@intentius/chant 0.124.31 → 0.124.33

package/dist/workspace/chant-migrations/fountain-retired-kinds.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `fountain-retired-kinds` (#3987, managoat/managoat#2793): take a project's
+ * fountain declarations off the kinds Managoat v0.29.0 removed.
+ *
+ * Managoat dropped the team, its schedules, webhooks and persistent
+ * sandboxes. Since #3987 the fountain lexicon keeps `Teammate`, `Schedule`
+ * and `Webhook` only as stubs, and FTN025 fails a build that declares one, or
+ * an Agent with `sandbox_mode: "persistent"`. chud's template (and the studio
+ * kit's copy of it) declares a Teammate and a Schedule for its night shift
+ * and its factory, and gives the dispatcher a persistent sandbox, so a repo
+ * migrated off chud stopped building with chant 0.124.32.
+ *
+ * In each `chant` member, every `.ts` file that imports the fountain lexicon
+ * loses its `new Teammate(...)`, `new Schedule(...)` and `new Webhook(...)`
+ * declarations, those names from the import, any one-line constant only they
+ * used, and `sandbox_mode: "persistent"`. Each removed Schedule is listed as
+ * not moved: its clock now lives outside Managoat. A removed declaration whose
+ * name the file still uses elsewhere is a conflict, as is a file that still
+ * names a retired kind after the edits.
+ *
+ * The plan is empty once no fountain file declares a retired kind.
+ */
+import type { ChantMigration, NotMoved } from "../chant-migrations.js";
+export declare const FOUNTAIN_RETIRED_KINDS = "fountain-retired-kinds";
+interface Rewrite {
+    text: string;
+    notMoved: NotMoved[];
+    conflict?: string;
+}
+/** The file without its retired declarations, or null when it has none. */
+export declare function rewriteFountainFile(path: string, original: string): Rewrite | null;
+export declare const fountainRetiredKinds: ChantMigration;
+export {};
+//# sourceMappingURL=fountain-retired-kinds.d.ts.map

package/dist/workspace/chant-migrations/fountain-retired-kinds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fountain-retired-kinds.d.ts","sourceRoot":"","sources":["../../../src/workspace/chant-migrations/fountain-retired-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAA6C,QAAQ,EAA+B,MAAM,qBAAqB,CAAC;AAG5I,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AA2D/D,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CA8ClF;AA6CD,eAAO,MAAM,oBAAoB,EAAE,cAIlC,CAAC"}

