLab default)
+* - failure → on_failure (run only if at least one parent job fails)
+* - always  → always
+* - never   → never
+*/
+function statusToGitlabWhen(status) {
+	switch (status) {
+		case "always": return "always";
+		case "never": return "never";
+		case "success": return "on_success";
+		case "failure": return "on_failure";
+	}
+}
+/** Resolve continueOnError to GitLab allowFailure field. */
+function resolveContinueOnError(step) {
+	if (step.continueOnError === void 0) return {};
+	return { allowFailure: typeof step.continueOnError === "boolean" ? step.continueOnError : { exitCodes: step.continueOnError.exitCodes } };
+}
+/** Resolve retry configuration to GitLab retry field. */
+function resolveRetryConfig(step) {
+	if (step.retry === void 0) return {};
+	return { retry: {
+		max: step.retry.max,
+		...step.retry.when ? { when: step.retry.when } : {},
+		...step.retry.exitCodes ? { exitCodes: step.retry.exitCodes } : {}
+	} };
+}
+function mergeNeeds(step, jobIdMap, importNeeds) {
+	return [.../* @__PURE__ */ new Set([...lowerDependencies(step.dependencies, jobIdMap), ...importNeeds])];
+}
+function lowerRuntime(step, baseVariables) {
+	const runtime = step.runtime;
+	const mode = runtime.mode ?? "host";
+	if (mode === "container" && !runtime.image) throw new GitlabTargetError(`step '${step.id}' uses container mode without an image`, "LOWER_FAILED");
+	const image = mode === "container" ? runtime.image : void 0;
+	const variables = { ...baseVariables };
+	if (runtime.env) Object.assign(variables, runtime.env);
+	if (runtime.secrets) for (const secret of runtime.secrets) variables[secret] = `$${secret}`;
+	if (runtime.network && runtime.network.allowed.length > 0) variables["SVERKA_NETWORK_ALLOWLIST"] = runtime.network.allowed.join(",");
+	return {
+		...image ? { image } : {},
+		variables
+	};
+}
+/**
+* Safe-outputs (Spec 25): GitLab has no per-job permission block.
+* Steps with declared writes receive CI variables corresponding to their
+* declared write kinds (e.g. SV_WRITE_DEPLOY=true). Steps without writes
+* receive no SV_WRITE_* variables.
+*/
+function lowerWriteVariables(step) {
+	const writes = step.permissions?.write;
+	if (!writes || writes.length === 0) return {};
+	const vars = {};
+	for (const decl of writes) {
+		const varName = `SV_WRITE_${decl.kind.toUpperCase().replace(/-/g, "_")}`;
+		vars[varName] = "true";
+	}
+	return vars;
+}
+/** Build core job fields: image, artifacts, variables, rules. */
+function buildJobCoreFields(ctx) {
+	return {
+		...ctx.image ? { image: ctx.image } : {},
+		...ctx.artifacts ? { artifacts: ctx.artifacts } : {},
+		...Object.keys(ctx.variables).length > 0 ? { variables: ctx.variables } : {},
+		...ctx.rules.length > 0 ? { rules: ctx.rules } : {}
+	};
+}
+/** Build runtime/execution fields: timeout, interruptible, runner tags, id_tokens. */
+function buildJobRuntimeFields(ctx) {
+	return {
+		...ctx.timeout !== void 0 ? { timeout: `${Math.ceil(ctx.timeout / 6e4)}m` } : {},
+		...ctx.interruptible !== void 0 ? { interruptible: ctx.interruptible } : {},
+		...ctx.runner !== void 0 ? { tags: ctx.runner.labels } : {},
+		...lowerIdTokens(ctx.identity)
+	};
+}
+/** Build environment-related fields: services, environment, cache, concurrency. */
+function buildJobEnvFields(ctx) {
+	return {
+		...ctx.services !== void 0 && ctx.services.length > 0 ? { services: lowerGitlabServices(ctx.services) } : {},
+		...ctx.environment !== void 0 ? { environment: lowerGitlabEnvironment(ctx.environment) } : {},
+		...ctx.cache !== void 0 ? { cache: lowerGitlabCache(ctx.cache) } : {},
+		...ctx.concurrency !== void 0 ? { resourceGroup: ctx.concurrency.group } : {}
+	};
+}
+function buildJobFields(ctx) {
+	return {
+		...buildJobCoreFields(ctx),
+		...buildJobRuntimeFields(ctx),
+		...buildJobEnvFields(ctx)
+	};
+}
+/** Lower identity tokens to GitLab id_tokens field. */
+function lowerIdTokens(identity) {
+	if (identity === void 0) return {};
+	const idTokens = {};
+	for (const [name, spec] of Object.entries(identity.tokens)) idTokens[name] = { aud: spec.audience };
+	return Object.keys(idTokens).length > 0 ? { idTokens } : {};
+}
+/**
+* Lower cache spec to GitLab cache keyword.
