@intentius/chant 0.124.32 → 0.124.33

package/dist/ci-jobs.d.ts

@@ -199,6 +199,10 @@ export declare const GITLAB_SCHEDULE_SOURCE = "$CI_PIPELINE_SOURCE == \"schedule
 export declare const GITLAB_FULL_HISTORY: {
     readonly GIT_DEPTH: "0";
 };
+/** The tags a build request is pushed as (#4169), as a glob for a trigger. */
+export declare const BUILD_REQUEST_TAGS = "ci/build/**";
+/** The `rules:` if-expression for a build request's tag (#4169). */
+export declare const GITLAB_BUILD_REQUEST_RULE = "$CI_COMMIT_TAG =~ /^ci\\/build\\//";
 /** The `rules:` if-expression for a push to `branch`, a quoted name or an expression such as `$CI_DEFAULT_BRANCH`. */
 export declare function gitlabPushRule(branch: string): string;
 /**

package/dist/ci-jobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-jobs.d.ts","sourceRoot":"","sources":["../src/ci-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItF;;;;GAIG;AACH,eAAO,MAAM,QAAQ,YAAY,CAAC;AAElC;;;;GAIG;AACH,eAAO,MAAM,cAAc,SAAS,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CASxE;AAED,uEAAuE;AACvE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,4DAA4D;AAC5D,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE/E;AAED,gHAAgH;AAChH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS,GAAG;KAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;CAAE,CAE1H;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAEzF;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAElG,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAEnH;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAMlI;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjH;AAED,8GAA8G;AAC9G,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,CAGrI;AAED,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAG7E;AAID,yGAAyG;AACzG,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAKnH;AAED,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,oCAAoC;AACpC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAYxF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAIxG;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAgBlD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AAeD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAsBhF;AAID,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,mDAAiD,CAAC;AAE1F,kEAAkE;AAClE,eAAO,MAAM,sBAAsB,wCAAsC,CAAC;AAE1E,+GAA+G;AAC/G,eAAO,MAAM,mBAAmB;aAAK,SAAS,EAAE,GAAG;CAAW,CAAC;AAE/D,sHAAsH;AACtH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAYxE;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBrI;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAuB3I;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAWtG;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAqBtF"}
+{"version":3,"file":"ci-jobs.d.ts","sourceRoot":"","sources":["../src/ci-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItF;;;;GAIG;AACH,eAAO,MAAM,QAAQ,YAAY,CAAC;AAElC;;;;GAIG;AACH,eAAO,MAAM,cAAc,SAAS,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CASxE;AAED,uEAAuE;AACvE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,4DAA4D;AAC5D,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE/E;AAED,gHAAgH;AAChH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS,GAAG;KAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;CAAE,CAE1H;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAEzF;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAElG,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAEnH;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAMlI;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjH;AAED,8GAA8G;AAC9G,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,CAGrI;AAED,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAG7E;AAID,yGAAyG;AACzG,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAKnH;AAED,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,oCAAoC;AACpC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAYxF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAIxG;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAgBlD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AAeD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAsBhF;AAID,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,mDAAiD,CAAC;AAE1F,kEAAkE;AAClE,eAAO,MAAM,sBAAsB,wCAAsC,CAAC;AAE1E,+GAA+G;AAC/G,eAAO,MAAM,mBAAmB;aAAK,SAAS,EAAE,GAAG;CAAW,CAAC;AAE/D,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,uCAAuC,CAAC;AAE9E,sHAAsH;AACtH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAYxE;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBrI;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAuB3I;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAWtG;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAqBtF"}

