@intentius/chant 0.124.32 → 0.124.33

package/dist/workspace/check.schema.json

@@ -298,7 +298,41 @@
             "flag-stale",
             "diagram-source-missing",
             "diagram-render-missing",
-            "diagram-render-drift"
+            "diagram-render-drift",
+
+            "security-signers-missing",
+
+            "security-release-gate-missing",
+
+            "security-publish-allows-unsigned",
+
+            "security-sbom-disabled",
+
+            "security-sbom-unsourced",
+
+            "security-publish-no-provenance",
+
+            "security-component-no-sbom",
+
+            "security-component-no-verify",
+
+            "security-signed-since-unset",
+
+            "security-runner-untrusted",
+
+            "security-tick-no-key",
+
+            "security-review-not-required",
+
+            "security-attribution-any",
+
+            "security-gate-unsigned",
+
+            "security-runner-start-no-key",
+
+            "security-runner-start-no-role",
+
+            "security-trust-unreadable"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         }
@@ -377,7 +411,41 @@
             "flag-stale",
             "diagram-source-missing",
             "diagram-render-missing",
-            "diagram-render-drift"
+            "diagram-render-drift",
+
+            "security-signers-missing",
+
+            "security-release-gate-missing",
+
+            "security-publish-allows-unsigned",
+
+            "security-sbom-disabled",
+
+            "security-sbom-unsourced",
+
+            "security-publish-no-provenance",
+
+            "security-component-no-sbom",
+
+            "security-component-no-verify",
+
+            "security-signed-since-unset",
+
+            "security-runner-untrusted",
+
+            "security-tick-no-key",
+
+            "security-review-not-required",
+
+            "security-attribution-any",
+
+            "security-gate-unsigned",
+
+            "security-runner-start-no-key",
+
+            "security-runner-start-no-role",
+
+            "security-trust-unreadable"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         },

package/dist/workspace/checks/security.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The security group checklists, WSP161 to WSP165 (#4168 step 7).
+ *
+ * A workspace opts into a security group with `security` in the
+ * declaration, at the top level or on a member (../security.ts). Each group
+ * has one check here, which reports what the group still lacks in the tree
+ * read. A group the declaration does not name is never checked, so a
+ * workspace that opts into nothing gets no finding from this file (#4168:
+ * security features are opt-in).
+ *
+ * | Id | Group | Codes |
+ * |---|---|---|
+ * | WSP161 | `verified-releases` | `security-signers-missing`, `security-release-gate-missing`, `security-publish-allows-unsigned` |
+ * | WSP162 | `supply-chain` | `security-sbom-disabled`, `security-sbom-unsourced`, `security-publish-no-provenance`, `security-component-no-sbom`, `security-component-no-verify` |
+ * | WSP163 | `who-ran-it` | `security-signed-since-unset`, `security-runner-untrusted`, `security-tick-no-key` |
+ * | WSP164 | `review-rules` | `security-review-not-required`, `security-attribution-any`, `security-gate-unsigned` |
+ * | WSP165 | `isolated-runners` | `security-runner-start-no-key`, `security-runner-start-no-role`, `security-trust-unreadable` |
+ *
+ * The checks read files, never run them: a member's `chant.config.ts` and
+ * `*.component.ts` are scanned as text, and the pipeline files are the
+ * forge files at the workspace root and in each member (`.github/workflows`,
+ * `.forgejo/workflows`, `.gitlab-ci.yml`). A command line is one line of a
+ * pipeline file that runs `chant release publish`, `chant ci tick` or
+ * `chant components pr-apply`.
