@intentius/chant 0.124.30 → 0.124.32

package/dist/workspace/chant-migrations/fountain-retired-kinds.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `fountain-retired-kinds` (#3987, managoat/managoat#2793): take a project's
+ * fountain declarations off the kinds Managoat v0.29.0 removed.
+ *
+ * Managoat dropped the team, its schedules, webhooks and persistent
+ * sandboxes. Since #3987 the fountain lexicon keeps `Teammate`, `Schedule`
+ * and `Webhook` only as stubs, and FTN025 fails a build that declares one, or
+ * an Agent with `sandbox_mode: "persistent"`. chud's template (and the studio
+ * kit's copy of it) declares a Teammate and a Schedule for its night shift
+ * and its factory, and gives the dispatcher a persistent sandbox, so a repo
+ * migrated off chud stopped building with chant 0.124.32.
+ *
+ * In each `chant` member, every `.ts` file that imports the fountain lexicon
+ * loses its `new Teammate(...)`, `new Schedule(...)` and `new Webhook(...)`
+ * declarations, those names from the import, any one-line constant only they
+ * used, and `sandbox_mode: "persistent"`. Each removed Schedule is listed as
+ * not moved: its clock now lives outside Managoat. A removed declaration whose
+ * name the file still uses elsewhere is a conflict, as is a file that still
+ * names a retired kind after the edits.
+ *
+ * The plan is empty once no fountain file declares a retired kind.
+ */
+import type { ChantMigration, NotMoved } from "../chant-migrations.js";
+export declare const FOUNTAIN_RETIRED_KINDS = "fountain-retired-kinds";
+interface Rewrite {
+    text: string;
+    notMoved: NotMoved[];
+    conflict?: string;
+}
+/** The file without its retired declarations, or null when it has none. */
+export declare function rewriteFountainFile(path: string, original: string): Rewrite | null;
+export declare const fountainRetiredKinds: ChantMigration;
+export {};
+//# sourceMappingURL=fountain-retired-kinds.d.ts.map

package/dist/workspace/chant-migrations/fountain-retired-kinds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fountain-retired-kinds.d.ts","sourceRoot":"","sources":["../../../src/workspace/chant-migrations/fountain-retired-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAA6C,QAAQ,EAA+B,MAAM,qBAAqB,CAAC;AAG5I,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AA2D/D,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CA8ClF;AA6CD,eAAO,MAAM,oBAAoB,EAAE,cAIlC,CAAC"}

