@intentius/chant 0.102.0 → 0.104.0

package/dist/terraform/parse.d.ts

@@ -1,47 +1,11 @@
 /**
  * Thin wasm glue for the carve-out advisor (#214 T1): read a Terraform estate's
  * `.tf` files, run them through `@cdktn/hcl2json`, merge into one tree, and hand
- * off to the pure `buildGraph`.
- *
- * `@cdktn/hcl2json` is NOT a chant dependency — it carries a ~1.8 MB wasm blob
- * and only carve-out users need it. It is lazy-loaded here and, if absent, the
- * advisor fails with a one-line install hint.
+ * off to the pure `buildGraph`. The parser loader lives in `./hcl2json`, which
+ * this module re-exports.
  */
-import type { Hcl2JsonTree, TfGraph } from "./types.js";
-/** Minimal shape of the parser exports we depend on. */
-export interface Hcl2Json {
-    parse: (filename: string, hcl: string) => Promise<Hcl2JsonTree>;
-    /** Expression-AST reference extraction (#998) — one traversal accessor per reference. */
-    getReferencesInExpression: (filename: string, expression: string) => Promise<Array<{
-        value: string;
-    }>>;
-}
-export declare class Hcl2JsonNotInstalled extends Error {
-    constructor(cause: unknown);
-}
-/**
- * The environment variable that turns on parser-input recording (chant #2483).
- *
- * When set to a file path, every `parse(filename, source)` and every
- * `getReferencesInExpression(filename, expression)` this process makes is
- * appended to that file as one JSON line before the real call runs. That is
- * how `scripts/check-hcl-parser-parity.ts` gets hold of the inline HCL the
- * test suite parses, which no corpus walk on disk would find: run the suite
- * with this set, then replay the file through two parsers and compare. Off
- * unless set, and never changes a result.
- */
-export declare const HCL2JSON_RECORD_ENV = "CHANT_HCL2JSON_RECORD";
-/** One recorded parser input, as {@link HCL2JSON_RECORD_ENV} writes it. */
-export interface Hcl2JsonRecordLine {
-    kind: "parse" | "refs";
-    filename: string;
-    text: string;
-}
-/**
- * Lazy-load the optional HCL parser. Throws `Hcl2JsonNotInstalled` with an
- * install hint when the package is missing, rather than a raw MODULE_NOT_FOUND.
- */
-export declare function loadHcl2json(): Promise<Hcl2Json>;
+import type { TfGraph } from "./types.js";
+export { loadHcl2json, Hcl2JsonNotInstalled, HCL2JSON_RECORD_ENV, type Hcl2Json, type Hcl2JsonRecordLine, } from "./hcl2json.js";
 export interface ParseTerraformOptions {
     /** Opt-in `.tfstate` path (#214 T2): overlays state-expanded instance counts. */
     statePath?: string;

package/dist/terraform/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/terraform/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAErD,wDAAwD;AACxD,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAChE,yFAAyF;IACzF,yBAAyB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CACxG;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,KAAK,EAAE,OAAO,EAOzB;CACF;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAE3D,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAkBD;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,CAStD;AAqDD,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,OAAO,CAAC,CAWvG"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/terraform/parse.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAgB,OAAO,EAAE,MAAM,SAAS,CAAC;AAErD,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,QAAQ,EACb,KAAK,kBAAkB,GACxB,MAAM,YAAY,CAAC;AAqDpB,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,OAAO,CAAC,CAWvG"}

package/dist/workspace/box-cli.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `chant workspace box`: a member's box block. Two verbs:
+ *
+ * - `box listing set <member>` (#3308) changes the box's listing
+ *   (`box-listing.ts`). A box's other configuration is changed by editing the
+ *   declaration in a reviewed change.
+ * - `box publish <member> <item> | --records` (#3165, ws-088) runs the
+ *   publisher the box block names and checks what it did (`box-publish.ts`).
+ */
+import type { CommandContext } from "../cli/registry.js";
+export declare function runWorkspaceBox(ctx: CommandContext): Promise<number>;
+//# sourceMappingURL=box-cli.d.ts.map

package/dist/workspace/box-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"box-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/box-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAStD,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAqD1E"}