package/dist/ci-jobs.js

@@ -356,6 +356,10 @@ export const GITLAB_MERGE_REQUEST_SOURCE = '$CI_PIPELINE_SOURCE == "merge_reques
 export const GITLAB_SCHEDULE_SOURCE = '$CI_PIPELINE_SOURCE == "schedule"';
 /** A job variable that makes the runner clone the whole history, which a job reading the base commit needs. */
 export const GITLAB_FULL_HISTORY = { GIT_DEPTH: "0" };
+/** The tags a build request is pushed as (#4169), as a glob for a trigger. */
+export const BUILD_REQUEST_TAGS = "ci/build/**";
+/** The `rules:` if-expression for a build request's tag (#4169). */
+export const GITLAB_BUILD_REQUEST_RULE = "$CI_COMMIT_TAG =~ /^ci\\/build\\//";
 /** The `rules:` if-expression for a push to `branch`, a quoted name or an expression such as `$CI_DEFAULT_BRANCH`. */
 export function gitlabPushRule(branch) {
     return `$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == ${branch}`;
@@ -398,11 +402,14 @@ export function gitlabRules(subject, trigger, selector) {
                 return { if: `${GITLAB_MERGE_REQUEST_SOURCE} && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "${branch}"` };
             });
         }
-        case "push":
-            return pushBranches(trigger.branches).map((branch) => {
+        case "push": {
+            const rules = pushBranches(trigger.branches).map((branch) => {
                 assertGitlabBranch(subject, branch);
                 return { if: gitlabPushRule(JSON.stringify(branch)) };
             });
+            // #4169: a newest build also runs at each build request's tag.
+            return trigger.build === "newest" ? [...rules, { if: GITLAB_BUILD_REQUEST_RULE }] : rules;
+        }
     }
 }
 /**

package/dist/cli/handlers/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/build.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAuMlD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsJnE"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/build.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAsNlD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsJnE"}

package/dist/cli/handlers/build.js

@@ -14,8 +14,12 @@ import { resolvePromotionSource } from "../../components/promote-order.js";
  * flags the generated jobs pass to pr-plan and pr-apply. `--pr-build` and
  * `--pr-build-command` (#4088) add the build and lint steps before both.
  * `reportUrl` is `--report-url`, else the workspace's `ci.reportUrl` (#4160).
+ * `requireReview` is `--require-review`, or a workspace that opts into the
+ * `review-rules` security group (#4168); off otherwise. `requireRunnerStart`
+ * is `--require-runner-start`, or the `isolated-runners` group. `--apply-on-merge`
+ * (#4168) writes the apply job on merge in place of the record job.
  */
-function prLoopOption(args, reportUrl) {
+function prLoopOption(args, reportUrl, requireReview = false, requireRunnerStart = false) {
     return {
         ...(args.gate ? { gate: args.gate } : {}),
         ...(args.branch ? { branch: args.branch } : {}),
@@ -23,6 +27,9 @@ function prLoopOption(args, reportUrl) {
         ...(reportUrl ? { reportUrl } : {}),
         ...(args.prBuild ? { build: true } : {}),
         ...(args.prBuildCommand ? { buildCommand: args.prBuildCommand } : {}),
+        ...(args.requireReview === true || requireReview ? { requireReview: true } : {}),
+        ...(args.requireRunnerStart === true || requireRunnerStart ? { requireRunnerStart: true } : {}),
+        ...(args.applyOnMerge ? { applyOnMerge: true } : {}),
     };
 }
 /**
@@ -97,6 +104,14 @@ async function runGenerateComponents(ctx) {
             return 1;
         }
     }
+    // #4168: the review-rules group turns on --require-review in the generated apply. Read only inside a workspace.
+    let reviewRules = false;
+    let isolatedRunners = false;
+    if (found && args.prLoop) {
+        const groups = (await import("../../workspace/security.js")).securityGroupsAt(resolve(args.path));
+        reviewRules = groups.has("review-rules");
+        isolatedRunners = groups.has("isolated-runners");
+    }
     if (found) {
         memberPipeline = await import("../../workspace/member-pipeline.js");
         try {
@@ -111,7 +126,7 @@ async function runGenerateComponents(ctx) {
                 params: args.param,
                 paramsFile: args.paramsFile,
                 ...(args.waveGate ? { waveGate: { gate: args.waveGate, ...(args.canary?.length ? { canary: args.canary } : {}), ...(args.base ? { base: args.base } : {}) } } : {}),
-                ...(args.prLoop ? { prLoop: prLoopOption(args, reportUrl) } : {}),
+                ...(args.prLoop ? { prLoop: prLoopOption(args, reportUrl, reviewRules, isolatedRunners) } : {}),
                 ...(args.image ? { image: args.image } : {}),
                 ...(args.beforeScript?.length ? { beforeScript: args.beforeScript } : {}),
             });
@@ -138,7 +153,7 @@ async function runGenerateComponents(ctx) {
             ? { gatedWaves: { gate: args.waveGate, ...(args.canary?.length ? { canary: args.canary } : {}), ...(args.base ? { base: args.base } : {}) } }
             : {}),
         // #3183: a plan job per pull request and an apply job per merge.
-        ...(args.prLoop ? { prLoop: prLoopOption(args, reportUrl) } : {}),
+        ...(args.prLoop ? { prLoop: prLoopOption(args, reportUrl, reviewRules, isolatedRunners) } : {}),
         // #4002: the job image and the lines that install what it lacks, chant itself included.
         ...(args.image ? { image: args.image } : {}),
         ...(args.beforeScript?.length ? { beforeScript: args.beforeScript } : {}),