package/dist/workspace/chant-migrations/fountain-retired-kinds.js

@@ -0,0 +1,176 @@
+/**
+ * `fountain-retired-kinds` (#3987, managoat/managoat#2793): take a project's
+ * fountain declarations off the kinds Managoat v0.29.0 removed.
+ *
+ * Managoat dropped the team, its schedules, webhooks and persistent
+ * sandboxes. Since #3987 the fountain lexicon keeps `Teammate`, `Schedule`
+ * and `Webhook` only as stubs, and FTN025 fails a build that declares one, or
+ * an Agent with `sandbox_mode: "persistent"`. chud's template (and the studio
+ * kit's copy of it) declares a Teammate and a Schedule for its night shift
+ * and its factory, and gives the dispatcher a persistent sandbox, so a repo
+ * migrated off chud stopped building with chant 0.124.32.
+ *
+ * In each `chant` member, every `.ts` file that imports the fountain lexicon
+ * loses its `new Teammate(...)`, `new Schedule(...)` and `new Webhook(...)`
+ * declarations, those names from the import, any one-line constant only they
+ * used, and `sandbox_mode: "persistent"`. Each removed Schedule is listed as
+ * not moved: its clock now lives outside Managoat. A removed declaration whose
+ * name the file still uses elsewhere is a conflict, as is a file that still
+ * names a retired kind after the edits.
+ *
+ * The plan is empty once no fountain file declares a retired kind.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { join, posix } from "node:path";
+import { applyEdits, readText } from "./chud-lexicon-exit.js";
+export const FOUNTAIN_RETIRED_KINDS = "fountain-retired-kinds";
+const DESCRIPTION = "drop the fountain kinds Managoat removed: Teammate, Schedule, Webhook and persistent sandboxes (#3987)";
+const FOUNTAIN = "@intentius/chant-lexicon-fountain";
+const RETIRED = ["Teammate", "Schedule", "Webhook"];
+const IMPORT = /import\s*\{([^}]*)\}\s*from\s*"@intentius\/chant-lexicon-fountain";/;
+/** A top-level declaration of a retired kind, with the doc comment just above it. */
+const DECLARATION = /(?:\/\*\*(?:(?!\*\/)[\s\S])*\*\/\n)?export const (\w+) = new (Teammate|Schedule|Webhook)\(\{\n[\s\S]*?\n\}\);\n(?:\n)?/g;
+const PERSISTENT = /^[ \t]*sandbox_mode:\s*"persistent",?[ \t]*\n/gm;
+/** The template's prose about what the edits remove. */
+const TEMPLATE_PROSE = [
+    {
+        find: " * build by this name (CHUD_FOUNTAIN_VAULT overrides it), and the two\n * Teammates below run with it.\n",
+        replace: " * build by this name (CHUD_FOUNTAIN_VAULT overrides it).\n",
+    },
+    {
+        find: " * Steward does: a persistent sandbox (its checkout survives a turn) and no\n" +
+            " * permission prompts (nobody is at the keyboard; chant's own gates still need\n" +
+            " * a person). Its Teammate gives it one thread, so two schedule fires never\n" +
+            " * run two dispatchers on one checkout, and the Schedule is what triggers it.\n",
+        replace: " * Steward does, with no permission prompts (nobody is at the keyboard;\n" +
+            " * chant's own gates still need a person). Managoat has no team or scheduler\n" +
+            " * any more: a clock outside it runs `chant run dispatch --on fountain`.\n",
+    },
+];
+/** The README row `chud-lexicon-exit` wrote, which names the factory's Schedule. */
+const README_EDITS = [
+    { find: " (the agents that build the app, as fountain specs; its factory Schedule still calls the kit's dispatch Op)", replace: " (the agents that build the app, as fountain specs)" },
+];
+function tsFiles(dir, rel = "", out = []) {
+    let entries;
+    try {
+        entries = readdirSync(join(dir, rel), { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const e of entries) {
+        const path = rel ? posix.join(rel, e.name) : e.name;
+        if (e.isDirectory()) {
+            if (e.name === "node_modules" || e.name === "dist" || e.name.startsWith("."))
+                continue;
+            tsFiles(dir, path, out);
+        }
+        else if (e.name.endsWith(".ts") && !e.name.endsWith(".d.ts")) {
+            out.push(path);
+        }
+    }
+    return out;
+}
+/** The text with its comments and string contents blanked, so prose naming a kind is not a use of it. */
+const code = (text) => text.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`(?:\\.|[^`\\])*`/g, '""');
+const uses = (text, name) => new RegExp(`(?<![\\w$.])${name}(?![\\w$])`).test(code(text));
+/** The file without its retired declarations, or null when it has none. */
+export function rewriteFountainFile(path, original) {
+    const imported = original.match(IMPORT);
+    if (!imported)
+        return null;
+    const declared = [...original.matchAll(DECLARATION)];
+    const persistent = PERSISTENT.test(original);
+    PERSISTENT.lastIndex = 0;
+    if (declared.length === 0 && !persistent)
+        return null;
+    const notMoved = [];
+    let text = original;
+    const removed = [];
+    const referenced = new Set();
+    for (const [block, name, kind] of declared) {
+        text = text.replace(block, "");
+        removed.push(name);
+        const body = block.slice(block.indexOf("new "));
+        for (const id of body.match(/\b[a-zA-Z_$][\w$]*\b/g) ?? [])
+            referenced.add(id);
+        if (kind === "Schedule") {
+            const cron = body.match(/cron:\s*"([^"]+)"/)?.[1];
+            notMoved.push({
+                what: `the Schedule ${name}${cron ? ` (cron "${cron}")` : ""} in ${path}`,
+                where: "a clock outside Managoat, which has no scheduler: a CI schedule or a CronJob running `chant run <op> --on fountain`, or `chant operator --steward`",
+            });
+        }
+        else if (kind === "Webhook") {
+            notMoved.push({ what: `the Webhook ${name} in ${path}`, where: "nothing: read a run's outcome from `chant run status` or `log`, or the conversation's event stream" });
+        }
+    }
+    text = text.replace(PERSISTENT, "");
+    // A one-line constant only the removed declarations used (the template's `nightlyMeta`).
+    for (const id of referenced) {
+        const line = new RegExp(`^export const ${id} = [^\\n]*;\\n\\n?`, "m");
+        const hit = text.match(line);
+        if (hit && !uses(text.replace(hit[0], ""), id))
+            text = text.replace(hit[0], "");
+    }
+    const names = imported[1].split(",").map((n) => n.trim()).filter(Boolean);
+    const kept = names.filter((n) => !RETIRED.includes(n) || uses(text.replace(IMPORT, ""), n));
+    if (kept.length !== names.length)
+        text = text.replace(IMPORT, `import { ${kept.join(", ")} } from "${FOUNTAIN}";`);
+    text = applyEdits(text, TEMPLATE_PROSE).text.replace(/\n{3,}/g, "\n\n").replace(/\n+$/, "\n");
+    const dangling = removed.filter((n) => uses(text, n));
+    if (dangling.length > 0)
+        return { text, notMoved, conflict: `${dangling.join(", ")} ${dangling.length === 1 ? "is" : "are"} still used after the retired declarations go. Remove ${dangling.length === 1 ? "that use" : "those uses"} by hand, then run the upgrade again` };
+    const still = RETIRED.filter((k) => new RegExp(`\\bnew ${k}\\(`).test(text));
+    if (still.length > 0)
+        return { text, notMoved, conflict: `a ${still.join(", ")} declaration this migration cannot read. Remove it by hand, then run the upgrade again` };
+    return { text, notMoved };
+}
+function planRetiredKinds(ctx) {
+    const { dir } = ctx;
+    let decl = null;
+    try {
+        decl = JSON.parse(readText(dir, "chant.workspace.json") ?? "null");
+    }
+    catch {
+        decl = null;
+    }
+    const members = (decl?.members ?? []).filter((m) => m.kind === "chant" && m.dir).map((m) => posix.normalize(m.dir));
+    if (members.length === 0 && existsSync(join(dir, "chant.config.ts")))
+        members.push(".");
+    const changes = [];
+    const notMoved = [];
+    const conflicts = [];
+    for (const member of members) {
+        for (const rel of tsFiles(join(dir, member))) {
+            const path = posix.join(member, rel);
+            const text = readText(dir, path);
+            if (text === undefined || !text.includes(FOUNTAIN))
+                continue;
+            const rewrite = rewriteFountainFile(path, text);
+            if (!rewrite)
+                continue;
+            if (rewrite.conflict) {
+                conflicts.push({ path, reason: rewrite.conflict });
+                continue;
+            }
+            changes.push({ path, action: "write", why: "no Teammate, Schedule, Webhook or persistent sandbox, which Managoat removed and FTN025 fails", data: Buffer.from(rewrite.text) });
+            notMoved.push(...rewrite.notMoved);
+        }
+    }
+    if (changes.length === 0 && conflicts.length === 0)
+        return null;
+    const readme = readText(dir, "README.md");
+    if (readme !== undefined && conflicts.length === 0) {
+        const edited = applyEdits(readme, README_EDITS).text;
+        if (edited !== readme)
+            changes.push({ path: "README.md", action: "write", why: "the agents no longer declare a factory Schedule", data: Buffer.from(edited) });
+    }
+    return { id: FOUNTAIN_RETIRED_KINDS, description: DESCRIPTION, changes, notMoved, conflicts };
+}
+export const fountainRetiredKinds = {
+    id: FOUNTAIN_RETIRED_KINDS,
+    description: DESCRIPTION,
+    plan: planRetiredKinds,
+};

