@intentius/chant 0.124.32 → 0.124.33

package/dist/components/deploy-inputs.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The local files a component's steps deploy from, and their content digests
+ * (#4155).
+ *
+ * A component gate approves `componentPlanDigest` (./gate-plan.ts). A step
+ * whose capability has a `plan` is bound by what it plans. Every other step
+ * was bound only by its input as written, so a Helm chart, a kustomize
+ * directory or a static site's tree could change after review without moving
+ * the digest. This module names those files and hashes them, so the digest
+ * moves when they do.
+ *
+ * Which fields name a path is data, as the template fields are in
+ * ./release-compile.ts and the unit fields in ./deploy-units.ts: a kind's
+ * fields in {@link DEPLOY_INPUT_FIELDS}, plus `template`, `manifest` and
+ * `values` on any step ({@link TEMPLATE_FIELDS}). Only a literal path counts:
+ * a value wired from another step (`@Build.uri`) or an `archive:` path is a
+ * build output, and binding it would make an approval unusable by a build
+ * that is not reproducible. The build steps' own sources are bound instead.
+ *
+ * - A file is hashed by its bytes.
+ * - A directory is hashed over the files under it that git does not ignore
+ *   (`git ls-files --cached --others --exclude-standard`), each by its path
+ *   and bytes, so `node_modules` and a build's `dist` inside a Docker context
+ *   are left out. Outside a git repository every file is hashed except under
+ *   `.git` and `node_modules`.
+ * - A directory git ignores as a whole is a build output. It is not hashed;
+ *   the step is listed as unbound, with that reason.
+ * - A path that does not exist is left out. One that appears later moves the
+ *   digest.
+ *
+ * A step whose kind runs content chant can't name, such as `shell`, is listed
+ * as unbound ({@link UNBOUND_KINDS}), so the plan note can show a reviewer
+ * what the approval does not cover.
+ */
+import type { DriverPhase, DriverStep } from "./driver.js";
+/** The fields that name every step's deployed file, whatever its kind (as ./release-compile.ts reads them). */
+export declare const TEMPLATE_FIELDS: readonly string[];
+/** Per kind, the fields beyond {@link TEMPLATE_FIELDS} that name a local file or directory the step deploys or builds from. */
+export declare const DEPLOY_INPUT_FIELDS: Readonly<Record<string, readonly string[]>>;
+/** Kinds that deploy content chant can't name from their input: a command, an agent's work. */
+export declare const UNBOUND_KINDS: readonly string[];
+/** One path a step names. */
+export interface DeployInputRef {
+    phase: string;
+    kind: string;
+    field: string;
+    /** Relative to the member's directory, as written. */
+    path: string;
+}
+/** A named path and the digest of what is there. */
+export interface DeployInputDigest {
+    path: string;
+    /** `sha256:<hex>` of a file's bytes, or a plan digest over a directory's files. */
+    digest: string;
+}
+/** A step the digest does not cover, and why. */
+export interface UnboundStep {
+    phase: string;
+    kind: string;
+    reason: string;
+}
+/** What a component's steps deploy from: the digests, and the steps they can't cover. */
+export interface ComponentDeployInputs {
+    inputs: DeployInputDigest[];
+    unbound: UnboundStep[];
+}
+/** Every capability step of a composition with its phase, nested phases included, gates left out. */
+export declare function stepsWithPhase(phases: readonly DriverPhase[]): Array<{
+    phase: string;
+    step: DriverStep;
+}>;
+/** The literal paths one step names, in field order. A Docker build's Dockerfile is named under its context. */
+export declare function stepInputRefs(phase: string, step: DriverStep): DeployInputRef[];
+/** The files under `dir` (relative to `root`) a directory digest covers, relative to `root`, sorted. */
+export declare function directoryFiles(root: string, dir: string): string[];
+/** Every file under `dir`, relative to `root`, sorted, leaving out `.git` and `node_modules`. What a cut records of a directory git ignores. */
+export declare function walkFiles(root: string, dir: string): string[];
+/** Whether git ignores `path` (relative to `root`). False outside a git repository. */
+export declare function ignoredByGit(root: string, path: string): boolean;
+/** `sha256:<hex>` of a file's bytes. */
+export declare function fileDigest(file: string): string;
+/** The digest of the files under `dir`: a plan digest over each file's path (from `dir`) and bytes. */
+export declare function directoryDigest(root: string, dir: string): string;
+/**
+ * What a component's steps deploy from, read under `root` (the member's
+ * directory). `include` picks the steps to read, all of them by default; the
+ * wave planner passes the steps without a `plan`, which their plan does not
+ * already cover.
+ */
+export declare function componentDeployInputs(phases: readonly DriverPhase[], root: string, include?: (step: DriverStep) => boolean): ComponentDeployInputs;
+//# sourceMappingURL=deploy-inputs.d.ts.map

