@intentius/chant 0.124.31 → 0.124.33

package/dist/workspace/reason-codes.d.ts

@@ -191,9 +191,26 @@ export declare const REASONS: {
     readonly "diagram-source-missing": "A declared diagram's source file does not exist in the tree read.";
     readonly "diagram-render-missing": "A declared diagram's render file does not exist in the tree read.";
     readonly "diagram-render-drift": "A declared diagram records a sourceHash, and the source's bytes now hash to something else: the render is stale for its source.";
+    readonly "security-signers-missing": "The workspace opts into verified-releases, and there is no .chant/allowed_signers to verify a release's signature against.";
+    readonly "security-release-gate-missing": "Under verified-releases, identity.gates has no release entry, or it names no class, so a cut is not held to a class of signers.";
+    readonly "security-publish-allows-unsigned": "Under verified-releases, a pipeline file runs release publish with --allow-unsigned.";
+    readonly "security-sbom-disabled": "Under supply-chain, a member's chant.config.ts sets sbom: false on a publish target.";
+    readonly "security-sbom-unsourced": "Under supply-chain, a member publishes, names no sbom file and has no package-lock.json, pom.xml or Cargo.lock to write one from.";
+    readonly "security-publish-no-provenance": "Under supply-chain, a pipeline file runs release publish without --require-provenance.";
+    readonly "security-component-no-sbom": "Under supply-chain, a member's components have no generate-sbom step.";
+    readonly "security-component-no-verify": "Under supply-chain, a member's components have no verify step.";
+    readonly "security-signed-since-unset": "Under who-ran-it, ci.green sets no signedSince, or there is no ci.green block.";
+    readonly "security-runner-untrusted": "Under who-ran-it, .chant/trust.json lists no runner key.";
+    readonly "security-tick-no-key": "Under who-ran-it, a pipeline file runs ci tick with no runner key.";
+    readonly "security-review-not-required": "Under review-rules, an apply job passes --no-require-review, which the group overrides.";
+    readonly "security-attribution-any": "Under review-rules, identity.attribution is not identified.";
+    readonly "security-gate-unsigned": "Under review-rules, an apply job names a gate identity.gates does not list, or identity.gates lists none.";
+    readonly "security-runner-start-no-key": "Under isolated-runners, .chant/trust.json lists no key under runners for a provisioner to sign runner-start statements with.";
+    readonly "security-runner-start-no-role": "Under isolated-runners, no principal under runners in .chant/trust.json holds the runner role.";
+    readonly "security-trust-unreadable": "Under isolated-runners, .chant/trust.json can't be read, so no runner-start statement can be checked.";
     readonly "box-credential-declared": "A file in a box member's directory carries a literal secret: a credential's shape, or a literal where a credential goes. A variable or secret-manager reference is not one.";
     readonly "box-capability-unbrokered": "A capability in a member's box block names no broker, so the box would hold its credential.";
-    readonly "box-fountain-callback-undeclared": "A box member builds a fountain Box, whose persistent sandbox fountain gives a callback token scoped to its owner, and the member's box block does not declare the fountain-callback capability brokered by fountain with scope owner.";
+    readonly "box-fountain-callback-undeclared": "A box member builds a fountain Box, whose sandbox fountain gives a callback token scoped to its owner, and the member's box block does not declare the fountain-callback capability brokered by fountain with scope owner.";