+ */
+import type { WorkspaceCheck } from "../checks.js";
+/** The read contract's codes for the security findings, carried as `code` on each. */
+export declare const SECURITY_FINDING_CODES: readonly ["security-signers-missing", "security-release-gate-missing", "security-publish-allows-unsigned", "security-sbom-disabled", "security-sbom-unsourced", "security-publish-no-provenance", "security-component-no-sbom", "security-component-no-verify", "security-signed-since-unset", "security-runner-untrusted", "security-tick-no-key", "security-review-not-required", "security-attribution-any", "security-gate-unsigned", "security-runner-start-no-key", "security-runner-start-no-role", "security-trust-unreadable"];
+export declare const WSP_SECURITY_VERIFIED_RELEASES = "WSP161";
+export declare const WSP_SECURITY_SUPPLY_CHAIN = "WSP162";
+export declare const WSP_SECURITY_WHO_RAN_IT = "WSP163";
+export declare const WSP_SECURITY_REVIEW_RULES = "WSP164";
+export declare const WSP_SECURITY_ISOLATED_RUNNERS = "WSP165";
+export declare const SECURITY_CHECKS: readonly WorkspaceCheck[];
+//# sourceMappingURL=security.d.ts.map

package/dist/workspace/checks/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAA8C,MAAM,WAAW,CAAC;AAU5F,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,ygBAkBO,CAAC;AAI3C,eAAO,MAAM,8BAA8B,WAAW,CAAC;AACvD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAChD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,6BAA6B,WAAW,CAAC;AA0GtD,eAAO,MAAM,eAAe,EAAE,SAAS,cAAc,EAuIpD,CAAC"}

package/dist/workspace/checks/security.js

@@ -0,0 +1,305 @@
+/**
+ * The security group checklists, WSP161 to WSP165 (#4168 step 7).
+ *
+ * A workspace opts into a security group with `security` in the
+ * declaration, at the top level or on a member (../security.ts). Each group
+ * has one check here, which reports what the group still lacks in the tree
+ * read. A group the declaration does not name is never checked, so a
+ * workspace that opts into nothing gets no finding from this file (#4168:
+ * security features are opt-in).
+ *
+ * | Id | Group | Codes |
+ * |---|---|---|
+ * | WSP161 | `verified-releases` | `security-signers-missing`, `security-release-gate-missing`, `security-publish-allows-unsigned` |
+ * | WSP162 | `supply-chain` | `security-sbom-disabled`, `security-sbom-unsourced`, `security-publish-no-provenance`, `security-component-no-sbom`, `security-component-no-verify` |
+ * | WSP163 | `who-ran-it` | `security-signed-since-unset`, `security-runner-untrusted`, `security-tick-no-key` |
+ * | WSP164 | `review-rules` | `security-review-not-required`, `security-attribution-any`, `security-gate-unsigned` |
+ * | WSP165 | `isolated-runners` | `security-runner-start-no-key`, `security-runner-start-no-role`, `security-trust-unreadable` |
+ *
+ * The checks read files, never run them: a member's `chant.config.ts` and
+ * `*.component.ts` are scanned as text, and the pipeline files are the
+ * forge files at the workspace root and in each member (`.github/workflows`,
+ * `.forgejo/workflows`, `.gitlab-ci.yml`). A command line is one line of a
+ * pipeline file that runs `chant release publish`, `chant ci tick` or
+ * `chant components pr-apply`.