package/dist/workspace/chant-migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chant-migrations.d.ts","sourceRoot":"","sources":["../../src/workspace/chant-migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAQ9C,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,8FAA8F;IAC9F,IAAI,CAAC,GAAG,EAAE,qBAAqB,GAAG,kBAAkB,GAAG,IAAI,CAAC;CAC7D;AAED,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAOrD,CAAC;AAEF,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,qBAAqB,EAAE,UAAU,GAAE,SAAS,cAAc,EAAqB,GAAG,kBAAkB,EAAE,CAS9I;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,EAAE,UAAU,GAAE,SAAS,cAAc,EAAqB,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAW9K;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAYjG;AAED,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,GAAG,oBAAoB,CAS3F"}
+{"version":3,"file":"chant-migrations.d.ts","sourceRoot":"","sources":["../../src/workspace/chant-migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAS9C,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,8FAA8F;IAC9F,IAAI,CAAC,GAAG,EAAE,qBAAqB,GAAG,kBAAkB,GAAG,IAAI,CAAC;CAC7D;AAED,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAQrD,CAAC;AAEF,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,qBAAqB,EAAE,UAAU,GAAE,SAAS,cAAc,EAAqB,GAAG,kBAAkB,EAAE,CAS9I;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,EAAE,UAAU,GAAE,SAAS,cAAc,EAAqB,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAW9K;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAYjG;AAED,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,GAAG,oBAAoB,CAS3F"}