package/dist/components/deploy-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-inputs.d.ts","sourceRoot":"","sources":["../../src/components/deploy-inputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAOH,OAAO,KAAK,EAAc,WAAW,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEpE,+GAA+G;AAC/G,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAuC,CAAC;AAErF,+HAA+H;AAC/H,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAa3E,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAA2B,CAAC;AAEvE,6BAA6B;AAC7B,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iDAAiD;AACjD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yFAAyF;AACzF,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAaD,qGAAqG;AACrG,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAUzG;AAED,gHAAgH;AAChH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc,EAAE,CAY/E;AAOD,wGAAwG;AACxG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAWlE;AAED,gJAAgJ;AAChJ,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAY7D;AAED,uFAAuF;AACvF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wCAAwC;AACxC,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAOjE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAoB,GAClD,qBAAqB,CA4BvB"}

package/dist/components/deploy-inputs.js

@@ -0,0 +1,184 @@
+/**
+ * The local files a component's steps deploy from, and their content digests
+ * (#4155).
+ *
+ * A component gate approves `componentPlanDigest` (./gate-plan.ts). A step
+ * whose capability has a `plan` is bound by what it plans. Every other step
+ * was bound only by its input as written, so a Helm chart, a kustomize
+ * directory or a static site's tree could change after review without moving
+ * the digest. This module names those files and hashes them, so the digest
+ * moves when they do.
+ *
+ * Which fields name a path is data, as the template fields are in
+ * ./release-compile.ts and the unit fields in ./deploy-units.ts: a kind's
+ * fields in {@link DEPLOY_INPUT_FIELDS}, plus `template`, `manifest` and
+ * `values` on any step ({@link TEMPLATE_FIELDS}). Only a literal path counts:
+ * a value wired from another step (`@Build.uri`) or an `archive:` path is a
+ * build output, and binding it would make an approval unusable by a build
+ * that is not reproducible. The build steps' own sources are bound instead.
+ *
+ * - A file is hashed by its bytes.
+ * - A directory is hashed over the files under it that git does not ignore
+ *   (`git ls-files --cached --others --exclude-standard`), each by its path
+ *   and bytes, so `node_modules` and a build's `dist` inside a Docker context
+ *   are left out. Outside a git repository every file is hashed except under
+ *   `.git` and `node_modules`.
+ * - A directory git ignores as a whole is a build output. It is not hashed;
+ *   the step is listed as unbound, with that reason.
+ * - A path that does not exist is left out. One that appears later moves the
+ *   digest.
+ *
+ * A step whose kind runs content chant can't name, such as `shell`, is listed
+ * as unbound ({@link UNBOUND_KINDS}), so the plan note can show a reviewer
+ * what the approval does not cover.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative, resolve, sep } from "node:path";
+import { sha256Hex } from "../content-digest.js";
+import { computePlanDigest } from "../lifecycle/plan-digest.js";
+/** The fields that name every step's deployed file, whatever its kind (as ./release-compile.ts reads them). */
+export const TEMPLATE_FIELDS = ["template", "manifest", "values"];
+/** Per kind, the fields beyond {@link TEMPLATE_FIELDS} that name a local file or directory the step deploys or builds from. */
+export const DEPLOY_INPUT_FIELDS = {
+    "helm-upgrade": ["chart"],
+    "kustomize-apply": ["dir"],
+    "fly-release": ["plan"],
+    "fly-rollback": ["plan"],
+    "s3-sync": ["from"],
+    "r2-sync": ["from"],
+    "copy-to-host": ["from"],
+    "wrangler-deploy": ["config"],
+    "wrangler-versions-promote": ["config"],
+    "docker-build": ["context"],
+    "zip-package": ["source"],
+    "jvm-build": ["path"],
+};
+/** Kinds that deploy content chant can't name from their input: a command, an agent's work. */
+export const UNBOUND_KINDS = ["shell", "run-agent"];
+function isGate(step) {
+    return step.kind === "gate";
+}
+function isPhase(step) {
+    return typeof step.phase === "string" && Array.isArray(step.steps);
+}
+const isLiteralPath = (v) => typeof v === "string" && v !== "" && !v.startsWith("@") && !v.startsWith("$") && !v.startsWith("archive:");
+/** Every capability step of a composition with its phase, nested phases included, gates left out. */
+export function stepsWithPhase(phases) {
+    const out = [];
+    const walk = (phase) => {
+        for (const step of phase.steps) {
+            if (isPhase(step))