+*/
+function lowerGitlabCache(cache) {
+	return {
+		paths: cache.paths,
+		key: cache.key,
+		...cache.policy !== void 0 ? { policy: cache.policy } : {},
+		...cache.restoreKeys !== void 0 ? { fallbackKeys: cache.restoreKeys } : {}
+	};
+}
+/**
+* Lower environment spec to GitLab environment map.
+*/
+function lowerGitlabEnvironment(env) {
+	return {
+		name: env.name,
+		...env.url !== void 0 ? { url: env.url } : {},
+		...env.action !== void 0 ? { action: env.action } : {},
+		...env.tier !== void 0 ? { deploymentTier: env.tier } : {}
+	};
+}
+/**
+* Lower service containers to GitLab services array.
+* ports are not supported by GitLab and are dropped.
+*/
+function lowerGitlabServices(services) {
+	return services.map((svc) => ({
+		name: svc.image,
+		alias: svc.alias ?? svc.name,
+		...svc.entrypoint !== void 0 ? { entrypoint: [...svc.entrypoint] } : {},
+		...svc.command !== void 0 ? { command: [...svc.command] } : {},
+		...svc.env !== void 0 ? { variables: { ...svc.env } } : {}
+	}));
+}
+/**
+* Merge trigger-derived rules with step-level rules.
+* Step-level rules are appended after trigger rules.
+*/
+function mergeRules(triggerRules, stepRules) {
+	if (stepRules === void 0 || stepRules.length === 0) return triggerRules;
+	const result = [...triggerRules];
+	for (const rule of stepRules) {
+		const gitlabRule = {
+			...rule.if !== void 0 ? { if: rule.if } : {},
+			...rule.when !== void 0 ? { when: rule.when } : {},
+			...rule.changes !== void 0 ? { changes: rule.changes } : {},
+			...rule.exists !== void 0 ? { exists: rule.exists } : {},
+			...rule.variables !== void 0 ? { variables: rule.variables } : {}
+		};
+		result.push(gitlabRule);
+	}
+	return result;
+}
+/**
+* Map dependencies to job needs.
+*/
+function lowerDependencies(deps, jobIdMap) {
+	const needs = /* @__PURE__ */ new Set();
+	for (const dep of deps) {
+		const jobId = jobIdMap.get(dep.producer) ?? dep.producer;
+		needs.add(jobId);
+	}
+	return [...needs];
+}
+/**
+* Map operations to script entries, artifacts, and dependencies.
+* Scalar outputs are written to a dotenv report file.
+*/
+function lowerOperations(step, jobId, jobIdMap) {
+	const acc = {
+		script: [],
+		artifactPaths: [],
+		importNeeds: [],
+		reportEntries: {},
+		inputs: step.inputs,
+		hasDotenv: false,
+		artifactRetention: void 0,
+		artifactAccess: void 0,
+		release: void 0,
+		pages: void 0,
+		stdoutTargetIndex: void 0,
+		stdoutNames: [],
+		stdoutArtifacts: false,
+		workingDir: step.runtime.workingDir
+	};
+	for (const op of step.operations) lowerOperation(op, jobId, acc, jobIdMap);
+	return assembleOperationResult(acc, step);
+}
+/**
+* Lower a shell operation, handling background execution.
+*/
+function lowerShellOp(op, acc, jobIdMap) {
+	sealStdoutCapture(acc);
+	const translated = translateGitlabCommand(op.command, acc.inputs, jobIdMap);
+	acc.script.push(op.background ? `${translated} &` : translated);
+	acc.stdoutTargetIndex = acc.script.length - 1;
+}
+/**
+* Bind the pending stdout artifact names to the most recent shell op: wrap
+* that op's script line so its stdout is also written to the declared file(s)
+* and record the files as job artifacts.