package/dist/workspace/chant-migrations/fountain-retired-kinds.js

@@ -0,0 +1,176 @@
+/**
+ * `fountain-retired-kinds` (#3987, managoat/managoat#2793): take a project's
+ * fountain declarations off the kinds Managoat v0.29.0 removed.
+ *
+ * Managoat dropped the team, its schedules, webhooks and persistent
+ * sandboxes. Since #3987 the fountain lexicon keeps `Teammate`, `Schedule`
+ * and `Webhook` only as stubs, and FTN025 fails a build that declares one, or
+ * an Agent with `sandbox_mode: "persistent"`. chud's template (and the studio
+ * kit's copy of it) declares a Teammate and a Schedule for its night shift
+ * and its factory, and gives the dispatcher a persistent sandbox, so a repo
+ * migrated off chud stopped building with chant 0.124.32.
+ *
+ * In each `chant` member, every `.ts` file that imports the fountain lexicon
+ * loses its `new Teammate(...)`, `new Schedule(...)` and `new Webhook(...)`
+ * declarations, those names from the import, any one-line constant only they
+ * used, and `sandbox_mode: "persistent"`. Each removed Schedule is listed as
+ * not moved: its clock now lives outside Managoat. A removed declaration whose
+ * name the file still uses elsewhere is a conflict, as is a file that still
+ * names a retired kind after the edits.
+ *
+ * The plan is empty once no fountain file declares a retired kind.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { join, posix } from "node:path";
+import { applyEdits, readText } from "./chud-lexicon-exit.js";
+export const FOUNTAIN_RETIRED_KINDS = "fountain-retired-kinds";
+const DESCRIPTION = "drop the fountain kinds Managoat removed: Teammate, Schedule, Webhook and persistent sandboxes (#3987)";
+const FOUNTAIN = "@intentius/chant-lexicon-fountain";
+const RETIRED = ["Teammate", "Schedule", "Webhook"];
+const IMPORT = /import\s*\{([^}]*)\}\s*from\s*"@intentius\/chant-lexicon-fountain";/;
+/** A top-level declaration of a retired kind, with the doc comment just above it. */
+const DECLARATION = /(?:\/\*\*(?:(?!\*\/)[\s\S])*\*\/\n)?export const (\w+) = new (Teammate|Schedule|Webhook)\(\{\n[\s\S]*?\n\}\);\n(?:\n)?/g;
+const PERSISTENT = /^[ \t]*sandbox_mode:\s*"persistent",?[ \t]*\n/gm;
+/** The template's prose about what the edits remove. */
+const TEMPLATE_PROSE = [
+    {
+        find: " * build by this name (CHUD_FOUNTAIN_VAULT overrides it), and the two\n * Teammates below run with it.\n",
+        replace: " * build by this name (CHUD_FOUNTAIN_VAULT overrides it).\n",
+    },
+    {
+        find: " * Steward does: a persistent sandbox (its checkout survives a turn) and no\n" +
+            " * permission prompts (nobody is at the keyboard; chant's own gates still need\n" +
+            " * a person). Its Teammate gives it one thread, so two schedule fires never\n" +
+            " * run two dispatchers on one checkout, and the Schedule is what triggers it.\n",
+        replace: " * Steward does, with no permission prompts (nobody is at the keyboard;\n" +
+            " * chant's own gates still need a person). Managoat has no team or scheduler\n" +
+            " * any more: a clock outside it runs `chant run dispatch --on fountain`.\n",
+    },
+];
+/** The README row `chud-lexicon-exit` wrote, which names the factory's Schedule. */
+const README_EDITS = [
+    { find: " (the agents that build the app, as fountain specs; its factory Schedule still calls the kit's dispatch Op)", replace: " (the agents that build the app, as fountain specs)" },
+];
+function tsFiles(dir, rel = "", out = []) {
+    let entries;
+    try {
+        entries = readdirSync(join(dir, rel), { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const e of entries) {
+        const path = rel ? posix.join(rel, e.name) : e.name;
+        if (e.isDirectory()) {
+            if (e.name === "node_modules" || e.name === "dist" || e.name.startsWith("."))
+                continue;
+            tsFiles(dir, path, out);
+        }
+        else if (e.name.endsWith(".ts") && !e.name.endsWith(".d.ts")) {
+            out.push(path);
+        }
+    }
+    return out;
+}
+/** The text with its comments and string contents blanked, so prose naming a kind is not a use of it. */
+const code = (text) => text.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`(?:\\.|[^`\\])*`/g, '""');
+const uses = (text, name) => new RegExp(`(?<![\\w$.])${name}(?![\\w$])`).test(code(text));
+/** The file without its retired declarations, or null when it has none. */
+export function rewriteFountainFile(path, original) {
+    const imported = original.match(IMPORT);
+    if (!imported)
+        return null;
+    const declared = [...original.matchAll(DECLARATION)];