+                walk(step);
+            else if (!isGate(step))
+                out.push({ phase: phase.phase, step });
+        }
+    };
+    phases.forEach(walk);
+    return out;
+}
+/** The literal paths one step names, in field order. A Docker build's Dockerfile is named under its context. */
+export function stepInputRefs(phase, step) {
+    const out = [];
+    for (const field of [...TEMPLATE_FIELDS, ...(DEPLOY_INPUT_FIELDS[step.kind] ?? [])]) {
+        const raw = step[field];
+        for (const value of Array.isArray(raw) ? raw : [raw]) {
+            if (isLiteralPath(value))
+                out.push({ phase, kind: step.kind, field, path: value });
+        }
+    }
+    if (step.kind === "docker-build" && isLiteralPath(step.context) && isLiteralPath(step.dockerfile)) {
+        out.push({ phase, kind: step.kind, field: "dockerfile", path: join(step.context, step.dockerfile) });
+    }
+    return out;
+}
+function git(root, args) {
+    const r = spawnSync("git", ["-C", root, ...args], { encoding: "utf-8", maxBuffer: 256 * 1024 * 1024 });
+    return { ok: r.status === 0, out: r.stdout ?? "" };
+}
+/** The files under `dir` (relative to `root`) a directory digest covers, relative to `root`, sorted. */
+export function directoryFiles(root, dir) {
+    const listed = git(root, ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", dir]);
+    if (listed.ok) {
+        return [...new Set(listed.out.split("\0").filter((p) => p !== ""))]
+            .filter((p) => {
+            const full = resolve(root, p);
+            return existsSync(full) && statSync(full).isFile();
+        })
+            .sort();
+    }
+    return walkFiles(root, dir);
+}
+/** Every file under `dir`, relative to `root`, sorted, leaving out `.git` and `node_modules`. What a cut records of a directory git ignores. */
+export function walkFiles(root, dir) {
+    const out = [];
+    const walk = (abs) => {
+        for (const entry of readdirSync(abs, { withFileTypes: true })) {
+            if (entry.name === ".git" || entry.name === "node_modules")
+                continue;
+            const full = join(abs, entry.name);
+            if (entry.isDirectory())
+                walk(full);
+            else if (entry.isFile())
+                out.push(relative(root, full).split(sep).join("/"));
+        }
+    };
+    walk(resolve(root, dir));
+    return out.sort();
+}
+/** Whether git ignores `path` (relative to `root`). False outside a git repository. */
+export function ignoredByGit(root, path) {
+    return git(root, ["check-ignore", "-q", "--", path]).ok;
+}
+/** `sha256:<hex>` of a file's bytes. */
+export function fileDigest(file) {
+    return `sha256:${sha256Hex(readFileSync(file))}`;
+}
+/** The digest of the files under `dir`: a plan digest over each file's path (from `dir`) and bytes. */
+export function directoryDigest(root, dir) {
+    const base = resolve(root, dir);
+    const files = directoryFiles(root, dir).map((p) => ({
+        path: relative(base, resolve(root, p)).split(sep).join("/"),
+        digest: fileDigest(resolve(root, p)),
+    }));
+    return computePlanDigest("directory", files);
+}
+/**
+ * What a component's steps deploy from, read under `root` (the member's
+ * directory). `include` picks the steps to read, all of them by default; the
+ * wave planner passes the steps without a `plan`, which their plan does not
+ * already cover.
+ */
+export function componentDeployInputs(phases, root, include = () => true) {
+    const inputs = new Map();
+    const unbound = [];
+    for (const { phase, step } of stepsWithPhase(phases)) {
+        if (!include(step))
+            continue;
+        if (UNBOUND_KINDS.includes(step.kind)) {
+            unbound.push({ phase, kind: step.kind, reason: `a ${step.kind} step runs content chant can't name from its input` });
+            continue;
+        }
+        for (const ref of stepInputRefs(phase, step)) {
+            if (inputs.has(ref.path))
+                continue;
+            const full = resolve(root, ref.path);
+            if (!existsSync(full))
+                continue;
+            if (statSync(full).isDirectory()) {
+                if (ignoredByGit(root, ref.path)) {
+                    unbound.push({ phase, kind: step.kind, reason: `its ${ref.field} "${ref.path}" is a directory git ignores, so a build output; bind its sources through the step that builds it` });
+                    continue;
+                }
+                inputs.set(ref.path, directoryDigest(root, ref.path));
+            }
+            else {
+                inputs.set(ref.path, fileDigest(full));
+            }
+        }
+    }
+    return {
+        inputs: [...inputs].map(([path, digest]) => ({ path, digest })).sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),
+        unbound,
+    };
+}

