@intentius/chant 0.124.32 → 0.124.33

package/dist/lifecycle/release-cut.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-cut.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-cut.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAUH,OAAO,EAUL,KAAK,OAAO,EAEZ,KAAK,UAAU,EACf,KAAK,aAAa,EAEnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpF,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GACtB,sBAAsB,GACtB,0BAA0B,GAC1B,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,GAC7B,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,CAAC;AAE1B,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAE7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAHvB,YACW,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;CACF;AAED,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,cAAc,CAAC;IACzB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;IAChB,oGAAoG;IACpG,MAAM,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAcD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,OAAO,0BAA0B,EAAE,OAAO,GAAG,IAAW,GAC9D,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAanH;AAED,uGAAuG;AACvG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAapH;AAyKD,6GAA6G;AAC7G,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8GAA8G;IAC9G,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4HAA4H;IAC5H,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sFAAsF;IACtF,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/H,2FAA2F;IAC3F,KAAK,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,+EAA+E;IAC/E,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5B,oFAAoF;IACpF,YAAY,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC5F,wEAAwE;IACxE,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CA4DnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6DpE"}
+{"version":3,"file":"release-cut.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-cut.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AASH,OAAO,EAUL,KAAK,OAAO,EAEZ,KAAK,UAAU,EACf,KAAK,aAAa,EAGnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpF,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GACtB,sBAAsB,GACtB,0BAA0B,GAC1B,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,GAC7B,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,CAAC;AAE1B,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAE7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAHvB,YACW,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;CACF;AAED,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,cAAc,CAAC;IACzB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;IAChB,oGAAoG;IACpG,MAAM,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAcD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,OAAO,0BAA0B,EAAE,OAAO,GAAG,IAAW,GAC9D,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAanH;AAED,uGAAuG;AACvG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAapH;AAoLD,6GAA6G;AAC7G,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8GAA8G;IAC9G,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4HAA4H;IAC5H,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sFAAsF;IACtF,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/H,2FAA2F;IAC3F,KAAK,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,+EAA+E;IAC/E,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5B,oFAAoF;IACpF,YAAY,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC5F,wEAAwE;IACxE,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CA4DnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6DpE"}

package/dist/lifecycle/release-cut.js

@@ -36,11 +36,10 @@ import { execFileSync } from "node:child_process";
 import { realpathSync } from "node:fs";
 import { relative, resolve } from "node:path";
 import { canonicalJson } from "../effect-receipt.js";
-import { contentDigest } from "../content-digest.js";
 import { getHeadCommit } from "./git.js";
 import { resolveMemberLedger } from "./member-ledger.js";
 import { resolveCiRun } from "./release-ledger.js";
-import { appendCut, invalidLabel, labelsByDigest, makeRelease, persistRelease, readAllReleases, readCuts, readRelease, ReleaseLabelError, } from "./release-store.js";
+import { appendCut, invalidLabel, labelsByDigest, makeRelease, persistRelease, readAllReleases, readCuts, readRelease, ReleaseLabelError, templateBytesDigest, } from "./release-store.js";
 export class ReleaseCutError extends Error {
     constructor(code, message, fix) {
         super(message);
@@ -213,18 +212,30 @@ async function prepare(req) {
         member: ledger.members.length > 0 ? ledger.members.join("/") : null,
     };
 }
-/** The targets and template bytes of a compile, each template by its content digest. */
+/**
+ * The targets and template bytes of a compile, each template by its content
+ * digest. A compile of components names its directories in `trees` (#4155),
+ * an empty list when it has none, which marks the target as one that records
+ * every deploy input. A project with no components has no deploy step to
+ * name one, and its targets have no `trees`.
+ */
 function targetsOf(compiled) {
     const templates = [];
-    const targets = compiled.map((t) => ({
-        env: t.env,
-        params: t.params,
-        templates: t.templates.map((tpl) => {
-            const digest = contentDigest(tpl.content);
-            templates.push({ digest, content: tpl.content });
-            return { component: tpl.component, path: tpl.path, digest };
-        }),
-    }));
+    const targets = compiled.map((t) => {
+        const seen = new Set();
+        const recorded = [];
+        for (const tpl of t.templates) {
+            // A file named twice, as a values file inside a recorded chart, is recorded once.
+            const key = `${tpl.component ?? ""}\u0000${tpl.path}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            const digest = templateBytesDigest(tpl.content, tpl.encoding);
+            templates.push({ digest, content: tpl.content, ...(tpl.encoding ? { encoding: tpl.encoding } : {}) });
+            recorded.push({ component: tpl.component, path: tpl.path, digest, ...(tpl.encoding ? { encoding: tpl.encoding } : {}) });
+        }
+        return { env: t.env, params: t.params, templates: recorded, ...(t.trees ? { trees: t.trees } : {}) };
+    });
     return { targets, templates };
 }
 /**