+*/
+function sealStdoutCapture(acc) {
+	if (acc.stdoutTargetIndex === void 0 || acc.stdoutNames.length === 0) return;
+	acc.script[acc.stdoutTargetIndex] = wrapStdoutCaptureLine(acc.script[acc.stdoutTargetIndex], acc.stdoutNames);
+	acc.artifactPaths.push(...acc.stdoutNames.map((name) => acc.workingDir ? `${acc.workingDir}/${name}` : name));
+	acc.stdoutArtifacts = true;
+	acc.stdoutNames = [];
+}
+/**
+* Lower a single operation, mutating the accumulator.
+*/
+function lowerOperation(op, stepId, acc, jobIdMap) {
+	switch (op.kind) {
+		case "shell":
+			lowerShellOp(op, acc, jobIdMap);
+			break;
+		case "exportOutput":
+			lowerExportOutput(op, stepId, acc);
+			break;
+		case "exportArtifact":
+			lowerExportArtifact(op, acc);
+			break;
+		case "exportStdout":
+			if (acc.stdoutTargetIndex === void 0) throw new GitlabTargetError(`step '${stepId}' declares stdout artifact '${op.name}' but no shell output was captured`, "LOWER_FAILED");
+			acc.stdoutNames.push(op.name);
+			break;
+		case "importArtifact":
+			acc.importNeeds.push(jobIdMap.get(op.from) ?? op.from);
+			break;
+		case "diagnostic":
+			acc.script.push(`echo ${shellQuoteSingle(op.message)}`);
+			break;
+		case "report":
+			lowerReport(op, acc);
+			break;
+		case "release":
+			acc.release = lowerReleaseOp(op);
+			break;
+		case "deployPages":
+			lowerDeployPages(op, acc);
+			break;
+		default: throw new GitlabTargetError(`unsupported operation kind: ${JSON.stringify(op.kind)}`, "LOWER_FAILED");
+	}
+}
+/**
+* Lower an exportOutput operation into a dotenv echo line.
+*/
+function lowerExportOutput(op, stepId, acc) {
+	const name = shellEscapeDoubleQuoted(`${stepId}_${op.name}`);
+	acc.script.push(`echo "${name}=\${${op.name}}" >> ${DOTENV_REPORT_FILE}`);
+	acc.hasDotenv = true;
+}
+/**
+* Lower an exportArtifact operation, recording paths and retention metadata.
+*/
+function lowerExportArtifact(op, acc) {
+	acc.artifactPaths.push(op.path);
+	if (op.retention !== void 0) acc.artifactRetention = op.retention;
+	if (op.access !== void 0) acc.artifactAccess = op.access;
+}
+/**
+* Lower a report operation into a GitLab artifacts:reports entry.
+*/
+function lowerReport(op, acc) {
+	const key = gitlabReportKey(op.spec.type);
+	if (op.spec.type === "coverage") acc.reportEntries[key] = {
+		coverage_format: op.spec.format ?? "cobertura",
+		path: op.spec.path
+	};
+	else acc.reportEntries[key] = op.spec.path;
+}
+/**
+* Lower a release operation to a GitLab release keyword.
+* Assets are file paths → emit as links with placeholder URLs
+* (GitLab requires URLs, not file paths).
+*/
+function lowerReleaseOp(op) {
+	const links = (op.assets ?? []).map((path) => ({
+		name: path.split("/").pop() ?? path,
+		url: `$CI_PROJECT_URL/-/jobs/$CI_JOB_ID/artifacts/file/${path}`
+	}));
+	return {
+		tag_name: op.tag,
+		...op.name ? { name: op.name } : {},
+		...op.description ? { description: op.description } : {},
+		...links.length > 0 ? { assets: { links } } : {},
+		...op.draft !== void 0 ? { draft: op.draft } : {}
+	};
+}
+/**
+* Lower a deployPages operation to a GitLab pages keyword.
+* GitLab 17.6+ accepts any job name when the job sets the `pages` keyword.
+* The path is also added as an artifact.
