@intentius/chant 0.124.33 → 0.124.34

package/dist/workspace/__fixtures__/contract-repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-repo.d.ts","sourceRoot":"","sources":["../../../src/workspace/__fixtures__/contract-repo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,OAAO,MAAM,eAAe,CAAC;AAGpC,6CAA6C;AAC7C,eAAO,MAAM,IAAI,QAAwE,CAAC;AAI1F,gGAAgG;AAChG,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED,wBAAgB,UAAU,CAAC,MAAM,SAAoB,GAAG,MAAM,CAI7D;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAM1D;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAO7G;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,MAAM,UAAQ,GAAG,MAAM,CAS3G;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,MAAM,EAAE,MAAM,SAAyB,GAAG,MAAM,MAAM,CAQ9F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAS,GAAG,MAAM,CAIhE;AAED,QAAA,MAAM,GAAG,SAAiD,CAAC;AAE3D,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IAAC,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAStH;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,eAAO,MAAM,WAAW,YAAa,OAAO,EAAE,UAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACL,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,6XAU5B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,sZASjC,CAAC"}
+{"version":3,"file":"contract-repo.d.ts","sourceRoot":"","sources":["../../../src/workspace/__fixtures__/contract-repo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,OAAO,MAAM,eAAe,CAAC;AAGpC,6CAA6C;AAC7C,eAAO,MAAM,IAAI,QAAwE,CAAC;AAI1F,gGAAgG;AAChG,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED,wBAAgB,UAAU,CAAC,MAAM,SAAoB,GAAG,MAAM,CAI7D;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAM1D;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAO7G;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,MAAM,UAAQ,GAAG,MAAM,CAS3G;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,MAAM,EAAE,MAAM,SAAyB,GAAG,MAAM,MAAM,CAiB9F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAS,GAAG,MAAM,CAIhE;AAED,QAAA,MAAM,GAAG,SAAiD,CAAC;AAE3D,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IAAC,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAStH;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,eAAO,MAAM,WAAW,YAAa,OAAO,EAAE,UAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACL,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,6XAU5B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,sZASjC,CAAC"}

package/dist/workspace/__fixtures__/contract-repo.js

@@ -22,7 +22,7 @@ export function scratchDir(prefix = "chant-contract-") {
     return d;
 }
 export function git(cwd, ...args) {
-    return execFileSync("git", ["-c", "user.name=t", "-c", "user.email=t@example.com", "-c", "commit.gpgsign=false", ...args], {
+    return execFileSync("git", ["-c", "user.name=t", "-c", "user.email=t@example.com", "-c", "commit.gpgsign=false", "-c", "gc.auto=0", "-c", "maintenance.auto=false", ...args], {
         cwd,
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"],
@@ -61,7 +61,18 @@ export function repoFixture(build, prefix = "chant-contract-copy-") {
         if (template === undefined || !existsSync(template))
             template = build();
         const root = scratchDir(prefix);
-        cpSync(template, root, { recursive: true });
+        // A commit can leave a detached `git gc --auto` or maintenance run moving
+        // the template's objects, and a copy that meets it fails with ENOENT on
+        // .git/objects. Copy once more after it settles.
+        try {
+            cpSync(template, root, { recursive: true });
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+            rmSync(root, { recursive: true, force: true });
+            cpSync(template, root, { recursive: true });
+        }
         return root;
     };
 }

package/dist/workspace/check.schema.json

@@ -332,7 +332,16 @@
 
             "security-runner-start-no-role",
 
-            "security-trust-unreadable"
+            "security-trust-unreadable",
+            "ci-workflow-green-undeclared",
+            "ci-workflow-no-pre-merge",
+            "ci-workflow-apply-in-green",
+            "ci-workflow-no-components",
+            "ci-workflow-no-environments",
+            "ci-workflow-ungated-env",
+            "ci-workflow-pipeline-missing",
+            "ci-workflow-pipeline-differs",
+            "ci-workflow-publish-missing"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         }
@@ -445,7 +454,16 @@
 