package/dist/lifecycle/release-publish.d.ts

@@ -7,16 +7,23 @@
  *
  * - a release no cut names (`release-not-found`);
  * - a release cut from a revoked commit (`release-revoked`, #4033);
- * - a release none of whose cuts carries a signature that verifies for its
- *   actor against `.chant/allowed_signers` at base (`release-unsigned` or
- *   `release-signature-unverified`, #4049), and under an `identity.gates`
- *   entry for `release` (#4031) one whose signer is not in the gate's class.
- *   `--allow-unsigned` publishes one with no verified signature anyway, with
- *   a warning, except under the release gate, which it never overrides.
+ * - under an `identity.gates` entry for `release` (#4031), a release with no
+ *   cut signed by a signer in the gate's class (`release-unsigned` or
+ *   `release-signature-unverified`);
+ * - when the workspace opts into `verified-releases` (`security` in
+ *   chant.workspace.json, #4168), a release none of whose cuts carries a
+ *   signature that verifies for its actor against `.chant/allowed_signers`
+ *   at base (#4049). `--allow-unsigned` publishes it anyway, with a warning;
+ *   it never overrides the release gate.
+ *
+ * With neither, an unsigned release publishes quietly, and the plan records
+ * its `signature` status (#4168: security features are opt-in).
  *
  * It then says whether the run has an OIDC token to sign provenance with
- * ({@link detectProvenance}), and warns when it has none, before any target
- * runs; `--require-provenance` refuses instead (`publish-provenance-missing`).
+ * ({@link detectProvenance}). Under `supply-chain` it warns when there is
+ * none, before any target runs; `--require-provenance` refuses instead
+ * (`publish-provenance-missing`). Without either, provenance is only the
+ * plan's `provenance` field.
  * The targets come from {@link releasePublishTargets}: the member declares them under `release.publish` in its `chant.config.ts` (#4047).
  * With a target, the checkout must be the release's commit with a clean
  * tree ({@link checkCheckoutIsRelease}), every target is planned before any
@@ -140,6 +147,12 @@ export interface PublishContext {
     redactor: Redactor;
     /** Print one line of progress. The line is redacted. */
     log(line: string): void;
+    /**
+     * Whether a target with no SBOM source refuses (`publish-sbom-missing`),
+     * as under the `supply-chain` group (#4168). False or absent: it publishes
+     * without an SBOM. A declared `sbom` file is attached either way.
+     */
+    requireSbom?: boolean;
 }
 /** A target refused or failed. The message never holds a credential. */
 export declare class PublishTargetError extends Error {
@@ -219,7 +232,7 @@ export interface PublishPlan {
         reason: string;
     };
     provenance: ProvenanceCheck;
-    /** The warning printed before publishing, when the run has no OIDC token. */
+    /** The warning printed before publishing, when the run has no OIDC token and the workspace opts into `supply-chain` (#4168). */
     warning: string | null;
     /** The warning printed before publishing a release with no verified signature under `--allow-unsigned` (#4049). */
     signatureWarning: string | null;
@@ -230,15 +243,18 @@ export interface PublishPlan {
     targets: PublishTarget[];
     /** Masks the run's credentials in what the publish prints. */
     redactor: Redactor;
+    /** Whether a target with no SBOM source is refused (`publish-sbom-missing`): the workspace opts into `supply-chain` (#4168). Otherwise it publishes without one. */
+    requireSbom: boolean;
 }
 /**
  * Resolve `ref` (a label or a digest) in the member at `cwd` and decide
  * whether it may be published, reading the local `chant/lifecycle` branch,
  * the local tags and the declaration at base. Fetches nothing.
  *
- * `allowUnsigned` publishes a release with no verified signature, which is
- * refused otherwise (#4049); it does not override the release gate.
- * `requireProvenance` refuses a run with no OIDC token, where it warns.
+ * `allowUnsigned` publishes a release with no verified signature, which
+ * `verified-releases` refuses otherwise (#4049, #4168); it does not override
+ * the release gate. `requireProvenance` refuses a run with no OIDC token,
+ * where `supply-chain` warns and no group says nothing.
  */
 export declare function preparePublish(req: {
     cwd: string;