+*/
+function lowerDeployPages(op, acc) {
+	acc.pages = {
+		publish: op.path,
+		...op.prefix ? { path_prefix: op.prefix } : {}
+	};
+	acc.artifactPaths.push(op.path);
+}
+/**
+* Assemble the final lowerOperations result from the accumulator.
+*/
+function assembleOperationResult(acc, step) {
+	sealStdoutCapture(acc);
+	const artifacts = {};
+	if (acc.artifactPaths.length > 0) artifacts.paths = acc.artifactPaths;
+	if (acc.stdoutArtifacts) artifacts.when = "always";
+	if (acc.hasDotenv) acc.reportEntries.dotenv = DOTENV_REPORT_FILE;
+	if (Object.keys(acc.reportEntries).length > 0) artifacts.reports = acc.reportEntries;
+	if (acc.artifactRetention !== void 0) artifacts.expireIn = parseGitlabExpireIn(acc.artifactRetention);
+	if (acc.artifactAccess !== void 0) artifacts.access = acc.artifactAccess;
+	if (step.runtime.workingDir && acc.script.length > 0) {
+		const escapedDir = shellQuoteSingle(step.runtime.workingDir);
+		acc.script.unshift(`cd ${escapedDir}`);
+	}
+	return {
+		script: acc.script,
+		...Object.keys(artifacts).length > 0 ? { artifacts } : {},
+		needs: acc.importNeeds,
+		variables: {},
+		...acc.release ? { release: acc.release } : {},
+		...acc.pages ? { pages: acc.pages } : {}
+	};
+}
+/**
+* Convert Sverka retention duration to GitLab expire_in format.
+* "7d" → "7 days", "1h" → "1 hours", "30m" → "30 minutes", "never" → "never".
+*/
+function parseGitlabExpireIn(retention) {
+	if (retention === "never") return "never";
+	const match = /^(\d+)([dhm])$/.exec(retention);
+	if (match === null) return retention;
+	const value = match[1];
+	const unit = match[2];
+	if (unit === "d") return `${value} days`;
+	if (unit === "h") return `${value} hours`;
+	if (unit === "m") return `${value} minutes`;
+	return retention;
+}
+/**
+* Map Sverka report type to GitLab artifacts:reports key.
+*/
+function gitlabReportKey(type) {
+	return {
+		junit: "junit",
+		coverage: "coverage_report",
+		dotenv: "dotenv",
+		sast: "sast",
+		dast: "dast",
+		dependencyScanning: "dependency_scanning",
+		containerScanning: "container_scanning",
+		licenseScanning: "license_scanning",
+		performance: "performance",
+		metrics: "metrics",
+		terraform: "terraform",
+		quality: "quality",
+		sarif: "sast"
+	}[type] ?? type;
+}
+/**
+* Produce a deterministic JSON string literal (quoted) for a value.
+*/
+function quoteJsonString(value) {
+	return `"${value.replace(/[\\"\n\r\t\b\f\u0000-\u001f]/g, (ch) => {
+		return JSON_STRING_ESCAPES[ch] ?? `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`;
+	})}"`;
+}
+const JSON_STRING_ESCAPES = {
+	"\"": "\\\"",
+	"\\": "\\\\",
+	"\n": "\\n",
+	"\r": "\\r",
+	"	": "\\t",
+	"\b": "\\b",
+	"\f": "\\f"
+};
+/**
+* Escape a string for use inside double quotes in a POSIX shell.
+*/
+function shellEscapeDoubleQuoted(value) {
+	return value.replace(/[\\"`$]/g, "\\$&");
+}
+/**
+* Collect pipeline-level variables from inputs.
+* Secret inputs are omitted from the generated variables block.
+*/
+function collectVariables(pipeline) {
+	const vars = {};
+	for (const [name, input] of Object.entries(pipeline.inputs)) {
+		if (input.secret) continue;
+		if (input.default !== void 0) vars[name] = String(input.default);
+	}
+	return vars;
+}
+/**
+* Lower a MatrixSpec to a GitLab parallel:matrix array.
+* GitLab has no native include/exclude — exclude is emulated by filtering
+* combinations at synthesis time, include is appended to the array.