package/dist/cli/handlers/lifecycle-health.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `chant lifecycle health <env> [lexicon] [--json]` (#4177): whether each
+ * declared resource that has a health read is up, separate from drift.
+ *
+ * It builds the project as `lifecycle diff` does, so the entity names are the
+ * graph's node ids, then asks each lexicon with a health read about the
+ * entities whose types it names. An environment's declared endpoint is applied
+ * for the read, as on the other live reads (#1166).
+ *
+ * The JSON is the {@link HEALTH_SCHEMA} shape. A single-stack project prints
+ * `lexicons` at the top level; a multi-stack one nests them under `stacks`,
+ * the same split `lifecycle diff --live --json` makes.
+ */
+import type { CommandContext } from "../registry.js";
+export declare function runLifecycleHealth(ctx: CommandContext): Promise<number>;
+//# sourceMappingURL=lifecycle-health.d.ts.map

package/dist/cli/handlers/lifecycle-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-health.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/lifecycle-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiH7E"}

package/dist/cli/handlers/lifecycle-health.js

@@ -0,0 +1,150 @@
+/**
+ * `chant lifecycle health <env> [lexicon] [--json]` (#4177): whether each
+ * declared resource that has a health read is up, separate from drift.
+ *
+ * It builds the project as `lifecycle diff` does, so the entity names are the
+ * graph's node ids, then asks each lexicon with a health read about the
+ * entities whose types it names. An environment's declared endpoint is applied
+ * for the read, as on the other live reads (#1166).
+ *
+ * The JSON is the {@link HEALTH_SCHEMA} shape. A single-stack project prints
+ * `lexicons` at the top level; a multi-stack one nests them under `stacks`,
+ * the same split `lifecycle diff --live --json` makes.
+ */
+import { resolve } from "node:path";
+import { build } from "../../build.js";
+import { loadChantConfig } from "../../config.js";
+import { isObservableDeclarable } from "../../declarable.js";
+import { HEALTH_SCHEMA, healthApplicable, observeHealthFor, summarizeHealth } from "../../health.js";
+import { applyLiveEndpoint } from "../../live-endpoint.js";
+import { CHANT_VERSION } from "../version.js";
+import { commandBuildParams } from "../build-params-cli.js";
+import { resolveBuildModes, resolveProjectBuildOptions } from "../build-options.js";
+import { formatBold, formatError, formatWarning } from "../format.js";
+import { resolveStackTargets } from "./lifecycle.js";
+export async function runLifecycleHealth(ctx) {
+    const { args, plugins } = ctx;
+    const environment = args.extraPositional;
+    const lexiconFilter = args.extraPositional2;
+    if (!environment) {
+        console.error(formatError({ message: "Environment is required: chant lifecycle health <environment> [lexicon]" }));
+        return 1;
+    }
+    const readers = plugins.filter((p) => p.observeHealth && (p.healthTypes?.length ?? 0) > 0 && (!lexiconFilter || p.name === lexiconFilter));
+    if (readers.length === 0) {
+        console.error(formatWarning({
+            message: lexiconFilter
+                ? `${lexiconFilter}: no health read in this lexicon`
+                : "No configured lexicon has a health read (aws, azure and gcp do)",
+        }));
+        return 1;
+    }
+    const projectRoot = resolve(".");
+    const { config } = await loadChantConfig(projectRoot);
+    const declaredParams = await commandBuildParams(config.buildParams, args);
+    if (!declaredParams)
+        return 1;
+    const targets = resolveStackTargets(args, config);
+    const buildOptions = resolveProjectBuildOptions({
+        config,
+        configDir: projectRoot,
+        plugins,
+        modes: resolveBuildModes(config, { fold: args.fold, sandbox: args.sandbox }),
+        buildParams: declaredParams,
+    });
+    const serializers = readers.map((p) => p.serializer);
+    const endpoint = applyLiveEndpoint(config.environments, environment, readers);
+    if (endpoint.notice)