package/dist/workspace/chant-migrations.js

@@ -40,6 +40,7 @@ import { chudLexiconExitShipInputs } from "./chant-migrations/chud-lexicon-exit-
 import { chudLexiconExitShipPolicy } from "./chant-migrations/chud-lexicon-exit-ship-policy.js";
 import { chudLexiconExitFlySite } from "./chant-migrations/chud-lexicon-exit-fly-site.js";
 import { chudLexiconExitLiveNames } from "./chant-migrations/chud-lexicon-exit-live-names.js";
+import { fountainRetiredKinds } from "./chant-migrations/fountain-retired-kinds.js";
 /** Every migration chant ships, in the order they are planned. */
 export const CHANT_MIGRATIONS = [
     chudLexiconExit,
@@ -48,6 +49,7 @@ export const CHANT_MIGRATIONS = [
     chudLexiconExitShipPolicy,
     chudLexiconExitFlySite,
     chudLexiconExitLiveNames,
+    fountainRetiredKinds,
 ];
 /** The plans for a scope: each migration not yet in the lineage that finds something to move. */
 export function planChantMigrations(ctx, migrations = CHANT_MIGRATIONS) {

package/dist/workspace/check.schema.json

@@ -298,7 +298,41 @@
             "flag-stale",
             "diagram-source-missing",
             "diagram-render-missing",
-            "diagram-render-drift"
+            "diagram-render-drift",
+
+            "security-signers-missing",
+
+            "security-release-gate-missing",
+
+            "security-publish-allows-unsigned",
+
+            "security-sbom-disabled",
+
+            "security-sbom-unsourced",
+
+            "security-publish-no-provenance",
+
+            "security-component-no-sbom",
+
+            "security-component-no-verify",
+
+            "security-signed-since-unset",
+
+            "security-runner-untrusted",
+
+            "security-tick-no-key",
+
+            "security-review-not-required",
+
+            "security-attribution-any",
+
+            "security-gate-unsigned",
+
+            "security-runner-start-no-key",
+
+            "security-runner-start-no-role",
+
+            "security-trust-unreadable"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         }
@@ -377,7 +411,41 @@
             "flag-stale",
             "diagram-source-missing",
             "diagram-render-missing",
-            "diagram-render-drift"
+            "diagram-render-drift",
+
+            "security-signers-missing",
+
+            "security-release-gate-missing",
+
+            "security-publish-allows-unsigned",
+
+            "security-sbom-disabled",
+
+            "security-sbom-unsourced",
+
+            "security-publish-no-provenance",
+
+            "security-component-no-sbom",
+
+            "security-component-no-verify",
+
+            "security-signed-since-unset",
+
+            "security-runner-untrusted",
+
+            "security-tick-no-key",
+
+            "security-review-not-required",
+
+            "security-attribution-any",
+
+            "security-gate-unsigned",
+
+            "security-runner-start-no-key",
+
+            "security-runner-start-no-role",
+
+            "security-trust-unreadable"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         },