+*/
+function lowerGitlabMatrix(spec) {
+	validateMatrixKeys(spec);
+	const combinations = computeMatrixCombinations(spec.dimensions, spec.exclude ?? []);
+	const totalRows = combinations.length + (spec.include?.length ?? 0);
+	if (totalRows > 200) throw new GitlabTargetError(`GitLab matrix has ${totalRows} rows, exceeding the 200-row limit`, "MATRIX_TOO_LARGE");
+	const includeEntries = (spec.include ?? []).map((entry) => ({ ...entry }));
+	return [...combinations.map((c) => ({ ...c })), ...includeEntries];
+}
+/**
+* Validate that matrix dimension and include keys contain only valid
+* GitLab variable name characters: letters, digits, underscores.
+*/
+function validateMatrixKeys(spec) {
+	const validKey = /^[A-Za-z_]\w*$/;
+	for (const key of Object.keys(spec.dimensions)) if (!validKey.test(key)) throw new GitlabTargetError(String.raw`invalid matrix dimension key '${key}': must match [A-Za-z_]\w*`, "INVALID_MATRIX");
+	if (spec.include) {
+		for (const entry of spec.include) for (const key of Object.keys(entry)) if (!validKey.test(key)) throw new GitlabTargetError(String.raw`invalid matrix include key '${key}': must match [A-Za-z_]\w*`, "INVALID_MATRIX");
+	}
+}
+/**
+* Compute the cross-product of matrix dimensions, then filter out
+* combinations matching any exclude rule (partial match).
+*/
+function computeMatrixCombinations(dimensions, exclude) {
+	const keys = Object.keys(dimensions);
+	if (keys.length === 0) return [];
+	let combinations = [{}];
+	for (const key of keys) {
+		const values = dimensions[key];
+		if (!values || values.length === 0) continue;
+		const next = [];
+		for (const combo of combinations) for (const v of values) next.push({
+			...combo,
+			[key]: v
+		});
+		combinations = next;
+	}
+	if (exclude.length === 0) return combinations;
+	return combinations.filter((combo) => !matchesAny(combo, exclude));
+}
+/**
+* Check if a combination matches any exclude rule (partial match).
+*/
+function matchesAny(combo, rules) {
+	for (const rule of rules) {
+		const ruleEntries = Object.entries(rule);
+		if (ruleEntries.length === 0) continue;
+		if (ruleEntries.every(([k, v]) => combo[k] === v)) return true;
+	}
+	return false;
+}
+const GITLAB_CONTEXT_MAP = {
+	"git.sha": "$CI_COMMIT_SHA",
+	"git.branch": "$CI_COMMIT_BRANCH",
+	"git.tag": "$CI_COMMIT_TAG",
+	"change.id": "$CI_MERGE_REQUEST_IID",
+	"change.source": "$CI_PIPELINE_SOURCE",
+	"change.target": "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME",
+	"change.draft": "$CI_MERGE_REQUEST_DRAFT",
+	"event.type": "$CI_PIPELINE_SOURCE",
+	"run.id": "$CI_PIPELINE_ID",
+	"run.attempt": "$run_attempt"
+};
+/**
+* Translate a context ref (namespace.field) to GitLab variable syntax.
+*/
+function translateGitlabContextRef(namespace, field) {
+	const key = `${namespace}.${field}`;
+	const mapped = GITLAB_CONTEXT_MAP[key];
+	if (mapped) return mapped;
+	if (namespace === "env" || namespace === "secrets") return `$${field}`;
+	if (namespace === "matrix") return `$${field.toUpperCase()}`;
+	if (namespace === "inputs") return `$[[ inputs.${field} ]]`;
+	throw new GitlabTargetError(`unsupported context namespace '${namespace}' in GitLab lowering`, "LOWER_FAILED");
+}
+/**
+* Translate a step ref to GitLab variable syntax: $<output> (from dotenv artifact).
+*/
+function translateGitlabStepRef(ref) {
+	return `$${ref.output}`;
+}
+/**
+* Build a lookup map from placeholder key to Reference from the step's inputs.
+*/
+function buildGitlabInputLookup(inputs) {
+	const map = /* @__PURE__ */ new Map();
+	for (const ref of inputs) if (ref.kind === "context") map.set(`${ref.namespace}.${ref.field}`, ref);
+	else if (ref.kind === "step") map.set(`${ref.step}.${ref.output}`, ref);
+	return map;
+}
+/**
+* Translate ${...} placeholders in a command string to GitLab variable syntax.