             "security-runner-start-no-role",
 
-            "security-trust-unreadable"
+            "security-trust-unreadable",
+            "ci-workflow-green-undeclared",
+            "ci-workflow-no-pre-merge",
+            "ci-workflow-apply-in-green",
+            "ci-workflow-no-components",
+            "ci-workflow-no-environments",
+            "ci-workflow-ungated-env",
+            "ci-workflow-pipeline-missing",
+            "ci-workflow-pipeline-differs",
+            "ci-workflow-publish-missing"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         },

package/dist/workspace/checks/ci-workflow.d.ts

@@ -0,0 +1,17 @@
+/**
+ * WSP151 (#4168 step 6): what a member under `ci.workflow` still lacks.
+ *
+ * A declaration that names no workflow gets no finding from this file. The
+ * requirements and their codes are {@link CI_WORKFLOW_REQUIREMENTS}
+ * (../ci-workflow.ts). Like the security checklists (./security.ts), the
+ * check reads files and never runs them: `chant.config.ts` for the
+ * environments (its literal `environments`, as `workspace status` reads it),
+ * `*.component.ts` for components and gates, and the forge pipeline files for
+ * the jobs. A generated file that differs from what its generator writes is
+ * WSP101 to WSP106's to report; this check asks only whether the jobs the
+ * workflow needs are there.
+ */
+import type { WorkspaceCheck } from "../checks.js";
+export declare const WSP_CI_WORKFLOW = "WSP151";
+export declare const CI_WORKFLOW_CHECKS: readonly WorkspaceCheck[];
+//# sourceMappingURL=ci-workflow.d.ts.map

package/dist/workspace/checks/ci-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/ci-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAQrE,eAAO,MAAM,eAAe,WAAW,CAAC;AAaxC,eAAO,MAAM,kBAAkB,EAAE,SAAS,cAAc,EA6FvD,CAAC"}