package/dist/lifecycle/release-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-publish.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtE,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,IAAI,EAAE,OAAO,CAAC;IACd,sDAAsD;IACtD,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC/B,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CAYtF;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kHAAkH;IAClH,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IACnC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,6GAA6G;AAC7G,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,kFAAkF;IAClF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wDAAwD;AACxD,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,KAClH,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEtH,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kIAAkI;IAClI,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,eAAe,CAAC;IAC5B,oGAAoG;IACpG,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,EAAE,QAAQ,CAAC;IACnB,wDAAwD;IACxD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,wEAAwE;AACxE,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAHvB,YACW,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;CACF;AAED,4HAA4H;AAC5H,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,IAAI,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7E;AAED,iGAAiG;AACjG,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAKzG;AAED,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,IAAI,EACA,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,8BAA8B,GAC9B,4BAA4B,GAC5B,wBAAwB,GACxB,uBAAuB,GACvB,wBAAwB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,8GAA8G;AAC9G,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,6EAA6E;IAC7E,SAAS,EAAE;QAAE,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxH,UAAU,EAAE,eAAe,CAAC;IAC5B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mHAAmH;IACnH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,mGAAmG;IACnG,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,iEAAiE;IACjE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,OAAO,CAAC,WAAW,GAAG;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC,CAoGrD;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAmBvG;AAUD,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAAG,cAAc,CAajK;AAED,mCAAmC;AACnC,MAAM,WAAW,UAAU;IACzB,oDAAoD;IACpD,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,+FAA+F;IAC/F,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAA;KAAE,CAAC,CAAC;IAChE,2GAA2G;IAC3G,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,0GAA0G;AAC1G,qBAAa,eAAgB,SAAQ,kBAAkB;IAKnD,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE;IAN7B,YACE,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GAAG,SAAS,EACd,IAAI,EAAE,OAAO,GAAG,QAAQ,EACxB,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,EAAE,MAAM,EAAE,EAI5B;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAClC,GAAG,EAAE,cAAc,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiFtB"}
+{"version":3,"file":"release-publish.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtE,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,IAAI,EAAE,OAAO,CAAC;IACd,sDAAsD;IACtD,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC/B,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CAYtF;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kHAAkH;IAClH,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IACnC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,6GAA6G;AAC7G,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,kFAAkF;IAClF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wDAAwD;AACxD,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,KAClH,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEtH,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kIAAkI;IAClI,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,eAAe,CAAC;IAC5B,oGAAoG;IACpG,GAAG,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,EAAE,QAAQ,CAAC;IACnB,wDAAwD;IACxD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wEAAwE;AACxE,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAHvB,YACW,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;CACF;AAED,4HAA4H;AAC5H,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,IAAI,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7E;AAED,iGAAiG;AACjG,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAKzG;AAED,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,IAAI,EACA,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,8BAA8B,GAC9B,4BAA4B,GAC5B,wBAAwB,GACxB,uBAAuB,GACvB,wBAAwB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,8GAA8G;AAC9G,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,6EAA6E;IAC7E,SAAS,EAAE;QAAE,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxH,UAAU,EAAE,eAAe,CAAC;IAC5B,gIAAgI;IAChI,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mHAAmH;IACnH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,mGAAmG;IACnG,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,iEAAiE;IACjE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,EAAE,QAAQ,CAAC;IACnB,oKAAoK;IACpK,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,OAAO,CAAC,WAAW,GAAG;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC,CAuGrD;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAmBvG;AAUD,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAAG,cAAc,CAcjK;AAED,mCAAmC;AACnC,MAAM,WAAW,UAAU;IACzB,oDAAoD;IACpD,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,+FAA+F;IAC/F,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAA;KAAE,CAAC,CAAC;IAChE,2GAA2G;IAC3G,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,0GAA0G;AAC1G,qBAAa,eAAgB,SAAQ,kBAAkB;IAKnD,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE;IAN7B,YACE,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GAAG,SAAS,EACd,IAAI,EAAE,OAAO,GAAG,QAAQ,EACxB,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,EAAE,MAAM,EAAE,EAI5B;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAClC,GAAG,EAAE,cAAc,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiFtB"}