+*/
+function translateGitlabCommand(command, inputs, _jobIdMap) {
+	const lookup = buildGitlabInputLookup(inputs);
+	return command.replace(/\$\{([^{}]+)\}/g, (_, key) => {
+		const ref = lookup.get(key);
+		if (ref === void 0) return `\${${key}}`;
+		if (ref.kind === "context") return translateGitlabContextRef(ref.namespace, ref.field);
+		return translateGitlabStepRef(ref);
+	});
+}
+/**
+* Lower a step condition to a GitLab if: expression string (without wrapping in a rule).
+* Returns the raw expression that can be combined with trigger rule conditions.
+*/
+function lowerGitlabConditionExpr(condition, _jobIdMap) {
+	if (condition.kind === "status") {
+		if (condition.status === "always") return "true";
+		if (condition.status === "never") return "false";
+		return "";
+	}
+	if (condition.kind === "context") return translateGitlabContextRef(condition.namespace, condition.field);
+	if (condition.kind === "step") return translateGitlabStepRef(condition);
+	const lookup = buildGitlabInputLookup(condition.refs);
+	return condition.template.replace(/\$\{([^{}]+)\}/g, (_, key) => {
+		const ref = lookup.get(key);
+		if (ref === void 0) return `\${${key}}`;
+		if (ref.kind === "context") return translateGitlabContextRef(ref.namespace, ref.field);
+		return translateGitlabStepRef(ref);
+	});
+}
+//#endregion
+//#region src/gitlab/emit.ts
+const RESERVED_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
+	"stages",
+	"variables",
+	"workflow",
+	"include",
+	"default",
+	"image",
+	"services",
+	"before_script",
+	"after_script",
+	"cache",
+	"spec",
+	"pages:deploy"
+]);
+/**
+* Emit a GitlabTargetGraph as YAML artifacts.
+* Produces one .gitlab-ci.yml file.
+*/
+function emitGitlab(targetGraph) {
+	return [{
+		path: ".gitlab-ci.yml",
+		content: stringifyTargetGraph(targetGraph)
+	}];
+}
+/**
+* Convert a GitlabTargetGraph to a YAML string.
+*/
+function stringifyTargetGraph(graph) {
+	const doc = { stages: graph.stages };
+	if (graph.autoCancel) doc.workflow = { auto_cancel: { on_new_commit: "interruptible" } };
+	if (Object.keys(graph.variables).length > 0) doc.variables = graph.variables;
+	if (graph.default) doc.default = defaultToYaml(graph.default);
+	if (graph.specInputs && Object.keys(graph.specInputs).length > 0) doc.spec = { inputs: graph.specInputs };
+	const allIncludes = collectIncludes(graph);
+	if (allIncludes.length > 0) doc.include = allIncludes;
+	if (graph.workflowRules && graph.workflowRules.length > 0) doc.workflow = {
+		...doc.workflow,
+		rules: graph.workflowRules.map(workflowRuleToYaml)
+	};
+	for (const job of graph.jobs) {
+		if (RESERVED_TOP_LEVEL_KEYS.has(job.id)) throw new GitlabTargetError(`job id '${job.id}' conflicts with a reserved top-level GitLab CI key`, "EMIT_FAILED");
+		doc[job.id] = jobToYaml(job);
+	}
+	return stringify(doc, { sortMapEntries: false });
+}
+/**
+* Convert a GitlabDefault to a YAML-compatible object.
+*/
+function defaultToYaml(def) {
+	const result = {};
+	if (def.beforeScript !== void 0) result.before_script = [...def.beforeScript];
+	if (def.afterScript !== void 0) result.after_script = [...def.afterScript];
+	if (def.timeout !== void 0) result.timeout = def.timeout;
+	if (def.retry !== void 0) {
+		const retry = { max: def.retry.max };
+		if (def.retry.exitCodes !== void 0) retry.exit_codes = [...def.retry.exitCodes];
+		result.retry = retry;
+	}
+	if (def.interruptible !== void 0) result.interruptible = def.interruptible;
+	return result;
+}
+/**
+* Collect all include entries (component + local) from a GitlabTargetGraph.