package/dist/workspace/checks/ci-workflow.js

@@ -0,0 +1,123 @@
+/**
+ * WSP151 (#4168 step 6): what a member under `ci.workflow` still lacks.
+ *
+ * A declaration that names no workflow gets no finding from this file. The
+ * requirements and their codes are {@link CI_WORKFLOW_REQUIREMENTS}
+ * (../ci-workflow.ts). Like the security checklists (./security.ts), the
+ * check reads files and never runs them: `chant.config.ts` for the
+ * environments (its literal `environments`, as `workspace status` reads it),
+ * `*.component.ts` for components and gates, and the forge pipeline files for
+ * the jobs. A generated file that differs from what its generator writes is
+ * WSP101 to WSP106's to report; this check asks only whether the jobs the
+ * workflow needs are there.
+ */
+import { appliesOnMerge, STUB_MARKER, workflowOf } from "../ci-workflow.js";
+import { matchesCheckRun } from "../ci-green.js";
+import { staticPromotionOrder } from "../promotion-order.js";
+import { joinPath } from "../tree.js";
+import { allPipelineFiles, commandLines, componentFiles, read } from "./security.js";
+export const WSP_CI_WORKFLOW = "WSP151";
+const memberDir = (dir) => (dir === "." ? "" : dir);
+const PLAN = /\bci\s+run\s+plan\b|\bcomponents\s+pr-plan\b/;
+const RECORD = /\bci\s+run\s+record\b|\bcomponents\s+pr-record\b/;
+const APPLY = /\bci\s+run\s+apply\b|\bcomponents\s+pr-apply\b/;
+const TICK = /\bci\s+tick\b/;
+const PUBLISH = /\brelease\s+publish\b/;
+/** The apply job names a required phase could match. */
+const APPLY_JOB_NAMES = ["apply", "pr-apply"];
+export const CI_WORKFLOW_CHECKS = [
+    {
+        id: WSP_CI_WORKFLOW,
+        name: "ci-workflow",
+        description: "Under ci.workflow: ci.green with pre-merge phases and no apply job required, each member with a component, environments and a gate on each component, and pipeline files that plan, record (or apply under apply on merge), tick and publish.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            const under = d.members
+                .map((m) => ({ member: m, workflow: workflowOf(d, m) }))
+                .filter((u) => u.workflow !== null)
+                // The top level's workflow covers the members that build with chant; a member that names one itself is held to it.
+                .filter((u) => u.member.ciWorkflow !== null || ctx.tree.stat(joinPath(memberDir(u.member.dir), "chant.config.ts")) === "file");
+            if (under.length === 0 && !d.ci?.workflow)
+                return [];
+            const pointer = d.ci?.workflow ? "/ci/workflow" : `${under[0].member.pointer}/ci/workflow`;
+            const out = [];
+            const finding = (code, message, at = {}) => {
+                out.push({
+                    checkId: this.id,
+                    severity: this.severity,
+                    code,
+                    message: `${code}: ${message}`,
+                    pointer: at.pointer ?? pointer,
+                    ...(at.entity !== undefined ? { entity: at.entity } : {}),
+                    ...(at.treeFile !== undefined ? { treeFile: at.treeFile, line: at.line ?? 1, column: 1 } : {}),
+                });
+            };
+            const green = d.ci?.green ?? null;
+            if (!green) {
+                finding("ci-workflow-green-undeclared", "the workspace follows a ci.workflow and declares no ci.green, so no commit gets a verdict and no release can be cut; run chant ci init or add a ci.green block");
+            }
+            else {
+                if ((green.preMerge ?? []).length === 0) {
+                    finding("ci-workflow-no-pre-merge", "ci.green.preMerge names no phase, so nothing says which checks run before the branch moves; name the quick ones", { pointer: green.pointer });
+                }
+                for (const name of green.require) {
+                    const phase = green.phases.find((p) => p.name === name);
+                    const hit = phase?.runs.find((pattern) => APPLY_JOB_NAMES.some((job) => matchesCheckRun(pattern, job)));
+                    if (phase && hit) {
+                        finding("ci-workflow-apply-in-green", `the required phase ${name} matches the apply job with ${JSON.stringify(hit)}, so an apply that waits for a green commit would wait on itself; drop the pattern`, { pointer: phase.pointer });
+                    }
+                }
+            }
+            for (const { member } of under) {
+                const dir = memberDir(member.dir);
+                const components = componentFiles(ctx.tree, dir);
+                if (components.length === 0) {
+                    finding("ci-workflow-no-components", `member ${member.name} declares no component, so nothing of it can be cut or promoted; chant ci init writes a stub`, { pointer: member.pointer, entity: member.name });
+                }
+                else if (components.every((f) => (read(ctx.tree, f) ?? "").includes(STUB_MARKER))) {
+                    finding("ci-workflow-no-components", `member ${member.name}'s only component is the stub chant ci init wrote (${components[0]}); say how it is built and deployed, then delete its ${STUB_MARKER} line`, { pointer: member.pointer, entity: member.name, treeFile: components[0] });
+                }
+                const configPath = joinPath(dir, "chant.config.ts");
+                const config = read(ctx.tree, configPath);
+                // A config whose environments aren't literals can't be read without running it; say nothing rather than guess.
+                const order = config === null ? [] : staticPromotionOrder(config);
+                if (order !== undefined && order.length === 0) {
+                    finding("ci-workflow-no-environments", `member ${member.name}'s chant.config.ts declares no environments, so a release has nowhere to be promoted to`, { pointer: member.pointer, entity: member.name, ...(config !== null ? { treeFile: configPath } : {}) });
+                }
+                for (const file of components) {
+                    const text = read(ctx.tree, file) ?? "";
+                    if (/\bgate\s*\(|kind\s*:\s*["']gate["']/.test(text))
+                        continue;
+                    const last = order && order.length > 0 ? order[order.length - 1].name : "the last environment";
+                    finding("ci-workflow-ungated-env", `${file} has no gate, so a promote to ${last} waits on no approval; add a gate() step`, { pointer: member.pointer, entity: member.name, treeFile: file });
+                }
+            }
+            const files = allPipelineFiles(ctx);
+            const has = (re) => files.some((f) => f.lines.some((l) => re.test(l)));
+            const applyOnMerge = under.some((u) => appliesOnMerge(u.workflow)) || (d.ci?.workflow ? appliesOnMerge(d.ci.workflow) : false);
+            const missing = [
+                ...(has(PLAN) ? [] : ["a plan job (ci run plan)"]),
+                ...(has(RECORD) || has(APPLY) ? [] : [applyOnMerge ? "an apply job (ci run apply)" : "a record job (ci run record)"]),
+                ...(has(TICK) ? [] : ["chant ci tick"]),
+            ];
+            if (missing.length > 0) {
+                finding("ci-workflow-pipeline-missing", `no pipeline file runs ${missing.join(", ")}; generate them with chant build --components --generate <forge> --pr-loop and chant ci workflow`);
+            }
+            if (!applyOnMerge) {
+                for (const l of commandLines(ctx, APPLY)) {
+                    finding("ci-workflow-pipeline-differs", `${l.path} applies on merge, and the workflow is trunk-curated, where a merge records the plan and deploys nothing; regenerate without --apply-on-merge, or set ci.workflow to trunk-curated+apply-on-merge`, { treeFile: l.path, line: l.line });
+                }
+            }
+            else if (!has(APPLY) && has(RECORD)) {
+                const l = commandLines(ctx, RECORD)[0];
+                finding("ci-workflow-pipeline-differs", `${l.path} records on merge, and the workflow is trunk-curated+apply-on-merge; regenerate with --apply-on-merge`, { treeFile: l.path, line: l.line });
+            }
+            if (!has(PUBLISH)) {
+                finding("ci-workflow-publish-missing", "no pipeline file runs chant release publish, so a cut release is never published; generate one with chant release workflow");
+            }
+            return out;
+        },
+    },
+];