package/dist/lifecycle/release-publish.js

@@ -7,16 +7,23 @@
  *
  * - a release no cut names (`release-not-found`);
  * - a release cut from a revoked commit (`release-revoked`, #4033);
- * - a release none of whose cuts carries a signature that verifies for its
- *   actor against `.chant/allowed_signers` at base (`release-unsigned` or
- *   `release-signature-unverified`, #4049), and under an `identity.gates`
- *   entry for `release` (#4031) one whose signer is not in the gate's class.
- *   `--allow-unsigned` publishes one with no verified signature anyway, with
- *   a warning, except under the release gate, which it never overrides.
+ * - under an `identity.gates` entry for `release` (#4031), a release with no
+ *   cut signed by a signer in the gate's class (`release-unsigned` or
+ *   `release-signature-unverified`);
+ * - when the workspace opts into `verified-releases` (`security` in
+ *   chant.workspace.json, #4168), a release none of whose cuts carries a
+ *   signature that verifies for its actor against `.chant/allowed_signers`
+ *   at base (#4049). `--allow-unsigned` publishes it anyway, with a warning;
+ *   it never overrides the release gate.
+ *
+ * With neither, an unsigned release publishes quietly, and the plan records
+ * its `signature` status (#4168: security features are opt-in).
  *
  * It then says whether the run has an OIDC token to sign provenance with
- * ({@link detectProvenance}), and warns when it has none, before any target
- * runs; `--require-provenance` refuses instead (`publish-provenance-missing`).
+ * ({@link detectProvenance}). Under `supply-chain` it warns when there is
+ * none, before any target runs; `--require-provenance` refuses instead
+ * (`publish-provenance-missing`). Without either, provenance is only the
+ * plan's `provenance` field.
  * The targets come from {@link releasePublishTargets}: the member declares them under `release.publish` in its `chant.config.ts` (#4047).
  * With a target, the checkout must be the release's commit with a clean
  * tree ({@link checkCheckoutIsRelease}), every target is planned before any
@@ -76,9 +83,10 @@ export async function releasePublishTargets(cwd, deps = {}) {
  * whether it may be published, reading the local `chant/lifecycle` branch,
  * the local tags and the declaration at base. Fetches nothing.
  *
- * `allowUnsigned` publishes a release with no verified signature, which is
- * refused otherwise (#4049); it does not override the release gate.
- * `requireProvenance` refuses a run with no OIDC token, where it warns.
+ * `allowUnsigned` publishes a release with no verified signature, which
+ * `verified-releases` refuses otherwise (#4049, #4168); it does not override
+ * the release gate. `requireProvenance` refuses a run with no OIDC token,
+ * where `supply-chain` warns and no group says nothing.
  */
 export async function preparePublish(req) {
     const { resolveRelease, readCuts } = await import("./release-store.js");
@@ -86,6 +94,7 @@ export async function preparePublish(req) {
     const { scopeSource } = await import("../workspace/write-scope.js");
     const { releaseRuleFrom } = await import("../workspace/identity.js");
     const { checkReleaseSignature } = await import("../workspace/identity-gate-rule.js");
+    const { securityGroupsIn } = await import("../workspace/security.js");
     const { cwd, ref } = req;
     const found = await resolveRelease(ref, { cwd });
     if (!found)
@@ -102,7 +111,9 @@ export async function preparePublish(req) {
             },
         };
     }
-    const rule = releaseRuleFrom(scopeSource(cwd));
+    const source = scopeSource(cwd);
+    const rule = releaseRuleFrom(source);
+    const groups = securityGroupsIn(source, cwd);
     const cuts = (await readCuts({ cwd })).cuts.filter((c) => c.releaseDigest === release.releaseDigest);
     const checks = cuts.map((c) => ({
         cut: c,
@@ -121,9 +132,9 @@ export async function preparePublish(req) {
             },
         };
     }
-    // #4049: with or without the gate, a publish refuses a release whose signature does not verify, unless --allow-unsigned.
+    // #4049, #4168: under verified-releases a publish refuses a release whose signature does not verify, unless --allow-unsigned. Without it an unsigned release publishes quietly.
     let signatureWarning = null;
-    if (!verified) {
+    if (!verified && groups.has("verified-releases")) {
         const why = unsigned
             ? `${name} has no signed cut`
             : `no cut of ${name} carries a signature that verifies against the signers file at base: ${checks.map((c) => c.check.reason).join("; ")}`;
@@ -131,7 +142,7 @@ export async function preparePublish(req) {
             return {
                 refusal: {
                     code: unsigned ? "release-unsigned" : "release-signature-unverified",
-                    message: `${why}, and chant release publish publishes only a release signed by a key in .chant/allowed_signers`,
+                    message: `${why}, and the workspace opts into verified-releases (security in chant.workspace.json), which publishes only a release signed by a key in .chant/allowed_signers`,
                     fix: `Cut it signed with a key .chant/allowed_signers lists for the chant-release namespace: chant release cut ${label ?? "<label>"} --sign --yes. To publish it unsigned anyway, pass --allow-unsigned.`,
                 },
             };
@@ -169,7 +180,7 @@ export async function preparePublish(req) {
             },
         };
     }
-    const warning = provenance.oidc
+    const warning = provenance.oidc || !groups.has("supply-chain")
         ? null
         : `this publish runs without OIDC, so what it publishes carries no provenance: ${provenance.reason}. Publish from CI to get provenance.`;
     const { resolveMemberLedger } = await import("./member-ledger.js");
@@ -178,7 +189,7 @@ export async function preparePublish(req) {
     const member = ledger.members.length > 0 ? ledger.members.join("/") : null;
     const releaseTag = label !== null ? releaseTagName(member, label) : null;
     const redactor = createRedactor(env, targets.flatMap((t) => t.credentialEnv));
-    return { release, label, signature, provenance, warning, signatureWarning, cut, releaseTag, targets, redactor };
+    return { release, label, signature, provenance, warning, signatureWarning, cut, releaseTag, targets, redactor, requireSbom: groups.has("supply-chain") };
 }
 /**
  * A publish with a target reads files from the checkout it runs in: package
@@ -228,6 +239,7 @@ export function publishContext(plan, req) {
         env: req.env ?? process.env,
         redactor: plan.redactor,
         log: (line) => req.log(plan.redactor.redact(line)),
+        requireSbom: plan.requireSbom,
     };
 }
 /** A publish that stopped, with what it left staged and revealed so a run of the same command resumes. */