+*/
+function collectIncludes(graph) {
+	const allIncludes = [];
+	for (const inc of graph.includes) allIncludes.push({
+		component: inc.component,
+		...Object.keys(inc.inputs).length > 0 ? { inputs: inc.inputs } : {}
+	});
+	if (graph.localIncludes) for (const inc of graph.localIncludes) allIncludes.push({
+		local: inc.local,
+		...inc.inputs && Object.keys(inc.inputs).length > 0 ? { inputs: inc.inputs } : {}
+	});
+	return allIncludes;
+}
+/**
+* Convert a workflow rule to a YAML-compatible object.
+*/
+function workflowRuleToYaml(rule) {
+	const r = {};
+	if (rule.if) r.if = rule.if;
+	if (rule.changes) r.changes = rule.changes;
+	if (rule.exists) r.exists = rule.exists;
+	if (rule.variables) r.variables = rule.variables;
+	if (rule.when) r.when = rule.when;
+	return r;
+}
+/**
+* Convert a GitlabJob to a YAML-compatible object.
+*/
+function jobToYaml(job) {
+	const result = {
+		stage: job.stage,
+		script: job.script
+	};
+	const simpleFields = [
+		["image", job.image],
+		["timeout", job.timeout],
+		["interruptible", job.interruptible],
+		["resource_group", job.resourceGroup],
+		["trigger", job.trigger],
+		["release", job.release],
+		["pages", job.pages],
+		["when", job.when],
+		["start_in", job.start_in]
+	];
+	for (const [yamlKey, value] of simpleFields) if (value !== void 0 && value !== null) result[yamlKey] = value;
+	addComplexJobFields(result, job);
+	return result;
+}
+/** Add artifacts, variables, and rules fields to the result object. */
+function assignJobArtifactsVarsRules(result, job) {
+	if (job.artifacts) result.artifacts = artifactsToYaml(job.artifacts);
+	if (job.variables) result.variables = job.variables;
+	if (job.rules && job.rules.length > 0) result.rules = job.rules.map(ruleToYaml);
+}
+/** Add parallel/matrix field to the result object. */
+function assignJobParallel(result, job) {
+	if (job.parallel?.matrix) result.parallel = { matrix: job.parallel.matrix.map((row) => {
+		const wrapped = {};
+		for (const [k, v] of Object.entries(row)) wrapped[k] = Array.isArray(v) ? v : [v];
+		return wrapped;
+	}) };
+	else assignOptional(result, "parallel", job.parallel);
+}
+/** Add tags, id_tokens, services, environment, and cache fields. */
+function assignJobContainerFields(result, job) {
+	if (job.tags && job.tags.length > 0) result.tags = [...job.tags];
+	if (job.idTokens && Object.keys(job.idTokens).length > 0) result.id_tokens = idTokensToYaml(job.idTokens);
+	if (job.services && job.services.length > 0) result.services = job.services.map(serviceToYaml);
+	if (job.environment) result.environment = environmentToYaml(job.environment);
+	if (job.cache) result.cache = cacheToYaml(job.cache);
+}
+/** Add fields requiring transformation to the result object. */
+function addComplexJobFields(result, job) {
+	if (job.needs.length > 0) result.needs = [...job.needs];
+	assignOptionalList(result, "before_script", job.beforeScript);
+	assignOptionalList(result, "after_script", job.afterScript);
+	assignJobArtifactsVarsRules(result, job);
+	assignAllowFailure(result, job.allowFailure);
+	assignRetry(result, job.retry);
+	assignJobParallel(result, job);
+	assignJobContainerFields(result, job);
+}
+function assignOptional(result, key, value) {
+	if (value !== void 0) result[key] = value;
+}
+function assignOptionalList(result, key, value) {
+	if (value && value.length > 0) result[key] = [...value];
+}
+function assignAllowFailure(result, value) {
+	if (value === void 0) return;
+	if (typeof value === "boolean") result.allow_failure = value;
+	else result.allow_failure = { exit_codes: [...value.exitCodes] };
+}
+function assignRetry(result, value) {
+	if (value === void 0) return;
+	const retry = { max: Math.min(value.max, 2) };
+	if (value.when && value.when.length > 0) retry.when = [...value.when];
+	if (value.exitCodes && value.exitCodes.length > 0) retry.exit_codes = [...value.exitCodes];
+	result.retry = retry;
+}
+/**
+* Convert an artifacts spec to a YAML-compatible object.