+ */
+import { securityGroupsOf } from "../security.js";
+import { joinPath } from "../tree.js";
+import { runnerStartReadiness } from "../ci-runner-start.js";
+import { readTrustPolicy } from "../trust/policy.js";
+import { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH } from "../trust/trust-files.js";
+/** The read contract's codes for the security findings, carried as `code` on each. */
+export const SECURITY_FINDING_CODES = [
+    "security-signers-missing",
+    "security-release-gate-missing",
+    "security-publish-allows-unsigned",
+    "security-sbom-disabled",
+    "security-sbom-unsourced",
+    "security-publish-no-provenance",
+    "security-component-no-sbom",
+    "security-component-no-verify",
+    "security-signed-since-unset",
+    "security-runner-untrusted",
+    "security-tick-no-key",
+    "security-review-not-required",
+    "security-attribution-any",
+    "security-gate-unsigned",
+    "security-runner-start-no-key",
+    "security-runner-start-no-role",
+    "security-trust-unreadable",
+];
+export const WSP_SECURITY_VERIFIED_RELEASES = "WSP161";
+export const WSP_SECURITY_SUPPLY_CHAIN = "WSP162";
+export const WSP_SECURITY_WHO_RAN_IT = "WSP163";
+export const WSP_SECURITY_REVIEW_RULES = "WSP164";
+export const WSP_SECURITY_ISOLATED_RUNNERS = "WSP165";
+const memberDir = (dir) => (dir === "." ? "" : dir);
+/** The members under `group`: every member when the top level names it, else those that name it themselves. */
+function membersUnder(declaration, group) {
+    return declaration.members.filter((m) => securityGroupsOf(declaration, m.name).has(group));
+}
+/** Whether the declaration names `group` anywhere. */
+function declares(declaration, group) {
+    return declaration.security.includes(group) || declaration.members.some((m) => m.security.includes(group));
+}
+/** Where the group is named, for the finding's pointer: the top level, else the first member naming it. */
+function groupPointer(declaration, group) {
+    const top = declaration.security.indexOf(group);
+    if (top >= 0)
+        return `/security/${top}`;
+    const m = declaration.members.find((e) => e.security.includes(group));
+    return m ? `${m.pointer}/security/${m.security.indexOf(group)}` : "/security";
+}
+function read(tree, path) {
+    if (tree.stat(path) !== "file")
+        return null;
+    try {
+        return tree.read(path);
+    }
+    catch {
+        return null;
+    }
+}
+/** The forge pipeline files under `dir`, each as its path and lines. */
+function pipelineFiles(tree, dir) {
+    const out = [];
+    for (const folder of [".github/workflows", ".forgejo/workflows", ".gitea/workflows"]) {
+        for (const e of tree.list(joinPath(dir, folder)) ?? []) {
+            if (e.type !== "file" || !/\.ya?ml$/.test(e.name))
+                continue;
+            const path = joinPath(dir, folder, e.name);
+            const text = read(tree, path);
+            if (text !== null)
+                out.push({ path, lines: text.split("\n") });
+        }
+    }
+    const gitlab = read(tree, joinPath(dir, ".gitlab-ci.yml"));
+    if (gitlab !== null)
+        out.push({ path: joinPath(dir, ".gitlab-ci.yml"), lines: gitlab.split("\n") });
+    return out;
+}
+/** Every pipeline file of the workspace: its root's, and each member's. */
+function allPipelineFiles(ctx) {
+    const dirs = new Set(["", ...ctx.declaration.members.map((m) => memberDir(m.dir))]);
+    return [...dirs].flatMap((d) => pipelineFiles(ctx.tree, d));
+}
+/** The lines of the pipeline files that run a chant command, `command` naming it, such as `release publish`. */
+function commandLines(ctx, command) {
+    return allPipelineFiles(ctx).flatMap((f) => f.lines.flatMap((text, i) => (command.test(text) ? [{ path: f.path, line: i + 1, text }] : [])));
+}
+/** The member's `*.component.ts` files, walked a few levels down, past node_modules and build output. */
+function componentFiles(tree, dir, depth = 4) {
+    const out = [];
+    for (const e of tree.list(dir) ?? []) {
+        if (e.type === "dir") {
+            if (depth > 0 && !["node_modules", "dist", ".git", ".chant", "target"].includes(e.name))
+                out.push(...componentFiles(tree, joinPath(dir, e.name), depth - 1));
+        }
+        else if (e.name.endsWith(".component.ts"))
+            out.push(joinPath(dir, e.name));
+    }
+    return out;
+}
+/** Whether a lockfile chant writes an SBOM from is in `dir` or a directory above it in the tree. */