package/dist/workspace/box-factory.d.ts

@@ -9,7 +9,7 @@
  * workspace and an infra workspace with a factory and no box services both
  * read and check cleanly; they just aren't plantable.
  */
-import type { BoxFactory, BoxListing, Declaration, FactoryCheckKind } from "./declaration.js";
+import type { BoxFactory, BoxListing, Declaration, FactoryCheckKind, FactoryTier } from "./declaration.js";
 import type { WorkspaceTree } from "./tree.js";
 /** Why a workspace isn't plantable. Closed. */
 export declare const PLANTABLE_REASON_CODES: readonly ["box-none", "box-several"];
@@ -36,6 +36,18 @@ export interface FactoryView {
     } | null;
     checks: string | null;
     builders: string | null;
+    /** Which builder agent builds at which tier, as declared (#3152, ws-094); empty when none is. */
+    tiers: FactoryTier[];
+    /**
+     * The builder for each member the factory builds, by tier (#3152): the
+     * entry for the tier that names the member's kind, else the tier's entry
+     * with no kinds. A tier with no entry for the member is left out, so a
+     * reader resolves a work item's tier with one lookup, without studio.
+     */
+    builderFor: Record<string, Record<string, {
+        agent: string;
+        session: string | null;
+    }>>;
     publish: {
         forge: "github";
         repo: string;
@@ -57,7 +69,16 @@ export interface ListingView {
 }
 /** Whether the declaration is plantable (#3146): exactly one member's box block declares services. */
 export declare function plantability(declaration: Declaration): Plantable;
-export declare function factoryView(f: BoxFactory | null): FactoryView | null;
+/** A box's factory as the read contract prints it. `members` gives each built member's kind, for `builderFor`. */
+export declare function factoryView(f: BoxFactory | null, members?: readonly {
+    name: string;
+    kind: string;
+}[]): FactoryView | null;
+/** The builder table (#3152): for each built member, each tier's agent, by the member's kind first and the tier's default second. */
+export declare function builderTable(f: BoxFactory, members: readonly {
+    name: string;
+    kind: string;
+}[]): FactoryView["builderFor"];
 /** The listing, hashing the cover through `read` (bytes, or null when the file can't be read). */
 export declare function listingView(l: BoxListing | null, read: (path: string) => Uint8Array | null): ListingView | null;
 /** A reader of a file's bytes in `tree` for {@link listingView}: null when the file can't be read. */
@@ -66,7 +87,10 @@ export declare function treeBytes(tree: WorkspaceTree): (path: string) => Uint8A
 export declare function graphBox(box: {
     factory: BoxFactory | null;
     listing: BoxListing | null;
-} | null, tree: WorkspaceTree): {
+} | null, tree: WorkspaceTree, members?: readonly {
+    name: string;
+    kind: string;
+}[]): {
     factory: FactoryView | null;
     listing: ListingView | null;
 } | null;

package/dist/workspace/box-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"box-factory.d.ts","sourceRoot":"","sources":["../../src/workspace/box-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE5C,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB,sCAAuE,CAAC;AAC3G,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/D;AAED,+FAA+F;AAC/F,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,IAAI,CAAC;IACtD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACnH;AAED,oGAAoG;AACpG,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,wIAAwI;IACxI,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAWhE;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,GAAG,WAAW,GAAG,IAAI,CASpE;AAED,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,GAAG,WAAW,GAAG,IAAI,CAQ/G;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,CASlF;AAED,oIAAoI;AACpI,wBAAgB,QAAQ,CAAC,GAAG,EAAE;IAAE,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,EAAE,IAAI,EAAE,aAAa,GAAG;IAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAGzL"}
+{"version":3,"file":"box-factory.d.ts","sourceRoot":"","sources":["../../src/workspace/box-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAExG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE5C,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB,sCAAuE,CAAC;AAC3G,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/D;AAED,+FAA+F;AAC/F,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,IAAI,CAAC;IACtD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iGAAiG;IACjG,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IACtF,OAAO,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACnH;AAED,oGAAoG;AACpG,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,wIAAwI;IACxI,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAWhE;AAED,kHAAkH;AAClH,wBAAgB,WAAW,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,EAAE,OAAO,GAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAO,GAAG,WAAW,GAAG,IAAI,CAW7H;AAED,qIAAqI;AACrI,wBAAgB,YAAY,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAczH;AAED,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,GAAG,WAAW,GAAG,IAAI,CAQ/G;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,CASlF;AAED,oIAAoI;AACpI,wBAAgB,QAAQ,CACtB,GAAG,EAAE;IAAE,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,EACtE,IAAI,EAAE,aAAa,EACnB,OAAO,GAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAO,GACtD;IAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAGrE"}