+    const persistent = PERSISTENT.test(original);
+    PERSISTENT.lastIndex = 0;
+    if (declared.length === 0 && !persistent)
+        return null;
+    const notMoved = [];
+    let text = original;
+    const removed = [];
+    const referenced = new Set();
+    for (const [block, name, kind] of declared) {
+        text = text.replace(block, "");
+        removed.push(name);
+        const body = block.slice(block.indexOf("new "));
+        for (const id of body.match(/\b[a-zA-Z_$][\w$]*\b/g) ?? [])
+            referenced.add(id);
+        if (kind === "Schedule") {
+            const cron = body.match(/cron:\s*"([^"]+)"/)?.[1];
+            notMoved.push({
+                what: `the Schedule ${name}${cron ? ` (cron "${cron}")` : ""} in ${path}`,
+                where: "a clock outside Managoat, which has no scheduler: a CI schedule or a CronJob running `chant run <op> --on fountain`, or `chant operator --steward`",
+            });
+        }
+        else if (kind === "Webhook") {
+            notMoved.push({ what: `the Webhook ${name} in ${path}`, where: "nothing: read a run's outcome from `chant run status` or `log`, or the conversation's event stream" });
+        }
+    }
+    text = text.replace(PERSISTENT, "");
+    // A one-line constant only the removed declarations used (the template's `nightlyMeta`).
+    for (const id of referenced) {
+        const line = new RegExp(`^export const ${id} = [^\\n]*;\\n\\n?`, "m");
+        const hit = text.match(line);
+        if (hit && !uses(text.replace(hit[0], ""), id))
+            text = text.replace(hit[0], "");
+    }
+    const names = imported[1].split(",").map((n) => n.trim()).filter(Boolean);
+    const kept = names.filter((n) => !RETIRED.includes(n) || uses(text.replace(IMPORT, ""), n));
+    if (kept.length !== names.length)
+        text = text.replace(IMPORT, `import { ${kept.join(", ")} } from "${FOUNTAIN}";`);
+    text = applyEdits(text, TEMPLATE_PROSE).text.replace(/\n{3,}/g, "\n\n").replace(/\n+$/, "\n");
+    const dangling = removed.filter((n) => uses(text, n));
+    if (dangling.length > 0)
+        return { text, notMoved, conflict: `${dangling.join(", ")} ${dangling.length === 1 ? "is" : "are"} still used after the retired declarations go. Remove ${dangling.length === 1 ? "that use" : "those uses"} by hand, then run the upgrade again` };
+    const still = RETIRED.filter((k) => new RegExp(`\\bnew ${k}\\(`).test(text));
+    if (still.length > 0)
+        return { text, notMoved, conflict: `a ${still.join(", ")} declaration this migration cannot read. Remove it by hand, then run the upgrade again` };
+    return { text, notMoved };
+}
+function planRetiredKinds(ctx) {
+    const { dir } = ctx;
+    let decl = null;
+    try {
+        decl = JSON.parse(readText(dir, "chant.workspace.json") ?? "null");
+    }
+    catch {
+        decl = null;
+    }
+    const members = (decl?.members ?? []).filter((m) => m.kind === "chant" && m.dir).map((m) => posix.normalize(m.dir));
+    if (members.length === 0 && existsSync(join(dir, "chant.config.ts")))
+        members.push(".");
+    const changes = [];
+    const notMoved = [];
+    const conflicts = [];
+    for (const member of members) {
+        for (const rel of tsFiles(join(dir, member))) {
+            const path = posix.join(member, rel);
+            const text = readText(dir, path);
+            if (text === undefined || !text.includes(FOUNTAIN))
+                continue;
+            const rewrite = rewriteFountainFile(path, text);
+            if (!rewrite)
+                continue;
+            if (rewrite.conflict) {
+                conflicts.push({ path, reason: rewrite.conflict });
+                continue;
+            }
+            changes.push({ path, action: "write", why: "no Teammate, Schedule, Webhook or persistent sandbox, which Managoat removed and FTN025 fails", data: Buffer.from(rewrite.text) });
+            notMoved.push(...rewrite.notMoved);
+        }
+    }
+    if (changes.length === 0 && conflicts.length === 0)
+        return null;
+    const readme = readText(dir, "README.md");
+    if (readme !== undefined && conflicts.length === 0) {
+        const edited = applyEdits(readme, README_EDITS).text;
+        if (edited !== readme)
+            changes.push({ path: "README.md", action: "write", why: "the agents no longer declare a factory Schedule", data: Buffer.from(edited) });
+    }
+    return { id: FOUNTAIN_RETIRED_KINDS, description: DESCRIPTION, changes, notMoved, conflicts };
+}
+export const fountainRetiredKinds = {
+    id: FOUNTAIN_RETIRED_KINDS,
+    description: DESCRIPTION,
+    plan: planRetiredKinds,
+};