+function lockfileAbove(tree, dir) {
+    let at = dir;
+    for (;;) {
+        if (["package-lock.json", "pom.xml", "Cargo.lock"].some((f) => tree.stat(joinPath(at, f)) === "file"))
+            return true;
+        if (at === "")
+            return false;
+        at = at.includes("/") ? at.slice(0, at.lastIndexOf("/")) : "";
+    }
+}
+/** The trust policy in the tree read: `.chant/trust.json` and the signers file it names. */
+function treePolicy(tree) {
+    const source = {
+        label: tree.label,
+        list: (dir) => tree.list(dir)?.filter((e) => e.type === "file").map((e) => e.name),
+        read: (path) => tree.read(path),
+        bytes: (path) => (tree.bytes ? tree.bytes(path) : new Uint8Array(Buffer.from(tree.read(path), "utf-8"))),
+    };
+    return readTrustPolicy(source, null);
+}
+function finding(check, code, message, at) {
+    return {
+        checkId: check.id,
+        severity: check.severity,
+        code,
+        message: `${code}: ${message}`,
+        pointer: at.pointer,
+        ...(at.entity !== undefined ? { entity: at.entity } : {}),
+        ...(at.treeFile !== undefined ? { treeFile: at.treeFile, line: at.line ?? 1, column: 1 } : {}),
+    };
+}
+const RELEASE_PUBLISH = /\bchant\b.*\brelease\s+publish\b/;
+const CI_TICK = /\bchant\b.*\bci\s+tick\b|main\.ts\s+ci\s+tick\b/;
+const PR_APPLY = /\bcomponents\s+pr-apply\b|\bci\s+run\s+apply\b/;
+export const SECURITY_CHECKS = [
+    {
+        id: WSP_SECURITY_VERIFIED_RELEASES,
+        name: "security-verified-releases",
+        description: "Under the verified-releases group: a signers file, a release gate naming a class, and no publish job that passes --allow-unsigned.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            if (!declares(d, "verified-releases"))
+                return [];
+            const pointer = groupPointer(d, "verified-releases");
+            const out = [];
+            if (ctx.tree.stat(DEFAULT_SIGNERS_PATH) !== "file") {
+                out.push(finding(this, "security-signers-missing", `the workspace opts into verified-releases, and there is no ${DEFAULT_SIGNERS_PATH}${ctx.tree.label} to verify a release's signature against; add the keys of the people who cut releases to it, in ssh-keygen's allowed_signers format`, { pointer }));
+            }
+            const gate = d.identity?.gates.release;
+            if (!gate?.class) {
+                out.push(finding(this, "security-release-gate-missing", gate ? `identity.gates.release names no class, so any signer in ${DEFAULT_SIGNERS_PATH} may cut a release; name the class that may` : "the workspace opts into verified-releases, and identity.gates has no release entry, so a cut is not held to a class of signers", { pointer: gate?.pointer ?? pointer }));
+            }
+            for (const l of commandLines(ctx, RELEASE_PUBLISH)) {
+                if (!/--allow-unsigned\b/.test(l.text))
+                    continue;
+                out.push(finding(this, "security-publish-allows-unsigned", `${l.path} runs release publish with --allow-unsigned, which publishes a release whose signature does not verify`, { pointer, treeFile: l.path, line: l.line }));
+            }
+            return out;
+        },
+    },
+    {
+        id: WSP_SECURITY_SUPPLY_CHAIN,
+        name: "security-supply-chain",
+        description: "Under the supply-chain group: every publish target attaches an SBOM it has a source for, publish jobs require OIDC provenance, and components generate an SBOM and verify what they deploy.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            if (!declares(d, "supply-chain"))
+                return [];
+            const pointer = groupPointer(d, "supply-chain");
+            const out = [];
+            for (const m of membersUnder(d, "supply-chain")) {
+                const configPath = joinPath(memberDir(m.dir), "chant.config.ts");
+                const config = read(ctx.tree, configPath);
+                if (config !== null && /\bpublish\s*:/.test(config)) {
+                    const lines = config.split("\n");
+                    const off = lines.findIndex((l) => /\bsbom\s*:\s*false\b/.test(l));
+                    if (off >= 0)
+                        out.push(finding(this, "security-sbom-disabled", `member ${m.name}'s chant.config.ts sets sbom: false on a publish target, so what it publishes carries no SBOM`, { pointer, entity: m.name, treeFile: configPath, line: off + 1 }));