package/dist/workspace/box-listing.d.ts

@@ -0,0 +1,85 @@
+/**
+ * `chant workspace box listing set <member>` (#3308): change a box's listing,
+ * `members[i].box.listing` in the declaration (#3146, ws-077), through chant.
+ *
+ * ws-074 makes the repo the database and lets a tool write only through
+ * chant's write contract. The listing is configuration on the box block, so
+ * before this a tool such as hud would have had to edit `chant.workspace.json`
+ * itself. This write changes only the listing's own properties, in place, so
+ * the file keeps its formatting, key order and, in a `.jsonc` file, its
+ * comments. It can copy a cover image into the repository and point the
+ * listing at it. It validates the declaration it would write, judges every
+ * path it writes by the write scope at base (`judgePath`, the rule `check
+ * --changes` applies to the commit later), refuses a bare `--by` name under
+ * `identity.attribution: "identified"` (ws-080), prints one JSON document
+ * (`box-listing-write.schema.json`) and never commits: the caller commits, as
+ * after the records writes. Like them it holds the working tree's write lock
+ * (#3173, ws-089) from reading the declaration to writing it.
+ */
+import { type ListingView } from "./box-factory.js";
+/** The version of the document this write prints. */
+export declare const BOX_LISTING_CONTRACT_VERSION = 1;
+/** `$id` of the JSON Schema for what `box listing set` prints, shipped beside this file. */
+export declare const BOX_LISTING_WRITE_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/box-listing-write/v1/box-listing-write.schema.json";
+/** Why a listing write wrote nothing. Closed. */
+export declare const BOX_LISTING_ERROR_CODES: readonly ["declaration-missing", "declaration-ambiguous", "declaration-unparseable", "declaration-invalid", "placement-invalid", "reader-too-old", "root-chant-required", "not-a-git-repository", "revision-unknown", "write-usage-invalid", "write-input-invalid", "listing-member-unknown", "listing-box-missing", "listing-cover-invalid", "write-scope-member", "write-scope-protected", "write-scope-class-unknown", "agent-unknown", "principal-unidentified", "write-lock-timeout", "write-lock-not-held"];
+export type BoxListingErrorCode = (typeof BOX_LISTING_ERROR_CODES)[number];
+/** The listing properties a write may set. Any `x-` key is passed through as well. */
+export declare const LISTING_FIELDS: readonly ["published", "title", "line", "cover"];
+/** The largest cover image the write copies, in bytes. */
+export declare const COVER_MAX_BYTES: number;
+/** What `box listing set` prints. */
+export type BoxListingWriteDocument = {
+    $schema: string;
+    contract: number;
+    chant: string;
+    member: string;
+    /** The declaration file, from the repository root, and the sha256 of its bytes after the write (or as it would be, with dryRun). */
+    declaration: {
+        path: string;
+        sha256: string;
+    };
+    /** Every file the write changed, from the repository root: the declaration and the cover it copied. Empty when nothing changed. */
+    paths: string[];
+    changed: boolean;
+    dryRun: boolean;
+    /** The listing before the write, as status --json prints it, or null when the box declared none. */
+    previous: ListingView | null;
+    /** The listing after the write, as status --json prints it. */
+    listing: ListingView;
+    /** The cover copied with --cover, or null. */
+    cover: {
+        path: string;
+        sha256: string;
+        bytes: number;
+        type: string;
+        replaced: string | null;
+    } | null;
+} | {
+    $schema: string;
+    contract: number;
+    chant: string;
+    member: string | null;
+    error: {
+        code: BoxListingErrorCode;
+        message: string;
+    };
+};
+export interface BoxListingWriteRequest {
+    cwd: string;
+    member: string;
+    /** The listing fields as JSON text (`--from`), or undefined. */
+    fields?: string;
+    /** An image to copy in as the cover (`--cover`), from `cwd`. */
+    cover?: string;
+    /** Where to copy it, from the workspace root (`--cover-path`). */
+    coverPath?: string;
+    /** Who is writing (`--by`). */
+    by?: string;
+    /** The agent session (`CHANT_AGENT`). */
+    agent?: string;
+    dryRun?: boolean;
+}
+/** Run the write and build the document it prints. Never throws for a refusal. */
+export declare function boxListingSet(req: BoxListingWriteRequest): BoxListingWriteDocument;
+//# sourceMappingURL=box-listing.d.ts.map