package/dist/workspace/chant-migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chant-migrations.d.ts","sourceRoot":"","sources":["../../src/workspace/chant-migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAQ9C,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,8FAA8F;IAC9F,IAAI,CAAC,GAAG,EAAE,qBAAqB,GAAG,kBAAkB,GAAG,IAAI,CAAC;CAC7D;AAED,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAOrD,CAAC;AAEF,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,qBAAqB,EAAE,UAAU,GAAE,SAAS,cAAc,EAAqB,GAAG,kBAAkB,EAAE,CAS9I;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,EAAE,UAAU,GAAE,SAAS,cAAc,EAAqB,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAW9K;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAYjG;AAED,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,GAAG,oBAAoB,CAS3F"}
+{"version":3,"file":"chant-migrations.d.ts","sourceRoot":"","sources":["../../src/workspace/chant-migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAS9C,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,8FAA8F;IAC9F,IAAI,CAAC,GAAG,EAAE,qBAAqB,GAAG,kBAAkB,GAAG,IAAI,CAAC;CAC7D;AAED,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAQrD,CAAC;AAEF,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,qBAAqB,EAAE,UAAU,GAAE,SAAS,cAAc,EAAqB,GAAG,kBAAkB,EAAE,CAS9I;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,EAAE,UAAU,GAAE,SAAS,cAAc,EAAqB,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAW9K;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAYjG;AAED,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,GAAG,oBAAoB,CAS3F"}

package/dist/workspace/chant-migrations.js

@@ -40,6 +40,7 @@ import { chudLexiconExitShipInputs } from "./chant-migrations/chud-lexicon-exit-
 import { chudLexiconExitShipPolicy } from "./chant-migrations/chud-lexicon-exit-ship-policy.js";
 import { chudLexiconExitFlySite } from "./chant-migrations/chud-lexicon-exit-fly-site.js";
 import { chudLexiconExitLiveNames } from "./chant-migrations/chud-lexicon-exit-live-names.js";
+import { fountainRetiredKinds } from "./chant-migrations/fountain-retired-kinds.js";
 /** Every migration chant ships, in the order they are planned. */
 export const CHANT_MIGRATIONS = [
     chudLexiconExit,
@@ -48,6 +49,7 @@ export const CHANT_MIGRATIONS = [
     chudLexiconExitShipPolicy,
     chudLexiconExitFlySite,
     chudLexiconExitLiveNames,
+    fountainRetiredKinds,
 ];
 /** The plans for a scope: each migration not yet in the lineage that finds something to move. */
 export function planChantMigrations(ctx, migrations = CHANT_MIGRATIONS) {

package/dist/workspace/checks/boxes.d.ts

@@ -28,15 +28,15 @@
  * listed here after these two.
  *
  * WSP125 (`box-fountain-callback-undeclared`, #2780) is the one credential a
- * box gets without asking. fountain v0.21.0 gives every persistent sandbox a
- * callback token scoped to its owner (`FOUNTAIN_TOKEN`, `sandbox_api_access:
- * owner`), and a fountain `Box` is always persistent, so its member's block
- * has to say so: the capability `fountain-callback`, brokered by `fountain`,
+ * box gets without asking. fountain gives every sandbox a callback token
+ * scoped to its owner (`FOUNTAIN_TOKEN`, `sandbox_api_access: owner`) unless
+ * its conversation asks for none, and a fountain `Box` runs with it, so its
+ * member's block has to say so: the capability `fountain-callback`, brokered by `fountain`,
  * with scope `owner`. It is named apart from `fountain`, the API access a
  * lobby may broker for the same box. A member builds a Box when one of its TypeScript or JavaScript files
  * imports `Box` from `@intentius/chant-lexicon-fountain` and calls it, read as
- * syntax and never run. Upstream, managoat/fountain#2497 asks for a way to run
- * a persistent agent with no callback token.
+ * syntax and never run. Upstream, managoat/fountain#2497 asked for a way to run
+ * a box's agent with no callback token.
  *
  * WSP126 (`box-intent-unknown`) and WSP127 (`box-intent-unconstrained`), #2850,
  * read the decision record a box block names as its intent (`box-intent.ts`).