package/dist/lifecycle/release-store.d.ts

@@ -14,6 +14,7 @@
  *   _releases/<releaseDigest>.json      the release, written once and never rewritten
  *   _releases/cuts.jsonl                one line per cut, with the release's label
  *   _releases/templates/<digest>.txt    each template's bytes, by content digest
+ *   _releases/templates/<digest>.b64    a file that is not UTF-8, base64 (#4155)
  *
  * `:` is written as `_` in file names, as `_plans/` and `_builds/` do. A
  * workspace member's copy sits under `_members/<member>/` through the same
@@ -24,6 +25,14 @@
  * (ws-104 question 5). They are named by content digest, so a template that
  * two environments or two releases share is stored once.
  *
+ * Since #4155 a cut records every local file a deploy step deploys from, not
+ * only `template`, `manifest` and `values` files: a chart, a kustomize
+ * directory, a site's tree. A directory is recorded as one template per file
+ * under it, and named in the target's `trees`, so a promote deploys the
+ * recorded tree. A target with `trees` is one such cut; a target without the
+ * field was cut before #4155, and a promote of it reads directories and the
+ * other fields from the checkout, as it did then.
+ *
  * `releaseDigest` is `computePlanDigest("release", subject)` over the member,
  * the commit, the artifact digests and each target's env, templates and the
  * name and value of each param. A param's `source`, the label, the actor, the
@@ -56,6 +65,14 @@ export interface ReleaseTemplate {
     path: string;
     /** `sha256:<hex>` of the file's bytes. */
     digest: string;
+    /** `base64` for a file that is not UTF-8 (#4155): its stored copy is base64. Absent for text. */
+    encoding?: "base64";
+}
+/** A directory a component's deploy names, whose files the target records as templates under its path (#4155). */
+export interface ReleaseTree {
+    component: string | null;
+    /** The directory as the deploy step names it, relative to the member's directory. */
+    path: string;
 }
 /** One resolved build parameter of a target. */
 export interface ReleaseParam {
@@ -69,6 +86,8 @@ export interface ReleaseTarget {
     env: string;
     templates: ReleaseTemplate[];
     params: ReleaseParam[];
+    /** The directories the target records (#4155). Absent on a target cut before #4155. */
+    trees?: ReleaseTree[];
 }
 /** The release file, `_releases/<releaseDigest>.json`. */
 export interface Release {
@@ -120,6 +139,8 @@ export declare function computeReleaseDigest(release: ReleaseSubject): string;
 export declare function makeRelease(subject: ReleaseSubject): Release;
 /** Whether a release's own `releaseDigest` is the digest of what it holds. */
 export declare function verifyReleaseDigest(release: Release): boolean;
+/** The digest of a template's bytes: its text, or what its base64 decodes to. */
+export declare function templateBytesDigest(content: string, encoding?: "base64"): string;
 /** Why a label can't be used, or undefined when it can. */
 export declare function invalidLabel(label: string): string | undefined;
 /** Thrown when a cut would give a label two digests, or a digest two labels. */
@@ -130,7 +151,9 @@ export declare class ReleaseLabelError extends Error {
 /** A release's template bytes, as the cut read them. */
 export interface TemplateContent {
     digest: string;
+    /** The text, or the base64 of the bytes when `encoding` is `base64`. */
     content: string;
+    encoding?: "base64";
 }
 /**
  * Store a release and its template bytes in one commit. A release already
@@ -187,8 +210,8 @@ export declare function appendCut(input: Omit<ReleaseCut, "version" | "signature
 }, opts?: {
     cwd?: string;
 }): Promise<CutOutcome>;
-/** A template's bytes by digest, or null when none is stored. */
-export declare function readReleaseTemplate(digest: string, opts?: LedgerLocation): Promise<string | null>;
+/** A template's bytes by digest, or null when none is stored. Under `base64` (#4155), the stored base64 of the bytes. */
+export declare function readReleaseTemplate(digest: string, opts?: LedgerLocation, encoding?: "base64"): Promise<string | null>;
 /**
  * Find a release by its digest or its label. Null when neither names one.
  * A string that names a digest is read as a digest first.