package/dist/workspace/box-listing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"box-listing.d.ts","sourceRoot":"","sources":["../../src/workspace/box-listing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAA0B,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAWzE,qDAAqD;AACrD,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,4FAA4F;AAC5F,eAAO,MAAM,2BAA2B,oGAAoG,CAAC;AAE7I,iDAAiD;AACjD,eAAO,MAAM,uBAAuB,mfAaM,CAAC;AAC3C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,sFAAsF;AACtF,eAAO,MAAM,cAAc,YAAI,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAE/E,0DAA0D;AAC1D,eAAO,MAAM,eAAe,QAAkB,CAAC;AAe/C,qCAAqC;AACrC,MAAM,MAAM,uBAAuB,GAC/B;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,oIAAoI;IACpI,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,mIAAmI;IACnI,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,oGAAoG;IACpG,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7B,+DAA+D;IAC/D,OAAO,EAAE,WAAW,CAAC;IACrB,8CAA8C;IAC9C,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACtG,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEvI,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA4DD,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,GAAG,EAAE,sBAAsB,GAAG,uBAAuB,CAclF"}

package/dist/workspace/box-publish.d.ts

@@ -0,0 +1,147 @@
+/**
+ * `chant workspace box publish <member> <item> | --records` (#3165, ws-088):
+ * the one call a surface such as hud makes to publish a box's work.
+ *
+ * Publishing is the orchestrator's: studio's kit merges a built work item's
+ * branch into the box's checkout, pushes it to the box's `factory.publish`
+ * repo through its broker, opens the pull request, and sends the records a
+ * person kept uncommitted. The box block names the command that does it,
+ * `box.publisher`, so nothing is injected into a surface's environment.
+ *
+ * chant does none of that work. It reads the publisher from the declaration,
+ * applies the identity rule to `--by` (ws-080), runs the publisher from the
+ * workspace root with no shell and a JSON request on stdin, reads the last
+ * JSON object it prints, and checks the commit it names for the apply record
+ * of ws-075: `Chant-Applied-By` naming `--by`, `Chant-Applied-At`,
+ * `Chant-Applied-Commit` and a `Chant-Record` for the item, or a
+ * `Chant-Record` for each record sent. It prints one document,
+ * `box-publish.schema.json`, and never commits, pushes or calls a forge.
+ *
+ * The publisher's protocol, which `box-publish.schema.json` also states:
+ *
+ * - stdin: one JSON object, `$defs.request`.
+ * - exit 0 and a JSON object on the last line of stdout that holds one:
+ *   `$defs.answer`, with `ok: true`.
+ * - exit 2: a refusal, nothing was published, stderr says why.
+ * - any other exit: a failure, stderr says why and what was done.
+ */
+import { type FactoryView } from "./box-factory.js";
+/** The version of the document this command prints, and of the request it gives a publisher. */
+export declare const BOX_PUBLISH_CONTRACT_VERSION = 1;
+/** `$id` of the JSON Schema for what `box publish` prints, shipped beside this file. */
+export declare const BOX_PUBLISH_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/box-publish/v1/box-publish.schema.json";
+/** How long a publisher may run before chant stops it: a push and a pull request through a broker, with room to spare. */
+export declare const PUBLISH_TIMEOUT_MS = 600000;
+/** Why a publish printed no result. Closed. */
+export declare const BOX_PUBLISH_ERROR_CODES: readonly ["declaration-missing", "declaration-ambiguous", "declaration-unparseable", "declaration-invalid", "placement-invalid", "reader-too-old", "root-chant-required", "not-a-git-repository", "revision-unknown", "write-usage-invalid", "publish-member-unknown", "publish-none", "publish-refused", "publish-failed", "publish-answer-invalid", "publish-unrecorded", "principal-unidentified"];
+export type BoxPublishErrorCode = (typeof BOX_PUBLISH_ERROR_CODES)[number];
+/** What a publish is asked to do: one built work item, or the records kept uncommitted. */
+export type PublishAction = "item" | "records";
+/** A record a publisher sent, or would send with dryRun. */
+export interface PublishedRecord {
+    kind: string;
+    id: string;
+    path: string;
+    title: string | null;
+}
+/** The pull request a publisher opened, or found already open. */
+export interface PublishedPullRequest {
+    url: string;
+    number: number;
+    branch: string;
+    base: string;
+    /** owner/name of the fork the branch was pushed to, or null when it went to the repo itself. */
+    head: string | null;
+}
+/** What chant writes on the publisher's stdin. */
+export interface PublishRequest {
+    contract: number;
+    action: PublishAction;
+    member: string;
+    item: string | null;
+    by: string | null;
+    head: string | null;
+    dryRun: boolean;
+    workspace: {
+        root: string;
+    };
+    /** The workspace's factory as status --json prints it, or null when no box declares one. */
+    factory: FactoryView | null;
+}
+/** The publisher's answer, checked and with every field present. */
+export interface PublishAnswer {
+    commit: string | null;
+    records: PublishedRecord[];
+    pullRequest: PublishedPullRequest | null;
+    pushed: {
+        branch: string;
+        repo: string;
+    } | null;
+    local: string | null;
+}
+/** What `box publish` prints. */
+export type BoxPublishDocument = ({
+    $schema: string;
+    contract: number;
+    chant: string;
+    member: string;
+    action: PublishAction;
+    item: string | null;
+    by: string | null;
+    dryRun: boolean;
+    /** The publisher as the box block declares it. */
+    publisher: string;
+    /** The apply record read back from the commit's trailers, for an item; null for records and with dryRun. */
+    applied: {
+        by: string;
+        at: string;
+        commit: string;
+    } | null;
+    /** The publisher's answer as it printed it, x- fields and all. */
+    answer: Record<string, unknown>;
+} & PublishAnswer) | {
+    $schema: string;
+    contract: number;
+    chant: string;
+    member: string | null;
+    action: PublishAction | null;
+    item: string | null;
+    error: {
+        code: BoxPublishErrorCode;
+        message: string;
+    };
+    /** The publisher's answer when it printed one and something about it was refused. */
+    answer?: Record<string, unknown>;
+};
+export interface BoxPublishRequest {
+    cwd: string;
+    member: string;
+    /** The work item to publish; absent with `records`. */
+    item?: string;
+    /** Publish the records kept uncommitted instead of an item (`--records`). */
+    records?: boolean;
+    /** Who publishes (`--by`); required unless dryRun. */
+    by?: string;
+    /** A fork to push to, as owner/name (`--head`). */
+    head?: string;
+    /** Ask the publisher what would be published, and publish nothing (`--dry-run`). */
+    dryRun?: boolean;
+    /** The agent session (`CHANT_AGENT`). */
+    agent?: string;
+    /** The environment the publisher runs with; the caller's when absent. */
+    env?: NodeJS.ProcessEnv;
+    timeoutMs?: number;
+}
+/**
+ * Split a command into words as a POSIX shell splits plain words: blanks
+ * separate words, single quotes keep everything, double quotes keep
+ * everything but `\\`, `\"`, `\$` and `` \` ``, and a backslash outside quotes
+ * escapes the next character. Nothing else a shell does (variables, `~`,
+ * globs, pipes, redirection) happens: those characters are part of a word.
+ */
+export declare function splitCommand(text: string): string[];
+/** The publisher's answer, checked field by field, or a reason it is not one. */
+export declare function readAnswer(answer: Record<string, unknown>): PublishAnswer | string;
+/** Run the publish and build the document it prints. Never throws for a refusal. */
+export declare function boxPublish(req: BoxPublishRequest): BoxPublishDocument;
+//# sourceMappingURL=box-publish.d.ts.map