+                    else if (!/\bsbom\s*:\s*["'`]/.test(config) && !lockfileAbove(ctx.tree, memberDir(m.dir))) {
+                        out.push(finding(this, "security-sbom-unsourced", `member ${m.name} publishes, names no sbom file and has no package-lock.json, pom.xml or Cargo.lock in its directory or above it, so publish would refuse it as publish-sbom-missing`, { pointer, entity: m.name, treeFile: configPath }));
+                    }
+                }
+                const components = componentFiles(ctx.tree, memberDir(m.dir));
+                if (components.length === 0)
+                    continue;
+                const text = components.map((f) => read(ctx.tree, f) ?? "").join("\n");
+                if (!/\bgenerateSbom\s*\(|["']generate-sbom["']/.test(text)) {
+                    out.push(finding(this, "security-component-no-sbom", `member ${m.name}'s components have no generate-sbom step, so what they build carries no SBOM`, { pointer, entity: m.name, treeFile: components[0] }));
+                }
+                if (!/\bverify\s*\(|["']verify["']/.test(text)) {
+                    out.push(finding(this, "security-component-no-verify", `member ${m.name}'s components have no verify step, so a signature or attestation is never checked before a deploy`, { pointer, entity: m.name, treeFile: components[0] }));
+                }
+            }
+            for (const l of commandLines(ctx, RELEASE_PUBLISH)) {
+                if (/--require-provenance\b/.test(l.text))
+                    continue;
+                out.push(finding(this, "security-publish-no-provenance", `${l.path} runs release publish without --require-provenance, so a run with no OIDC token publishes with only a warning`, { pointer, treeFile: l.path, line: l.line }));
+            }
+            return out;
+        },
+    },
+    {
+        id: WSP_SECURITY_WHO_RAN_IT,
+        name: "security-who-ran-it",
+        description: "Under the who-ran-it group: ci.green.signedSince is set, .chant/trust.json lists a runner key, and the tick signs its tags.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            if (!declares(d, "who-ran-it"))
+                return [];
+            const pointer = groupPointer(d, "who-ran-it");
+            const out = [];
+            if (!d.ci?.green?.signedSince) {
+                out.push(finding(this, "security-signed-since-unset", d.ci?.green ? "ci.green sets no signedSince, so an unsigned green tag still counts" : "the workspace opts into who-ran-it, and has no ci.green block, so no commit's green tag is signed", { pointer: d.ci?.green?.pointer ?? pointer }));
+            }
+            const runners = treePolicy(ctx.tree).runners.filter((r) => r.class === "runner").length;
+            if (runners === 0) {
+                out.push(finding(this, "security-runner-untrusted", `${TRUST_CONFIG_PATH}${ctx.tree.label} lists no runner key, so no run or tag can be traced to a runner; add one with chant ci serve --setup-key --trust`, { pointer }));
+            }
+            for (const l of commandLines(ctx, CI_TICK)) {
+                const file = allPipelineFiles(ctx).find((f) => f.path === l.path);
+                if (/--key\b/.test(l.text) || file?.lines.some((t) => /CHANT_RUNNER_KEY/.test(t)))
+                    continue;
+                out.push(finding(this, "security-tick-no-key", `${l.path} runs ci tick with no runner key, so its tags are unsigned; regenerate it with chant ci workflow --runner-key-secret <NAME>`, { pointer, treeFile: l.path, line: l.line }));
+            }
+            return out;
+        },
+    },
+    {
+        id: WSP_SECURITY_REVIEW_RULES,
+        name: "security-review-rules",
+        description: "Under the review-rules group: no apply job turns forge review off, attribution is identified, and every gate an apply job names needs a signed approval.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            if (!declares(d, "review-rules"))
+                return [];
+            const pointer = groupPointer(d, "review-rules");
+            const out = [];
+            const applies = commandLines(ctx, PR_APPLY);
+            for (const l of applies) {
+                if (!/--no-require-review\b/.test(l.text))
+                    continue;
+                out.push(finding(this, "security-review-not-required", `${l.path} passes --no-require-review, which the review-rules group overrides; drop it so the file says what runs`, { pointer, treeFile: l.path, line: l.line }));
