forgemap 0.7.0 → 0.8.0

package/dist/bin/forgemap.mjs

@@ -175,36 +175,186 @@ async function loadForgeMapConfig(options = {}) {
 	};
 }
 //#endregion
+//#region src/utils/concurrency.ts
+/**
+* Map over `items` running at most `limit` calls of `fn` at once, preserving
+* input order in the result. Keeps `import` from spawning one subprocess per
+* repo all at once when checking remotes across a large tree.
+*/
+async function mapLimit(items, limit, fn) {
+	const results = Array.from({ length: items.length });
+	const max = Math.max(1, Math.min(limit, items.length));
+	let next = 0;
+	async function worker() {
+		while (next < items.length) {
+			const index = next++;
+			results[index] = await fn(items[index], index);
+		}
+	}
+	await Promise.all(Array.from({ length: max }, () => worker()));
+	return results;
+}
+/**
+* The entry that marks a directory as a repo. A **file** counts as much as a
+* directory: linked worktrees and submodules record their git dir in a `.git`
+* file, and an `isDirectory()` test would skip them silently.
+*/
+var GIT_MARKER = ".git";
+/**
+* How many namespace segments a forge type accepts. GitHub, Gitea and Codeberg
+* have exactly one level of owner; GitLab nests arbitrarily, and `git` is the
+* documented fallback for a GitLab-shaped remote, so it nests too.
+*/
+function namespaceDepthLimit(type) {
+	switch (type) {
+		case "gitlab":
+		case "git": return 9;
+		case "github":
+		case "gitea":
+		case "codeberg": return 1;
+	}
+}
+/**
+* Check a parsed namespace against the forge it was resolved to. Returns an
+* error message, or `null` when the depth is acceptable.
+*
+* This lives here rather than in `parseSlug` on purpose: the parser has no
+* forge, and keeping it pure is worth more than an earlier error message.
+*/
+function checkNamespaceDepth(forgeName, type, namespace) {
+	const depth = namespace.split("/").filter(Boolean).length;
+	const limit = namespaceDepthLimit(type);
+	if (depth <= limit) return null;
+	if (limit === 1) return `Forge "${forgeName}" (type ${type}) does not support nested namespaces: "${namespace}" has ${depth} segments, expected 1.`;
+	return `Namespace "${namespace}" is ${depth} segments deep; forgemap supports at most ${limit}.`;
+}
+//#endregion
 //#region src/repos/scan.ts
-async function listDirs$1(path) {
+var WALK_CONCURRENCY = 32;
+async function readEntries$1(path) {
 	try {
-		return (await readdir(path, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
-	} catch (error) {
-		if (error.code === "ENOENT") return [];
-		throw error;
+		const entries = await readdir(path, { withFileTypes: true });
+		return {
+			dirs: entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name),
+			isRepo: entries.some((e) => e.name === GIT_MARKER)
+		};
+	} catch {
+		return null;
 	}
 }
-async function scanRepos(options) {
+async function safeStat(path) {
+	try {
+		const s = await stat(path);
+		return Math.trunc(s.mtimeMs);
+	} catch {
+		return 0;
+	}
+}
+/**
+* One rule for every forge type: a directory holding a `.git` entry **is** a
+* repo, and everything above it is namespace. The walk stops at the first
+* marker and never descends into a repo, which keeps submodules and nested
+* checkouts out without a special case for either.
+*
+* `segments` is the path accumulated below the forge dir; the repo takes the
+* last one and the namespace the rest, so a repo needs at least two.
+*
+* The cap counts those segments inclusive of the repo's own — a namespace at
+* exactly MAX_NAMESPACE_DEPTH must still have its repo visited, or the
+* resolver would accept a path the scanner can never find.
+*/
+async function walk(ctx, dirPath, segments) {
+	if (segments.length > 10) {
+		ctx.hints.push({
+			path: dirPath,
+			reason: "too-deep"
+		});
+		return;
+	}
+	const entries = await readEntries$1(dirPath);
+	if (!entries) {
+		if (segments.length === 0) ctx.entries.push([dirPath, "d:0:[]"]);
+		else ctx.hints.push({
+			path: dirPath,
+			reason: "no-repo"
+		});
+		return;
+	}
+	if (entries.isRepo) {
+		ctx.entries.push([dirPath, "r"]);
+		if (segments.length < 2) {
+			ctx.hints.push({
+				path: dirPath,
+				reason: "missing-namespace"
+			});
+			return;
+		}
+		const owner = segments.slice(0, -1).join("/");
+		const repo = segments.at(-1);
+		ctx.repos.push({
+			forgeName: ctx.forgeName,
+			forge: ctx.forge,
+			owner,
+			repo,
+			localPath: dirPath,
+			slug: `${owner}/${repo}`
+		});
+		return;
+	}
+	const names = [...entries.dirs].sort();
+	const mtime = await safeStat(dirPath);
+	ctx.entries.push([dirPath, `d:${mtime}:${JSON.stringify(names)}`]);
+	if (names.length === 0) {
+		if (segments.length > 0) ctx.hints.push({
+			path: dirPath,
+			reason: "no-repo"
+		});
+		return;
+	}
+	await mapLimit(names, WALK_CONCURRENCY, (name) => walk(ctx, join(dirPath, name), [...segments, name]));
+}
+/**
+* Walk the configured layout once, producing the repos, the branches that
+* yielded none, and a fingerprint of what was observed.