package/dist/workspace/box-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"box-publish.d.ts","sourceRoot":"","sources":["../../src/workspace/box-publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAS9D,gGAAgG;AAChG,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,wFAAwF,CAAC;AAE3H,0HAA0H;AAC1H,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAE1C,+CAA+C;AAC/C,eAAO,MAAM,uBAAuB,uYAUM,CAAC;AAC3C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,2FAA2F;AAC3F,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,CAAC;AAE/C,4DAA4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;CAC7B;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,WAAW,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACzC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,iCAAiC;AACjC,MAAM,MAAM,kBAAkB,GAC1B,CAAC;IACC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,4GAA4G;IAC5G,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3D,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,GAAG,aAAa,CAAC,GAClB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEN,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sDAAsD;IACtD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkCnD;AAuBD,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,GAAG,MAAM,CAuClF;AAED,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,GAAG,EAAE,iBAAiB,GAAG,kBAAkB,CAmBrE"}

package/dist/workspace/broker-protocol.d.ts

@@ -0,0 +1,190 @@
+/**
+ * The broker protocol for box capabilities, version 1 (#3164, ws-097).
+ *
+ * A box holds no credential (#2726). Each capability its box block declares,
+ * `{ name, broker, scope }`, is reached through a broker: a runtime that
+ * holds the credential, swaps the box's own token for it, and refuses what
+ * the box's declaration does not allow. chant never runs a broker (ws-052,
+ * ws-086). It specifies one here, so studio's lobby, fountain's broker or a
+ * self-hosted one serve the same box without the box changing its
+ * declaration, and `runBrokerConformance` in
+ * `@intentius/chant/workspace/conformance` checks an implementation.
+ *
+ * Every route is relative to the broker's base URL, and every request
+ * carries the box's own token: `Authorization: Bearer <token>`, or for
+ * inference `x-api-key: <token>` as the Anthropic SDK sends it, or for egress
+ * wherever the API expects its key. How a box gets its token (studio's
+ * door claiming it, fountain's sandbox callback token) is the broker's own.
+ *
+ * | Route | Capability, scope word | Does |
+ * |---|---|---|
+ * | `POST /api/box/declaration` | none | the box's steward reports its block's capabilities (`declarationReport`) |
+ * | `/llm/anthropic/...` | `inference`, `agent` | the Anthropic API, with the payer's credential in place of the box's token |
+ * | `POST /decide/v1/systemone` | `inference`, `decide` | chant's decide wire format (op/decide-backend.ts), answers with `reason` (#3345) |
+ * | `/egress/<NAME>/...` | `egress`, `<NAME>` | the secret's one host, with the secret's value in place of the box's token |
+ * | `POST /api/feedback` | `feedback`, `agent` for `entries` and `passive` for `counts` | the box's agents' feedback (studio#257) |
+ * | `/fountain/api/...` | `fountain`, `agent`, `conversations`, `sandboxes`, `vault` | Fountain's API, with the operator's Fountain key |
+ *
+ * A broker may say whose credential pays (#3474, ws-098): `payer` on the
+ * declaration's answer and the `chant-payer` header on each inference and
+ * decide answer ({@link BrokerPayer}). It is optional within version 1.
+ * A box names whose turn a request is with a `chant-grant` header the broker
+ * issued (#3477, ws-099); the broker then may spend that person's credential.
+ *
+ * The rule every broker keeps: a request that needs scope word `w` of
+ * capability `c` is refused with a 403 unless the box's last report holds an
+ * entry named `c`, brokered by this broker, whose scope lists `w`. A box that
+ * has never reported is refused. The refusal's message names `c` and `w`, so
+ * whoever reads it knows which entry to add. The box's token never reaches
+ * an upstream, and the credential or secret never comes back to the box.
+ *
+ * The `broker` word in a box block names the broker the box reaches, not an
+ * implementation: an implementation is configured with the word it answers
+ * for (`lobby` for studio's), so a box moves between implementations by
+ * where its broker URL points.
+ *
+ * A capability a lexicon or a runtime adds is a {@link BrokerCapabilitySpec}:
+ * its own route prefix, and a function from a request to the scope words it
+ * needs. `runBrokerConformance` takes extra specs and holds them to the same
+ * rule.
+ */
+/** The protocol's version, carried by the schema's `$id`. */
+export declare const BROKER_PROTOCOL_VERSION = 1;
+/** The bodies' schema, beside this module. */
+export declare const BROKER_PROTOCOL_SCHEMA = "broker-protocol.schema.json";
+/** The routes, relative to the broker's base URL. */
+export declare const BROKER_ROUTES: {
+    readonly declaration: "/api/box/declaration";
+    readonly inference: "/llm/anthropic";
+    readonly decide: "/decide/v1/systemone";
+    readonly egress: "/egress";
+    readonly feedback: "/api/feedback";
+    readonly fountain: "/fountain";
+};
+/** What the Anthropic API proxy forwards, under {@link BROKER_ROUTES.inference}. Anything else is a 404. */
+export declare const INFERENCE_FORWARDED: readonly [{
+    readonly method: "POST";
+    readonly path: RegExp;
+}, {
+    readonly method: "GET";
+    readonly path: RegExp;
+}];
+/** A secret's name in an egress path, and so a word of the `egress` scope. */
+export declare const EGRESS_SECRET_NAME: RegExp;
+/** The limits on a declaration report. */
+export declare const DECLARATION_LIMITS: {
+    readonly bytes: number;
+    readonly capabilities: 20;
+    readonly scopeWords: 50;
+    readonly wordLength: 64;
+};