package/dist/workspace/checks/security.d.ts

@@ -23,7 +23,8 @@
  * pipeline file that runs `chant release publish`, `chant ci tick` or
  * `chant components pr-apply`.
  */
-import type { WorkspaceCheck } from "../checks.js";
+import type { WorkspaceCheck, WorkspaceCheckContext } from "../checks.js";
+import { type WorkspaceTree } from "../tree.js";
 /** The read contract's codes for the security findings, carried as `code` on each. */
 export declare const SECURITY_FINDING_CODES: readonly ["security-signers-missing", "security-release-gate-missing", "security-publish-allows-unsigned", "security-sbom-disabled", "security-sbom-unsourced", "security-publish-no-provenance", "security-component-no-sbom", "security-component-no-verify", "security-signed-since-unset", "security-runner-untrusted", "security-tick-no-key", "security-review-not-required", "security-attribution-any", "security-gate-unsigned", "security-runner-start-no-key", "security-runner-start-no-role", "security-trust-unreadable"];
 export declare const WSP_SECURITY_VERIFIED_RELEASES = "WSP161";
@@ -31,5 +32,19 @@ export declare const WSP_SECURITY_SUPPLY_CHAIN = "WSP162";
 export declare const WSP_SECURITY_WHO_RAN_IT = "WSP163";
 export declare const WSP_SECURITY_REVIEW_RULES = "WSP164";
 export declare const WSP_SECURITY_ISOLATED_RUNNERS = "WSP165";
+export declare function read(tree: WorkspaceTree, path: string): string | null;
+/** Every pipeline file of the workspace: its root's, and each member's. */
+export declare function allPipelineFiles(ctx: WorkspaceCheckContext): {
+    path: string;
+    lines: string[];
+}[];
+/** The lines of the pipeline files that run a chant command, `command` naming it, such as `release publish`. */
+export declare function commandLines(ctx: WorkspaceCheckContext, command: RegExp): {
+    path: string;
+    line: number;
+    text: string;
+}[];
+/** The member's `*.component.ts` files, walked a few levels down, past node_modules and build output. */
+export declare function componentFiles(tree: WorkspaceTree, dir: string, depth?: number): string[];
 export declare const SECURITY_CHECKS: readonly WorkspaceCheck[];
 //# sourceMappingURL=security.d.ts.map