+*
+* The fingerprint records each namespace directory's mtime **and** its sorted
+* child names, plus which directories turned out to be repos. The names are
+* what make it reliable: mtimes compare at millisecond granularity, so two
+* clones landing inside the same millisecond hash identically and a stale
+* cache would win. Recording the repo classification is what catches a plain
+* directory becoming a checkout (`git init`) without any name moving at all.
+*/
+async function scanLayout(options) {
 	const { config, configDir } = options;
 	const root = resolveRoot(config.root, configDir);
+	const contexts = await mapLimit(Object.entries(config.forges), WALK_CONCURRENCY, async ([forgeName, forge]) => {
+		const ctx = {
+			forgeName,
+			forge,
+			repos: [],
+			hints: [],
+			entries: []
+		};
+		await walk(ctx, join(root, forge.dir), []);
+		return ctx;
+	});
+	const entries = [[root, `m:${await safeStat(root)}`]];
 	const repos = [];
-	for (const [forgeName, forge] of Object.entries(config.forges)) {
-		const forgeRoot = join(root, forge.dir);
-		const owners = await listDirs$1(forgeRoot);
-		for (const owner of owners) {
-			const ownerPath = join(forgeRoot, owner);
-			const repoNames = await listDirs$1(ownerPath);
-			for (const repo of repoNames) repos.push({
-				forgeName,
-				forge,
-				owner,
-				repo,
-				localPath: join(ownerPath, repo),
-				slug: `${owner}/${repo}`
-			});
-		}
+	const hints = [];
+	for (const ctx of contexts) {
+		repos.push(...ctx.repos);
+		hints.push(...ctx.hints);
+		entries.push(...ctx.entries);
 	}
-	return repos;
+	entries.sort((a, b) => a[0].localeCompare(b[0]));
+	return {
+		repos,
+		hints,
+		fingerprint: createHash("sha1").update(entries.map(([p, marker]) => `${p}:${marker}`).join("\n")).digest("hex")
+	};
+}
+async function scanRepos(options) {
+	return (await scanLayout(options)).repos;
 }
 //#endregion
 //#region src/repos/cache.ts
@@ -223,54 +373,18 @@ function cachePath(root) {
 	const hash = createHash("sha1").update(root).digest("hex").slice(0, 16);
 	return join(cacheDir(), `scan-${hash}.json`);
 }
-async function safeStat(path) {
-	try {
-		const s = await stat(path);
-		return Math.trunc(s.mtimeMs);
-	} catch {
-		return 0;
-	}
-}
-async function safeListDirs(path) {
-	try {
-		return (await readdir(path, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
-	} catch {
-		return [];
-	}
-}
 /**
-* Fingerprint of the layout: directory mtimes for root, forge.dir and
-* every owner, plus the repo names each owner holds. Catches new clones
-* / removals at any of those levels. Stops short of stat-ing each repo
-* dir — that would mostly duplicate the scan it's meant to avoid.
-*
-* The repo names are what make the check reliable. An owner's mtime
-* alone is not enough: a repo cloned beside an existing one moves only
-* that mtime, and mtimes are compared at millisecond granularity, so
-* two clones landing inside the same millisecond hash identically and
-* a stale cache wins. Listing the names makes invalidation independent
-* of clock and filesystem timestamp resolution.
-*
-* Stats are issued in parallel: one batch per forge for its forge.dir +
-* owner list, all forges in parallel. Beats the sequential version by
-* an order of magnitude at thousands of owners.
+* Fingerprint of the layout, computed by the same walk that finds the repos —
+* see {@link scanLayout}, which owns what goes into it. Since a directory is
+* only known to be a repo once its entries have been read, the fingerprint
+* cannot be cheaper than the scan; producing both from one walk is what keeps
+* the cold path from paying for the tree twice.