+/** A capability's name, as the declaration's kind-name grammar and the lobby both allow it. */
+export declare const CAPABILITY_NAME: RegExp;
+/** A request as a broker sees it, for {@link BrokerCapabilitySpec.scopes}. */
+export interface BrokerRequest {
+    method: string;
+    /** The path from the broker's base URL, without the query. */
+    path: string;
+    /** The parsed JSON body, when the route reads one. */
+    body?: unknown;
+}
+/**
+ * One capability's broker side: the route prefixes it owns, the scope words
+ * it knows, and the words a request needs.
+ */
+export interface BrokerCapabilitySpec {
+    name: string;
+    /** Path prefixes, from the broker's base URL, this capability owns. */
+    routes: readonly string[];
+    /** The scope words and what each lets the box reach. `"<NAME>"` stands for an open set, such as egress's secret names. */
+    scopeWords: Readonly<Record<string, string>>;
+    /**
+     * The scope words `request` needs, all of them; `[]` when it needs none
+     * (inference's `/api/hello`); null when the request is not this
+     * capability's, or names nothing the capability serves (a 404).
+     */
+    scopes(request: BrokerRequest): string[] | null;
+}
+/** `inference`: the model proxy (`agent`) and the decide endpoint (`decide`). */
+export declare const INFERENCE_CAPABILITY: BrokerCapabilitySpec;
+/** `egress`: a secret the broker holds, used against its one host, by name. */
+export declare const EGRESS_CAPABILITY: BrokerCapabilitySpec;
+/** The scope words a feedback batch needs: `agent` for entries, `passive` for counts. */
+export declare function feedbackScopes(body: unknown): string[];
+/** `feedback`: the box's agents' feedback (studio#257, hud RFC-009). */
+export declare const FEEDBACK_CAPABILITY: BrokerCapabilitySpec;
+/** `fountain`: Fountain's API, on the operator's key, for the box's own conversations, sandboxes and vault. */
+export declare const FOUNTAIN_CAPABILITY: BrokerCapabilitySpec;
+/** The standard capabilities, by name. */
+export declare const STANDARD_CAPABILITIES: Readonly<Record<string, BrokerCapabilitySpec>>;
+/** A capability as a broker keeps it from a report. */
+export interface KeptCapability {
+    name: string;
+    broker: string;
+    scope: string[];
+}
+/**
+ * Whose credential pays for a box's model calls (#3474, ws-098): `shared`, a
+ * credential neither the box's owner nor its visitor owns (a house or
+ * operator key); `owner`, the box owner's own; `visitor`, the credential a
+ * person brought for this box. `principal` is the payer in ws-080's form
+ * (`github:<login>`) when the broker knows them. A broker that does not say
+ * leaves it out, and a box reads that as unknown.
+ */
+export interface BrokerPayer {
+    kind: "shared" | "owner" | "visitor";
+    principal?: string | null;
+}
+/** The payer kinds, in the protocol's order. */
+export declare const PAYER_KINDS: readonly ["shared", "owner", "visitor"];
+/** The response header that carries the payer on each answer from `/llm/anthropic` and `/decide`: `<kind>` or `<kind> <principal>`. */
+export declare const PAYER_HEADER = "chant-payer";
+/**
+ * The request header a box sends on an inference or decide request made on a
+ * person's turn (#3477, ws-099): a grant the broker itself issued to that
+ * person for this box, which the person's browser carried to the box's
+ * surface. Opaque to chant and to the box. The broker checks its own grant
+ * (issued by it, for the box whose token the request carries, not expired or
+ * revoked, the person still holding a credential), spends the person's
+ * credential, and answers `chant-payer: visitor <principal>`. A grant it does
+ * not accept is ignored, not refused: the request is paid as it would have
+ * been without one, and the payer header says so.
+ */
+export declare const GRANT_HEADER = "chant-grant";
+/** The longest grant a box sends, in characters; a broker may refuse a longer header as malformed. */
+export declare const GRANT_MAX_LENGTH = 2048;
+/** Whether `value` is a grant a box may send: printable ASCII without spaces, at most {@link GRANT_MAX_LENGTH} long. */
+export declare function isGrantValue(value: unknown): value is string;
+/** A payer as the header carries it. */
+export declare function formatPayerHeader(payer: BrokerPayer): string;
+/** The payer a `chant-payer` header value names, or undefined when it names none the protocol knows. */
+export declare function parsePayerHeader(value: string | null | undefined): BrokerPayer | undefined;
+/** The payer in a `declarationKept` answer (or any object with a `payer` field), or undefined when it has none or a malformed one. */
+export declare function payerOf(body: unknown): BrokerPayer | undefined;
+/** What a broker keeps of a box's last report, and, when it says, who pays (#3474). */
+export interface KeptDeclaration {
+    capabilities: KeptCapability[];
+    at: string;
+    payer?: BrokerPayer;
+}
+/**
+ * A report's body, checked, kept to the entries that name `broker`; or the
+ * reason it is refused with a 400. The same rules as studio's lobby
+ * (`lobby/capabilities.mjs`).
+ */
+export declare function parseDeclarationReport(body: unknown, broker: string): {
+    capabilities: KeptCapability[];
+} | {
+    error: string;
+};
+/**
+ * Why `declared` (the box's last report, or undefined when it never sent
+ * one) does not allow scope word `word` of `capability` through `broker`,
+ * naming the entry that would; null when it does.
+ */
+export declare function declaredRefusal(declared: {
+    capabilities?: readonly KeptCapability[];
+} | undefined, broker: string, capability: string, word: string): string | null;
+/** The message of a refusal body (`{ error: string }` or `{ error: { message } }`), or undefined when it is not one. */
+export declare function refusalMessage(body: unknown): string | undefined;
+//# sourceMappingURL=broker-protocol.d.ts.map