+*/
+function artifactsToYaml(artifacts) {
+	const result = {};
+	if (artifacts.paths !== void 0) result.paths = [...artifacts.paths];
+	if (artifacts.reports !== void 0) result.reports = artifacts.reports;
+	if (artifacts.expireIn !== void 0) result.expire_in = artifacts.expireIn;
+	if (artifacts.access !== void 0) result.access = artifacts.access;
+	if (artifacts.when !== void 0) result.when = artifacts.when;
+	return result;
+}
+/**
+* Convert a job rule to a YAML-compatible object.
+*/
+function ruleToYaml(rule) {
+	const r = {};
+	if (rule.if !== void 0) r.if = rule.if;
+	if (rule.when !== void 0) r.when = rule.when;
+	if (rule.changes !== void 0) r.changes = [...rule.changes];
+	if (rule.exists !== void 0) r.exists = [...rule.exists];
+	if (rule.variables !== void 0) r.variables = rule.variables;
+	return r;
+}
+/**
+* Convert id tokens to a YAML-compatible object.
+*/
+function idTokensToYaml(idTokens) {
+	const result = {};
+	for (const [name, spec] of Object.entries(idTokens)) result[name] = { aud: spec.aud };
+	return result;
+}
+/**
+* Convert a service to a YAML-compatible object.
+*/
+function serviceToYaml(svc) {
+	const s = { name: svc.name };
+	if (svc.alias !== void 0) s.alias = svc.alias;
+	if (svc.entrypoint !== void 0) s.entrypoint = [...svc.entrypoint];
+	if (svc.command !== void 0) s.command = [...svc.command];
+	if (svc.variables !== void 0) s.variables = svc.variables;
+	return s;
+}
+/**
+* Convert an environment spec to a YAML-compatible object.
+*/
+function environmentToYaml(env) {
+	const result = { name: env.name };
+	if (env.url !== void 0) result.url = env.url;
+	if (env.action !== void 0) result.action = env.action;
+	if (env.deploymentTier !== void 0) result.deployment_tier = env.deploymentTier;
+	if (env.onStop !== void 0) result.on_stop = env.onStop;
+	return result;
+}
+/**
+* Convert a cache spec to a YAML-compatible object.
+*/
+function cacheToYaml(cache) {
+	const result = {
+		paths: [...cache.paths],
+		key: cache.key
+	};
+	if (cache.policy !== void 0) result.policy = cache.policy;
+	if (cache.fallbackKeys !== void 0) result.fallback_keys = [...cache.fallbackKeys];
+	return result;
+}
+//#endregion
+//#region src/gitlab/target.ts
+/**
+* GitLab CI target — native lowering from Definition Graph.
+* Implements the Target contract: analyze → lower → emit.
+*/
+var GitlabTarget = class {
+	name = "gitlab";
+	capabilities = gitlabCapabilities;
+	/**
+	* Analyze a Definition Graph against the GitLab capability manifest.
+	* Returns diagnostics for unsupported or emulated capabilities.
+	*/
+	analyze(graph) {
+		return analyzeCapabilities(graph, [this.capabilities]);
+	}
+	/**
+	* Lower a Definition Graph to a GitlabTargetGraph.
+	* One GitLab job per reachable Step with needs, stages, and operation mapping.
+	*/
+	lower(graph) {
+		return lowerGitlab(graph);
+	}
+	/**
+	* Emit a GitlabTargetGraph as YAML artifacts.
+	* Produces one .gitlab-ci.yml file.
+	*/
+	emit(targetGraph) {
+		return emitGitlab(targetGraph);
+	}
+	/**
+	* Compile a Definition Graph to generated artifacts and diagnostics.
+	*/
+	compile(graph) {
+		const diagnostics = this.analyze(graph);
+		const targetGraph = this.lower(graph);
+		return {
+			artifacts: this.emit(targetGraph),
+			diagnostics
+		};
+	}
+};
+/**
+* Convenience function: analyze → lower → emit in one call.
+*/
+function compileGitlab(graph) {
+	return new GitlabTarget().compile(graph);
+}
+//#endregion
+export { PluginError, analyzeCapabilities, compileGithub, compileGitlab, createPluginRegistry, defineSverkaPlugin, detectCapabilities, loadBundledRegistry, pinActionRef };
+
+//# sourceMappingURL=index.mjs.map