package/dist/workspace/checks/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAA8C,MAAM,WAAW,CAAC;AAU5F,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,ygBAkBO,CAAC;AAI3C,eAAO,MAAM,8BAA8B,WAAW,CAAC;AACvD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAChD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,6BAA6B,WAAW,CAAC;AA0GtD,eAAO,MAAM,eAAe,EAAE,SAAS,cAAc,EAuIpD,CAAC"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAuB,MAAM,WAAW,CAAC;AAI5F,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAMvD,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,ygBAkBO,CAAC;AAI3C,eAAO,MAAM,8BAA8B,WAAW,CAAC;AACvD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAChD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,6BAA6B,WAAW,CAAC;AAsBtD,wBAAgB,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOrE;AAkBD,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,CAGhG;AAED,gHAAgH;AAChH,wBAAgB,YAAY,CAAC,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAExH;AAED,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,MAAM,EAAE,CAQpF;AAuCD,eAAO,MAAM,eAAe,EAAE,SAAS,cAAc,EAuIpD,CAAC"}

package/dist/workspace/checks/security.js

@@ -70,7 +70,7 @@ function groupPointer(declaration, group) {
     const m = declaration.members.find((e) => e.security.includes(group));
     return m ? `${m.pointer}/security/${m.security.indexOf(group)}` : "/security";
 }
-function read(tree, path) {
+export function read(tree, path) {
     if (tree.stat(path) !== "file")
         return null;
     try {
@@ -99,16 +99,16 @@ function pipelineFiles(tree, dir) {
     return out;
 }
 /** Every pipeline file of the workspace: its root's, and each member's. */
-function allPipelineFiles(ctx) {
+export function allPipelineFiles(ctx) {
     const dirs = new Set(["", ...ctx.declaration.members.map((m) => memberDir(m.dir))]);
     return [...dirs].flatMap((d) => pipelineFiles(ctx.tree, d));
 }
 /** The lines of the pipeline files that run a chant command, `command` naming it, such as `release publish`. */
-function commandLines(ctx, command) {
+export function commandLines(ctx, command) {
     return allPipelineFiles(ctx).flatMap((f) => f.lines.flatMap((text, i) => (command.test(text) ? [{ path: f.path, line: i + 1, text }] : [])));
 }
 /** The member's `*.component.ts` files, walked a few levels down, past node_modules and build output. */
-function componentFiles(tree, dir, depth = 4) {
+export function componentFiles(tree, dir, depth = 4) {
     const out = [];
     for (const e of tree.list(dir) ?? []) {
         if (e.type === "dir") {

package/dist/workspace/checks.d.ts

@@ -37,7 +37,7 @@
  * | WSP126, WSP127 | box intent: the decision record a box names exists, and constrains a member or path of this workspace (#2850, #2857) |
  * | WSP141, WSP142 | member links resolved against a live read, with `--live` (#2549) |
  * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
- * | WSP151 | reserved for the `ci.workflow` preset (#4168 step 6) |
+ * | WSP151 | what a member under `ci.workflow` still lacks (#4168 step 6) |
  * | WSP161 to WSP165 | the security groups the declaration opts into: what each still lacks (#4168 step 7) |
  */
 import type { LintDiagnostic, LintRule, Severity } from "../lint/rule.js";

package/dist/workspace/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAInE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAmMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAKnE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAqMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}