+        console.error(formatWarning({ message: endpoint.notice }));
+    const perStack = {};
+    let single;
+    let anyBuildError = false;
+    const observedAt = new Date().toISOString();
+    try {
+        for (const target of targets) {
+            const buildResult = await build(target.root, serializers, undefined, buildOptions);
+            if (buildResult.errors.length > 0) {
+                console.error(formatError({
+                    message: `Build failed for ${target.stack ? `stack "${target.stack}"` : "project"}; fix errors before reading health`,
+                }));
+                anyBuildError = true;
+                continue;
+            }
+            const byLexicon = {};
+            for (const plugin of readers) {
+                const declared = new Map();
+                for (const [name, entity] of buildResult.entities) {
+                    if (entity.lexicon === plugin.name && isObservableDeclarable(entity)) {
+                        declared.set(name, {
+                            entityType: entity.entityType,
+                            props: (entity.props != null ? entity.props : {}),
+                        });
+                    }
+                }
+                const entities = healthApplicable(plugin, declared);
+                if (entities.size === 0)
+                    continue;
+                const raw = buildResult.outputs.get(plugin.name);
+                const buildOutput = raw === undefined ? "" : typeof raw === "string" ? raw : raw.primary;
+                byLexicon[plugin.name] = await observeHealthFor(plugin, {
+                    environment,
+                    buildOutput,
+                    entities,
+                    ...(target.stack ? { stack: target.stack } : {}),
+                    ...(target.region ? { region: target.region } : {}),
+                });
+            }
+            if (target.stack)
+                perStack[target.stack] = byLexicon;
+            else
+                single = byLexicon;
+        }
+    }
+    finally {
+        endpoint.restore();
+    }
+    const all = single ? [single] : Object.values(perStack);
+    const summary = summarizeHealth(all.flatMap((b) => Object.values(b)));
+    if (args.json) {
+        console.log(JSON.stringify({
+            schema: HEALTH_SCHEMA,
+            chantVersion: CHANT_VERSION,
+            environment,
+            observedAt,
+            ...(single ? { lexicons: single } : { stacks: perStack }),
+            summary,
+        }));
+    }
+    else {
+        if (single)
+            renderHealth(single);
+        else
+            for (const [stack, byLexicon] of Object.entries(perStack)) {
+                console.log(`\n${formatBold(`■ stack ${stack}`)}`);
+                renderHealth(byLexicon);
+            }
+        const total = summary.healthy + summary.unhealthy + summary.unknown + summary.unobserved + summary.absent;
+        if (total === 0) {
+            console.error(formatWarning({ message: "No declared resource has a health read" }));
+        }
+        else {
+            console.error(`${summary.healthy} healthy, ${summary.unhealthy} unhealthy, ${summary.unknown} unknown` +
+                (summary.unobserved > 0 ? `, ${summary.unobserved} not observed` : "") +
+                (summary.absent > 0 ? `, ${summary.absent} not deployed` : ""));
+        }
+    }
+    return anyBuildError ? 1 : 0;
+}
+function renderHealth(byLexicon) {
+    for (const [lexicon, result] of Object.entries(byLexicon)) {
+        console.log(formatBold(lexicon));
+        for (const [name, entry] of Object.entries(result.entities)) {
+            console.log(`  ${entry.state.padEnd(9)} ${name} (${entry.type}): ${entry.detail}`);
+        }
+        for (const [name, hole] of Object.entries(result.unobserved)) {
+            console.log(`  ${"not read".padEnd(9)} ${name}${hole.type ? ` (${hole.type})` : ""}: ${hole.reason}${hole.detail ? `, ${hole.detail}` : ""}`);
+        }
+        for (const name of result.absent)
+            console.log(`  ${"absent".padEnd(9)} ${name}: not deployed`);
+    }
+}