package/dist/workspace/checks/boxes.js

@@ -28,15 +28,15 @@
  * listed here after these two.
  *
  * WSP125 (`box-fountain-callback-undeclared`, #2780) is the one credential a
- * box gets without asking. fountain v0.21.0 gives every persistent sandbox a
- * callback token scoped to its owner (`FOUNTAIN_TOKEN`, `sandbox_api_access:
- * owner`), and a fountain `Box` is always persistent, so its member's block
- * has to say so: the capability `fountain-callback`, brokered by `fountain`,
+ * box gets without asking. fountain gives every sandbox a callback token
+ * scoped to its owner (`FOUNTAIN_TOKEN`, `sandbox_api_access: owner`) unless
+ * its conversation asks for none, and a fountain `Box` runs with it, so its
+ * member's block has to say so: the capability `fountain-callback`, brokered by `fountain`,
  * with scope `owner`. It is named apart from `fountain`, the API access a
  * lobby may broker for the same box. A member builds a Box when one of its TypeScript or JavaScript files
  * imports `Box` from `@intentius/chant-lexicon-fountain` and calls it, read as
- * syntax and never run. Upstream, managoat/fountain#2497 asks for a way to run
- * a persistent agent with no callback token.
+ * syntax and never run. Upstream, managoat/fountain#2497 asked for a way to run
+ * a box's agent with no callback token.
  *
  * WSP126 (`box-intent-unknown`) and WSP127 (`box-intent-unconstrained`), #2850,
  * read the decision record a box block names as its intent (`box-intent.ts`).
@@ -68,7 +68,7 @@ export const WSP_BOX_UNBROKERED = "WSP122";
 export const WSP_BOX_FOUNTAIN_CALLBACK = "WSP125";
 export const WSP_BOX_INTENT_UNKNOWN = "WSP126";
 export const WSP_BOX_INTENT_UNCONSTRAINED = "WSP127";
-/** The fountain lexicon's package, whose `Box` composite runs a persistent sandbox. */
+/** The fountain lexicon's package, whose `Box` composite declares a box's agent. */
 const FOUNTAIN_LEXICON = "@intentius/chant-lexicon-fountain";
 /**
  * The capability a box block declares for fountain's callback token (#2780).
@@ -379,7 +379,7 @@ export const BOX_CHECKS = [
     {
         id: WSP_BOX_FOUNTAIN_CALLBACK,
         name: "box-fountain-callback-undeclared",
-        description: "A box member that builds a fountain Box declares the callback token fountain gives its persistent sandbox: the fountain-callback capability, brokered by fountain, with scope owner.",
+        description: "A box member that builds a fountain Box declares the callback token fountain gives its sandbox: the fountain-callback capability, brokered by fountain, with scope owner.",
         severity: "error",
         configurable: true,
         check(ctx) {
@@ -424,7 +424,7 @@ export const BOX_CHECKS = [
                     checkId: this.id,
                     severity: this.severity,
                     code: "box-fountain-callback-undeclared",
-                    message: `box-fountain-callback-undeclared: member ${m.name} builds a fountain Box (${at.path}), and fountain v0.21.0 gives a persistent box's sandbox ` +
+                    message: `box-fountain-callback-undeclared: member ${m.name} builds a fountain Box (${at.path}), and fountain gives a box's sandbox ` +
                         `a callback token scoped to its owner (FOUNTAIN_TOKEN); ${why}. Declare ${expected} in the box block ` +
                         `(managoat/fountain#2497 tracks running without it)`,
                     entity: m.name,

package/dist/workspace/ci-green-forge.d.ts

@@ -30,8 +30,8 @@ export interface CheckRun {
     url: string | null;
     /**
      * Set when the "check run" is a chant Op run (#4044, `ci.green.source:
-     * "runs"`): the run's id and env, the runner whose statement it carries,
-     * and that statement. `name` is then the Op's name and `id` the run's end
+     * "runs"`): the run's id and env, and the runner whose statement it
+     * carries with that statement, or a null signer for an unsigned run. `name` is then the Op's name and `id` the run's end
      * time in milliseconds, which orders a re-run after the run it replaced.
      */
     opRun?: OpRunRef;
@@ -42,8 +42,10 @@ export interface CheckRun {
 export interface OpRunRef {
     id: string;
     env: string;
-    signer: string;
-    statement: NonNullable<OpRunRecord["statement"]>;
+    /** The runner whose statement the run carries, or null for an unsigned run, which counts unless `ci.green.signedSince` asks for one (#4156). */
+    signer: string | null;
+    /** The run's statement, when it has one. */
+    statement?: NonNullable<OpRunRecord["statement"]>;
 }
 export interface CiForge {
     kind: ForgeKind;