 */
 async function computeFingerprint(config, configDir) {
-	const root = resolveRoot(config.root, configDir);
-	const perForge = await Promise.all(Object.values(config.forges).map(async (forge) => {
-		const forgeRoot = join(root, forge.dir);
-		const [forgeMtime, owners] = await Promise.all([safeStat(forgeRoot), safeListDirs(forgeRoot)]);
-		const ownerEntries = await Promise.all(owners.map(async (owner) => {
-			const ownerPath = join(forgeRoot, owner);
-			const [mtime, repos] = await Promise.all([safeStat(ownerPath), safeListDirs(ownerPath)]);
-			return [ownerPath, `${mtime}:${JSON.stringify(repos.sort())}`];
-		}));
-		return [[forgeRoot, String(forgeMtime)], ...ownerEntries];
-	}));
-	const entries = [[root, String(await safeStat(root))]];
-	for (const group of perForge) entries.push(...group);
-	entries.sort((a, b) => a[0].localeCompare(b[0]));
-	return createHash("sha1").update(entries.map(([p, marker]) => `${p}:${marker}`).join("\n")).digest("hex");
+	return (await scanLayout({
+		config,
+		configDir
+	})).fingerprint;
 }
 async function readCacheFile(file) {
 	try {
@@ -292,26 +406,35 @@ async function scanReposCached(options) {
 		if (cached) {
 			const age = Date.now() - cached.writtenAt;
 			if (trustTtl && age < ttl()) return cached.repos;
-			const fingerprint = await computeFingerprint(config, configDir);
-			if (cached.fingerprint === fingerprint) {
+			const scan = await scanLayout({
+				config,
+				configDir
+			});
+			if (cached.fingerprint === scan.fingerprint) {
 				await writeCacheFile(file, {
 					...cached,
 					writtenAt: Date.now()
 				});
 				return cached.repos;
 			}
+			await writeCacheFile(file, {
+				fingerprint: scan.fingerprint,
+				writtenAt: Date.now(),
+				repos: scan.repos
+			});
+			return scan.repos;
 		}
 	}
-	const repos = await scanRepos({
+	const scan = await scanLayout({
 		config,
 		configDir
 	});
 	await writeCacheFile(file, {
-		fingerprint: await computeFingerprint(config, configDir),
+		fingerprint: scan.fingerprint,
 		writtenAt: Date.now(),
-		repos
+		repos: scan.repos
 	});
-	return repos;
+	return scan.repos;
 }
 /**
 * Append a freshly-cloned repo to the cache without touching the
@@ -348,9 +471,15 @@ async function removeCachedRepo(options, localPath) {
 }
 //#endregion
 //#region src/utils/exec.ts
-function execInherit(command, args) {
+function execInherit(command, args, options = {}) {
 	return new Promise((resolvePromise, rejectPromise) => {
-		const child = spawn(command, args, { stdio: "inherit" });
+		const child = spawn(command, args, {
+			env: options.env ? {
+				...process.env,
+				...options.env
+			} : void 0,
+			stdio: "inherit"
+		});
 		child.on("error", rejectPromise);
 		child.on("close", (code) => {
 			resolvePromise({ code: code ?? 0 });
@@ -476,33 +605,13 @@ function isRepoMissing(stderr) {
 	return /repository not found/.test(s) || /remote:.*not found/.test(s) || /\b404\b/.test(s) || /could not find repository/.test(s);
 }
 //#endregion
-//#region src/utils/concurrency.ts
-/**
-* Map over `items` running at most `limit` calls of `fn` at once, preserving
-* input order in the result. Keeps `import` from spawning one subprocess per
-* repo all at once when checking remotes across a large tree.