package/dist/cli/handlers/lifecycle.d.ts

@@ -10,6 +10,31 @@ import type { ChantConfig } from "../../config.js";
  * so their build digests stay consistent.
  */
 export declare function resolveBuildRoot(args: ParsedArgs, config: ChantConfig): string;
+/** One stack a lifecycle command operates on: its build root and, for a
+ * multi-stack project, the deployed CloudFormation stack name it observes
+ * against. */
+interface StackTarget {
+    /** The deployed stack name to observe (undefined ⇒ single-stack convention:
+     * the stack named after the environment). */
+    stack?: string;
+    /** Build root to synthesize this stack from, scoped so its logical ids match
+     * what the stack actually deploys. */
+    root: string;
+    /** Region the stack is deployed in, from `stacks[].region` (#1261). Without
+     * it every stack is observed against the ambient region, so a multi-region
+     * estate snapshots only the stacks that happen to share it and reports the
+     * rest as "no valid resources or artifacts returned". */
+    region?: string;
+}
+/**
+ * The stacks a lifecycle command (`snapshot`/`diff`) iterates. A multi-stack
+ * project declares them via `stacks` in chant.config (#932) — each built from
+ * its own `src` and observed against its own live stack `name`. A single-stack
+ * project (no `stacks`) resolves to one target built from `sourceDir`/root and
+ * observed as the stack named after the environment (unchanged behavior). An
+ * explicit `--src` always wins and forces a single scoped target.
+ */
+export declare function resolveStackTargets(args: ParsedArgs, config: ChantConfig): StackTarget[];
 /**
  * chant lifecycle snapshot <environment> [lexicon]
  */
@@ -93,4 +118,5 @@ export declare function runLifecycleUnknown(ctx: CommandContext): Promise<number
  * an empty list as if it meant "nothing downstream".
  */
 export declare function runLifecycleAffected(ctx: CommandContext): Promise<number>;
+export {};
 //# sourceMappingURL=lifecycle.d.ts.map

package/dist/cli/handlers/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/lifecycle.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAE9E;AAmCD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyH/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C3E;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+L3E;AA+sBD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwR3E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2L/E;AAsBD;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1E;AAgBD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAmE7E;AAiCD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAkBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8D/E"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/lifecycle.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAE9E;AAED;;cAEc;AACd,UAAU,WAAW;IACnB;iDAC6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;0CACsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb;;;6DAGyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,WAAW,EAAE,CAMxF;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyH/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C3E;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+L3E;AA+sBD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwR3E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2L/E;AAsBD;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1E;AAgBD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAmE7E;AAiCD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAkBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8D/E"}

package/dist/cli/handlers/lifecycle.js

@@ -48,7 +48,7 @@ export function resolveBuildRoot(args, config) {
  * observed as the stack named after the environment (unchanged behavior). An
  * explicit `--src` always wins and forces a single scoped target.
  */
-function resolveStackTargets(args, config) {
+export function resolveStackTargets(args, config) {
     if (args.src)
         return [{ root: resolve(args.src) }];
     if (config.stacks && config.stacks.length > 0) {

package/dist/cli/handlers/pr.d.ts

@@ -70,4 +70,6 @@ export declare const PR_REPORT_DIR = ".chant/pr";
 export declare function runComponentsPrPlan(ctx: CommandContext): Promise<number>;
 /** chant components pr-apply --base <ref> [--pr <n>] [--env <env>] [--gate <name>] [--forge <kind>] [--require-review] [--output <dir>] [--json] [--events-json] [--report-url <url>] */
 export declare function runComponentsPrApply(ctx: CommandContext): Promise<number>;
+/** chant components pr-record --base <ref> [--pr <n>] [--env <env>] [--gate <name>] [--forge <kind>] [--output <dir>] [--json] [--events-json] [--report-url <url>] */
+export declare function runComponentsPrRecord(ctx: CommandContext): Promise<number>;
 //# sourceMappingURL=pr.d.ts.map

package/dist/cli/handlers/pr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/pr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAuDH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAMlD,qDAAqD;AACrD,eAAO,MAAM,aAAa,cAAc,CAAC;AAoSzC,mKAAmK;AACnK,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxE;AAyDD,yLAAyL;AACzL,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAGzE"}
+{"version":3,"file":"pr.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/pr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAuDH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAMlD,qDAAqD;AACrD,eAAO,MAAM,aAAa,cAAc,CAAC;AAqSzC,mKAAmK;AACnK,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxE;AAyDD,yLAAyL;AACzL,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAGzE;AAuPD,uKAAuK;AACvK,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1E"}