package/dist/components/driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../src/components/driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAIH,OAAO,EAAmC,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAI3G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAmD,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzG,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIvD,oGAAoG;AACpG,MAAM,MAAM,WAAW,GACnB,MAAM,GACN;IAAE,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE5B,uFAAuF;AACvF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,iHAAiH;AACjH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;CAC3B;AAED,wHAAwH;AACxH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,uGAAuG;IACvG,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;CAC1B;AAYD,uEAAuE;AACvE,qBAAa,oBAAqB,SAAQ,KAAK;aACjB,KAAK,EAAE,MAAM,EAAE;IAA3C,YAA4B,KAAK,EAAE,MAAM,EAAE,EAG1C;CACF;AAED,0FAA0F;AAC1F,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,SAAS,EAAE,MAAM;aACjB,UAAU,EAAE,MAAM;IAFpC,YACkB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAInC;CACF;AAED,+FAA+F;AAC/F,qBAAa,gBAAiB,SAAQ,KAAK;aACb,MAAM,EAAE,eAAe;IAAnD,YAA4B,MAAM,EAAE,eAAe,EAGlD;CACF;AAID,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,oBAAoB,CAAC;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yHAAyH;IACzH,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,uGAAuG;QACvG,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,oGAAoG;QACpG,KAAK,CAAC,EAAE,IAAI,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,2KAA2K;IAC3K,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAChC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,qFAAqF;IACrF,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wHAAwH;IACxH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IAClB,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,kEAAkE;IAClE,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAChC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,8GAA8G;IAC9G,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qGAAqG;IACrG,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3D;AAID,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,cAAc,CA0BnF;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,WAAW,EAClB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACrD,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,OAAO,CAmBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACrD,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,MAAM,EAAE,CAEV;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,eAAe,EAAE,CAEnB;AAmCD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC3C,eAAe,EAAE,CAGnB;AAmDD,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,cAAc,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,EAAE,EAAE,MAAM,CAAC;IACX,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,8GAA8G;IAC9G,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AA6UD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,EAC1B,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,kBAAkB,EAC5B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzD,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,EAC9C,WAAW,GAAE,WAA2C,EACxD,UAAU,CAAC,EAAE,YAAY,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAgFhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACpD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAKrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzD,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACpD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAMzC;AAsCD,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,GAAG,OAAO,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,GAAG,MAAM,CAEnF;AAQD,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,iIAAiI;IACjI,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,qKAAqK;IACrK,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC/C;;;;OAIG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,8KAA8K;IAC9K,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8HAA8H;IAC9H,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,qHAAqH;IACrH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;CACtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,yGAAyG;AACzG,wBAAgB,aAAa,CAC3B,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAA;CAAE,EAC9H,SAAS,EAAE,MAAM,GAChB,aAAa,CAGf;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,eAAe,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,eAAe,CAAC,CAoE1B"}
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../src/components/driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAIH,OAAO,EAAmC,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAK3G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAmD,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzG,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIvD,oGAAoG;AACpG,MAAM,MAAM,WAAW,GACnB,MAAM,GACN;IAAE,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE5B,uFAAuF;AACvF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,iHAAiH;AACjH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;CAC3B;AAED,wHAAwH;AACxH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,uGAAuG;IACvG,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;CAC1B;AAYD,uEAAuE;AACvE,qBAAa,oBAAqB,SAAQ,KAAK;aACjB,KAAK,EAAE,MAAM,EAAE;IAA3C,YAA4B,KAAK,EAAE,MAAM,EAAE,EAG1C;CACF;AAED,0FAA0F;AAC1F,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,SAAS,EAAE,MAAM;aACjB,UAAU,EAAE,MAAM;IAFpC,YACkB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAInC;CACF;AAED,+FAA+F;AAC/F,qBAAa,gBAAiB,SAAQ,KAAK;aACb,MAAM,EAAE,eAAe;IAAnD,YAA4B,MAAM,EAAE,eAAe,EAGlD;CACF;AAID,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,oBAAoB,CAAC;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yHAAyH;IACzH,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,uGAAuG;QACvG,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,oGAAoG;QACpG,KAAK,CAAC,EAAE,IAAI,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,2KAA2K;IAC3K,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAChC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,qFAAqF;IACrF,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wHAAwH;IACxH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IAClB,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,kEAAkE;IAClE,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAChC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,8GAA8G;IAC9G,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qGAAqG;IACrG,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3D;AAID,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,cAAc,CA0BnF;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,WAAW,EAClB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACrD,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,OAAO,CAmBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACrD,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAazB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,MAAM,EAAE,CAEV;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,eAAe,EAAE,CAEnB;AAmCD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC3C,eAAe,EAAE,CAGnB;AAmDD,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,cAAc,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,EAAE,EAAE,MAAM,CAAC;IACX,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,8GAA8G;IAC9G,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAoVD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,EAC1B,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,kBAAkB,EAC5B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzD,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,EAC9C,WAAW,GAAE,WAA2C,EACxD,UAAU,CAAC,EAAE,YAAY,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAmFhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACpD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAKrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzD,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACpD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAMzC;AAsCD,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,GAAG,OAAO,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,GAAG,MAAM,CAEnF;AAQD,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,iIAAiI;IACjI,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,qKAAqK;IACrK,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC/C;;;;OAIG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,8KAA8K;IAC9K,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8HAA8H;IAC9H,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,qHAAqH;IACrH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;CACtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,yGAAyG;AACzG,wBAAgB,aAAa,CAC3B,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAA;CAAE,EAC9H,SAAS,EAAE,MAAM,GAChB,aAAa,CAGf;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,eAAe,EAAE,EAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,eAAe,CAAC,CAoE1B"}