     readonly "box-intent-unknown": "A box block names an intent, and no record of a declared kind named decision has that id.";
     readonly "box-intent-unconstrained": "The decision record a box names as its intent constrains no member or path of this workspace: no member: entry for a declared member and no path: entry at, above or inside one's directory.";
     readonly "box-none": "No member's box block declares services, so the workspace has no box for a host to plant.";

package/dist/workspace/reason-codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reason-codes.d.ts","sourceRoot":"","sources":["../../src/workspace/reason-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,sHAAsH;AACtH,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,uHAAuH;AACvH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,qFAAqF;AACrF,eAAO,MAAM,OAAO;aAElB,qBAAqB,EAAE,2EAA2E;aAClG,uBAAuB,EAAE,4DAA4D;aACrF,yBAAyB,EAAE,mEAAmE;aAC9F,qBAAqB,EAAE,wFAAwF;aAC/G,mBAAmB,EAAE,kDAAkD;aACvE,gBAAgB,EAAE,iEAAiE;aACnF,qBAAqB,EAAE,sHAAsH;aAE7I,sBAAsB,EAAE,mEAAmE;aAC3F,kBAAkB,EAAE,uBAAuB;aAC3C,kBAAkB,EAAE,wFAAwF;aAE5G,qBAAqB,EAAE,yDAAyD;aAEhF,aAAa,EAAE,wCAAwC;aACvD,cAAc,EAAE,gEAAgE;aAChF,mBAAmB,EAAE,oDAAoD;aACzE,YAAY,EAAE,gEAAgE;aAE9E,cAAc,EAAE,4EAA4E;aAC5F,gBAAgB,EAAE,2KAA2K;aAC7L,mBAAmB,EAAE,2EAA2E;aAChG,wBAAwB,EAAE,sDAAsD;aAEhF,mBAAmB,EAAE,0DAA0D;aAC/E,kBAAkB,EAAE,uEAAuE;aAE3F,iBAAiB,EAAE,iFAAiF;aACpG,sBAAsB,EAAE,gFAAgF;aACxG,yBAAyB,EAAE,gEAAgE;aAE3F,qBAAqB,EAAE,iFAAiF;aACxG,mBAAmB,EAAE,iFAAiF;aACtG,yBAAyB,EAAE,8GAA8G;aAEzI,oBAAoB,EAAE,sJAAsJ;aAC5K,uBAAuB,EAAE,kFAAkF;aAC3G,qBAAqB,EAAE,uDAAuD;aAC9E,2BAA2B,EAAE,8CAA8C;aAC3E,4BAA4B,EAAE,4EAA4E;aAC1G,2BAA2B,EAAE,8CAA8C;aAC3E,8BAA8B,EAAE,6FAA6F;aAC7H,sBAAsB,EAAE,wGAAwG;aAEhI,uBAAuB,EAAE,kJAAkJ;aAC3K,gCAAgC,EAAE,yFAAyF;aAE3H,aAAa,EAAE,4FAA4F;aAC3G,eAAe,EAAE,iEAAiE;aAClF,aAAa,EAAE,sIAAsI;aACrJ,2BAA2B,EAAE,gHAAgH;aAC7I,oBAAoB,EAAE,qHAAqH;aAC3I,mBAAmB,EAAE,+GAA+G;aACpI,yBAAyB,EAAE,2KAA2K;aAEtM,oBAAoB,EAAE,sFAAsF;aAC5G,yBAAyB,EAAE,sEAAsE;aACjG,kBAAkB,EAAE,+EAA+E;aACnG,2BAA2B,EAAE,oFAAoF;aACjH,oBAAoB,EAAE,wFAAwF;aAC9G,0BAA0B,EAAE,2DAA2D;aACvF,oBAAoB,EAAE,mJAAmJ;aACzK,uBAAuB,EAAE,+IAA+I;aACxK,+BAA+B,EAAE,uJAAuJ;aACxL,uBAAuB,EAAE,gFAAgF;aACzG,yBAAyB,EAAE,8EAA8E;aACzG,mBAAmB,EAAE,mFAAmF;aAExG,mBAAmB,EAAE,6EAA6E;aAClG,YAAY,EAAE,uHAAuH;aAErI,0BAA0B,EAAE,uEAAuE;aACnG,sBAAsB,EAAE,8EAA8E;aACtG,sBAAsB,EAAE,qHAAqH;aAE7I,gBAAgB,EAAE,yFAAyF;aAC3G,cAAc,EAAE,gEAAgE;aAChF,kBAAkB,EAAE,oHAAoH;aACxI,qBAAqB,EAAE,oGAAoG;aAC3H,mBAAmB,EAAE,0GAA0G;aAE/H,cAAc,EAAE,8CAA8C;aAC9D,sBAAsB,EAAE,wGAAwG;aAChI,wBAAwB,EAAE,uIAAuI;aACjK,mBAAmB,EAAE,sLAAsL;aAE3M,mBAAmB,EAAE,sKAAsK;aAC3L,8BAA8B,EAAE,6MAA6M;aAE7O,iBAAiB,EAAE,2DAA2D;aAC9E,cAAc,EAAE,oEAAoE;aACpF,mBAAmB,EAAE,kEAAkE;aACvF,oBAAoB,EAAE,6DAA6D;aACnF,gBAAgB,EAAE,4CAA4C;aAC9D,kBAAkB,EAAE,uEAAuE;aAE3F,qBAAqB,EAAE,gFAAgF;aACvG,qBAAqB,EAAE,8FAA8F;aACrH,kBAAkB,EAAE,yCAAyC;aAC7D,iBAAiB,EAAE,4EAA4E;aAC/F,yBAAyB,EAAE,wGAAwG;aACnI,uBAAuB,EAAE,uFAAuF;aAChH,eAAe,EAAE,gGAAgG;aACjH,oBAAoB,EAAE,qEAAqE;aAC3F,yBAAyB,EAAE,+IAA+I;aAC1K,oBAAoB,EAAE,wEAAwE;aAC9F,sBAAsB,EAAE,6DAA6D;aACrF,oBAAoB,EAAE,0IAA0I;aAChK,0BAA0B,EAAE,4IAA4I;aACxK,6BAA6B,EAAE,uIAAuI;aACtK,uBAAuB,EAAE,+IAA+I;aACxK,oBAAoB,EAAE,6KAA6K;aAEnM,iBAAiB,EAAE,mLAAmL;aACtM,oBAAoB,EAAE,iKAAiK;aACvL,qBAAqB,EAAE,kKAAkK;aAEzL,oBAAoB,EAAE,qMAAqM;aAC3N,kBAAkB,EAAE,yIAAyI;aAC7J,uBAAuB,EAAE,qLAAqL;aAC9M,2BAA2B,EAAE,8PAA8P;aAC3R,eAAe,EAAE,kHAAkH;aACnI,wBAAwB,EAAE,0VAA0V;aAEpX,iBAAiB,EAAE,oFAAoF;aACvG,kBAAkB,EAAE,4EAA4E;aAEhG,mBAAmB,EAAE,4GAA4G;aACjI,gBAAgB,EAAE,kIAAkI;aACpJ,eAAe,EAAE,sEAAsE;aACvF,sBAAsB,EAAE,kFAAkF;aAC1G,sBAAsB,EAAE,mGAAmG;aAC3H,sBAAsB,EAAE,8DAA8D;aACtF,gBAAgB,EAAE,oOAAoO;aACtP,wBAAwB,EAAE,wKAAwK;aAClM,uBAAuB,EAAE,oNAAoN;aAC7O,qBAAqB,EAAE,mIAAmI;aAC1J,0BAA0B,EAAE,kOAAkO;aAC9P,0BAA0B,EAAE,6KAA6K;aAEzM,mBAAmB,EAAE,6FAA6F;aAClH,uBAAuB,EAAE,0HAA0H;aACnJ,oBAAoB,EAAE,yFAAyF;aAE/G,uBAAuB,EAAE,wEAAwE;aACjG,uBAAuB,EAAE,iFAAiF;aAC1G,2BAA2B,EAAE,uGAAuG;aACpI,uBAAuB,EAAE,uEAAuE;aAChG,yBAAyB,EAAE,6GAA6G;aAExI,wBAAwB,EAAE,2FAA2F;aACrH,sBAAsB,EAAE,uGAAuG;aAC/H,mBAAmB,EAAE,qMAAqM;aAE1N,yBAAyB,EAAE,kFAAkF;aAC7G,oBAAoB,EAAE,qKAAqK;aAC3L,oBAAoB,EAAE,2DAA2D;aACjF,oBAAoB,EAAE,+DAA+D;aACrF,kBAAkB,EAAE,wKAAwK;aAC5L,0BAA0B,EAAE,4EAA4E;aACxG,iCAAiC,EAAE,uDAAuD;aAC1F,6BAA6B,EAAE,6GAA6G;aAC5I,2BAA2B,EAAE,4GAA4G;aACzI,0BAA0B,EAAE,iEAAiE;aAC7F,wBAAwB,EAAE,iFAAiF;aAC3G,0BAA0B,EAAE,qEAAqE;aACjG,2BAA2B,EAAE,6FAA6F;aAC1H,6BAA6B,EAAE,uDAAuD;aACtF,+BAA+B,EAAE,8HAA8H;aAC/J,qBAAqB,EAAE,uGAAuG;aAC9H,+BAA+B,EAAE,+GAA+G;aAChJ,6BAA6B,EAAE,6KAA6K;aAE5M,wBAAwB,EAAE,wIAAwI;aAClK,mBAAmB,EAAE,oFAAoF;aACzG,wBAAwB,EAAE,mDAAmD;aAC7E,0BAA0B,EAAE,0GAA0G;aAEtI,kBAAkB,EAAE,kHAAkH;aACtI,qBAAqB,EAAE,yJAAyJ;aAEhL,iBAAiB,EAAE,2HAA2H;aAC9I,uBAAuB,EAAE,sPAAsP;aAE/Q,oBAAoB,EAAE,oFAAoF;aAE1G,4BAA4B,EAAE,4FAA4F;aAC1H,0BAA0B,EAAE,iDAAiD;aAC7E,yBAAyB,EAAE,0EAA0E;aAErG,4BAA4B,EAAE,mIAAmI;aACjK,6BAA6B,EAAE,4FAA4F;aAE3H,4BAA4B,EAAE,qHAAqH;aACnJ,gCAAgC,EAAE,oJAAoJ;aACtL,gCAAgC,EAAE,6FAA6F;aAC/H,mCAAmC,EAAE,6JAA6J;aAElM,wBAAwB,EAAE,mEAAmE;aAC7F,wBAAwB,EAAE,mEAAmE;aAC7F,sBAAsB,EAAE,iIAAiI;aAEzJ,yBAAyB,EAAE,6KAA6K;aACxM,2BAA2B,EAAE,6FAA6F;aAE1H,kCAAkC,EAAE,uOAAuO;aAE3Q,oBAAoB,EAAE,2FAA2F;aACjH,0BAA0B,EAAE,8LAA8L;aAE1N,UAAU,EAAE,2FAA2F;aACvG,aAAa,EAAE,2FAA2F;aAE1G,mBAAmB,EAAE,kHAAkH;aACvI,qBAAqB,EAAE,qFAAqF;aAC5G,mBAAmB,EAAE,0DAA0D;aAC/E,kBAAkB,EAAE,oGAAoG;aAExH,wBAAwB,EAAE,uHAAuH;aAEjJ,YAAY,EAAE,6FAA6F;aAC3G,gBAAgB,EAAE,4FAA4F;aAC9G,sBAAsB,EAAE,mFAAmF;aAC3G,YAAY,EAAE,6EAA6E;aAC3F,qBAAqB,EAAE,8GAA8G;aAErI,YAAY,EAAE,sEAAsE;aACpF,aAAa,EAAE,mDAAmD;aAClE,WAAW,EAAE,qDAAqD;aAClE,gBAAgB,EAAE,iFAAiF;aACnG,uBAAuB,EAAE,0EAA0E;aAEnG,eAAe,EAAE,kHAAkH;aACnI,uBAAuB,EAAE,uIAAuI;aAChK,+BAA+B,EAAE,yEAAyE;aAC1G,wBAAwB,EAAE,0LAA0L;aAEpN,wBAAwB,EAAE,kEAAkE;aAC5F,qBAAqB,EAAE,yFAAyF;aAChH,uBAAuB,EAAE,2KAA2K;aAEpM,eAAe,EAAE,gGAAgG;aACjH,gBAAgB,EAAE,gEAAgE;aAElF,sBAAsB,EAAE,gHAAgH;aACxI,gBAAgB,EAAE,sJAAsJ;aACxK,eAAe,EAAE,8IAA8I;aAC/J,gBAAgB,EAAE,8EAA8E;aAEhG,wBAAwB,EAAE,kEAAkE;aAC5F,qBAAqB,EAAE,yFAAyF;aAEhH,wBAAwB,EAAE,8DAA8D;aACxF,cAAc,EAAE,gGAAgG;aAChH,iBAAiB,EAAE,6FAA6F;aAChH,gBAAgB,EAAE,mIAAmI;aACrJ,wBAAwB,EAAE,yGAAyG;aACnI,oBAAoB,EAAE,6OAA6O;aAEnQ,eAAe,EAAE,6GAA6G;aAC9H,UAAU,EAAE,2FAA2F;aACvG,sBAAsB,EAAE,iFAAiF;aACzG,kBAAkB,EAAE,gFAAgF;aACpG,UAAU,EAAE,yFAAyF;aACrG,iBAAiB,EAAE,4FAA4F;aAC/G,oBAAoB,EAAE,iIAAiI;aAEvJ,qBAAqB,EAAE,qGAAqG;aAC5H,mBAAmB,EAAE,4GAA4G;aAEjI,yBAAyB,EAAE,qHAAqH;aAChJ,uBAAuB,EAAE,8IAA8I;aAEvK,sBAAsB,EAAE,uFAAuF;aAC/G,iBAAiB,EAAE,8HAA8H;aACjJ,sBAAsB,EAAE,wDAAwD;aAChF,kBAAkB,EAAE,yHAAyH;aAC7I,wBAAwB,EAAE,0FAA0F;aACpH,kBAAkB,EAAE,gHAAgH;aACpI,uBAAuB,EAAE,oHAAoH;aAC7I,4BAA4B,EAAE,0GAA0G;aACxI,kCAAkC,EAAE,mHAAmH;aACvJ,4BAA4B,EAAE,0HAA0H;aAExJ,yBAAyB,EAAE,uGAAuG;aAClI,qBAAqB,EAAE,oDAAoD;aAC3E,kBAAkB,EAAE,+GAA+G;aACnI,oBAAoB,EAAE,sFAAsF;aAC5G,uBAAuB,EAAE,kEAAkE;aAC3F,4BAA4B,EAAE,kIAAkI;aAChK,0BAA0B,EAAE,sEAAsE;aAClG,oBAAoB,EAAE,mLAAmL;aACzM,sBAAsB,EAAE,8MAA8M;aACtO,qBAAqB,EAAE,sFAAsF;aAE7G,cAAc,EAAE,iCAAiC;aACjD,kBAAkB,EAAE,sDAAsD;CAClE,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,OAAO,CAAC;AAE9C,mDAAmD;AACnD,eAAO,MAAM,YAAY,EAA2B,UAAU,EAAE,CAAC;AAEjE,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,MAAM,IAAI,MAAM,EAAE,CAAC;AAEtD,eAAO,MAAM,WAAW,QAAkD,CAAC;AAE3E,2HAA2H;AAC3H,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,UAAU,CAI/E"}