package/dist/workspace/ci-green-forge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-green-forge.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-forge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAwC,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,gDAAgD;AAChD,MAAM,WAAW,QAAQ;IACvB,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,MAAM,EAAE,MAAM,CAAC;IACf,8HAA8H;IAC9H,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,6GAA6G;IAC7G,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wDAAwD;AACxD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAKD,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAkCjE;AAED,0EAA0E;AAC1E,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,IAAI,EAAE,MAAM,EAKvB;CACF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAiB,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,OAAO,CAW9I"}
+{"version":3,"file":"ci-green-forge.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-forge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAwC,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,gDAAgD;AAChD,MAAM,WAAW,QAAQ;IACvB,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,MAAM,EAAE,MAAM,CAAC;IACf,8HAA8H;IAC9H,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,6GAA6G;IAC7G,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wDAAwD;AACxD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,gJAAgJ;IAChJ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAKD,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAkCjE;AAED,0EAA0E;AAC1E,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,IAAI,EAAE,MAAM,EAKvB;CACF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAiB,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,OAAO,CAW9I"}

package/dist/workspace/ci-green.d.ts

@@ -41,12 +41,16 @@
  * pipelines run as chant Ops, such as one on GitLab or Forgejo, gets green
  * and revoked tags with no forge check runs. A phase's patterns then match
  * Op names, a run counts for the commit its record names as `gitSha`, and
- * the latest run of each Op decides, by its end time. A run counts only when
- * its record carries a statement signed by a runner key whose principal
- * holds the `runner` role at base (`./trust/op-run-statement.ts`); the tick
- * ignores and reports any other, so it neither greens nor revokes a commit.
- * A tick from runs signs every tag it makes, and each run in the tag's
- * record names the Op run's id and carries its statement.
+ * the latest run of each Op decides, by its end time. Signing is opt-in
+ * (#4156): an unsigned run counts, with no signer, and a run whose statement
+ * a runner key holding the `runner` role at base signed counts with that
+ * signer (`./trust/op-run-statement.ts`). A run whose statement is there and
+ * does not verify is ignored and reported, so it neither greens nor revokes
+ * a commit. With `ci.green.signedSince`, an unsigned run counts only on a
+ * strict first-parent ancestor of that commit, as an unsigned tag does. A
+ * tick given a runner key signs the tags it makes, and each run in the
+ * tag's record names the Op run's id and carries its statement when it has
+ * one.
  */
 import { type CommitLink } from "./commit-links.js";
 import { type CiGreen, type CiPhase, type CiSource } from "./declaration.js";
@@ -206,6 +210,14 @@ export declare function unsignedHistory(top: string, signedSince: string): Set<s
  * `declaration-invalid` when `signedSince` names no commit here.
  */
 export declare function readCiTags(top: string, green?: CiGreen | null, base?: string | null): CiTags;
+/**
+ * Whether the workspace at `cwd` requires signed runs (#4156): its
+ * `ci.green.signedSince`, or null when it sets none, declares no
+ * `ci.green`, or has no declaration chant can read. Signing is opt-in, so
+ * only this makes `ci serve` refuse to start without a trusted runner key
+ * and `ci run` and `chant run` warn about a run they leave unsigned.
+ */
+export declare function signedRunsRequired(cwd: string): string | null;
 export interface TickRequest {
     cwd: string;
     /**
@@ -256,7 +268,7 @@ export declare function ciTagSigner(top: string, base: string, pem: string, what
 export declare function ciTick(req: TickRequest): Promise<TickResult>;
 /** The Op runs on the ledger, judged, as check runs by commit. */
 export interface OpRunSource {
-    /** The signed runs on `sha`, each as a check run named for its Op. */
+    /** The runs on `sha` that count, each as a check run named for its Op. */
     checkRuns(sha: string): CheckRun[];
     /** The runs on each commit that do not count, by commit. */
     ignored: Map<string, IgnoredOpRun[]>;
@@ -267,14 +279,18 @@ export interface OpRunSource {
  * going. The id is the run's end time in milliseconds, so the latest run of
  * an Op is its latest attempt.
  */
-export declare function opRunCheckRun(record: OpRunRecord, signer: string): CheckRun;
+export declare function opRunCheckRun(record: OpRunRecord, signer: string | null): CheckRun;
 /**
  * Judge every Op run record that names a commit against `.chant/trust.json`
  * at `base` (#4044), from the run ledger the project at `cwd` writes to. A
- * record with a valid statement becomes a check run on its `gitSha`; any
- * other is kept as an ignored run. Reads local refs only.
+ * record with a valid statement becomes a check run on its `gitSha` with
+ * its signer, and an unsigned one becomes a check run with signer null
+ * (#4156). A record whose statement does not verify is kept as an ignored
+ * run. With `signedSince` (`ci.green.signedSince`) an unsigned record counts
+ * only on a strict first-parent ancestor of that commit, and is ignored
+ * elsewhere. Reads local refs only.
  */
-export declare function readOpRunSource(cwd: string, top: string, base: string): Promise<OpRunSource>;
+export declare function readOpRunSource(cwd: string, top: string, base: string, signedSince?: string | null): Promise<OpRunSource>;
 /**
  * What `chant run <op> --key` signs a run's record with (#4044): the runner
  * key `.chant/trust.json` at the checkout's `HEAD` lists for a principal
@@ -351,7 +367,7 @@ export interface CiListRun {
     opRun?: {
         id: string;
         env: string;
-        signer: string;
+        signer: string | null;
     };
 }
 export interface CiListPhase {