package/dist/lifecycle/release-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-store.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,uFAAuF;AACvF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,+CAA+C;AAC/C,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,0GAA0G;AAC1G,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,6FAA6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,eAAe;IAC9B,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,0DAA0D;AAC1D,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,wGAAwG;IACxG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,eAAe,EAAE,CAAC;IACnC,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;OAGG;IACH,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,iBAAiB,GAAG,SAAS,CAAC,CAAC;AAIhG,qKAAqK;AACrK,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,cAAc,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAgBxE;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAQjE;AAED,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAEpE;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAG5D;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AASD,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG9D;AAED,gFAAgF;AAChF,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,GAAG,uBAAuB;IAD7F,YACW,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,GAAG,uBAAuB,EAC3F,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,eAAe,EAAE,EACrC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4BtD;AAED,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CA2BzD;AAED,kIAAkI;AAClI,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAMhG;AAED,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhH;AAED,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA0BxF;AAED,+BAA+B;AAC/B,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAExG;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED,kCAAkC;AAClC,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE;AACrC,iGAAiG;GAC/F;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAI9C;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACjH,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,UAAU,CAAC,CAiDrB;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEvG;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAQnI"}
+{"version":3,"file":"release-store.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAKH,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,uFAAuF;AACvF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,+CAA+C;AAC/C,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,0GAA0G;AAC1G,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,6FAA6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,eAAe;IAC9B,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,kHAAkH;AAClH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,uFAAuF;IACvF,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,wGAAwG;IACxG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,eAAe,EAAE,CAAC;IACnC,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;OAGG;IACH,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,iBAAiB,GAAG,SAAS,CAAC,CAAC;AAIhG,qKAAqK;AACrK,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,cAAc,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAmBxE;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAajE;AAED,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAEpE;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAG5D;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AAMD,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAEhF;AAKD,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG9D;AAED,gFAAgF;AAChF,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,GAAG,uBAAuB;IAD7F,YACW,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,GAAG,uBAAuB,EAC3F,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,eAAe,EAAE,EACrC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA6BtD;AAED,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAmCzD;AAED,kIAAkI;AAClI,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAMhG;AAED,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhH;AAED,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA0BxF;AAED,+BAA+B;AAC/B,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAExG;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED,kCAAkC;AAClC,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE;AACrC,iGAAiG;GAC/F;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAI9C;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACjH,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,UAAU,CAAC,CAiDrB;AAED,yHAAyH;AACzH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE5H;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAQnI"}