+            }
+            if (d.identity?.attribution !== "identified") {
+                out.push(finding(this, "security-attribution-any", "identity.attribution is not identified, so a person-attributed write may name anyone", { pointer: d.identity ? "/identity" : pointer }));
+            }
+            const signed = new Set(Object.keys(d.identity?.gates ?? {}));
+            const named = new Set(applies.flatMap((l) => [...l.text.matchAll(/--(?:wave-)?gate\s+["']?([A-Za-z0-9_.-]+)/g)].map((m) => m[1])));
+            const unsigned = [...named].filter((g) => !signed.has(g));
+            if (unsigned.length > 0) {
+                out.push(finding(this, "security-gate-unsigned", `the apply jobs name the gate${unsigned.length > 1 ? "s" : ""} ${unsigned.join(", ")}, which identity.gates does not list, so an unsigned approval passes ${unsigned.length > 1 ? "them" : "it"}`, { pointer }));
+            }
+            else if (named.size === 0 && signed.size === 0) {
+                out.push(finding(this, "security-gate-unsigned", "identity.gates lists no gate, so every approval may be unsigned", { pointer }));
+            }
+            return out;
+        },
+    },
+    {
+        id: WSP_SECURITY_ISOLATED_RUNNERS,
+        name: "security-isolated-runners",
+        description: "Under the isolated-runners group: .chant/trust.json lists a runner key whose principal holds the runner role, so an apply job can require a runner-start statement (#4147).",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            if (!declares(d, "isolated-runners"))
+                return [];
+            const pointer = groupPointer(d, "isolated-runners");
+            const codes = { "no-runner-key": "security-runner-start-no-key", "no-runner-role": "security-runner-start-no-role", "trust-unreadable": "security-trust-unreadable" };
+            return runnerStartReadiness(treePolicy(ctx.tree)).gaps.map((g) => finding(this, codes[g.gap], `the workspace opts into isolated-runners, so every apply job requires a runner-start statement, and ${g.reason}`, { pointer }));
+        },
+    },
+];

package/dist/workspace/checks.d.ts

@@ -37,6 +37,8 @@
  * | WSP126, WSP127 | box intent: the decision record a box names exists, and constrains a member or path of this workspace (#2850, #2857) |
  * | WSP141, WSP142 | member links resolved against a live read, with `--live` (#2549) |
  * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
+ * | WSP151 | reserved for the `ci.workflow` preset (#4168 step 6) |
+ * | WSP161 to WSP165 | the security groups the declaration opts into: what each still lacks (#4168 step 7) |
  */
 import type { LintDiagnostic, LintRule, Severity } from "../lint/rule.js";
 import type { PostSynthDiagnostic } from "../lint/post-synth.js";

package/dist/workspace/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAiMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAInE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAmMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}

package/dist/workspace/checks.js

@@ -37,6 +37,8 @@
  * | WSP126, WSP127 | box intent: the decision record a box names exists, and constrains a member or path of this workspace (#2850, #2857) |
  * | WSP141, WSP142 | member links resolved against a live read, with `--live` (#2549) |
  * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
+ * | WSP151 | reserved for the `ci.workflow` preset (#4168 step 6) |
+ * | WSP161 to WSP165 | the security groups the declaration opts into: what each still lacks (#4168 step 7) |
  */
 import { realpathSync } from "node:fs";
 import { relative, sep } from "node:path";
@@ -53,6 +55,7 @@ import { gatherLiveLinkFacts, LIVE_CHECKS } from "./checks/live.js";
 import { RECORD_CHECKS } from "./checks/records.js";
 import { BOX_CHECKS } from "./checks/boxes.js";
 import { DIAGRAM_CHECKS } from "./checks/diagrams.js";
+import { SECURITY_CHECKS } from "./checks/security.js";
 import { loadDeclaredKinds } from "./declared-kinds.js";
 import { resolveBoxIntents } from "./box-intent.js";
 import { gatherLexiconOutputs } from "./lexicon-outputs.js";
@@ -270,6 +273,8 @@ export const WORKSPACE_CHECKS = [
     ...DIAGRAM_CHECKS,
     // Links resolved against a live read, with --live (#2549), WSP141 and WSP142.
     ...LIVE_CHECKS,
+    // The security groups the declaration opts into (#4168 step 7), WSP161 to WSP165.