-*/
-async function mapLimit(items, limit, fn) {
-	const results = Array.from({ length: items.length });
-	const max = Math.max(1, Math.min(limit, items.length));
-	let next = 0;
-	async function worker() {
-		while (next < items.length) {
-			const index = next++;
-			results[index] = await fn(items[index], index);
-		}
-	}
-	await Promise.all(Array.from({ length: max }, () => worker()));
-	return results;
-}
-//#endregion
 //#region src/forges/github.ts
-var GRAPHQL_CHUNK = 100;
-var FALLBACK_CONCURRENCY = 8;
+var GRAPHQL_CHUNK$1 = 100;
+var FALLBACK_CONCURRENCY$1 = 8;
 var GH_TIMEOUT_MS = 2e4;
 /** Single-repo REST check. `gh api` follows the redirect a renamed/transferred
 *  repo issues, so the returned full_name reveals the canonical owner/repo. */
-async function checkOne(owner, repo) {
+async function checkOne$1(owner, repo) {
 	const result = await execCapture("gh", [
 		"api",
 		`repos/${owner}/${repo}`,
@@ -539,7 +648,7 @@ async function checkOne(owner, repo) {
 		canonicalUrl: `https://github.com/${canonicalOwner}/${canonicalRepo}.git`
 	};
 }
-function buildQuery(chunk) {
+function buildQuery$1(chunk) {
 	return `query {\n${chunk.map((input, i) => `  r${i}: repository(owner: ${JSON.stringify(input.owner)}, name: ${JSON.stringify(input.repo)}) { nameWithOwner }`).join("\n")}\n}`;
 }
 var githubAdapter = {
@@ -558,7 +667,7 @@ var githubAdapter = {
 			state: "unknown",
 			reason: "gh not installed"
 		};
-		return checkOne(owner, repo);
+		return checkOne$1(owner, repo);
 	},
 	/**
 	* One GraphQL request resolves up to GRAPHQL_CHUNK repos at once. GraphQL
@@ -573,13 +682,13 @@ var githubAdapter = {
 			reason: "gh not installed"
 		}));
 		const results = Array.from({ length: inputs.length }, () => null);
-		for (let start = 0; start < inputs.length; start += GRAPHQL_CHUNK) {
-			const chunk = inputs.slice(start, start + GRAPHQL_CHUNK);
+		for (let start = 0; start < inputs.length; start += GRAPHQL_CHUNK$1) {
+			const chunk = inputs.slice(start, start + GRAPHQL_CHUNK$1);
 			const res = await execCapture("gh", [
 				"api",
 				"graphql",
 				"-f",
-				`query=${buildQuery(chunk)}`
+				`query=${buildQuery$1(chunk)}`
 			], { timeoutMs: GH_TIMEOUT_MS });
 			let data = null;
 			try {
@@ -601,8 +710,153 @@ var githubAdapter = {
 				}
 			}
 		}
+		await mapLimit(results.flatMap((r, i) => r === null ? [i] : []), FALLBACK_CONCURRENCY$1, async (index) => {
+			results[index] = await checkOne$1(inputs[index].owner, inputs[index].repo);
+		});
+		return results;
+	}
+};
+//#endregion
+//#region src/forges/gitlab.ts
+var GRAPHQL_CHUNK = 100;
+var FALLBACK_CONCURRENCY = 8;
+var GLAB_TIMEOUT_MS = 2e4;
+var MISSING_GLAB = "GitLab CLI (`glab`) is not installed. Install it from https://gitlab.com/gitlab-org/cli and run `glab auth login`.";
+/**
+* Pin every invocation to the forge's own host. `glab repo clone` has no
+* `--hostname` flag, and leaning on the user's global `glab config set host`
+* would make behaviour depend on state forgemap never set.
+*/
+function glabEnv(forge) {
+	return { GITLAB_HOST: forge.host };
+}
+/** Split GitLab's `full path` into namespace and project. */
+function splitFullPath(fullPath) {
+	const segments = fullPath.split("/").filter(Boolean);
+	if (segments.length < 2) return null;
+	return {
+		owner: segments.slice(0, -1).join("/"),
+		repo: segments.at(-1)
+	};
+}
+/**
+* Single-project REST check. `projects/<url-encoded path>` answers with
+* `path_with_namespace`, GitLab's counterpart to GitHub's `full_name`, so a
+* differing answer is a move and a 404 is a deletion.
+*/
+async function checkOne(forge, owner, repo) {
+	const result = await execCapture("glab", ["api", `projects/${encodeURIComponent(`${owner}/${repo}`)}`], {
+		timeoutMs: GLAB_TIMEOUT_MS,
+		env: glabEnv(forge)
+	});
+	if (result.timedOut) return {
+		state: "unknown",
+		reason: "glab api timed out"
+	};
+	if (result.code !== 0) {
+		if (/404|not found/i.test(result.stderr)) return { state: "gone" };
+		return {
+			state: "unknown",
+			reason: result.stderr.trim() || `glab api exited with code ${result.code}`
+		};
+	}
+	let fullPath;
+	try {
+		fullPath = JSON.parse(result.stdout).path_with_namespace;
+	} catch {
+		fullPath = void 0;
+	}
+	const canonical = fullPath ? splitFullPath(fullPath) : null;
+	if (!canonical) return {
+		state: "unknown",
+		reason: "could not parse glab api path_with_namespace"
+	};
+	if (canonical.owner === owner && canonical.repo === repo) return {
+		state: "exists",
+		canonical
+	};
+	return {
+		state: "moved",
+		canonical,
+		canonicalUrl: `https://${forge.host}/${canonical.owner}/${canonical.repo}.git`
+	};
+}
+function buildQuery(chunk) {
+	return `query {\n${chunk.map((input, i) => `  r${i}: project(fullPath: ${JSON.stringify(`${input.owner}/${input.repo}`)}) { fullPath }`).join("\n")}\n}`;
+}
+var gitlabAdapter = {
+	async clone({ forge, owner, repo, dest }) {
+		if (!await hasCommand("glab")) throw new Error(MISSING_GLAB);
+		const { code } = await execInherit("glab", [
+			"repo",
+			"clone",
+			`${owner}/${repo}`,
+			dest
+		], { env: glabEnv(forge) });
+		if (code !== 0) throw new Error(`glab repo clone exited with code ${code}`);
+	},
+	async checkRemote({ forge, owner, repo }) {
+		if (!await hasCommand("glab")) return {
+			state: "unknown",
+			reason: "glab not installed"
+		};
+		return checkOne(forge, owner, repo);
+	},
+	/**
+	* Mirrors the GitHub adapter: one aliased GraphQL request resolves up to
+	* GRAPHQL_CHUNK projects, and each miss — `null` could mean gone *or*
+	* renamed — costs a single REST call to tell the two apart.