package/dist/lifecycle/release-store.js

@@ -14,6 +14,7 @@
  *   _releases/<releaseDigest>.json      the release, written once and never rewritten
  *   _releases/cuts.jsonl                one line per cut, with the release's label
  *   _releases/templates/<digest>.txt    each template's bytes, by content digest
+ *   _releases/templates/<digest>.b64    a file that is not UTF-8, base64 (#4155)
  *
  * `:` is written as `_` in file names, as `_plans/` and `_builds/` do. A
  * workspace member's copy sits under `_members/<member>/` through the same
@@ -24,6 +25,14 @@
  * (ws-104 question 5). They are named by content digest, so a template that
  * two environments or two releases share is stored once.
  *
+ * Since #4155 a cut records every local file a deploy step deploys from, not
+ * only `template`, `manifest` and `values` files: a chart, a kustomize
+ * directory, a site's tree. A directory is recorded as one template per file
+ * under it, and named in the target's `trees`, so a promote deploys the
+ * recorded tree. A target with `trees` is one such cut; a target without the
+ * field was cut before #4155, and a promote of it reads directories and the
+ * other fields from the checkout, as it did then.
+ *
  * `releaseDigest` is `computePlanDigest("release", subject)` over the member,
  * the commit, the artifact digests and each target's env, templates and the
  * name and value of each param. A param's `source`, the label, the actor, the
@@ -31,7 +40,7 @@
  * same digest.
  */
 import { sortedJsonReplacer } from "../utils.js";
-import { contentDigest } from "../content-digest.js";
+import { contentDigest, sha256Hex } from "../content-digest.js";
 import { computePlanDigest } from "./plan-digest.js";
 import { ledgerDir, listFilesInDir, readBlobBySha, readBlobFromPath, readPathSha, RefCASConflictError, writeLedgerFiles, } from "./git.js";
 /** The directory on `chant/lifecycle` that holds releases, cuts and template bytes. */
@@ -54,9 +63,12 @@ export function normalizeRelease(release) {
             .map((t) => ({
             env: t.env,
             templates: [...t.templates]
-                .map(({ component, path, digest }) => ({ component, path, digest }))
+                .map(({ component, path, digest, encoding }) => ({ component, path, digest, ...(encoding ? { encoding } : {}) }))
                 .sort((a, b) => byString(a.component ?? "", b.component ?? "") || byString(a.path, b.path)),
             params: [...t.params].map(({ name, value, source }) => ({ name, value, source })).sort((a, b) => byString(a.name, b.name)),
+            ...(t.trees
+                ? { trees: [...t.trees].map(({ component, path }) => ({ component, path })).sort((a, b) => byString(a.component ?? "", b.component ?? "") || byString(a.path, b.path)) }
+                : {}),
         }))
             .sort((a, b) => byString(a.env, b.env)),
     };
@@ -68,7 +80,12 @@ export function releaseHashInput(release) {
         member: n.member,
         commit: n.commit,
         artifactDigests: n.artifactDigests,
-        targets: n.targets.map((t) => ({ env: t.env, templates: t.templates, params: t.params.map(({ name, value }) => ({ name, value })) })),
+        targets: n.targets.map((t) => ({
+            env: t.env,
+            templates: t.templates,
+            params: t.params.map(({ name, value }) => ({ name, value })),
+            ...(t.trees ? { trees: t.trees } : {}),
+        })),
     };
 }
 /** `computePlanDigest("release", input)` over {@link releaseHashInput}. */
@@ -86,7 +103,11 @@ export function verifyReleaseDigest(release) {
 }
 const stem = (digest) => digest.replace(/:/g, "_");
 const releaseFile = (digest) => `${stem(digest)}.json`;
-const templateFile = (digest) => `${stem(digest)}.txt`;
+const templateFile = (digest, encoding) => `${stem(digest)}.${encoding === "base64" ? "b64" : "txt"}`;
+/** The digest of a template's bytes: its text, or what its base64 decodes to. */
+export function templateBytesDigest(content, encoding) {
+    return encoding === "base64" ? `sha256:${sha256Hex(Buffer.from(content, "base64"))}` : contentDigest(content);
+}
 /** A label names a release in commands such as `chant release cut <label>`, so it is one plain word. */
 const LABEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
 /** Why a label can't be used, or undefined when it can. */
@@ -113,7 +134,7 @@ export async function persistRelease(release, templates, opts) {
         throw new Error(`release ${release.releaseDigest} does not hash to its own digest; refusing to store it`);
     }
     for (const t of templates) {
-        if (contentDigest(t.content) !== t.digest)
+        if (templateBytesDigest(t.content, t.encoding) !== t.digest)
             throw new Error(`template bytes do not hash to ${t.digest}; refusing to store them`);
     }
     const dir = await ledgerDir(RELEASES_DIR, opts);
@@ -124,12 +145,13 @@ export async function persistRelease(release, templates, opts) {
         files.push({ path: releasePath, content: `${JSON.stringify(release, sortedJsonReplacer)}\n`, expectPriorSha: null });
     const seen = new Set();
     for (const t of templates) {
-        if (seen.has(t.digest))
+        const file = templateFile(t.digest, t.encoding);
+        if (seen.has(file))
             continue;
-        seen.add(t.digest);
-        if ((await readPathSha(`${RELEASES_DIR}/${TEMPLATES_SUBDIR}`, templateFile(t.digest), opts)) !== null)
+        seen.add(file);
+        if ((await readPathSha(`${RELEASES_DIR}/${TEMPLATES_SUBDIR}`, file, opts)) !== null)
             continue;
-        files.push({ path: `${dir}/${TEMPLATES_SUBDIR}/${templateFile(t.digest)}`, content: t.content, expectPriorSha: null });
+        files.push({ path: `${dir}/${TEMPLATES_SUBDIR}/${file}`, content: t.content, expectPriorSha: null });
     }
     if (files.length === 0)
         return { commit: null, written: false };
@@ -166,7 +188,12 @@ export function parseRelease(text) {
         r.targets.every((t) => t &&
             typeof t.env === "string" &&
             Array.isArray(t.templates) &&
-            t.templates.every((x) => x && (x.component === null || typeof x.component === "string") && typeof x.path === "string" && typeof x.digest === "string") &&
+            t.templates.every((x) => x &&
+                (x.component === null || typeof x.component === "string") &&
+                typeof x.path === "string" &&
+                typeof x.digest === "string" &&
+                (x.encoding === undefined || x.encoding === "base64")) &&
+            (t.trees === undefined || (Array.isArray(t.trees) && t.trees.every((x) => x && (x.component === null || typeof x.component === "string") && typeof x.path === "string"))) &&
             Array.isArray(t.params) &&
             t.params.every((p) => p && typeof p.name === "string" && ["string", "number", "boolean"].includes(typeof p.value) && typeof p.source === "string"));
     return ok ? r : null;
@@ -297,9 +324,9 @@ export async function appendCut(input, opts) {
     }
     throw lastErr;
 }
-/** A template's bytes by digest, or null when none is stored. */
-export async function readReleaseTemplate(digest, opts) {
-    return readBlobFromPath(`${RELEASES_DIR}/${TEMPLATES_SUBDIR}`, templateFile(digest), opts);
+/** A template's bytes by digest, or null when none is stored. Under `base64` (#4155), the stored base64 of the bytes. */
+export async function readReleaseTemplate(digest, opts, encoding) {
+    return readBlobFromPath(`${RELEASES_DIR}/${TEMPLATES_SUBDIR}`, templateFile(digest, encoding), opts);
 }
 /**
  * Find a release by its digest or its label. Null when neither names one.