package/dist/workspace/checks/boxes.d.ts

@@ -28,15 +28,15 @@
  * listed here after these two.
  *
  * WSP125 (`box-fountain-callback-undeclared`, #2780) is the one credential a
- * box gets without asking. fountain v0.21.0 gives every persistent sandbox a
- * callback token scoped to its owner (`FOUNTAIN_TOKEN`, `sandbox_api_access:
- * owner`), and a fountain `Box` is always persistent, so its member's block
- * has to say so: the capability `fountain-callback`, brokered by `fountain`,
+ * box gets without asking. fountain gives every sandbox a callback token
+ * scoped to its owner (`FOUNTAIN_TOKEN`, `sandbox_api_access: owner`) unless
+ * its conversation asks for none, and a fountain `Box` runs with it, so its
+ * member's block has to say so: the capability `fountain-callback`, brokered by `fountain`,
  * with scope `owner`. It is named apart from `fountain`, the API access a
  * lobby may broker for the same box. A member builds a Box when one of its TypeScript or JavaScript files
  * imports `Box` from `@intentius/chant-lexicon-fountain` and calls it, read as
- * syntax and never run. Upstream, managoat/fountain#2497 asks for a way to run
- * a persistent agent with no callback token.
+ * syntax and never run. Upstream, managoat/fountain#2497 asked for a way to run
+ * a box's agent with no callback token.
  *
  * WSP126 (`box-intent-unknown`) and WSP127 (`box-intent-unconstrained`), #2850,
  * read the decision record a box block names as its intent (`box-intent.ts`).

package/dist/workspace/checks/boxes.js

@@ -28,15 +28,15 @@
  * listed here after these two.
  *
  * WSP125 (`box-fountain-callback-undeclared`, #2780) is the one credential a
- * box gets without asking. fountain v0.21.0 gives every persistent sandbox a
- * callback token scoped to its owner (`FOUNTAIN_TOKEN`, `sandbox_api_access:
- * owner`), and a fountain `Box` is always persistent, so its member's block
- * has to say so: the capability `fountain-callback`, brokered by `fountain`,
+ * box gets without asking. fountain gives every sandbox a callback token
+ * scoped to its owner (`FOUNTAIN_TOKEN`, `sandbox_api_access: owner`) unless
+ * its conversation asks for none, and a fountain `Box` runs with it, so its
+ * member's block has to say so: the capability `fountain-callback`, brokered by `fountain`,
  * with scope `owner`. It is named apart from `fountain`, the API access a
  * lobby may broker for the same box. A member builds a Box when one of its TypeScript or JavaScript files
  * imports `Box` from `@intentius/chant-lexicon-fountain` and calls it, read as
- * syntax and never run. Upstream, managoat/fountain#2497 asks for a way to run
- * a persistent agent with no callback token.
+ * syntax and never run. Upstream, managoat/fountain#2497 asked for a way to run
+ * a box's agent with no callback token.
  *
  * WSP126 (`box-intent-unknown`) and WSP127 (`box-intent-unconstrained`), #2850,
  * read the decision record a box block names as its intent (`box-intent.ts`).
@@ -68,7 +68,7 @@ export const WSP_BOX_UNBROKERED = "WSP122";
 export const WSP_BOX_FOUNTAIN_CALLBACK = "WSP125";
 export const WSP_BOX_INTENT_UNKNOWN = "WSP126";
 export const WSP_BOX_INTENT_UNCONSTRAINED = "WSP127";
-/** The fountain lexicon's package, whose `Box` composite runs a persistent sandbox. */
+/** The fountain lexicon's package, whose `Box` composite declares a box's agent. */
 const FOUNTAIN_LEXICON = "@intentius/chant-lexicon-fountain";
 /**
  * The capability a box block declares for fountain's callback token (#2780).
@@ -379,7 +379,7 @@ export const BOX_CHECKS = [
     {
         id: WSP_BOX_FOUNTAIN_CALLBACK,
         name: "box-fountain-callback-undeclared",
-        description: "A box member that builds a fountain Box declares the callback token fountain gives its persistent sandbox: the fountain-callback capability, brokered by fountain, with scope owner.",
+        description: "A box member that builds a fountain Box declares the callback token fountain gives its sandbox: the fountain-callback capability, brokered by fountain, with scope owner.",
         severity: "error",
         configurable: true,
         check(ctx) {
@@ -424,7 +424,7 @@ export const BOX_CHECKS = [
                     checkId: this.id,
                     severity: this.severity,
                     code: "box-fountain-callback-undeclared",
-                    message: `box-fountain-callback-undeclared: member ${m.name} builds a fountain Box (${at.path}), and fountain v0.21.0 gives a persistent box's sandbox ` +
+                    message: `box-fountain-callback-undeclared: member ${m.name} builds a fountain Box (${at.path}), and fountain gives a box's sandbox ` +
                         `a callback token scoped to its owner (FOUNTAIN_TOKEN); ${why}. Declare ${expected} in the box block ` +
                         `(managoat/fountain#2497 tracks running without it)`,
                     entity: m.name,