package/dist/workspace/checks.js

@@ -37,7 +37,7 @@
  * | WSP126, WSP127 | box intent: the decision record a box names exists, and constrains a member or path of this workspace (#2850, #2857) |
  * | WSP141, WSP142 | member links resolved against a live read, with `--live` (#2549) |
  * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
- * | WSP151 | reserved for the `ci.workflow` preset (#4168 step 6) |
+ * | WSP151 | what a member under `ci.workflow` still lacks (#4168 step 6) |
  * | WSP161 to WSP165 | the security groups the declaration opts into: what each still lacks (#4168 step 7) |
  */
 import { realpathSync } from "node:fs";
@@ -56,6 +56,7 @@ import { RECORD_CHECKS } from "./checks/records.js";
 import { BOX_CHECKS } from "./checks/boxes.js";
 import { DIAGRAM_CHECKS } from "./checks/diagrams.js";
 import { SECURITY_CHECKS } from "./checks/security.js";
+import { CI_WORKFLOW_CHECKS } from "./checks/ci-workflow.js";
 import { loadDeclaredKinds } from "./declared-kinds.js";
 import { resolveBoxIntents } from "./box-intent.js";
 import { gatherLexiconOutputs } from "./lexicon-outputs.js";
@@ -273,6 +274,8 @@ export const WORKSPACE_CHECKS = [
     ...DIAGRAM_CHECKS,
     // Links resolved against a live read, with --live (#2549), WSP141 and WSP142.
     ...LIVE_CHECKS,
+    // What a member under ci.workflow still lacks (#4168 step 6), WSP151.
+    ...CI_WORKFLOW_CHECKS,
     // The security groups the declaration opts into (#4168 step 7), WSP161 to WSP165.
     ...SECURITY_CHECKS,
 ];