package/dist/components/driver.js

@@ -51,6 +51,7 @@ import { evaluateGate, gitGateLedgerPort } from "../op/gate.js";
 import { gateName } from "../op/gate-name.js";
 import { GateNotRecordableError } from "../lifecycle/no-record.js";
 import { componentPlanDigest } from "./gate-plan.js";
+import { componentDeployInputs } from "./deploy-inputs.js";
 import { isPlanMovedError, PLAN_MOVED_EXIT_CODE } from "./capability.js";
 import { isPromotedArtifact } from "./auto-release.js";
 import { gateEventsOf, joinRunEventSinks, progressSinkOf } from "../run-event-stream.js";
@@ -570,6 +571,11 @@ async function rollbackExecuted(executed, ctx, registry) {
     return records;
 }
 // ── Per-component deploy ─────────────────────────────────────────────────
+/** Whether a component's composition has a gate step anywhere, nested phases and `rollback` included. */
+function hasGateStep(component) {
+    const walk = (steps) => steps.some((step) => isGateStep(step) || (Array.isArray(step.steps) && walk(step.steps)));
+    return [...component.deploy, ...(component.rollback ?? [])].some((p) => walk(p.steps));
+}
 /**
  * Run one component's `deploy` composition. On terminal failure: unwind every
  * executed step in reverse via its capability's `rollback` (saga
@@ -610,6 +616,9 @@ export async function runComponentDeploy(component, ctx, registry, componentOutp
                 component,
                 ...(ctx.vars ? { vars: ctx.vars } : {}),
                 ...(release !== undefined ? { release } : {}),
+                // #4155: the files the steps deploy from, read where the steps read
+                // them. Only a gate reads the digest, so a run with none skips the hashing.
+                ...(hasGateStep(component) ? { inputs: componentDeployInputs(component.deploy, process.cwd()).inputs } : {}),
             }),
     };
     const records = [];

package/dist/components/gate-plan.d.ts

@@ -17,6 +17,11 @@
  *   its publish output against a recorded digest that is not in the
  *   composition, so it passes that digest here.
  * - `vars`, the environment config the caller resolved ahead of the run.
+ * - The content digests of the local files the steps deploy from (#4155,
+ *   ./deploy-inputs.ts): a chart, a manifest, a site's tree, a build step's
+ *   sources. A file changed after review moves the digest. The key is left
+ *   out when no step names an existing file, so a composition that deploys
+ *   none keeps the digest it had before #4155.
  *
  * ## What it leaves out
  *
@@ -26,6 +31,7 @@
  * upstream components. The run id and the time are left out for the reasons
  * `../lifecycle/plan-digest.ts` gives.
  */
+import type { DeployInputDigest } from "./deploy-inputs.js";
 import type { DriverComponent } from "./driver.js";
 /** What a component gate's plan digest is taken over. */
 export interface ComponentGatePlan {
@@ -34,6 +40,8 @@ export interface ComponentGatePlan {
     vars?: Record<string, unknown>;
     /** The recorded digest a promote or rollback deploys, when the caller has one. */
     release?: string;
+    /** What the steps deploy from (`componentDeployInputs`), when the caller read it. */
+    inputs?: readonly DeployInputDigest[];
 }
 /** The plan digest a component gate records and approves. */
 export declare function componentPlanDigest(plan: ComponentGatePlan): string;

package/dist/components/gate-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-plan.d.ts","sourceRoot":"","sources":["../../src/components/gate-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6DAA6D;AAC7D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAUnE"}
+{"version":3,"file":"gate-plan.d.ts","sourceRoot":"","sources":["../../src/components/gate-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACvC;AAED,6DAA6D;AAC7D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAWnE"}

package/dist/components/gate-plan.js

@@ -17,6 +17,11 @@
  *   its publish output against a recorded digest that is not in the
  *   composition, so it passes that digest here.
  * - `vars`, the environment config the caller resolved ahead of the run.
+ * - The content digests of the local files the steps deploy from (#4155,
+ *   ./deploy-inputs.ts): a chart, a manifest, a site's tree, a build step's
+ *   sources. A file changed after review moves the digest. The key is left
+ *   out when no step names an existing file, so a composition that deploys
+ *   none keeps the digest it had before #4155.
  *
  * ## What it leaves out
  *
@@ -37,5 +42,6 @@ export function componentPlanDigest(plan) {
         rollback: component.rollback ?? null,
         vars: plan.vars ?? null,
         release: plan.release ?? null,
+        ...(plan.inputs && plan.inputs.length > 0 ? { inputs: plan.inputs } : {}),
     });
 }