package/dist/workspace/checks/security.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The security group checklists, WSP161 to WSP165 (#4168 step 7).
+ *
+ * A workspace opts into a security group with `security` in the
+ * declaration, at the top level or on a member (../security.ts). Each group
+ * has one check here, which reports what the group still lacks in the tree
+ * read. A group the declaration does not name is never checked, so a
+ * workspace that opts into nothing gets no finding from this file (#4168:
+ * security features are opt-in).
+ *
+ * | Id | Group | Codes |
+ * |---|---|---|
+ * | WSP161 | `verified-releases` | `security-signers-missing`, `security-release-gate-missing`, `security-publish-allows-unsigned` |
+ * | WSP162 | `supply-chain` | `security-sbom-disabled`, `security-sbom-unsourced`, `security-publish-no-provenance`, `security-component-no-sbom`, `security-component-no-verify` |
+ * | WSP163 | `who-ran-it` | `security-signed-since-unset`, `security-runner-untrusted`, `security-tick-no-key` |
+ * | WSP164 | `review-rules` | `security-review-not-required`, `security-attribution-any`, `security-gate-unsigned` |
+ * | WSP165 | `isolated-runners` | `security-runner-start-no-key`, `security-runner-start-no-role`, `security-trust-unreadable` |
+ *
+ * The checks read files, never run them: a member's `chant.config.ts` and
+ * `*.component.ts` are scanned as text, and the pipeline files are the
+ * forge files at the workspace root and in each member (`.github/workflows`,
+ * `.forgejo/workflows`, `.gitlab-ci.yml`). A command line is one line of a
+ * pipeline file that runs `chant release publish`, `chant ci tick` or
+ * `chant components pr-apply`.
+ */
+import type { WorkspaceCheck } from "../checks.js";
+/** The read contract's codes for the security findings, carried as `code` on each. */
+export declare const SECURITY_FINDING_CODES: readonly ["security-signers-missing", "security-release-gate-missing", "security-publish-allows-unsigned", "security-sbom-disabled", "security-sbom-unsourced", "security-publish-no-provenance", "security-component-no-sbom", "security-component-no-verify", "security-signed-since-unset", "security-runner-untrusted", "security-tick-no-key", "security-review-not-required", "security-attribution-any", "security-gate-unsigned", "security-runner-start-no-key", "security-runner-start-no-role", "security-trust-unreadable"];
+export declare const WSP_SECURITY_VERIFIED_RELEASES = "WSP161";
+export declare const WSP_SECURITY_SUPPLY_CHAIN = "WSP162";
+export declare const WSP_SECURITY_WHO_RAN_IT = "WSP163";
+export declare const WSP_SECURITY_REVIEW_RULES = "WSP164";
+export declare const WSP_SECURITY_ISOLATED_RUNNERS = "WSP165";
+export declare const SECURITY_CHECKS: readonly WorkspaceCheck[];
+//# sourceMappingURL=security.d.ts.map

package/dist/workspace/checks/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAA8C,MAAM,WAAW,CAAC;AAU5F,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,ygBAkBO,CAAC;AAI3C,eAAO,MAAM,8BAA8B,WAAW,CAAC;AACvD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAChD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,6BAA6B,WAAW,CAAC;AA0GtD,eAAO,MAAM,eAAe,EAAE,SAAS,cAAc,EAuIpD,CAAC"}