package/dist/cli/handlers/pr.js

@@ -239,6 +239,7 @@ function settleOf(status) {
     switch (status) {
         case "nothing":
         case "planned":
+        case "recorded":
         case "applied":
             return "ok";
         case "refused":
@@ -415,6 +416,13 @@ export function runComponentsPrApply(ctx) {
     return withStageEvents("pr-apply", ctx, (events) => prApply(ctx, events));
 }
 async function prApply(ctx, stage) {
+    // #4168: the review-rules security group turns --require-review on, read from the declaration at base.
+    const { securityGroupsAt } = await import("../../workspace/security.js");
+    const reviewRules = !ctx.args.requireReview && securityGroupsAt(process.cwd(), ctx.args.base).has("review-rules");
+    if (reviewRules && !ctx.args.forge)
+        return fail("the workspace opts into review-rules, which reads the pull request's reviews, so pr-apply needs --forge <kind>");
+    if (reviewRules)
+        ctx = { ...ctx, args: { ...ctx.args, requireReview: true } };
     const { args } = ctx;
     if (args.requireReview && !args.forge)
         return fail("--require-review reads the pull request's reviews, so it needs --forge <kind>");
@@ -641,12 +649,126 @@ async function prApply(ctx, stage) {
         console.error(formatSuccess(`applied the plan ${report.digest} approved by ${(approval.approvedBy ?? []).join(", ")}`));
     return code;
 }
+/** chant components pr-record --base <ref> [--pr <n>] [--env <env>] [--gate <name>] [--forge <kind>] [--output <dir>] [--json] [--events-json] [--report-url <url>] */
+export function runComponentsPrRecord(ctx) {
+    if (refusesEventsWithJson(ctx.args, "the stage's report"))
+        return Promise.resolve(1);
+    return withStageEvents("pr-record", ctx, (events) => prRecord(ctx, events));
+}
+/**
+ * The record stage (#4168 step 1): what a merge does unless apply on merge
+ * is opted in. It plans the members the change reaches on the merged
+ * commit, stores the change set, decides the pull request's gate against
+ * it without writing to the ledger, and writes the merge record
+ * (`../../lifecycle/merge-record.ts`). It applies nothing and refuses
+ * nothing. A plan that differs from the approved one is recorded, and the
+ * `chant/record` status fails (decision 1). It exits 1 only when a member
+ * failed to plan.
+ */
+async function prRecord(ctx, stage) {
+    const { args } = ctx;
+    const p = await prepare(ctx, "record");
+    if (typeof p === "number")
+        return p;
+    let pr = args.pr ?? null;
+    if (pr === null && p.forge) {
+        try {
+            pr = await p.forge.pullRequestFor(p.head);
+        }
+        catch (err) {
+            console.error(formatWarning({ message: `could not ask ${p.forge.kind} which pull request merged ${p.head}, so the record names none: ${err instanceof Error ? err.message : String(err)}` }));
+        }
+    }
+    const op = pr === null ? "pr-unknown" : prOp(pr, p.member);
+    const upload = openUpload(stage, "record", pr, p);
+    const events = await openCliRunEvents(args, { kind: "component", name: `pr-record ${op}`, cwd: resolve(".") }, upload?.line);
+    stage.stream = events;
+    events?.emit({ type: "run-start", waves: p.plan.waves });
+    const set = await planAll(p, events?.emit);
+    const nothing = p.plan.order.length === 0;
+    let approval = { status: "pending" };
+    if (!nothing && !set.failed) {
+        await storeChangeSetForGate(ctx, p, set.doc);
+        if (pr !== null) {
+            try {
+                const check = await emitGateStep(events?.emit, { op, gate: p.gate }, () => decidePrGate(readOnlyLedger(gitGateLedgerPort()), { op, gate: p.gate, digest: set.doc.digest }));
+                approval = approvalOf(check);
+            }
+            catch (err) {
+                console.error(formatWarning({ message: `could not read the gate ledger, so the record says no approval: ${err instanceof Error ? err.message : String(err)}` }));
+            }
+        }
+    }
+    // #4000: the record keeps an approval by someone who wrote the change, which review rules would not count.
+    let authorApproved;
+    if (pr !== null && p.forge && approval.status === "approved") {