+    ...SECURITY_CHECKS,
 ];
 const BY_ID = new Map(WORKSPACE_CHECKS.map((c) => [c.id, c]));
 function settingProblem(id) {

package/dist/workspace/ci-builds.d.ts

@@ -0,0 +1,163 @@
+/**
+ * Which commits get built, and what each one ends with (#4169).
+ *
+ * A `ci.green` phase declares `build: "every"` (the default) or
+ * `build: "newest"`. Under `newest` the phase's workflow keeps one run
+ * waiting and drops the rest, so only the newest commit is built when a
+ * runner frees. This module does the tick's part of that, given the
+ * verdicts {@link planTick} (./ci-green.ts) judged:
+ *
+ * - Superseded. A commit with no run of a `newest` phase, below a newer
+ *   commit that has one, is `unbuilt` for that phase, covered by the newer
+ *   commit. A cancelled run makes any phase `unbuilt` (`phaseVerdictOf`).
+ * - Retry. A failed run with one attempt is run again once before the
+ *   commit counts red: through the forge's re-run (`CiForge.rerun`) for
+ *   check runs, or a build request for chant runs. A retry that has not
+ *   started an hour on counts as the failure it was.
+ * - Bisect. When the newest built commit of a `newest` phase is red, the
+ *   unbuilt commits back to the last one the phase passed on are built, one
+ *   request per tick: the commit halfway when more than four are left, else
+ *   the one just below the red. The first red commit found is the culprit,
+ *   and it and every commit after it name it.
+ * - Requests. A build is asked for with an annotated tag,
+ *   `ci/build/<sha>`, whose record names the phases and why. The tick
+ *   starts a workflow at that tag on GitHub (`CiForge.dispatch`), and `ci
+ *   serve --build-command` serves it for chant runs. A phase a request
+ *   waits on is `pending`. A request no runner served in six hours leaves
+ *   the phase `unbuilt`, and once its phases are decided the tick deletes
+ *   the tag.
+ * - Records. Every first-parent commit the tick judged gets
+ *   `_ci/<sha>.json` on `chant/lifecycle`, rewritten only when what it says
+ *   changes: `green`, `red`, `unbuilt` or `pending`, with each required
+ *   phase's verdict, runs, reason, the commit that covers it and the culprit.
+ *   A commit that leaves the window still `pending` is rewritten `unbuilt`,
+ *   for the reason `aged-out`. The `ci/green` and `ci/revoked` tags stay
+ *   what decides a release; the records say what happened to the rest.
+ */
+import type { CiBuild, CiGreen } from "./declaration.js";
+import type { CheckRun } from "./ci-green-forge.js";
+import { type PhaseReason, type TickCommit, type Verdict } from "./ci-green.js";
+export declare const CI_BUILD_TAG_PREFIX = "ci/build/";
+/** The directory on `chant/lifecycle` holding one record per commit. */
+export declare const CI_RECORDS_DIR = "_ci";
+/** How long a build request may wait for a runner before its phases count as unbuilt. */
+export declare const BUILD_REQUEST_TTL_MS: number;
+/** How long a retry may take to start before the failure it was counts. */
+export declare const RETRY_TTL_MS = 3600000;
+/** Above this many unbuilt commits a bisect halves the range; at or below it, it steps back one commit at a time. */
+export declare const BISECT_HALVE_ABOVE = 4;
+export type BuildRequestReason = "bisect" | "retry" | "requested";
+/** A `ci/build/<sha>` tag's record: the phases to build at the commit, and why. */
+export interface BuildRequest {
+    schema: 1;
+    tag: string;
+    commit: string;
+    branch: string;
+    phases: string[];
+    reason: BuildRequestReason;
+    /** When it was asked for, ISO 8601. */
+    at: string;
+}
+/** One record, `_ci/<sha>.json` on `chant/lifecycle`. */
+export interface CiRecord {
+    schema: 1;
+    commit: string;
+    branch: string;
+    /** `green` and `red` follow the tags: a green tag, or a failed phase or a revoked tag. */
+    state: "green" | "red" | "unbuilt" | "pending";
+    /** When this content was written, ISO 8601. Not compared when deciding whether to write again. */