+	*
+	* A batch may span several configured GitLab forges, so the inputs are
+	* grouped by host before they are chunked: one server must never be asked
+	* about another's projects. Where the same full path exists on both — a
+	* public mirror of an internal project — the wrong server would otherwise
+	* answer `exists` for a project this one does not have.
+	*/
+	async checkRemotes(inputs) {
+		if (inputs.length === 0) return [];
+		if (!await hasCommand("glab")) return inputs.map(() => ({
+			state: "unknown",
+			reason: "glab not installed"
+		}));
+		const results = Array.from({ length: inputs.length }, () => null);
+		const byHost = /* @__PURE__ */ new Map();
+		inputs.forEach((input, index) => {
+			const indices = byHost.get(input.forge.host);
+			if (indices) indices.push(index);
+			else byHost.set(input.forge.host, [index]);
+		});
+		for (const indices of byHost.values()) for (let start = 0; start < indices.length; start += GRAPHQL_CHUNK) {
+			const slice = indices.slice(start, start + GRAPHQL_CHUNK);
+			const chunk = slice.map((index) => inputs[index]);
+			const res = await execCapture("glab", [
+				"api",
+				"graphql",
+				"-f",
+				`query=${buildQuery(chunk)}`
+			], {
+				timeoutMs: GLAB_TIMEOUT_MS,
+				env: glabEnv(chunk[0].forge)
+			});
+			let data = null;
+			try {
+				const parsed = JSON.parse(res.stdout);
+				data = parsed.data ?? parsed;
+			} catch {
+				data = null;
+			}
+			for (let i = 0; i < chunk.length; i++) {
+				const node = data?.[`r${i}`];
+				const canonical = node?.fullPath ? splitFullPath(node.fullPath) : null;
+				if (canonical) results[slice[i]] = {
+					state: "exists",
+					canonical
+				};
+			}
+		}
 		await mapLimit(results.flatMap((r, i) => r === null ? [i] : []), FALLBACK_CONCURRENCY, async (index) => {
-			results[index] = await checkOne(inputs[index].owner, inputs[index].repo);
+			const input = inputs[index];
+			results[index] = await checkOne(input.forge, input.owner, input.repo);
 		});
 		return results;
 	}
@@ -612,8 +866,8 @@ var githubAdapter = {
 function getForgeAdapter(type) {
 	switch (type) {
 		case "github": return githubAdapter;
+		case "gitlab": return gitlabAdapter;
 		case "git": return gitAdapter;
-		case "gitlab":
 		case "gitea":
 		case "codeberg": throw new Error(`Forge type "${type}" is not implemented yet. Use type: 'git' for a vanilla git-clone fallback.`);
 		default: throw new Error(`Unknown forge type: ${String(type)}`);
@@ -621,21 +875,29 @@ function getForgeAdapter(type) {
 }
 //#endregion
 //#region src/slug/parse.ts
-var SHORT_RE = /^([\w.-]+)\/([\w.-]+)$/;
-var NAMED_RE = /^([\w.-]+):([\w.-]+)\/([\w.-]+)$/;
-var SSH_RE = /^git@([\w.-]+):([\w.-]+)\/([\w.-]+?)(?:\.git)?$/;
+var SEGMENT = String.raw`[\w.-]+`;
+var SHORT_RE = new RegExp(`^(${SEGMENT}(?:/${SEGMENT})*)/(${SEGMENT})$`);
+var NAMED_RE = new RegExp(`^(${SEGMENT}):(${SEGMENT}(?:/${SEGMENT})*)/(${SEGMENT})$`);
+var SSH_RE = new RegExp(`^git@(${SEGMENT}):(${SEGMENT}(?:/${SEGMENT})*)/(${SEGMENT}?)(?:\\.git)?$`);
 function stripGitSuffix(repo) {
 	return repo.endsWith(".git") ? repo.slice(0, -4) : repo;
 }
 /**
+* Split `<namespace…>/<repo>` into its two halves: the **last** segment is the
+* repo, everything before it the namespace. Collapses to today's result
+* whenever there are exactly two segments.