+{"version":3,"file":"reason-codes.d.ts","sourceRoot":"","sources":["../../src/workspace/reason-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,sHAAsH;AACtH,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,uHAAuH;AACvH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,qFAAqF;AACrF,eAAO,MAAM,OAAO;aAElB,qBAAqB,EAAE,2EAA2E;aAClG,uBAAuB,EAAE,4DAA4D;aACrF,yBAAyB,EAAE,mEAAmE;aAC9F,qBAAqB,EAAE,wFAAwF;aAC/G,mBAAmB,EAAE,kDAAkD;aACvE,gBAAgB,EAAE,iEAAiE;aACnF,qBAAqB,EAAE,sHAAsH;aAE7I,sBAAsB,EAAE,mEAAmE;aAC3F,kBAAkB,EAAE,uBAAuB;aAC3C,kBAAkB,EAAE,wFAAwF;aAE5G,qBAAqB,EAAE,yDAAyD;aAEhF,aAAa,EAAE,wCAAwC;aACvD,cAAc,EAAE,gEAAgE;aAChF,mBAAmB,EAAE,oDAAoD;aACzE,YAAY,EAAE,gEAAgE;aAE9E,cAAc,EAAE,4EAA4E;aAC5F,gBAAgB,EAAE,2KAA2K;aAC7L,mBAAmB,EAAE,2EAA2E;aAChG,wBAAwB,EAAE,sDAAsD;aAEhF,mBAAmB,EAAE,0DAA0D;aAC/E,kBAAkB,EAAE,uEAAuE;aAE3F,iBAAiB,EAAE,iFAAiF;aACpG,sBAAsB,EAAE,gFAAgF;aACxG,yBAAyB,EAAE,gEAAgE;aAE3F,qBAAqB,EAAE,iFAAiF;aACxG,mBAAmB,EAAE,iFAAiF;aACtG,yBAAyB,EAAE,8GAA8G;aAEzI,oBAAoB,EAAE,sJAAsJ;aAC5K,uBAAuB,EAAE,kFAAkF;aAC3G,qBAAqB,EAAE,uDAAuD;aAC9E,2BAA2B,EAAE,8CAA8C;aAC3E,4BAA4B,EAAE,4EAA4E;aAC1G,2BAA2B,EAAE,8CAA8C;aAC3E,8BAA8B,EAAE,6FAA6F;aAC7H,sBAAsB,EAAE,wGAAwG;aAEhI,uBAAuB,EAAE,kJAAkJ;aAC3K,gCAAgC,EAAE,yFAAyF;aAE3H,aAAa,EAAE,4FAA4F;aAC3G,eAAe,EAAE,iEAAiE;aAClF,aAAa,EAAE,sIAAsI;aACrJ,2BAA2B,EAAE,gHAAgH;aAC7I,oBAAoB,EAAE,qHAAqH;aAC3I,mBAAmB,EAAE,+GAA+G;aACpI,yBAAyB,EAAE,2KAA2K;aAEtM,oBAAoB,EAAE,sFAAsF;aAC5G,yBAAyB,EAAE,sEAAsE;aACjG,kBAAkB,EAAE,+EAA+E;aACnG,2BAA2B,EAAE,oFAAoF;aACjH,oBAAoB,EAAE,wFAAwF;aAC9G,0BAA0B,EAAE,2DAA2D;aACvF,oBAAoB,EAAE,mJAAmJ;aACzK,uBAAuB,EAAE,+IAA+I;aACxK,+BAA+B,EAAE,uJAAuJ;aACxL,uBAAuB,EAAE,gFAAgF;aACzG,yBAAyB,EAAE,8EAA8E;aACzG,mBAAmB,EAAE,mFAAmF;aAExG,mBAAmB,EAAE,6EAA6E;aAClG,YAAY,EAAE,uHAAuH;aAErI,0BAA0B,EAAE,uEAAuE;aACnG,sBAAsB,EAAE,8EAA8E;aACtG,sBAAsB,EAAE,qHAAqH;aAE7I,gBAAgB,EAAE,yFAAyF;aAC3G,cAAc,EAAE,gEAAgE;aAChF,kBAAkB,EAAE,oHAAoH;aACxI,qBAAqB,EAAE,oGAAoG;aAC3H,mBAAmB,EAAE,0GAA0G;aAE/H,cAAc,EAAE,8CAA8C;aAC9D,sBAAsB,EAAE,wGAAwG;aAChI,wBAAwB,EAAE,uIAAuI;aACjK,mBAAmB,EAAE,sLAAsL;aAE3M,mBAAmB,EAAE,sKAAsK;aAC3L,8BAA8B,EAAE,6MAA6M;aAE7O,iBAAiB,EAAE,2DAA2D;aAC9E,cAAc,EAAE,oEAAoE;aACpF,mBAAmB,EAAE,kEAAkE;aACvF,oBAAoB,EAAE,6DAA6D;aACnF,gBAAgB,EAAE,4CAA4C;aAC9D,kBAAkB,EAAE,uEAAuE;aAE3F,qBAAqB,EAAE,gFAAgF;aACvG,qBAAqB,EAAE,8FAA8F;aACrH,kBAAkB,EAAE,yCAAyC;aAC7D,iBAAiB,EAAE,4EAA4E;aAC/F,yBAAyB,EAAE,wGAAwG;aACnI,uBAAuB,EAAE,uFAAuF;aAChH,eAAe,EAAE,gGAAgG;aACjH,oBAAoB,EAAE,qEAAqE;aAC3F,yBAAyB,EAAE,+IAA+I;aAC1K,oBAAoB,EAAE,wEAAwE;aAC9F,sBAAsB,EAAE,6DAA6D;aACrF,oBAAoB,EAAE,0IAA0I;aAChK,0BAA0B,EAAE,4IAA4I;aACxK,6BAA6B,EAAE,uIAAuI;aACtK,uBAAuB,EAAE,+IAA+I;aACxK,oBAAoB,EAAE,6KAA6K;aAEnM,iBAAiB,EAAE,mLAAmL;aACtM,oBAAoB,EAAE,iKAAiK;aACvL,qBAAqB,EAAE,kKAAkK;aAEzL,oBAAoB,EAAE,qMAAqM;aAC3N,kBAAkB,EAAE,yIAAyI;aAC7J,uBAAuB,EAAE,qLAAqL;aAC9M,2BAA2B,EAAE,8PAA8P;aAC3R,eAAe,EAAE,kHAAkH;aACnI,wBAAwB,EAAE,0VAA0V;aAEpX,iBAAiB,EAAE,oFAAoF;aACvG,kBAAkB,EAAE,4EAA4E;aAEhG,mBAAmB,EAAE,4GAA4G;aACjI,gBAAgB,EAAE,kIAAkI;aACpJ,eAAe,EAAE,sEAAsE;aACvF,sBAAsB,EAAE,kFAAkF;aAC1G,sBAAsB,EAAE,mGAAmG;aAC3H,sBAAsB,EAAE,8DAA8D;aACtF,gBAAgB,EAAE,oOAAoO;aACtP,wBAAwB,EAAE,wKAAwK;aAClM,uBAAuB,EAAE,oNAAoN;aAC7O,qBAAqB,EAAE,mIAAmI;aAC1J,0BAA0B,EAAE,kOAAkO;aAC9P,0BAA0B,EAAE,6KAA6K;aAEzM,mBAAmB,EAAE,6FAA6F;aAClH,uBAAuB,EAAE,0HAA0H;aACnJ,oBAAoB,EAAE,yFAAyF;aAE/G,uBAAuB,EAAE,wEAAwE;aACjG,uBAAuB,EAAE,iFAAiF;aAC1G,2BAA2B,EAAE,uGAAuG;aACpI,uBAAuB,EAAE,uEAAuE;aAChG,yBAAyB,EAAE,6GAA6G;aAExI,wBAAwB,EAAE,2FAA2F;aACrH,sBAAsB,EAAE,uGAAuG;aAC/H,mBAAmB,EAAE,qMAAqM;aAE1N,yBAAyB,EAAE,kFAAkF;aAC7G,oBAAoB,EAAE,qKAAqK;aAC3L,oBAAoB,EAAE,2DAA2D;aACjF,oBAAoB,EAAE,+DAA+D;aACrF,kBAAkB,EAAE,wKAAwK;aAC5L,0BAA0B,EAAE,4EAA4E;aACxG,iCAAiC,EAAE,uDAAuD;aAC1F,6BAA6B,EAAE,6GAA6G;aAC5I,2BAA2B,EAAE,4GAA4G;aACzI,0BAA0B,EAAE,iEAAiE;aAC7F,wBAAwB,EAAE,iFAAiF;aAC3G,0BAA0B,EAAE,qEAAqE;aACjG,2BAA2B,EAAE,6FAA6F;aAC1H,6BAA6B,EAAE,uDAAuD;aACtF,+BAA+B,EAAE,8HAA8H;aAC/J,qBAAqB,EAAE,uGAAuG;aAC9H,+BAA+B,EAAE,+GAA+G;aAChJ,6BAA6B,EAAE,6KAA6K;aAE5M,wBAAwB,EAAE,wIAAwI;aAClK,mBAAmB,EAAE,oFAAoF;aACzG,wBAAwB,EAAE,mDAAmD;aAC7E,0BAA0B,EAAE,0GAA0G;aAEtI,kBAAkB,EAAE,kHAAkH;aACtI,qBAAqB,EAAE,yJAAyJ;aAEhL,iBAAiB,EAAE,2HAA2H;aAC9I,uBAAuB,EAAE,sPAAsP;aAE/Q,oBAAoB,EAAE,oFAAoF;aAE1G,4BAA4B,EAAE,4FAA4F;aAC1H,0BAA0B,EAAE,iDAAiD;aAC7E,yBAAyB,EAAE,0EAA0E;aAErG,4BAA4B,EAAE,mIAAmI;aACjK,6BAA6B,EAAE,4FAA4F;aAE3H,4BAA4B,EAAE,qHAAqH;aACnJ,gCAAgC,EAAE,oJAAoJ;aACtL,gCAAgC,EAAE,6FAA6F;aAC/H,mCAAmC,EAAE,6JAA6J;aAElM,wBAAwB,EAAE,mEAAmE;aAC7F,wBAAwB,EAAE,mEAAmE;aAC7F,sBAAsB,EAAE,iIAAiI;aAEzJ,0BAA0B,EAAE,4HAA4H;aACxJ,+BAA+B,EAAE,iIAAiI;aAClK,kCAAkC,EAAE,sFAAsF;aAC1H,wBAAwB,EAAE,sFAAsF;aAChH,yBAAyB,EAAE,mIAAmI;aAC9J,gCAAgC,EAAE,wFAAwF;aAC1H,4BAA4B,EAAE,uEAAuE;aACrG,8BAA8B,EAAE,gEAAgE;aAChG,6BAA6B,EAAE,gFAAgF;aAC/G,2BAA2B,EAAE,0DAA0D;aACvF,sBAAsB,EAAE,oEAAoE;aAC5F,8BAA8B,EAAE,yFAAyF;aACzH,0BAA0B,EAAE,6DAA6D;aACzF,wBAAwB,EAAE,2GAA2G;aACrI,8BAA8B,EAAE,8HAA8H;aAC9J,+BAA+B,EAAE,gGAAgG;aACjI,2BAA2B,EAAE,uGAAuG;aAEpI,yBAAyB,EAAE,6KAA6K;aACxM,2BAA2B,EAAE,6FAA6F;aAE1H,kCAAkC,EAAE,4NAA4N;aAEhQ,oBAAoB,EAAE,2FAA2F;aACjH,0BAA0B,EAAE,8LAA8L;aAE1N,UAAU,EAAE,2FAA2F;aACvG,aAAa,EAAE,2FAA2F;aAE1G,mBAAmB,EAAE,kHAAkH;aACvI,qBAAqB,EAAE,qFAAqF;aAC5G,mBAAmB,EAAE,0DAA0D;aAC/E,kBAAkB,EAAE,oGAAoG;aAExH,wBAAwB,EAAE,uHAAuH;aAEjJ,YAAY,EAAE,6FAA6F;aAC3G,gBAAgB,EAAE,4FAA4F;aAC9G,sBAAsB,EAAE,mFAAmF;aAC3G,YAAY,EAAE,6EAA6E;aAC3F,qBAAqB,EAAE,8GAA8G;aAErI,YAAY,EAAE,sEAAsE;aACpF,aAAa,EAAE,mDAAmD;aAClE,WAAW,EAAE,qDAAqD;aAClE,gBAAgB,EAAE,iFAAiF;aACnG,uBAAuB,EAAE,0EAA0E;aAEnG,eAAe,EAAE,kHAAkH;aACnI,uBAAuB,EAAE,uIAAuI;aAChK,+BAA+B,EAAE,yEAAyE;aAC1G,wBAAwB,EAAE,0LAA0L;aAEpN,wBAAwB,EAAE,kEAAkE;aAC5F,qBAAqB,EAAE,yFAAyF;aAChH,uBAAuB,EAAE,2KAA2K;aAEpM,eAAe,EAAE,gGAAgG;aACjH,gBAAgB,EAAE,gEAAgE;aAElF,sBAAsB,EAAE,gHAAgH;aACxI,gBAAgB,EAAE,sJAAsJ;aACxK,eAAe,EAAE,8IAA8I;aAC/J,gBAAgB,EAAE,8EAA8E;aAEhG,wBAAwB,EAAE,kEAAkE;aAC5F,qBAAqB,EAAE,yFAAyF;aAEhH,wBAAwB,EAAE,8DAA8D;aACxF,cAAc,EAAE,gGAAgG;aAChH,iBAAiB,EAAE,6FAA6F;aAChH,gBAAgB,EAAE,mIAAmI;aACrJ,wBAAwB,EAAE,yGAAyG;aACnI,oBAAoB,EAAE,6OAA6O;aAEnQ,eAAe,EAAE,6GAA6G;aAC9H,UAAU,EAAE,2FAA2F;aACvG,sBAAsB,EAAE,iFAAiF;aACzG,kBAAkB,EAAE,gFAAgF;aACpG,UAAU,EAAE,yFAAyF;aACrG,iBAAiB,EAAE,4FAA4F;aAC/G,oBAAoB,EAAE,iIAAiI;aAEvJ,qBAAqB,EAAE,qGAAqG;aAC5H,mBAAmB,EAAE,4GAA4G;aAEjI,yBAAyB,EAAE,qHAAqH;aAChJ,uBAAuB,EAAE,8IAA8I;aAEvK,sBAAsB,EAAE,uFAAuF;aAC/G,iBAAiB,EAAE,8HAA8H;aACjJ,sBAAsB,EAAE,wDAAwD;aAChF,kBAAkB,EAAE,yHAAyH;aAC7I,wBAAwB,EAAE,0FAA0F;aACpH,kBAAkB,EAAE,gHAAgH;aACpI,uBAAuB,EAAE,oHAAoH;aAC7I,4BAA4B,EAAE,0GAA0G;aACxI,kCAAkC,EAAE,mHAAmH;aACvJ,4BAA4B,EAAE,0HAA0H;aAExJ,yBAAyB,EAAE,uGAAuG;aAClI,qBAAqB,EAAE,oDAAoD;aAC3E,kBAAkB,EAAE,+GAA+G;aACnI,oBAAoB,EAAE,sFAAsF;aAC5G,uBAAuB,EAAE,kEAAkE;aAC3F,4BAA4B,EAAE,kIAAkI;aAChK,0BAA0B,EAAE,sEAAsE;aAClG,oBAAoB,EAAE,mLAAmL;aACzM,sBAAsB,EAAE,8MAA8M;aACtO,qBAAqB,EAAE,sFAAsF;aAE7G,cAAc,EAAE,iCAAiC;aACjD,kBAAkB,EAAE,sDAAsD;CAClE,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,OAAO,CAAC;AAE9C,mDAAmD;AACnD,eAAO,MAAM,YAAY,EAA2B,UAAU,EAAE,CAAC;AAEjE,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,MAAM,IAAI,MAAM,EAAE,CAAC;AAEtD,eAAO,MAAM,WAAW,QAAkD,CAAC;AAE3E,2HAA2H;AAC3H,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,UAAU,CAI/E"}

package/dist/workspace/reason-codes.js

@@ -226,11 +226,29 @@ export const REASONS = {
     "diagram-source-missing": "A declared diagram's source file does not exist in the tree read.",
     "diagram-render-missing": "A declared diagram's render file does not exist in the tree read.",
     "diagram-render-drift": "A declared diagram records a sourceHash, and the source's bytes now hash to something else: the render is stale for its source.",
+    // The security group checklists (check, #4168 step 7). Each is also a WSP finding.