package/dist/lifecycle/run-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAA+C,MAAM,eAAe,CAAC;AASrI,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjC,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,CAiDlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCxD"}
+{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAA+C,MAAM,eAAe,CAAC;AASrI,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjC,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,CAkDlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCxD"}

package/dist/lifecycle/run-ledger.js

@@ -91,6 +91,7 @@ export function buildRunRecord(config, records, times) {
             ...(record.point ? { point: record.point } : {}),
             ...(record.gate ? { gate: record.gate } : {}),
             ...(record.resumed ? { resumed: record.resumed } : {}),
+            ...(record.fn === "shellCmd" && typeof record.args?.image === "string" ? { image: record.args.image } : {}),
         });
         if (record.outcome)
             outcomes[record.outcome.name] = record.outcome.value;

package/dist/lint/rules/op/index.d.ts

@@ -16,6 +16,7 @@ export { ops014 } from "./ops014-converge-rule-refusals.js";
 export { ops015 } from "./ops015-gate-approval.js";
 export { ops016 } from "./ops016-gate-resume.js";
 export { ops017, ops017Check, workspaceIdentityGates } from "./ops017-gate-alias.js";
+export { ops018 } from "./ops018-shell-image-digest.js";
 export { sys010, sys010Check } from "./sys010-key-over-plain-http.js";
 export interface CoreOpCheckOptions {
     /** `decide.backends` from the project's chant.config, for SYS010 (#2828). */
@@ -25,7 +26,7 @@ export interface CoreOpCheckOptions {
 }
 /**
  * Core's own post-synth checks over the Op model: OPS012, OPS013, OPS014,
- * OPS015, OPS016, OPS017 over the workspace's `identity.gates`, and SYS010
+ * OPS015, OPS016, OPS017 over the workspace's `identity.gates`, OPS018, and SYS010
  * over the `decide` steps and the configured decide backends.
  */
 export declare function coreOpChecks(opts?: CoreOpCheckOptions): PostSynthCheck[];

package/dist/lint/rules/op/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAQvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;IACpE,6GAA6G;IAC7G,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,kBAAuB,GAAG,cAAc,EAAE,CAE5E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AASvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;IACpE,6GAA6G;IAC7G,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,kBAAuB,GAAG,cAAc,EAAE,CAE5E"}

package/dist/lint/rules/op/index.js

@@ -14,6 +14,7 @@ import { ops014 } from "./ops014-converge-rule-refusals.js";
 import { ops015 } from "./ops015-gate-approval.js";
 import { ops016 } from "./ops016-gate-resume.js";
 import { ops017Check } from "./ops017-gate-alias.js";
+import { ops018 } from "./ops018-shell-image-digest.js";
 import { sys010Check } from "./sys010-key-over-plain-http.js";
 export { ops012 } from "./ops012-activity-contract.js";
 export { ops013 } from "./ops013-step-output-ref.js";
@@ -21,12 +22,13 @@ export { ops014 } from "./ops014-converge-rule-refusals.js";
 export { ops015 } from "./ops015-gate-approval.js";
 export { ops016 } from "./ops016-gate-resume.js";
 export { ops017, ops017Check, workspaceIdentityGates } from "./ops017-gate-alias.js";
+export { ops018 } from "./ops018-shell-image-digest.js";
 export { sys010, sys010Check } from "./sys010-key-over-plain-http.js";
 /**
  * Core's own post-synth checks over the Op model: OPS012, OPS013, OPS014,
- * OPS015, OPS016, OPS017 over the workspace's `identity.gates`, and SYS010
+ * OPS015, OPS016, OPS017 over the workspace's `identity.gates`, OPS018, and SYS010
  * over the `decide` steps and the configured decide backends.
  */
 export function coreOpChecks(opts = {}) {
-    return [ops012, ops013, ops014, ops015, ops016, ops017Check(opts.identityGates), sys010Check(opts.decideBackends)];
+    return [ops012, ops013, ops014, ops015, ops016, ops017Check(opts.identityGates), ops018, sys010Check(opts.decideBackends)];
 }

package/dist/lint/rules/op/ops018-shell-image-digest.d.ts

@@ -0,0 +1,10 @@
+/**
+ * OPS018: a `shellCmd` step that runs in a container (#4015) names its image
+ * pinned by digest, `<ref>@sha256:<digest>`, as a literal string. A tag can
+ * move between two runs of the same Op, and then the step record's image no
+ * longer says what ran. Checked over the main phases, `onFailure`, and the
+ * steps inside an effect.
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+export declare const ops018: PostSynthCheck;
+//# sourceMappingURL=ops018-shell-image-digest.d.ts.map

package/dist/lint/rules/op/ops018-shell-image-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops018-shell-image-digest.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/ops018-shell-image-digest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AAW9F,eAAO,MAAM,MAAM,EAAE,cA6BpB,CAAC"}