+        try {
+            const authors = (await p.forge.authors(pr)).map((login) => p.forge.principalOf(login));
+            authorApproved = approversWhoAuthored(approval.approvedBy ?? [], authors);
+        }
+        catch (err) {
+            console.error(formatWarning({ message: `could not read the authors of #${pr}: ${err instanceof Error ? err.message : String(err)}` }));
+        }
+    }
+    const status = nothing ? "nothing" : set.failed ? "plan-failed" : "recorded";
+    const report = prReport({
+        stage: "record",
+        pr,
+        env: p.env,
+        ...(p.member ? { member: p.member } : {}),
+        base: p.base,
+        head: p.head,
+        op,
+        gate: p.gate,
+        plan: p.plan,
+        signal: p.signal,
+        set,
+        approval,
+        status,
+        ...(status === "plan-failed" ? { message: "A member failed to plan on the merged commit, so the record has no plan to compare with the approved one. Nothing was applied." } : {}),
+        ...(status === "recorded" && approval.status === "changed"
+            ? { message: `${describePlanChanged({ op, gate: p.gate, digest: set.doc.digest, approval })} The merge stands and nothing was applied; the release gate decides before this deploys.` }
+            : {}),
+    });
+    const { mergeSourceOf, writeMergeRecord, MERGE_RECORD_SCHEMA_ID, MERGE_RECORD_CONTRACT } = await import("../../lifecycle/merge-record.js");
+    const { pushLifecycleReport } = await import("../../lifecycle/git.js");
+    try {
+        const written = await writeMergeRecord({
+            $schema: MERGE_RECORD_SCHEMA_ID,
+            contract: MERGE_RECORD_CONTRACT,
+            commit: p.head,
+            base: p.base,
+            env: p.env,
+            ...(p.member ? { member: p.member } : {}),
+            source: mergeSourceOf(resolve("."), p.head, pr),
+            op: pr === null ? null : op,
+            gate: p.gate,
+            digest: nothing ? null : set.doc.digest,
+            plan: nothing ? "nothing" : set.failed ? "plan-failed" : approval.status === "approved" ? "approved" : approval.status === "changed" ? "changed" : "unapproved",
+            ...(approval.status === "changed" && approval.approved ? { approvedDigest: approval.approved } : {}),
+            approvedBy: approval.status === "approved" ? (approval.approvedBy ?? []) : [],
+            ...(authorApproved && authorApproved.length > 0 ? { authorApproved } : {}),
+            components: p.plan.order,
+            recordedAt: new Date().toISOString(),
+        });
+        if (written.written) {
+            const pushed = await pushLifecycleReport();
+            if (pushed.pushWarning)
+                console.error(formatWarning({ message: pushed.pushWarning }));
+        }
+    }
+    catch (err) {
+        console.error(formatWarning({ message: `could not write the merge record for ${p.head}: ${err instanceof Error ? err.message : String(err)}` }));
+    }
+    const stop = stopper(ctx, p, events, upload);
+    return stop(report, status === "plan-failed" ? 1 : 0);
+}
 /** How a stage stops: settle its events, write and publish the report, say how it ended, and return `code`. */
 function stopper(ctx, p, events, upload) {
     return async (report, code, settle) => {
-        events?.settle(settle ?? settleOf(report.status), report.status === "plan-failed" || report.status === "failed" ? report.message ?? `pr-apply ${report.status}` : undefined);
+        events?.settle(settle ?? settleOf(report.status), report.status === "plan-failed" || report.status === "failed" ? report.message ?? `pr-${report.stage} ${report.status}` : undefined);
         await finish(ctx, p, report, upload);
-        console.error((code === 0 ? formatInfo : (m) => formatWarning({ message: m }))(`pr-apply: ${report.status}${report.refusal ? ` (${report.refusal})` : ""}`));
+        console.error((code === 0 ? formatInfo : (m) => formatWarning({ message: m }))(`pr-${report.stage}: ${report.status}${report.refusal ? ` (${report.refusal})` : ""}`));
         if (report.message)
             console.error(report.message);
         printMembers(report);