package/dist/workspace/broker-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-protocol.d.ts","sourceRoot":"","sources":["../../src/workspace/broker-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,8CAA8C;AAC9C,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AAEpE,qDAAqD;AACrD,eAAO,MAAM,aAAa;aACxB,WAAW,EAAE,sBAAsB;aACnC,SAAS,EAAE,gBAAgB;aAC3B,MAAM,EAAE,sBAAsB;aAC9B,MAAM,EAAE,SAAS;aACjB,QAAQ,EAAE,eAAe;aACzB,QAAQ,EAAE,WAAW;CACb,CAAC;AAEX,4GAA4G;AAC5G,eAAO,MAAM,mBAAmB;aAC5B,MAAM,EAAE,MAAM;aAAE,IAAI;;aACpB,MAAM,EAAE,KAAK;aAAE,IAAI;EACb,CAAC;AAEX,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,QAA2B,CAAC;AAE3D,0CAA0C;AAC1C,eAAO,MAAM,kBAAkB;aAAK,KAAK;aAAa,YAAY,EAAE,EAAE;aAAE,UAAU,EAAE,EAAE;aAAE,UAAU,EAAE,EAAE;CAAW,CAAC;AAElH,+FAA+F;AAC/F,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,0HAA0H;IAC1H,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CACjD;AAID,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,EAAE,oBAgBlC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,EAAE,oBAU/B,CAAC;AAEF,yFAAyF;AACzF,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAMtD;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,oBAWjC,CAAC;AAEF,+GAA+G;AAC/G,eAAO,MAAM,mBAAmB,EAAE,oBAkBjC,CAAC;AAEF,0CAA0C;AAC1C,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAKhF,CAAC;AAEF,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,gDAAgD;AAChD,eAAO,MAAM,WAAW,YAAI,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAEnE,uIAAuI;AACvI,eAAO,MAAM,YAAY,gBAAgB,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,gBAAgB,CAAC;AAE1C,sGAAsG;AACtG,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,wHAAwH;AACxH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE5D;AAED,wCAAwC;AACxC,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAE5D;AAED,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAI1F;AAED,sIAAsI;AACtI,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAM9D;AAED,uFAAuF;AACvF,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,YAAY,EAAE,cAAc,EAAE,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAiB5H;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE;IAAE,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;CAAE,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASnK;AAED,wHAAwH;AACxH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAKhE"}