+    "security-signers-missing": "The workspace opts into verified-releases, and there is no .chant/allowed_signers to verify a release's signature against.",
+    "security-release-gate-missing": "Under verified-releases, identity.gates has no release entry, or it names no class, so a cut is not held to a class of signers.",
+    "security-publish-allows-unsigned": "Under verified-releases, a pipeline file runs release publish with --allow-unsigned.",
+    "security-sbom-disabled": "Under supply-chain, a member's chant.config.ts sets sbom: false on a publish target.",
+    "security-sbom-unsourced": "Under supply-chain, a member publishes, names no sbom file and has no package-lock.json, pom.xml or Cargo.lock to write one from.",
+    "security-publish-no-provenance": "Under supply-chain, a pipeline file runs release publish without --require-provenance.",
+    "security-component-no-sbom": "Under supply-chain, a member's components have no generate-sbom step.",
+    "security-component-no-verify": "Under supply-chain, a member's components have no verify step.",
+    "security-signed-since-unset": "Under who-ran-it, ci.green sets no signedSince, or there is no ci.green block.",
+    "security-runner-untrusted": "Under who-ran-it, .chant/trust.json lists no runner key.",
+    "security-tick-no-key": "Under who-ran-it, a pipeline file runs ci tick with no runner key.",
+    "security-review-not-required": "Under review-rules, an apply job passes --no-require-review, which the group overrides.",
+    "security-attribution-any": "Under review-rules, identity.attribution is not identified.",
+    "security-gate-unsigned": "Under review-rules, an apply job names a gate identity.gates does not list, or identity.gates lists none.",
+    "security-runner-start-no-key": "Under isolated-runners, .chant/trust.json lists no key under runners for a provisioner to sign runner-start statements with.",
+    "security-runner-start-no-role": "Under isolated-runners, no principal under runners in .chant/trust.json holds the runner role.",
+    "security-trust-unreadable": "Under isolated-runners, .chant/trust.json can't be read, so no runner-start statement can be checked.",
     // A box that holds a credential (check, #2726). Each is also a WSP finding.
     "box-credential-declared": "A file in a box member's directory carries a literal secret: a credential's shape, or a literal where a credential goes. A variable or secret-manager reference is not one.",
     "box-capability-unbrokered": "A capability in a member's box block names no broker, so the box would hold its credential.",
-    // The credential fountain itself hands a persistent box (check, #2780). Also a WSP finding.
-    "box-fountain-callback-undeclared": "A box member builds a fountain Box, whose persistent sandbox fountain gives a callback token scoped to its owner, and the member's box block does not declare the fountain-callback capability brokered by fountain with scope owner.",
+    // The credential fountain itself hands a box (check, #2780). Also a WSP finding.
+    "box-fountain-callback-undeclared": "A box member builds a fountain Box, whose sandbox fountain gives a callback token scoped to its owner, and the member's box block does not declare the fountain-callback capability brokered by fountain with scope owner.",
     // A box's intent, the decision record its box block names (check, #2850). Each is also a WSP finding.
     "box-intent-unknown": "A box block names an intent, and no record of a declared kind named decision has that id.",
     "box-intent-unconstrained": "The decision record a box names as its intent constrains no member or path of this workspace: no member: entry for a declared member and no path: entry at, above or inside one's directory.",

package/dist/workspace/release-candidates.d.ts

@@ -0,0 +1,129 @@
+/**
+ * The `release-candidates` read (#4168 4.2): which green commits of trunk a
+ * person can cut a release from, and what each one would ship.
+ *
+ * `chant release candidates [--env <env>] [--json]` prints this document.
+ * It walks the first-parent line of the trunk (`ci.green.branch`, else what
+ * `origin/HEAD` names, as `release cut` resolves it) from its tip back to the
+ * oldest commit an environment of the member runs, or `limit` commits when an
+ * environment runs no release yet. An environment runs the releases its
+ * latest deploy records name in `releaseDigest`, as the `releases` read
+ * (./releases.ts) says.
+ *
+ * Every green commit that is not revoked is a candidate. Its `changes` are
+ * the first-parent commits after the previous candidate up to and including
+ * it, so the candidates partition the walk. A revoked commit is listed under
+ * `skipped`, and its changes carry on into the next candidate. Commits after
+ * the newest candidate are listed under `pending`: they are not green yet, or
+ * went red.
+ *
+ * For each change it names the work items and other records its
+ * `Chant-Record` trailers name, the pull request a forge's squash subject
+ * names (`... (#123)`), and the merge record `_merges/<sha>.json` on
+ * `chant/lifecycle` when one exists (#4168 4.1). Each candidate lists the
+ * flags whose record files changed in its range, from the declared flag kinds
+ * (#4024).
+ *
+ * It reads local refs and tags only and never fetches. Git is read through a
+ * local `git` subprocess.
+ */
+export declare const RELEASE_CANDIDATES_CONTRACT_VERSION = 1;
+export declare const RELEASE_CANDIDATES_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/release-candidates/v1/release-candidates.schema.json";
+/** Why the read stopped. Closed; each code is in `reason-codes.ts`. */
+export declare const RELEASE_CANDIDATES_ERROR_CODES: readonly ["not-a-git-repository", "ledger-unreadable"];
+/** How many first-parent commits the walk reads when no environment bounds it. */
+export declare const DEFAULT_CANDIDATE_LIMIT = 50;
+/** A release an environment runs, by the components whose latest deploy names it. */
+export interface RunningRelease {
+    releaseDigest: string;
+    label: string | null;
+    /** The commit it was cut from, or null when its release file is not on this clone's branch. */
+    commit: string | null;
+    components: string[];
+}
+export interface CandidateEnvironment {
+    env: string;
+    /** Newest cut first. Empty when no deploy there names a release. */
+    running: RunningRelease[];
+}
+/** One first-parent commit in a candidate's range. */
+export interface CandidateChange {
+    commit: string;
+    subject: string;
+    /** Author date, ISO 8601. */
+    date: string;
+    /** The ids its `Chant-Record: work:<id>` trailers name. */
+    work: string[];
+    /** Every `Chant-Record` trailer, as `<kind>:<id>`. */
+    records: string[];
+    /** The pull request the subject names (`(#123)` at its end), the merge record's, or null. */
+    pr: number | null;
+    /** The merge record `_merges/<sha>.json` (#4168 4.1), as stored, or null when there is none. */
+    merge: Record<string, unknown> | null;
+}
+export interface CandidateFlag {
+    id: string;
+    member: string;
+    param: string;
+    /** The record file from the workspace root. */
+    path: string;
+    /** The value per environment, as the working tree's record writes it. */
+    values: Record<string, string | number | boolean>;
+}
+export interface Candidate {
+    commit: string;
+    subject: string;
+    date: string;
+    /** The environments that don't run this commit or a later one yet. */
+    newFor: string[];
+    /** The labels of releases already cut from it. */
+    cut: string[];
+    changes: CandidateChange[];
+    flags: CandidateFlag[];