package/dist/cli/handlers/promote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"promote.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/promote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA+CH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAwkBlD,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2E/E;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsChF;AAsCD,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BhF"}
+{"version":3,"file":"promote.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/promote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA+CH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAulBlD,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2E/E;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsChF;AAsCD,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BhF"}

package/dist/cli/handlers/promote.js

@@ -247,7 +247,7 @@ async function deployPlan(ctx, verb, plan, project, actor, record, under) {
     if (under) {
         const { pinReleaseTemplates } = await import("../../components/release-promote.js");
         const { readReleaseTemplate } = await import("../../lifecycle/release-store.js");
-        const pinned = await pinReleaseTemplates(prepared, under.release, under.target, (digest) => readReleaseTemplate(digest));
+        const pinned = await pinReleaseTemplates(prepared, under.release, under.target, (digest, encoding) => readReleaseTemplate(digest, undefined, encoding));
         if ("errors" in pinned) {
             for (const message of pinned.errors)
                 console.error(formatError({ message }));
@@ -526,6 +526,21 @@ async function resolveUnderRelease(ref, env, verb, fix) {
         console.error(formatError(revokedRefusal({ releaseDigest: found.release.releaseDigest, label: found.label }, revocation, await fix(found.release))));
         return 1;
     }
+    // #4168: under verified-releases a release deploys only once `chant release verify` passes for it.
+    const { securityGroupsAt } = await import("../../workspace/security.js");
+    if (securityGroupsAt(process.cwd()).has("verified-releases")) {
+        const { verifyRelease, verificationCode } = await import("../../lifecycle/release-verify.js");
+        const name = found.label ?? found.release.releaseDigest;
+        const v = await verifyRelease({ cwd: process.cwd(), ref: found.release.releaseDigest });
+        const code = "error" in v ? v.error.code : verificationCode(v);
+        if (code) {
+            console.error(formatError({
+                message: `${code}: release ${name} does not verify (${"error" in v ? v.error.message : v.reason}), and the workspace opts into verified-releases, so ${verb} deploys only a verified release`,
+                hint: `Check it with: chant release verify ${name}`,
+            }));
+            return 1;
+        }
+    }
     return { release: found.release, label: found.label, target: target.target };
 }
 /**

package/dist/cli/handlers/release.d.ts

@@ -1,7 +1,7 @@
 /**
  * `chant release` (#4026, ws-104): the release is what graduates.
  *
- *   release cut [<label>] [--yes] [--build <command>] [--param k=v]... [--params-file <file>] [--src <dir>] [-o <file>] [--lexicon <name>] [--actor <name>] [--sign [<key file>]] [--json]
+ *   release cut [<label>] [--at <sha>] [--yes] [--build <command>] [--param k=v]... [--params-file <file>] [--src <dir>] [-o <file>] [--lexicon <name>] [--actor <name>] [--sign [<key file>]] [--json]
  *       a dry run of a cut of this member from the checkout's HEAD, which must be
  *       clean, on trunk and pushed, and green (#4027); `--yes` cuts, records,
  *       and tags the commit `release/<label>` locally;
@@ -17,6 +17,9 @@
  *   release verify <label|digest> [--json]
  *       check the release's signature offline against .chant/allowed_signers
  *       at the release's commit (#4049)
+ *   release candidates [--env <env>] [--json]
+ *       the green commits of trunk a release can be cut from, each with what it
+ *       would ship, and what each environment runs (#4168 4.2)
  *   release list [--json]
  *       every release of this member with its targets, its cuts and where it runs;
  *       `--json` prints the read contract's `releases` document
@@ -49,6 +52,11 @@ export declare function sameWithYes(argv: readonly string[]): string;
  * would record, build and tag, and what publishes where. With `--yes` it
  * cuts, signs with `--sign`, records the cut with its actor and run id,
  * tags the commit locally and prints the next command.
+ *
+ * `--at <sha>` (#4168 4.2) cuts that commit instead of `HEAD`, from a
+ * temporary worktree (../../lifecycle/release-at.ts), so the checkout need
+ * not be clean or at the commit. The label reaches every compile and
+ * artifact build as `CHANT_RELEASE_LABEL` (decision 5).
  */
 export declare function runReleaseCut(ctx: CommandContext): Promise<number>;
 /**
@@ -76,6 +84,13 @@ export declare function runReleasePublish(ctx: CommandContext): Promise<number>;
  * verifies and 1 when it does not or can't be checked.
  */
 export declare function runReleaseVerify(ctx: CommandContext): Promise<number>;
+/**
+ * `release candidates [--env <env>] [--json]` (#4168 4.2): the green commits
+ * of trunk a release can be cut from, newest first, each with what it would
+ * ship since the previous one, and what each environment runs. `--json`
+ * prints the read contract's `release-candidates` document.
+ */
+export declare function runReleaseCandidates(ctx: CommandContext): Promise<number>;
 export declare function runReleaseList(ctx: CommandContext): Promise<number>;
 /**
  * `release export <label|digest> --env <env> [-o <dir>]` (#4046): write each

package/dist/cli/handlers/release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAmBlD,0HAA0H;AAC1H,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uFAAuF;IACvF,YAAY,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,EAAE,CASX;AAED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAG3D;AAiBD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyMxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2G5E;AAQD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC3E;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BzE;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyC3E;AAED,gHAAgH;AAChH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB5E;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5E"}
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAyBlD,0HAA0H;AAC1H,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uFAAuF;IACvF,YAAY,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,EAAE,CASX;AAED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAG3D;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwNxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2G5E;AAQD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC/E;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BzE;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyC3E;AAED,gHAAgH;AAChH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB5E;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5E"}