package/dist/components/pr-pipeline.d.ts

@@ -1,6 +1,7 @@
 /**
  * The jobs of a generated pull-request pipeline (#3183): a plan job on every
- * pull request and an apply job on every push to the target branch.
+ * pull request and, on every push to the target branch, a record job, or an
+ * apply job when the pipeline opts into apply on merge (#4168).
  *
  * Each forge's generator (the github, gitlab and forgejo lexicons) adds its
  * own triggers, permissions and artifact handling; the commands and the
@@ -9,11 +10,19 @@
  * - The plan job runs `chant components pr-plan` against the pull request's
  *   target commit. It posts the note and the `chant/plan` status and writes
  *   nothing to `chant/lifecycle`, since it runs the pull request's code.
- * - The apply job runs `chant components pr-apply` against the commit the
+ * - The record job (#4168 step 1, the default) runs `chant components
+ *   pr-record` against the commit the push replaced. It plans the same
+ *   members on the merged commit, stores the change set and writes the merge
+ *   record, `_merges/<commit>.json` on `chant/lifecycle`. It applies nothing:
+ *   a release that carries the commit deploys it. It needs write access to
+ *   `chant/lifecycle`. One record runs at a time per environment.
+ * - With `applyOnMerge` the apply job takes the record job's place. It runs
+ *   `chant components pr-apply` against the commit the
  *   push replaced, finds the pull request that merged the pushed commit
  *   through the forge, and applies only when an approval stands for the
- *   digest it plans. With `requireReview` (the default) the approver must
- *   also have approved the pull request on the forge. It needs write access
+ *   digest it plans. With `requireReview` (off by default since #4168, on
+ *   under the `review-rules` security group) the approver must also have
+ *   approved the pull request on the forge. It needs write access
  *   to `chant/lifecycle`, to record the pending fact when the gate stops it.
  *   One apply runs at a time per environment.
  *
@@ -35,6 +44,7 @@
  * it too. With `reportUrl` both pass `--report-url`, which copies the report,
  * the change set and the events where a reader outside CI can fetch them;
  * the job's own environment brings the credentials an `s3://` URL needs.
+ * The record job passes the same flags as the apply.
  *
  * With `build` (#4088) both jobs run the project's build and `chant lint`
  * before their command, and fail on an error. A `cfn-deploy` member's plan
@@ -104,8 +114,16 @@ export interface PrLoopPipelineOptions {
      * GitHub and Forgejo; on GitLab, the project's default branch.
      */
     branch?: string;
-    /** Count an approval only from someone who approved the pull request on the forge. Default true. */
+    /** Count an approval only from someone who approved the pull request on the forge. Default false (#4168): review rules are opt-in. */
     requireReview?: boolean;
+    /** The job on merge (apply, or record since #4168) has `chant ci run` refuse to start without a runner-start statement for it (`--require-runner-start`, #4147), as under the `isolated-runners` security group (#4168). Default false. */
+    requireRunnerStart?: boolean;
+    /**
+     * Apply the approved plan on merge (#4168), as every pull-request pipeline
+     * did before #4168: the apply job in place of the record job. Default
+     * false, so a merge deploys nothing. `waveGate` needs it.
+     */
+    applyOnMerge?: boolean;
     /**
      * Stream each job's run events (#4007): `--events-json` on both commands,
      * and `CHANT_RUN_EVENTS_DIR` set to {@link PR_LOOP_EVENTS_DIR}. Default false.
@@ -146,8 +164,8 @@ export interface PrLoopPipelineOptions {
 }
 /** One job's command and the forge values it reads, as environment variables for its step. */
 export interface PrLoopJob {
-    /** `plan` or `apply`. */
-    jobName: "plan" | "apply";
+    /** `plan`, `apply` or `record` (#4168). */
+    jobName: "plan" | "apply" | "record";
     /** The command line. Reads `$BASE_SHA` and, for the plan, `$PR_NUMBER`. */
     command: string;
     /**
@@ -178,11 +196,14 @@ export interface PrLoopJob {
 /** The lines `build` (#4088) runs before a job's command: the build, then the lint. Empty without the option. */
 export declare function prLoopBuildLines(env: string, options?: PrLoopPipelineOptions): string[];
 /**
- * The two jobs for `forge`. `member` is the workspace member the pipeline is
- * generated for; the commands then run in its directory, so `--output` is
- * relative to it.
+ * The jobs for `forge`: plan, apply and record, in that order. A generator
+ * writes the plan and, on merge, {@link prLoopMergeJob}'s choice of the
+ * other two. `member` is the workspace member the pipeline is generated for;
+ * the commands then run in its directory, so `--output` is relative to it.
  */
 export declare function prLoopJobs(forge: ForgeKind, env: string, options?: PrLoopPipelineOptions, member?: string): PrLoopJob[];
+/** The job a push to the target branch runs (#4168): `record`, or `apply` when the pipeline opts into apply on merge. */
+export declare function prLoopMergeJob(jobs: readonly PrLoopJob[], options?: PrLoopPipelineOptions): PrLoopJob;
 /**
  * The pull-request options with `--wave-gate` beside `--pr-loop` (#4003):
  * the apply gets a gate per wave. A canary or a fixed base is refused, since
@@ -211,6 +232,8 @@ export declare function prLoopWaveJobs(components: DriverComponent[], apply: PrL
  * apart from a single project's `chant-apply-<env>`.
  */
 export declare function prApplyGroup(env: string, member?: string): string;
+/** The group that keeps one record job at a time per environment and member (#4168), named as {@link prApplyGroup} names the apply's. */
+export declare function prRecordGroup(env: string, member?: string): string;
 /**
  * The cache key the apply job keeps its attempt record under (#3543), with
  * `commit` the forge's expression for the pushed commit. A push of another