+*/
+function splitPath(segments) {
+	return {
+		owner: segments.slice(0, -1).join("/"),
+		repo: stripGitSuffix(segments.at(-1))
+	};
+}
+/**
 * Whether the input is *shaped* like a strict slug. Every form
-* {@link parseSlug} accepts — `owner/repo`, `forge:owner/repo`, SSH and
-* URL — contains a `/`, so a bare term like `gild` can never be one and is
+* {@link parseSlug} accepts — `namespace/repo`, `forge:namespace/repo`, SSH
+* and URL — contains a `/`, so a bare term like `gild` can never be one and is
 * free to be treated as a fuzzy query instead.
-*
-* Shaped-like is deliberately not the same as valid: `foo/bar/baz` is shaped
-* like a slug, so it stays a hard parse error rather than silently degrading
-* into a fuzzy search for something the user clearly meant as a slug.
 */
 function looksLikeSlug(input) {
 	return input.trim().includes("/");
@@ -646,8 +908,7 @@ function parseSlug(input) {
 	const ssh = SSH_RE.exec(trimmed);
 	if (ssh) return {
 		host: ssh[1],
-		owner: ssh[2],
-		repo: stripGitSuffix(ssh[3])
+		...splitPath([...ssh[2].split("/"), ssh[3]])
 	};
 	if (/^https?:\/\//.test(trimmed)) {
 		let url;
@@ -656,25 +917,22 @@ function parseSlug(input) {
 		} catch {
 			throw new Error(`Invalid URL: ${trimmed}`);
 		}
-		const segments = url.pathname.split("/").filter(Boolean);
-		if (segments.length < 2) throw new Error(`URL must contain owner and repo: ${trimmed}`);
+		let segments = url.pathname.split("/").filter(Boolean);
+		const separator = segments.indexOf("-");
+		if (separator !== -1) segments = segments.slice(0, separator);
+		if (segments.length < 2) throw new Error(`URL must contain a namespace and repo: ${trimmed}`);
 		return {
 			host: url.host,
-			owner: segments[0],
-			repo: stripGitSuffix(segments[1])
+			...splitPath(segments)
 		};
 	}
 	const named = NAMED_RE.exec(trimmed);
 	if (named) return {
 		forgeName: named[1],
-		owner: named[2],
-		repo: stripGitSuffix(named[3])
+		...splitPath([...named[2].split("/"), named[3]])
 	};
 	const short = SHORT_RE.exec(trimmed);
-	if (short) return {
-		owner: short[1],
-		repo: stripGitSuffix(short[2])
-	};
+	if (short) return splitPath([...short[1].split("/"), short[2]]);
 	throw new Error(`Unrecognized slug format: ${input}`);
 }
 //#endregion
@@ -958,16 +1216,31 @@ function remoteBlocker(state) {
 	if (state === "exists" || state === "moved") return null;
 	return state === "gone" ? "remote no longer exists" : "remote unreachable";
 }
-/** Check each candidate's remote, grouped by forge so GitHub can batch. */
+/**
+* Check each candidate's remote, grouped by forge **type and host** so an
+* adapter can batch.
+*
+* The host is half the key, not a detail: two configured forges of one type —
+* gitlab.com beside a self-hosted instance — are two different servers, and a
+* batch spanning both would ask one of them about the other's projects. Where
+* the same path exists on each (a public mirror of an internal project), that
+* answers `exists` for the wrong server, and `remoteBlocker` reads `exists` as
+* "safe to delete".
+*/
 async function classifyRemotes(candidates) {
-	const byType = /* @__PURE__ */ new Map();
+	const groups = /* @__PURE__ */ new Map();
 	for (const c of candidates) {
-		const list = byType.get(c.repo.forge.type);
-		if (list) list.push(c);
-		else byType.set(c.repo.forge.type, [c]);
+		const { type, host } = c.repo.forge;
+		const key = `${type}\0${host}`;
+		const group = groups.get(key);
+		if (group) group.items.push(c);
+		else groups.set(key, {
+			type,
+			items: [c]
+		});
 	}
 	const results = /* @__PURE__ */ new Map();
-	await Promise.all(Array.from(byType, async ([type, items]) => {
+	await Promise.all(Array.from(groups.values(), async ({ type, items }) => {
 		const inputs = items.map((c) => ({
 			forge: c.repo.forge,
 			owner: c.owner,
@@ -1013,35 +1286,43 @@ async function classifyRemotes(candidates) {
 	}));
 	return results;
 }
-async function safeReaddir(path) {
+/**
+* Collect the empty namespace directories at and below `path`, deepest first,
+* and report whether `path` itself turned out to be one.