+}
+export type ReleaseCandidatesDocument = {
+    $schema: string;
+    contract: number;
+    chant: string;
+    member: string | null;
+    branch: string;
+    /** The tip of the branch as this clone knows it. */
+    tip: string | null;
+    environments: CandidateEnvironment[];
+    /** The oldest commit an environment runs, where the walk stopped, or null when it read `limit` commits. */
+    since: string | null;
+    /** Newest first. */
+    candidates: Candidate[];
+    /** Revoked green commits, newest first. */
+    skipped: Array<{
+        commit: string;
+        subject: string;
+        reason: "revoked";
+    }>;
+    /** Commits after the newest candidate, newest first. */
+    pending: CandidateChange[];
+} | {
+    $schema: string;
+    contract: number;
+    chant: string;
+    error: {
+        code: (typeof RELEASE_CANDIDATES_ERROR_CODES)[number];
+        message: string;
+    };
+};
+export interface ReleaseCandidatesQuery {
+    cwd: string;
+    /** Only this environment's view: the walk stops at what it runs, and `newFor` names only it. */
+    env?: string;
+    limit?: number;
+}
+/** The work ids and `<kind>:<id>` records a commit's `Chant-Record` trailers name. */
+export declare function recordTrailers(trailers: Record<string, string[]>): {
+    work: string[];
+    records: string[];
+};
+/** The pull request number at the end of a squash subject, or null. */
+export declare function prFromSubject(subject: string): number | null;
+/** Read the release candidates of the member at `query.cwd`. */
+export declare function releaseCandidatesDocument(query: ReleaseCandidatesQuery): Promise<ReleaseCandidatesDocument>;
+//# sourceMappingURL=release-candidates.d.ts.map

package/dist/workspace/release-candidates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-candidates.d.ts","sourceRoot":"","sources":["../../src/workspace/release-candidates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAUH,eAAO,MAAM,mCAAmC,IAAI,CAAC;AACrD,eAAO,MAAM,4BAA4B,sGAAsG,CAAC;AAEhJ,uEAAuE;AACvE,eAAO,MAAM,8BAA8B,YAAI,sBAAsB,EAAE,mBAAmB,CAAU,CAAC;AAErG,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,+FAA+F;IAC/F,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,sDAAsD;IACtD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6FAA6F;IAC7F,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,gGAAgG;IAChG,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,2GAA2G;IAC3G,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oBAAoB;IACpB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,2CAA2C;IAC3C,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IACvE,wDAAwD;IACxD,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5I,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,gGAAgG;IAChG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAOxG;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG5D;AAED,gEAAgE;AAChE,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAiIjH"}

package/dist/workspace/release-candidates.js

@@ -0,0 +1,233 @@
+/**
+ * The `release-candidates` read (#4168 4.2): which green commits of trunk a
+ * person can cut a release from, and what each one would ship.
+ *
+ * `chant release candidates [--env <env>] [--json]` prints this document.
+ * It walks the first-parent line of the trunk (`ci.green.branch`, else what
+ * `origin/HEAD` names, as `release cut` resolves it) from its tip back to the
+ * oldest commit an environment of the member runs, or `limit` commits when an
+ * environment runs no release yet. An environment runs the releases its
+ * latest deploy records name in `releaseDigest`, as the `releases` read
+ * (./releases.ts) says.
+ *
+ * Every green commit that is not revoked is a candidate. Its `changes` are
+ * the first-parent commits after the previous candidate up to and including
+ * it, so the candidates partition the walk. A revoked commit is listed under
+ * `skipped`, and its changes carry on into the next candidate. Commits after
+ * the newest candidate are listed under `pending`: they are not green yet, or
+ * went red.
+ *
+ * For each change it names the work items and other records its
+ * `Chant-Record` trailers name, the pull request a forge's squash subject
+ * names (`... (#123)`), and the merge record `_merges/<sha>.json` on
+ * `chant/lifecycle` when one exists (#4168 4.1). Each candidate lists the
+ * flags whose record files changed in its range, from the declared flag kinds
+ * (#4024).
+ *
+ * It reads local refs and tags only and never fetches. Git is read through a
+ * local `git` subprocess.
+ */
+import { execFileSync } from "node:child_process";
+import { relative, resolve, sep } from "node:path";
+import { latestPerComponent, readReleaseLedger } from "../lifecycle/release-ledger.js";
+import { readAllReleases, readCuts } from "../lifecycle/release-store.js";
+import { resolveMemberLedger } from "../lifecycle/member-ledger.js";
+import { readBlobFromPath } from "../lifecycle/git.js";
+import { readerVersion } from "./declaration.js";
+export const RELEASE_CANDIDATES_CONTRACT_VERSION = 1;
+export const RELEASE_CANDIDATES_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/release-candidates/v1/release-candidates.schema.json";
+/** Why the read stopped. Closed; each code is in `reason-codes.ts`. */
+export const RELEASE_CANDIDATES_ERROR_CODES = ["not-a-git-repository", "ledger-unreadable"];
+/** How many first-parent commits the walk reads when no environment bounds it. */
+export const DEFAULT_CANDIDATE_LIMIT = 50;
+function git(top, args) {
+    return execFileSync("git", args, { cwd: top, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 64 * 1024 * 1024 }).trim();
+}
+function tryGit(top, args) {
+    try {
+        return git(top, args);
+    }
+    catch {
+        return null;
+    }
+}
+const PR_IN_SUBJECT = /\(#(\d+)\)\s*$/;
+/** The work ids and `<kind>:<id>` records a commit's `Chant-Record` trailers name. */
+export function recordTrailers(trailers) {
+    const values = Object.entries(trailers)
+        .filter(([k]) => k.toLowerCase() === "chant-record")
+        .flatMap(([, v]) => v);
+    const records = values.map((v) => v.trim()).filter((v) => /^[^:\s]+:\S+$/.test(v));
+    const work = records.filter((r) => r.startsWith("work:")).map((r) => r.slice("work:".length));
+    return { work, records };
+}
+/** The pull request number at the end of a squash subject, or null. */
+export function prFromSubject(subject) {
+    const m = PR_IN_SUBJECT.exec(subject);
+    return m ? Number(m[1]) : null;
+}
+/** Read the release candidates of the member at `query.cwd`. */
+export async function releaseCandidatesDocument(query) {
+    const head = { $schema: RELEASE_CANDIDATES_SCHEMA_ID, contract: RELEASE_CANDIDATES_CONTRACT_VERSION, chant: readerVersion() };
+    const cwd = resolve(query.cwd);
+    const top = tryGit(cwd, ["rev-parse", "--show-toplevel"]);
+    if (!top)
+        return { ...head, error: { code: "not-a-git-repository", message: "candidates are read from trunk's commits and tags, and this directory is not in a git repository" } };
+    try {
+        const { scopeSource } = await import("./write-scope.js");
+        const { resolveTrunk } = await import("../lifecycle/release-workstation.js");
+        const { judgedCiTags } = await import("../lifecycle/release-revocation.js");
+        const { commitDetails } = await import("./intent.js");
+        const source = scopeSource(cwd);
+        const green = source.declaration?.ci?.green ?? null;
+        const trunk = resolveTrunk(top, green?.branch ?? null);
+        const tip = tryGit(top, ["rev-parse", "--verify", "--quiet", `refs/remotes/${trunk.remote}/${trunk.branch}^{commit}`]) ??