package/dist/workspace/ci-green.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-green.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAA6C,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5F,OAAO,EAA6E,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AACrJ,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAUjD,OAAO,EAA6D,KAAK,YAAY,EAAoB,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5J,iIAAiI;AACjI,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,eAAO,MAAM,uBAAuB,4FAA4F,CAAC;AAEjI,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,mQAAkH,CAAC;AACpJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,IAAI,EAAE,gBAAgB;IADjC,YACW,IAAI,EAAE,gBAAgB,EAC/B,OAAO,EAAE,MAAM,EAIhB;CACF;AAID,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAElD,4GAA4G;AAC5G,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtE;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAOpE;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AASD,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,YAAY,CAiBvF;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,+CAA+C;IAC/C,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,6FAA6F;IAC7F,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI,CAAC;CACpD;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,QAAQ,EAAE,GAAG,aAAa,CAMvF;AAID,8GAA8G;AAC9G,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,QAAQ,CAAC;IACjB,iEAAiE;IACjE,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,qCAAqC;IACrC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9C,6GAA6G;IAC7G,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,6GAA6G;IAC7G,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB,6IAA6I;IAC7I,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mHAAmH;IACnH,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC;CAC9B;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvD,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,sHAAsH;IACtH,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,GAAG,EAAE,IAAI,CAAC;IACV,+EAA+E;IAC/E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAKD,qDAAqD;AACrD,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAI/C;AAmBD,qHAAqH;AACrH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,CAW3H;AAED,+HAA+H;AAC/H,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,CAIrJ;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAsB1E;AAkED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,sFAAsF;IACtF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,iDAAiD;AACjD,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnC,wEAAwE;IACxE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAQ7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,OAAO,GAAG,IAAW,EAAE,IAAI,GAAE,MAAM,GAAG,IAAW,GAAG,MAAM,CA0BxG;AAaD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC;IAClC,0EAA0E;IAC1E,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,iEAAiE;IACjE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wFAAwF;IACxF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iDAAiD;IACjD,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,SAAuB,GAAG,WAAW,CAiB5G;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA8ElE;AAID,kEAAkE;AAClE,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,EAAE,CAAC;IACnC,4DAA4D;IAC5D,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;CACtC;AAID;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CAa3E;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBlG;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAOpH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO9D;AAgCD,2HAA2H;AAC3H,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAKtF;AAED,uCAAuC;AACvC,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,UAAQ,GAAG,MAAM,CAuBhE;AAYD,MAAM,MAAM,iBAAiB,GACzB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,yHAAyH;IACzH,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACtF,gIAAgI;IAChI,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE7G;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,iBAAiB,CA6BjG;AAID,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,iBAAiB,gFAAgF,CAAC;AAE/G,2GAA2G;AAC3G,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAEvE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,sIAAsI;IACtI,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,SAAS,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB;;;;OAIG;IACH,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,2GAA2G;IAC3G,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3H,oIAAoI;IACpI,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,8CAA8C;IAC9C,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,2IAA2I;IAC3I,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GACtB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,wBAAwB;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oBAAoB;IACpB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAW7G,0GAA0G;AAC1G,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,GAAG,cAAc,CAE3E;AAYD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CA4DtE;AAED,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,MAAM,CAUnF"}
+{"version":3,"file":"ci-green.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAA6C,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5F,OAAO,EAA6E,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AACrJ,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAUjD,OAAO,EAA6D,KAAK,YAAY,EAAoB,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5J,iIAAiI;AACjI,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,eAAO,MAAM,uBAAuB,4FAA4F,CAAC;AAEjI,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,mQAAkH,CAAC;AACpJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,IAAI,EAAE,gBAAgB;IADjC,YACW,IAAI,EAAE,gBAAgB,EAC/B,OAAO,EAAE,MAAM,EAIhB;CACF;AAID,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAElD,4GAA4G;AAC5G,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtE;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAOpE;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AASD,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,YAAY,CAiBvF;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,+CAA+C;IAC/C,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,6FAA6F;IAC7F,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI,CAAC;CACpD;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,QAAQ,EAAE,GAAG,aAAa,CAMvF;AAID,8GAA8G;AAC9G,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,QAAQ,CAAC;IACjB,iEAAiE;IACjE,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,qCAAqC;IACrC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9C,6GAA6G;IAC7G,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,6GAA6G;IAC7G,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB,6IAA6I;IAC7I,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mHAAmH;IACnH,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC;CAC9B;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvD,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,sHAAsH;IACtH,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,GAAG,EAAE,IAAI,CAAC;IACV,+EAA+E;IAC/E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAKD,qDAAqD;AACrD,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAI/C;AAmBD,qHAAqH;AACrH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,CAW3H;AAED,+HAA+H;AAC/H,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,CAIrJ;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAsB1E;AAkED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,sFAAsF;IACtF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,iDAAiD;AACjD,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnC,wEAAwE;IACxE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAQ7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,OAAO,GAAG,IAAW,EAAE,IAAI,GAAE,MAAM,GAAG,IAAW,GAAG,MAAM,CA0BxG;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM7D;AAaD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC;IAClC,0EAA0E;IAC1E,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,iEAAiE;IACjE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wFAAwF;IACxF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iDAAiD;IACjD,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,SAAuB,GAAG,WAAW,CAiB5G;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA2ElE;AAID,kEAAkE;AAClE,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,EAAE,CAAC;IACnC,4DAA4D;IAC5D,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;CACtC;AAID;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAalF;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAyBrI;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAOpH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO9D;AAgCD,2HAA2H;AAC3H,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAKtF;AAED,uCAAuC;AACvC,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,UAAQ,GAAG,MAAM,CAuBhE;AAYD,MAAM,MAAM,iBAAiB,GACzB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,yHAAyH;IACzH,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACtF,gIAAgI;IAChI,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE7G;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,iBAAiB,CA6BjG;AAID,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,iBAAiB,gFAAgF,CAAC;AAE/G,2GAA2G;AAC3G,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAEvE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,sIAAsI;IACtI,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC5D;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,SAAS,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB;;;;OAIG;IACH,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,2GAA2G;IAC3G,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3H,oIAAoI;IACpI,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,8CAA8C;IAC9C,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,2IAA2I;IAC3I,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GACtB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,wBAAwB;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oBAAoB;IACpB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAY7G,0GAA0G;AAC1G,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,GAAG,cAAc,CAE3E;AAYD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CA4DtE;AAED,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,MAAM,CAUnF"}