package/dist/workspace/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAA4C,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5G,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEzE;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC3C;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EA0LrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAiEjC"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEzE;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC3C;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAiMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAiEjC"}

package/dist/workspace/composites.d.ts

@@ -61,7 +61,7 @@ export type CompositesReasonCode = (typeof COMPOSITES_REASON_CODES)[number];
 /** Why a member's runtimes are only `local`, or leave out a lexicon its config lists (#2674). Closed. */
 export declare const COMPOSITES_RUNTIME_REASON_CODES: readonly ["runtimes-config-unreadable", "runtimes-lexicon-unreadable"];
 /** Why a member's environments are only `local`, or leave out one its ledger has (#2695). Closed. */
-export declare const COMPOSITES_ENVIRONMENT_REASON_CODES: readonly ["runtimes-config-unreadable", "environments-none-declared", "environments-ledger-undeclared", "environments-ledger-unreadable"];
+export declare const COMPOSITES_ENVIRONMENT_REASON_CODES: readonly ["runtimes-config-unreadable", "environments-none-declared", "environments-ledger-undeclared", "environments-ledger-unreadable", "environments-component-undeclared"];
 export interface CompositesMember {
     name: string;
     dir: string;
@@ -88,7 +88,7 @@ export interface ComponentEntry {
     file: string | null;
     /** The runtimes it can deploy on: `local` first, then each hosting lexicon its member configures. */
     runtimes: ComponentRuntime[];
-    /** The environments it may deploy to: `local` first, then the config's, then the ledger's. */
+    /** The environments it may deploy to: `local` first, then the config's, then the ledger's, then the ones only the component declares, each with the site the component declares for it. */
     environments: ComponentEnvironment[];
 }
 export interface ComponentMatch {