package/dist/components/pr-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/pr-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAKtE,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,YAAW,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,aAAa,UAEzB,CAAC;AAEF,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAAqC,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,yBAAyB;IACzB,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACvD;AAED,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE,CAG3F;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAsD3H;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,EAAE,wBAAwB,GAAG,qBAAqB,CAK3H;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAS3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAErF;AAoBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D"}
+{"version":3,"file":"pr-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/pr-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAKtE,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,YAAW,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,aAAa,UAEzB,CAAC;AAEF,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAAqC,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sIAAsI;IACtI,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2OAA2O;IAC3O,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACvD;AAED,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE,CAG3F;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CA+D3H;AAED,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,OAAO,GAAE,qBAA0B,GAAG,SAAS,CAEzG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,EAAE,wBAAwB,GAAG,qBAAqB,CAQ3H;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAS3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,yIAAyI;AACzI,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAErF;AAoBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/dist/components/pr-pipeline.js

@@ -1,6 +1,7 @@
 /**
  * The jobs of a generated pull-request pipeline (#3183): a plan job on every
- * pull request and an apply job on every push to the target branch.
+ * pull request and, on every push to the target branch, a record job, or an
+ * apply job when the pipeline opts into apply on merge (#4168).
  *
  * Each forge's generator (the github, gitlab and forgejo lexicons) adds its
  * own triggers, permissions and artifact handling; the commands and the
@@ -9,11 +10,19 @@
  * - The plan job runs `chant components pr-plan` against the pull request's
  *   target commit. It posts the note and the `chant/plan` status and writes
  *   nothing to `chant/lifecycle`, since it runs the pull request's code.
- * - The apply job runs `chant components pr-apply` against the commit the
+ * - The record job (#4168 step 1, the default) runs `chant components
+ *   pr-record` against the commit the push replaced. It plans the same
+ *   members on the merged commit, stores the change set and writes the merge
+ *   record, `_merges/<commit>.json` on `chant/lifecycle`. It applies nothing:
+ *   a release that carries the commit deploys it. It needs write access to
+ *   `chant/lifecycle`. One record runs at a time per environment.
+ * - With `applyOnMerge` the apply job takes the record job's place. It runs
+ *   `chant components pr-apply` against the commit the
  *   push replaced, finds the pull request that merged the pushed commit
  *   through the forge, and applies only when an approval stands for the
- *   digest it plans. With `requireReview` (the default) the approver must
- *   also have approved the pull request on the forge. It needs write access
+ *   digest it plans. With `requireReview` (off by default since #4168, on
+ *   under the `review-rules` security group) the approver must also have
+ *   approved the pull request on the forge. It needs write access
  *   to `chant/lifecycle`, to record the pending fact when the gate stops it.
  *   One apply runs at a time per environment.
  *
@@ -35,6 +44,7 @@
  * it too. With `reportUrl` both pass `--report-url`, which copies the report,
  * the change set and the events where a reader outside CI can fetch them;
  * the job's own environment brings the credentials an `s3://` URL needs.
+ * The record job passes the same flags as the apply.
  *
  * With `build` (#4088) both jobs run the project's build and `chant lint`
  * before their command, and fail on an error. A `cfn-deploy` member's plan
@@ -109,9 +119,10 @@ export function prLoopBuildLines(env, options = {}) {
     return [options.buildCommand ?? `chant build --env ${env}`, "chant lint"];
 }
 /**
- * The two jobs for `forge`. `member` is the workspace member the pipeline is
- * generated for; the commands then run in its directory, so `--output` is
- * relative to it.
+ * The jobs for `forge`: plan, apply and record, in that order. A generator