+            tryGit(top, ["rev-parse", "--verify", "--quiet", `refs/heads/${trunk.branch}^{commit}`]);
+        const ledger = await resolveMemberLedger(cwd);
+        const loc = { cwd };
+        // What each environment runs.
+        const { readMemberPromotionOrder } = await import("./promotion-order.js");
+        const order = ((await readMemberPromotionOrder(cwd)) ?? []).map((s) => s.name);
+        const envNames = query.env !== undefined ? [query.env] : order;
+        const { releases } = await readAllReleases(loc);
+        const { cuts } = await readCuts(loc);
+        const commitOf = new Map(releases.map((r) => [r.releaseDigest, r.commit]));
+        const labelOf = new Map();
+        const cutAt = new Map();
+        for (const c of cuts) {
+            if (c.label !== null && !labelOf.has(c.releaseDigest))
+                labelOf.set(c.releaseDigest, c.label);
+            if (!cutAt.has(c.releaseDigest) || c.timestamp > cutAt.get(c.releaseDigest))
+                cutAt.set(c.releaseDigest, c.timestamp);
+        }
+        const environments = [];
+        for (const env of envNames) {
+            const { records } = await readReleaseLedger(env, loc);
+            const byDigest = new Map();
+            for (const record of latestPerComponent(records).values()) {
+                const digest = record.releaseDigest;
+                if (typeof digest !== "string")
+                    continue;
+                byDigest.set(digest, [...(byDigest.get(digest) ?? []), record.component].sort());
+            }
+            const running = [...byDigest]
+                .map(([releaseDigest, components]) => ({ releaseDigest, label: labelOf.get(releaseDigest) ?? null, commit: commitOf.get(releaseDigest) ?? null, components }))
+                .sort((a, b) => ((cutAt.get(b.releaseDigest) ?? "") < (cutAt.get(a.releaseDigest) ?? "") ? -1 : 1));
+            environments.push({ env, running });
+        }
+        const empty = { ...head, member: ledger.members.length > 0 ? ledger.members.join("/") : null, branch: trunk.branch, tip, environments, since: null, candidates: [], skipped: [], pending: [] };
+        if (!tip)
+            return empty;
+        // The oldest commit any environment runs bounds the walk, when every environment runs one.
+        const limit = query.limit ?? DEFAULT_CANDIDATE_LIMIT;
+        const line = git(top, ["rev-list", "--first-parent", `--max-count=${Math.max(limit, 1) * 20}`, tip]).split("\n").filter(Boolean);
+        const position = new Map(line.map((sha, i) => [sha, i]));
+        const runningCommits = (e) => e.running.map((r) => r.commit).filter((c) => c !== null && position.has(c));
+        const bounded = environments.length > 0 && environments.every((e) => runningCommits(e).length > 0);
+        let since = null;
+        let walk = line.slice(0, limit);
+        if (bounded) {
+            const oldest = Math.max(...environments.flatMap((e) => runningCommits(e).map((c) => position.get(c))));
+            since = line[oldest];
+            walk = line.slice(0, oldest);
+        }
+        // An environment's newest running commit on the line, by position (smaller is newer).
+        const newestRun = new Map(environments.map((e) => [e.env, Math.min(...runningCommits(e).map((c) => position.get(c)), Number.POSITIVE_INFINITY)]));
+        const tags = await judgedCiTags(top, green);
+        const details = commitDetails(top, walk);
+        const merges = new Map();
+        for (const sha of walk) {
+            const text = (await readBlobFromPath("_merges", `${sha}.json`, loc)) ?? (ledger.prefix !== "" ? await readBlobFromPath("_merges", `${sha}.json`, { cwd, ledgerPrefix: "" }) : null);
+            if (text === null)
+                continue;
+            try {
+                const parsed = JSON.parse(text);
+                if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                    merges.set(sha, parsed);
+            }
+            catch {
+                // A merge record that is not JSON is left out.
+            }
+        }
+        const change = (sha) => {
+            const d = details.get(sha);
+            const { work, records } = recordTrailers(d?.trailers ?? {});
+            const merge = merges.get(sha) ?? null;
+            const mergePr = merge && typeof merge.pr === "number" ? merge.pr : null;
+            const subject = d?.subject ?? "";
+            return { commit: sha, subject, date: d?.date ?? "", work, records, pr: mergePr ?? prFromSubject(subject), merge };
+        };
+        const flagReader = await flagsReader(top, source.rootOnDisk);
+        const cutLabels = new Map();
+        for (const r of releases) {
+            const label = labelOf.get(r.releaseDigest);
+            if (label !== undefined)
+                cutLabels.set(r.commit, [...(cutLabels.get(r.commit) ?? []), label].sort());
+        }
+        // Oldest first, so each candidate closes the commits since the previous one.
+        const candidates = [];
+        const skipped = [];
+        let open = [];
+        for (let i = walk.length - 1; i >= 0; i--) {
+            const sha = walk[i];
+            open.push(sha);
+            if (tags.revoked.has(sha)) {
+                skipped.push({ commit: sha, subject: details.get(sha)?.subject ?? "", reason: "revoked" });
+                continue;
+            }
+            if (!tags.green.has(sha))
+                continue;
+            const own = change(sha);
+            candidates.push({
+                commit: sha,
+                subject: own.subject,
+                date: own.date,
+                newFor: environments.filter((e) => i < newestRun.get(e.env)).map((e) => e.env),
+                cut: cutLabels.get(sha) ?? [],
+                changes: open.map(change).reverse(),
+                flags: flagReader(open),
+            });
+            open = [];
+        }
+        return {
+            ...empty,
+            since,
+            candidates: candidates.reverse(),
+            skipped: skipped.reverse(),
+            pending: open.map(change).reverse(),
+        };
+    }
+    catch (err) {
+        return { ...head, error: { code: "ledger-unreadable", message: `reading the candidates failed: ${err instanceof Error ? err.message : String(err)}` } };
+    }
+}
+/** The flags whose record files the given commits change, or a reader that finds none when no flag kind can be read. */
+async function flagsReader(top, root) {
+    if (!root)
+        return () => [];
+    let flags;
+    try {
+        const { readWorkspaceFlags } = await import("./flags-read.js");
+        flags = (await readWorkspaceFlags(root)).flags;
+    }
+    catch {
+        return () => [];
+    }
+    if (flags.length === 0)
+        return () => [];
+    const fromTop = (p) => relative(top, resolve(root, p)).split(sep).join("/");
+    const byPath = new Map(flags.map((f) => [fromTop(f.path), f]));
+    return (shas) => {
+        const touched = new Set();
+        for (const sha of shas) {
+            const names = tryGit(top, ["diff-tree", "--no-commit-id", "--name-only", "-r", "--root", sha]) ?? "";
+            for (const n of names.split("\n"))
+                if (byPath.has(n))
+                    touched.add(n);
+        }
+        return [...touched]
+            .sort()
+            .map((p) => byPath.get(p))
+            .map((f) => ({ id: f.id, member: f.member, param: f.param, path: f.path, values: f.values }));
+    };
+}