+*
+* A namespace is empty when it holds nothing, or holds only namespaces that
+* are themselves empty — which is what makes this follow a nested layout
+* rather than the single owner level it used to assume. The walk never enters
+* a repo: a `.git` entry means the directory is a checkout, and a checkout is
+* never a leftover however empty its subdirectories are.
+*/
+async function collectEmptyDirs(path, depth, empties) {
+	if (depth > 10) return false;
+	let entries;
 	try {
-		return await readdir(path);
+		entries = await readdir(path, { withFileTypes: true });
 	} catch {
-		return null;
+		return false;
 	}
-}
-/** Empty owner directories (and a server directory that holds only such empty
-*  owners) under the configured forge dirs. Detection only — no removal. */
+	if (entries.some((e) => e.name === ".git")) return false;
+	if (entries.length === 0) {
+		empties.push(path);
+		return true;
+	}
+	if (entries.some((e) => !e.isDirectory())) return false;
+	let allEmpty = true;
+	for (const entry of entries) if (!await collectEmptyDirs(join(path, entry.name), depth + 1, empties)) allEmpty = false;
+	if (allEmpty) empties.push(path);
+	return allEmpty;
+}
+/** Empty namespace directories (server dir included) under the configured
+*  forge dirs, deepest first. Detection only — no removal. */
 async function findEmptyDirs(root, config) {
 	const empties = [];
-	for (const forge of Object.values(config.forges)) {
-		const serverPath = join(root, forge.dir);
-		const owners = await safeReaddir(serverPath);
-		if (owners === null) continue;
-		let emptyCount = 0;
-		for (const owner of owners) {
-			const ownerPath = join(serverPath, owner);
-			const inner = await safeReaddir(ownerPath);
-			if (inner !== null && inner.length === 0) {
-				empties.push(ownerPath);
-				emptyCount++;
-			}
-		}
-		if (owners.length === 0 || emptyCount === owners.length) empties.push(serverPath);
-	}
+	for (const forge of Object.values(config.forges)) await collectEmptyDirs(join(root, forge.dir), 0, empties);
 	return empties;
 }
-/** Remove the dirs from findEmptyDirs (owners before server dirs). */
+/** Remove the dirs from findEmptyDirs (children before their parents). */
 async function pruneEmptyDirs(root, config) {
 	const empties = await findEmptyDirs(root, config);
 	let removed = 0;
@@ -1233,6 +1514,8 @@ function resolveSlug(parsed, options) {
 		forgeName = config.defaultForge;
 		forge = candidate;
 	}
+	const depthError = checkNamespaceDepth(forgeName, forge.type, parsed.owner);
+	if (depthError) throw new Error(depthError);
 	const localPath = join(resolveRoot(config.root, configDir), forge.dir, parsed.owner, parsed.repo);
 	return {
 		forgeName,
@@ -2254,34 +2537,51 @@ var forgeCommand = defineCommand({
 });
 //#endregion
 //#region src/repos/import.ts
-async function listDirs(path) {
+async function readEntries(path) {
 	try {
-		return (await readdir(path, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
+		const entries = await readdir(path, { withFileTypes: true });
+		return {
+			dirs: entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name),
+			isRepo: entries.some((e) => e.name === GIT_MARKER)
+		};
 	} catch (error) {
-		if (error.code === "ENOENT") return [];
+		if (error.code === "ENOENT") return null;
 		throw error;
 	}
 }
 /**
-* Structure-driven depth-3 walk of `<path>/<serverDir>/<owner>/<repo>`.
-* Unlike `scanRepos`, this is config-free: every top-level directory is a
-* candidate server dir, and the names are discovered rather than configured.
+* Structure-driven walk of `<path>/<serverDir>/<namespace…>/<repo>`. Unlike
+* `scanRepos` this is config-free: every top-level directory is a candidate
+* server dir, and the names are discovered rather than configured.
+*
+* A `.git` entry ends a branch, so a nested namespace is adopted as readily as
+* a flat one and a repo's own subdirectories are never mistaken for more of
+* the layout. A branch that dead-ends without one is still surfaced — that is
+* the candidate `analyzeLocal` reports as `not-a-git-repo`, which is the whole
+* reason `import` looks at directories a scan would simply skip.