+    at: string;
+    /** Set when the commit has a revoked tag. */
+    revoked?: true;
+    phases: Record<string, CiRecordPhase>;
+    /** The first required phase that failed, and its run, when the state is red. */
+    failure?: {
+        phase: string;
+        run: CiRecordRun;
+    };
+    /** The retries asked for, by run name: the run that failed and when. */
+    retried?: Record<string, {
+        run: number;
+        at: string;
+    }>;
+    /** The build request waiting on this commit, when there is one. */
+    request?: {
+        tag: string;
+        reason: BuildRequestReason;
+        phases: string[];
+        at: string;
+        dispatched?: true;
+    };
+}
+export interface CiRecordRun {
+    name: string;
+    id: number | null;
+    conclusion: string | null;
+    url: string | null;
+}
+export interface CiRecordPhase {
+    verdict: Verdict;
+    build: CiBuild;
+    runs: CiRecordRun[];
+    reason?: PhaseReason | "aged-out";
+    coveredBy?: string;
+    culprit?: string;
+}
+/** How a tick can run a failed job again: the forge's re-run, a build request, or not at all. */
+export type RetryVia = "forge" | "request" | null;
+export interface BuildsInput {
+    green: CiGreen;
+    /** Newest first, as {@link planTick} returns them. */
+    commits: TickCommit[];
+    /** Every attempt of every run, by commit. */
+    runs: ReadonlyMap<string, readonly CheckRun[]>;
+    requests: ReadonlyMap<string, BuildRequest>;
+    records: ReadonlyMap<string, CiRecord>;
+    now: Date;
+    retryVia: RetryVia;
+}
+export interface BuildsPlan {
+    /** Requests to make: bisect steps, and retries of chant runs. */
+    requests: BuildRequest[];
+    /** Failed check runs to run again through the forge, by commit. */
+    retries: {
+        sha: string;
+        run: CheckRun;
+    }[];
+    /** Request tags whose phases are decided, or that waited too long, or whose commit left the window. */
+    resolved: string[];
+}
+/**
+ * Apply supersession, retries, requests and bisection to the judged commits,
+ * in place, and say what the tick has to ask for. Pure: it reads and writes
+ * nothing but its input.
+ */
+export declare function planBuilds(input: BuildsInput): BuildsPlan;
+/** The record a judged commit gets, carrying the retries asked for before and now. */
+export declare function recordOf(input: {
+    green: CiGreen;
+    commit: TickCommit;
+    previous?: CiRecord;
+    retries: readonly {
+        sha: string;
+        run: CheckRun;
+    }[];
+    requests: ReadonlyMap<string, BuildRequest>;
+    now: Date;
+}): CiRecord;
+/** The record a commit that left the window still pending gets: each pending phase `unbuilt`, `aged-out`. */
+export declare function agedOut(record: CiRecord, now: Date): CiRecord;
+/** Whether two records say the same thing, the time each was written aside. */
+export declare function sameRecord(a: CiRecord | undefined, b: CiRecord): boolean;
+export declare const recordPath: (sha: string) => string;
+/** One commit's record, from the local `chant/lifecycle`. */
+export declare function readCiRecord(top: string, sha: string): CiRecord | undefined;
+/** Every record on the local `chant/lifecycle`, by commit. Empty when the branch or the directory is missing. */
+export declare function readCiRecords(top: string): Map<string, CiRecord>;
+/** Every `ci/build/<sha>` tag with a record this reads, from local refs, by commit. */
+export declare function readBuildRequests(top: string): Map<string, BuildRequest>;
+/** The annotation of a request tag: a subject line, then the record. */
+export declare function buildRequestAnnotation(r: BuildRequest): string;
+/** A request for `ci run --at <sha>`: every required phase, asked for by a person. */
+export declare function requestedBuild(green: CiGreen, commit: string, phases: readonly string[], now: Date): BuildRequest;
+//# sourceMappingURL=ci-builds.d.ts.map