package/dist/workspace/ci-init.d.ts

@@ -0,0 +1,100 @@
+/**
+ * `chant ci init --workflow <name> [--forge <forge>] [--security <group>]...
+ * [--yes]` (#4168 step 6, section 9): set a workspace up for a prescribed
+ * delivery workflow (../ci-workflow.ts).
+ *
+ * It proposes, prints the proposal as a diff, and writes only on `--yes` or a
+ * yes at the prompt. What it proposes comes from what `workspace check`'s
+ * WSP151 reports for the workspace as it would be with `ci.workflow` set, so
+ * a second run proposes only what is still missing, and nothing once the
+ * workspace has it all.
+ *
+ * - The declaration gains `ci.workflow`, a `ci.green` block when it has none
+ *   (one phase per GitHub workflow, its jobs as the check runs, and the
+ *   workflows a pull request runs as `preMerge`), and `preMerge` when the
+ *   block has none. `--security` adds groups to the top-level `security`;
+ *   without it no group is turned on, and the groups are listed.
+ * - A member that builds with chant and declares no component gets a
+ *   `<member>.component.ts` stub with a gate and a TODO line, which WSP151
+ *   keeps reporting until someone fills the stub in. A `chant.config.ts`
+ *   that declares no environments gains `environments: ["staging", "prod"]`
+ *   when its default export is a plain object literal.
+ * - The generated files are written by the generators that own them, run
+ *   after the edits: `chant build --components --generate <forge> --pr-loop`
+ *   in each member, `chant ci workflow` for the tick, and `chant release
+ *   workflow` for the publish job. Each is named in the proposal before it
+ *   runs.
+ *
+ * It never edits a file the diff did not show, and never overwrites a file
+ * it proposed to create that appeared in the meantime.
+ */
+import type { CommandContext } from "../cli/registry.js";
+import type { WorkspaceDiagnostic } from "./checks.js";
+import { STUB_MARKER } from "./ci-workflow.js";
+export { STUB_MARKER };
+import { type CiWorkflow } from "./declaration.js";
+import { type SecurityGroup } from "./security.js";
+import { type ReleaseWorkflowForge } from "./release-workflow.js";
+/** The environments a config with none is given. */
+export declare const DEFAULT_ENVIRONMENTS: readonly ["staging", "prod"];
+/** One file the proposal writes: created when `before` is null. */
+export interface ProposedFile {
+    path: string;
+    before: string | null;
+    after: string;
+}
+/** A generator the proposal runs after the edits, in `cwd` (relative to the workspace root). */
+export interface ProposedCommand {
+    cwd: string;
+    args: string[];
+    why: string;
+}
+export interface CiInitProposal {
+    files: ProposedFile[];
+    commands: ProposedCommand[];
+    /** What the proposal leaves to a person, such as a component with no gate. */
+    notes: string[];
+    /** The WSP151 findings the proposal answers. */
+    findings: WorkspaceDiagnostic[];
+}
+export interface CiInitOptions {
+    workflow: CiWorkflow;
+    forge?: ReleaseWorkflowForge;
+    security?: readonly SecurityGroup[];
+}
+/** The forge whose pipeline files the repository has, or null. */
+export declare function inferForge(repoRoot: string): ReleaseWorkflowForge | null;
+/** The branch `origin/HEAD` names, else `main`. */
+export declare function inferTrunk(repoRoot: string): string;
+/**
+ * A `ci.green` block from the repository's GitHub workflows: a phase per
+ * workflow holding its jobs' check runs, all required, and those a pull
+ * request runs as `preMerge`. chant's own generated workflows are left out.
+ */
+export declare function inferGreen(repoRoot: string): {
+    branch: string;
+    phases: Record<string, string[]>;
+    require: string[];
+    preMerge: string[];
+};
+/**
+ * The declaration's text with `next`'s top-level keys. A key the file lacks
+ * is added as text before the closing brace, so the rest keeps its layout; a
+ * key it has whose value changes rewrites the file, two-space indented.
+ */
+export declare function editDeclarationText(text: string, raw: Record<string, unknown>, next: Record<string, unknown>): string;
+/** The component stub for a member that declares none: a gate and a TODO, so WSP151 keeps asking until it is filled in. */
+export declare function componentStub(member: string, lastEnvironment: string): string;
+/** The config with `environments` added after `export default {`, or null when its default export is not a plain object literal. */
+export declare function withEnvironments(config: string, environments?: readonly string[]): string | null;
+/**
+ * What `chant ci init` would write for the workspace at `root`, and the
+ * generators it would run. Reads only; {@link applyCiInit} writes.
+ */
+export declare function proposeCiInit(root: string, options: CiInitOptions): CiInitProposal;
+/** A unified-style diff of two texts, for the proposal. Line-based, from their longest common subsequence. */
+export declare function lineDiff(path: string, before: string | null, after: string): string;
+/** Write the proposal's files. A file it would create that now exists is refused, and nothing is written. */
+export declare function applyCiInit(root: string, proposal: CiInitProposal): string[];
+export declare function runCiInit(ctx: CommandContext): Promise<number>;
+//# sourceMappingURL=ci-init.d.ts.map

package/dist/workspace/ci-init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-init.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAItD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAgB,WAAW,EAAkB,MAAM,eAAe,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,CAAC;AAGvB,OAAO,EAAyD,KAAK,UAAU,EAAoB,MAAM,eAAe,CAAC;AAEzH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAA2B,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAKxF,oDAAoD;AACpD,eAAO,MAAM,oBAAoB,YAAI,SAAS,EAAE,MAAM,CAAU,CAAC;AAEjE,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gGAAgG;AAChG,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CACrC;AAMD,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAKxE;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAInD;AAWD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBxI;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAerH;AASD,2HAA2H;AAC3H,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAgB7E;AAED,oIAAoI;AACpI,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,GAAE,SAAS,MAAM,EAAyB,GAAG,MAAM,GAAG,IAAI,CAKtH;AAgBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,cAAc,CAqFlF;AAED,8GAA8G;AAC9G,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAmCnF;AAED,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,MAAM,EAAE,CAO5E;AAoBD,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2EpE"}