 */
-async function discoverForgemapLayout(path) {
-	const repos = [];
-	for (const serverDir of await listDirs(path)) {
-		const serverPath = join(path, serverDir);
-		for (const owner of await listDirs(serverPath)) {
-			const ownerPath = join(serverPath, owner);
-			for (const repo of await listDirs(ownerPath)) repos.push({
-				serverDir,
-				owner,
-				repo,
-				localPath: join(ownerPath, repo)
-			});
-		}
+async function discoverBelow(serverDir, dirPath, segments, found) {
+	if (segments.length > 10) return;
+	const entries = await readEntries(dirPath);
+	const isLeaf = entries === null || entries.dirs.length === 0;
+	if (segments.length >= 2 && (entries?.isRepo || isLeaf)) {
+		found.push({
+			serverDir,
+			owner: segments.slice(0, -1).join("/"),
+			repo: segments.at(-1),
+			localPath: dirPath
+		});
+		return;
 	}
-	return repos;
+	if (entries === null || entries.isRepo) return;
+	for (const name of entries.dirs) await discoverBelow(serverDir, join(dirPath, name), [...segments, name], found);
+}
+async function discoverForgemapLayout(path) {
+	const root = await readEntries(path);
+	if (!root) return [];
+	const found = [];
+	for (const serverDir of root.dirs) await discoverBelow(serverDir, join(path, serverDir), [], found);
+	return found;
 }
 function forgeTypeForHost(host) {
 	return host === "github.com" ? "github" : "git";
@@ -2943,7 +3243,7 @@ var infoCommand = defineCommand({
 	async run({ args }) {
 		const binary = resolveBinary(process.argv[1]);
 		const info = {
-			version: "0.7.0",
+			version: "0.8.0",
 			build: detectBuild(binary.resolved),
 			binary,
 			node: process.version,
@@ -3754,6 +4054,7 @@ async function runChecks(config, configDir) {
 	const types = new Set(Object.values(config.forges).map((f) => f.type));
 	const needsGit = types.has("git") || types.size > 0;
 	const needsGh = types.has("github");
+	const gitlabForges = Object.entries(config.forges).filter(([, forge]) => forge.type === "gitlab");
 	if (needsGit) checks.push(await hasCommand("git") ? {
 		name: "git CLI",
 		severity: "ok",
@@ -3784,8 +4085,69 @@ async function runChecks(config, configDir) {
 		severity: "fail",
 		message: "install from https://cli.github.com/"
 	});
+	if (gitlabForges.length > 0) if (await hasCommand("glab")) {
+		checks.push({
+			name: "glab CLI",
+			severity: "ok",
+			message: "on PATH"
+		});
+		for (const [name, forge] of gitlabForges) {
+			const auth = await execCapture("glab", [
+				"auth",
+				"status",
+				"--hostname",
+				forge.host
+			]);
+			checks.push(auth.code === 0 ? {
+				name: `glab auth (${name})`,
+				severity: "ok",
+				message: `authenticated at ${forge.host}`
+			} : {
+				name: `glab auth (${name})`,
+				severity: "warn",
+				message: `not logged in — run \`glab auth login --hostname ${forge.host}\``
+			});
+		}
+	} else checks.push({
+		name: "glab CLI",
+		severity: "fail",
+		message: "install from https://gitlab.com/gitlab-org/cli"
+	});
+	checks.push(await layoutCheck(config, configDir));
 	return checks;
 }
+var HINT_LABEL = {
+	"no-repo": "holds no git repo",
+	"missing-namespace": "is a repo with no namespace above it",
+	"too-deep": `is deeper than 10 levels`
+};
+var HINTS_SHOWN = 5;
+/**
+* A repo is a directory holding a `.git` entry, so a branch that never reaches
+* one simply drops out of `list`, `status` and `pick`. That is easy to read as
+* "where did my repo go", which is exactly the question this command exists to
+* answer — so name the branches rather than leaving them silent. A hint, never
+* a failure: an odd layout is not a broken one.
+*/
+async function layoutCheck(config, configDir) {
+	const { repos, hints } = await scanLayout({
+		config,
+		configDir
+	});
+	const count = `${repos.length} repo${repos.length === 1 ? "" : "s"}`;
+	if (hints.length === 0) return {
+		name: "layout",
+		severity: "ok",
+		message: count
+	};
+	const shown = hints.slice(0, HINTS_SHOWN).map((hint) => `${hint.path} ${HINT_LABEL[hint.reason]}`);
+	const rest = hints.length > HINTS_SHOWN ? ` (+${hints.length - HINTS_SHOWN} more)` : "";
+	return {
+		name: "layout",
+		severity: "warn",
+		message: `${count}; ${shown.join(", ")}${rest}`
+	};
+}
 function severitySymbol(severity) {
 	if (severity === "ok") return colors.green("✓");
 	if (severity === "warn") return colors.yellow("!");
@@ -4081,7 +4443,7 @@ var completionCommand = defineCommand({
 runMain(defineCommand({
 	meta: {
 		name: "forgemap",
-		version: "0.7.0",
+		version: "0.8.0",
 		description: "Manage a local repo layout of the form <root>/<forge.dir>/<owner>/<repo>"
 	},
 	subCommands: {