+ * writes the plan and, on merge, {@link prLoopMergeJob}'s choice of the
+ * other two. `member` is the workspace member the pipeline is generated for;
+ * the commands then run in its directory, so `--output` is relative to it.
  */
 export function prLoopJobs(forge, env, options = {}, member) {
     const gate = options.gate ?? PR_APPLY_GATE;
@@ -133,9 +144,10 @@ export function prLoopJobs(forge, env, options = {}, member) {
         "chant", "ci", "run", job, "--in-place", ...(job === "plan" ? ["--no-push"] : []),
         "--base", '"$BASE_SHA"', ...(job === "plan" ? ["--pr", '"$PR_NUMBER"'] : []),
         "--env", env, "--gate", gate, "--forge", forge,
-        ...(options.waveGate ? ["--wave-gate", options.waveGate] : []),
-        ...(job === "apply" && options.branch ? ["--branch", JSON.stringify(options.branch)] : []),
-        ...(job === "apply" && options.requireReview === false ? ["--no-require-review"] : []),
+        ...(job !== "record" && options.waveGate ? ["--wave-gate", options.waveGate] : []),
+        ...(job !== "plan" && options.branch ? ["--branch", JSON.stringify(options.branch)] : []),
+        ...(job === "apply" && options.requireReview === true ? ["--require-review"] : []),
+        ...(job !== "plan" && options.requireRunnerStart === true ? ["--require-runner-start"] : []),
         ...(options.events ? ["--events-json"] : []),
         ...(options.reportUrl ? ["--report-url", JSON.stringify(options.reportUrl)] : []),
     ];
@@ -157,7 +169,7 @@ export function prLoopJobs(forge, env, options = {}, member) {
             jobName: "apply",
             command: [
                 "chant", "components", "pr-apply", "--base", '"$BASE_SHA"', ...common,
-                ...(options.requireReview === false ? [] : ["--require-review"]),
+                ...(options.requireReview === true ? ["--require-review"] : []),
                 ...(options.waveGate ? ["--wave-gate", options.waveGate] : []),
                 "--resume", PR_APPLY_RECORD,
             ].join(" "),
@@ -166,8 +178,20 @@ export function prLoopJobs(forge, env, options = {}, member) {
             ...build,
             run: { command: ciRun("apply").join(" "), env: runEnv(applyEnv) },
         },
+        {
+            jobName: "record",
+            command: ["chant", "components", "pr-record", "--base", '"$BASE_SHA"', ...common].join(" "),
+            env: applyEnv,
+            setup: [github ? githubBaseFallback(options.branch) : gitlabBaseFallback(options.branch)],
+            ...build,
+            run: { command: ciRun("record").join(" "), env: runEnv(applyEnv) },
+        },
     ];
 }
+/** The job a push to the target branch runs (#4168): `record`, or `apply` when the pipeline opts into apply on merge. */
+export function prLoopMergeJob(jobs, options = {}) {
+    return jobs.find((j) => j.jobName === (options.applyOnMerge ? "apply" : "record"));
+}
 /**
  * The pull-request options with `--wave-gate` beside `--pr-loop` (#4003):
  * the apply gets a gate per wave. A canary or a fixed base is refused, since
@@ -177,6 +201,9 @@ export function prLoopJobs(forge, env, options = {}, member) {
 export function prLoopWithWaves(prLoop, gatedWaves) {
     if (!gatedWaves)
         return prLoop;
+    if (!prLoop.applyOnMerge) {
+        throw new Error("--wave-gate beside --pr-loop gates the apply on merge, so it needs --apply-on-merge (#4168); without it a merge records the plan and a release deploys it");
+    }
     if (gatedWaves.canary?.length)
         throw new Error("a pull-request pipeline's waves are the change's derivation, so it takes no --canary; drop --canary");
     if (gatedWaves.base !== undefined)
@@ -217,6 +244,10 @@ export function prLoopWaveJobs(components, apply) {
 export function prApplyGroup(env, member) {
     return member ? `chant-apply.${member}.${env}` : `chant-apply-${env}`;
 }
+/** The group that keeps one record job at a time per environment and member (#4168), named as {@link prApplyGroup} names the apply's. */
+export function prRecordGroup(env, member) {
+    return member ? `chant-record.${member}.${env}` : `chant-record-${env}`;
+}
 /**
  * The cache key the apply job keeps its attempt record under (#3543), with
  * `commit` the forge's expression for the pushed commit. A push of another

package/dist/components/pr-run.d.ts

@@ -307,7 +307,7 @@ export declare function prWavePlan(plan: FanOutPlan, components: DriverComponent
  */
 export declare function waveNotCovered(approved: ChangeSetDocument, fresh: ChangeSetDocument, approvedMembers?: readonly PrMember[]): string[];
 export interface PrReportInput {
-    stage: "plan" | "apply";
+    stage: "plan" | "apply" | "record";
     pr: number | null;
     env: string;
     /** The workspace member whose pipeline runs the stage (#3465). */