package/dist/workspace/ci-green.js

@@ -41,12 +41,16 @@
  * pipelines run as chant Ops, such as one on GitLab or Forgejo, gets green
  * and revoked tags with no forge check runs. A phase's patterns then match
  * Op names, a run counts for the commit its record names as `gitSha`, and
- * the latest run of each Op decides, by its end time. A run counts only when
- * its record carries a statement signed by a runner key whose principal
- * holds the `runner` role at base (`./trust/op-run-statement.ts`); the tick
- * ignores and reports any other, so it neither greens nor revokes a commit.
- * A tick from runs signs every tag it makes, and each run in the tag's
- * record names the Op run's id and carries its statement.
+ * the latest run of each Op decides, by its end time. Signing is opt-in
+ * (#4156): an unsigned run counts, with no signer, and a run whose statement
+ * a runner key holding the `runner` role at base signed counts with that
+ * signer (`./trust/op-run-statement.ts`). A run whose statement is there and
+ * does not verify is ignored and reported, so it neither greens nor revokes
+ * a commit. With `ci.green.signedSince`, an unsigned run counts only on a
+ * strict first-parent ancestor of that commit, as an unsigned tag does. A
+ * tick given a runner key signs the tags it makes, and each run in the
+ * tag's record names the Op run's id and carries its statement when it has
+ * one.
  */
 import { judgeCommits, mergeCommits, readWorkIndex } from "./commit-links.js";
 import { execFileSync } from "node:child_process";
@@ -143,7 +147,7 @@ export function windowMs(window) {
  * names the Op run's id, env and signer, and carries the run's statement.
  */
 const runRecord = (r) => r.opRun
-    ? { name: r.name, id: null, conclusion: r.conclusion, url: r.url, opRun: { id: r.opRun.id, env: r.opRun.env, signer: r.opRun.signer, statement: r.opRun.statement } }
+    ? { name: r.name, id: null, conclusion: r.conclusion, url: r.url, opRun: { id: r.opRun.id, env: r.opRun.env, signer: r.opRun.signer, ...(r.opRun.statement ? { statement: r.opRun.statement } : {}) } }
     : { name: r.name, id: r.id, conclusion: r.conclusion, url: r.url };
 /** `source: "runs"` on a record made from chant runs (#4044); nothing for check runs, so their records read as before. */
 const sourceField = (green) => (green.source === "runs" ? { source: "runs" } : {});
@@ -303,6 +307,21 @@ export function readCiTags(top, green = null, base = null) {
     }
     return out;
 }
+/**
+ * Whether the workspace at `cwd` requires signed runs (#4156): its
+ * `ci.green.signedSince`, or null when it sets none, declares no
+ * `ci.green`, or has no declaration chant can read. Signing is opt-in, so
+ * only this makes `ci serve` refuse to start without a trusted runner key
+ * and `ci run` and `chant run` warn about a run they leave unsigned.
+ */
+export function signedRunsRequired(cwd) {
+    try {
+        return readDeclaration(locateWorkspace(cwd).tree).ci?.green?.signedSince ?? null;
+    }
+    catch {
+        return null;
+    }
+}
 /** The declaration's `ci.green`, read where `cwd` is, and the git top. */
 function readGreen(cwd) {
     const located = locateWorkspace(cwd);
@@ -376,9 +395,6 @@ export async function ciTick(req) {
     if (green.signedSince && req.runnerKey === undefined && !req.dryRun) {
         throw new Error(`ci.green.signedSince is ${green.signedSince}, so every tag the tick makes needs a statement signed by a runner key, and none was given: pass --key <runner key.pem> or set CHANT_RUNNER_KEY`);
     }
-    if (green.source === "runs" && req.runnerKey === undefined && !req.dryRun) {
-        throw new Error("the tick reads chant runs (source runs), and every tag it makes from them is signed by a runner key, and none was given: pass --key <runner key.pem> or set CHANT_RUNNER_KEY");
-    }
     const signer = req.runnerKey !== undefined ? ciTagSigner(top, base, req.runnerKey) : undefined;
     const links = await commitLinks(req.cwd, top, tracking, commits.map((c) => c.sha));
     const tags = readCiTags(top, green, base);
@@ -389,7 +405,7 @@ export async function ciTick(req) {
         if (fetched.status === "diverged" || fetched.status === "unreachable") {
             throw new Error(`could not fetch chant/lifecycle, where the Op runs are recorded, from ${fetched.remote}: ${fetched.status === "diverged" ? "the local branch and the remote's have diverged" : fetched.stderr}`);
         }
-        runs = await readOpRunSource(req.cwd, top, base);
+        runs = await readOpRunSource(req.cwd, top, base, green.signedSince);
     }
     const planned = await planTick({
         green,
@@ -445,18 +461,23 @@ export function opRunCheckRun(record, signer) {
         conclusion: settled ? (record.status === "ok" ? "success" : "failure") : null,
         completedAt: settled ? record.ended : null,
         url: record.runOrigin?.url ?? null,
-        opRun: { id: record.id, env: record.env, signer, statement: record.statement },
+        opRun: { id: record.id, env: record.env, signer, ...(signer !== null && record.statement ? { statement: record.statement } : {}) },
         ...(record.status === "fail" && record.failure ? { failureCode: record.failure.code } : {}),
     };
 }
 /**
  * Judge every Op run record that names a commit against `.chant/trust.json`
  * at `base` (#4044), from the run ledger the project at `cwd` writes to. A
- * record with a valid statement becomes a check run on its `gitSha`; any
- * other is kept as an ignored run. Reads local refs only.
+ * record with a valid statement becomes a check run on its `gitSha` with
+ * its signer, and an unsigned one becomes a check run with signer null
+ * (#4156). A record whose statement does not verify is kept as an ignored
+ * run. With `signedSince` (`ci.green.signedSince`) an unsigned record counts
+ * only on a strict first-parent ancestor of that commit, and is ignored
+ * elsewhere. Reads local refs only.
  */
-export async function readOpRunSource(cwd, top, base) {
+export async function readOpRunSource(cwd, top, base, signedSince = null) {
     const policy = readTrustPolicy(gitRevisionSource(top, base), base);
+    const before = signedSince ? unsignedHistory(top, signedSince) : null;
     const byCommit = new Map();
     const ignored = new Map();
     for (const env of await listLedgerTrees({ cwd })) {
@@ -468,11 +489,17 @@ export async function readOpRunSource(cwd, top, base) {
             for (const record of records) {
                 if (!record.gitSha)
                     continue;
+                // #4161: a job `ci run --local` ran stays on the machine that ran it, and is never CI's verdict.
+                if (record.runOrigin?.forge === "local")
+                    continue;
                 const v = verifyOpRunStatement(record, policy.runners, policy.roles);
-                if (v.status === "signed")
-                    byCommit.set(record.gitSha, [...(byCommit.get(record.gitSha) ?? []), opRunCheckRun(record, v.signer)]);
-                else
-                    ignored.set(record.gitSha, [...(ignored.get(record.gitSha) ?? []), { run: record.id, op: record.op, env: record.env, status: v.status, reason: v.reason }]);
+                const counts = v.status === "signed" || (v.status === "unsigned" && (before === null || before.has(record.gitSha)));
+                if (counts)
+                    byCommit.set(record.gitSha, [...(byCommit.get(record.gitSha) ?? []), opRunCheckRun(record, v.status === "signed" ? v.signer : null)]);
+                else {
+                    const reason = v.status === "unsigned" ? `${v.reason}; ci.green.signedSince is ${signedSince}, so a run on a commit that is not a strict first-parent ancestor of it needs one` : v.reason;
+                    ignored.set(record.gitSha, [...(ignored.get(record.gitSha) ?? []), { run: record.id, op: record.op, env: record.env, status: v.status, reason }]);
+                }
             }
         }
     }
@@ -637,7 +664,8 @@ const asRun = (r) => {
     if (typeof o.name !== "string")
         return null;
     const op = o.opRun;
-    const opRun = op && typeof op === "object" && typeof op.id === "string" && typeof op.env === "string" && typeof op.signer === "string" ? { opRun: { id: op.id, env: op.env, signer: op.signer } } : {};
+    const signer = op && typeof op === "object" ? (typeof op.signer === "string" ? op.signer : op.signer === null ? null : undefined) : undefined;
+    const opRun = op && typeof op === "object" && typeof op.id === "string" && typeof op.env === "string" && signer !== undefined ? { opRun: { id: op.id, env: op.env, signer } } : {};
     return { name: o.name, id: typeof o.id === "number" ? o.id : null, conclusion: typeof o.conclusion === "string" ? o.conclusion : null, url: typeof o.url === "string" ? o.url : null, ...opRun };
 };
 /**
@@ -693,7 +721,7 @@ export async function ciList(req) {
         const source = req.source ?? green.source;
         if (source === "runs" && req.forge)
             throw new Error("--forge reads check runs, and the source is chant runs (ci.green.source or --source runs); drop one");
-        const runs = source === "runs" ? await readOpRunSource(req.cwd, top, base) : undefined;
+        const runs = source === "runs" ? await readOpRunSource(req.cwd, top, base, green.signedSince) : undefined;
         const out = [];
         for (const c of commits) {
             const g = tags.green.get(c.sha);