@intentius/chant 0.124.39 → 0.124.41

package/dist/op/cron.js

@@ -144,3 +144,54 @@ export function cronDueBetween(expr, after, upTo) {
     }
     return false;
 }
+/**
+ * The minutes `expr` fires at in `(after, upTo]`, read in UTC as GitHub,
+ * GitLab and Forgejo read a CI cron, at most `max` of them (#4289). The
+ * plan job counts these to tell a schedule that stopped from one that ran
+ * late. A 6-field expression drops its seconds field, as {@link cronMatches}
+ * does, and an expression that is not 5 or 6 fields fires never.
+ */
+export function cronFiresUtc(expr, after, upTo, max) {
+    const fields = expr.trim().split(/\s+/);
+    const five = fields.length === 6 ? fields.slice(1) : fields;
+    if (five.length !== 5)
+        return [];
+    const minute = parseField(five[0], 0, 59);
+    const hour = parseField(five[1], 0, 23);
+    const dom = parseField(five[2], 1, 31);
+    const month = parseField(five[3], 1, 12);
+    const dow = parseField(five[4], 0, 7);
+    const dayMatches = (d) => {
+        const weekday = d.getUTCDay();
+        const domOk = fieldMatches(dom, d.getUTCDate());
+        const dowOk = fieldMatches(dow, weekday) || (weekday === 0 && fieldMatches(dow, 7));
+        if (dom.any && dow.any)
+            return true;
+        if (dom.any)
+            return dowOk;
+        if (dow.any)
+            return domOk;
+        return domOk || dowOk;
+    };
+    const out = [];
+    const t = new Date(Math.floor(after.getTime() / 60000) * 60000 + 60000);
+    while (t <= upTo && out.length < max) {
+        if (!fieldMatches(month, t.getUTCMonth() + 1)) {
+            t.setUTCMonth(t.getUTCMonth() + 1, 1);
+            t.setUTCHours(0, 0, 0, 0);
+        }
+        else if (!dayMatches(t)) {
+            t.setUTCDate(t.getUTCDate() + 1);
+            t.setUTCHours(0, 0, 0, 0);
+        }
+        else if (!fieldMatches(hour, t.getUTCHours())) {
+            t.setUTCHours(t.getUTCHours() + 1, 0, 0, 0);
+        }
+        else {
+            if (fieldMatches(minute, t.getUTCMinutes()))
+                out.push(new Date(t));
+            t.setTime(t.getTime() + 60000);
+        }
+    }
+    return out;
+}

package/dist/op/gate-approval.d.ts

@@ -5,7 +5,9 @@
  * more than that, as data that survives into the build output:
  *
  * - `quorum`: how many distinct human approvers the gate needs, and
- *   optionally which roles count toward it.
+ *   optionally which roles count toward it. Since #4290 it may be a list of
+ *   rules, each scoped by `targets` globs over the run's environment
+ *   (`./gate-quorum.ts`).
  * - `policy`: a policy set a lexicon rendered (the cedar lexicon's
  *   `gatePolicy()`), evaluated for each approval as a `PassGate` request.
  * - `mode`: `"log-only"` records the policy's decision next to the approval
@@ -30,11 +32,15 @@
  * decision also records the digest of the context it was asked about, and a
  * permit counts only while the run resolves that same context (#3774).
  *
- * The trust boundary is unchanged from `../lifecycle/gate-ledger.ts`: a
- * resolution is a local fact, not a signed one, and roles on it are what the
- * approver claimed.
+ * A resolution is a local fact, not a signed one (`../lifecycle/gate-ledger.ts`).
+ * Roles on it are what the approver claimed, and since #4290 the quorum
+ * never reads them: a role counts only when `.chant/trust.json` at base
+ * grants it and a seal proves the approver (`./gate-quorum.ts`). A policy
+ * still sees the claimed roles in its request.
  */
 import { type StepOutputRef } from "./step-output-ref.js";
+import { type GateQuorumRule, type GateQuorumSpec } from "./gate-quorum.js";
+export type { GateQuorumRule, GateQuorumSpec } from "./gate-quorum.js";
 /** What a policy's decision does to the gate. */
 export type GateApprovalMode = "log-only" | "enforce";
 export declare const GATE_APPROVAL_MODES: readonly GateApprovalMode[];
@@ -54,18 +60,18 @@ export interface GatePolicyRef {
     /** The policy set, in the lexicon's own language. */
     text: string;
 }
-/** How many distinct human approvers a gate needs, and which roles count. */
-export interface GateQuorum {
-    /** At least 1. */
-    count: number;
-    /** When set, only an approver holding one of these roles counts toward {@link GateQuorum.count}. */
-    roles?: string[];
-}
+/**
+ * How many distinct human approvers a gate needs, and which roles count: one
+ * approval rule (#4290, `./gate-quorum.ts`). A role counts only when
+ * `.chant/trust.json` at base grants it to a proven approver.
+ */
+export type GateQuorum = GateQuorumRule;
 /** A value a gate hands its policy as context. */
 export type GateContextValue = string | number | boolean | string[] | StepOutputRef;
 /** The `approval` block on a `gate` step. */
 export interface GateApproval {
-    quorum?: GateQuorum;
+    /** One rule, or a list of rules scoped by `targets` over the run's environment (#4290). */
+    quorum?: GateQuorumSpec;
     policy?: GatePolicyRef;
     /** Default `"log-only"`, so a new policy is observed against real gate traffic before it binds. */
     mode?: GateApprovalMode;
@@ -85,7 +91,8 @@ export interface GateApproval {
  * actually produced.
  */
 export interface ResolvedGateApproval {
-    quorum?: GateQuorum;
+    /** The rules this run's gate takes (#4290): a list, or one rule on a fact written before. */
+    quorum?: GateQuorumSpec;
     policy?: GatePolicyRef;
     mode: GateApprovalMode;
     context?: Record<string, unknown>;

package/dist/op/gate-approval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-approval.d.ts","sourceRoot":"","sources":["../../src/op/gate-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGxE,iDAAiD;AACjD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAAC;AAEtD,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAA4B,CAAC;AAExF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8HAA8H;IAC9H,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,MAAM,WAAW,UAAU;IACzB,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;AAEpF,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mGAAmG;IACnG,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uHAAuH;AACvH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzE,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,wDAAwD;IACxD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;CACrH;AAED,gJAAgJ;AAChJ,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAEtF;AASD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAUtE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAoEhE;AASD,sHAAsH;AACtH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB3F;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,iBAAiB,CAUpB"}
+{"version":3,"file":"gate-approval.d.ts","sourceRoot":"","sources":["../../src/op/gate-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzF,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpE,iDAAiD;AACjD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAAC;AAEtD,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAA4B,CAAC;AAExF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8HAA8H;IAC9H,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,CAAC;AAExC,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;AAEpF,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,2FAA2F;IAC3F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mGAAmG;IACnG,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,6FAA6F;IAC7F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uHAAuH;AACvH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzE,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,wDAAwD;IACxD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;CACrH;AAED,gJAAgJ;AAChJ,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAEtF;AASD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAUtE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAyDhE;AASD,sHAAsH;AACtH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB3F;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,iBAAiB,CAUpB"}

package/dist/op/gate-approval.js

@@ -5,7 +5,9 @@
  * more than that, as data that survives into the build output:
  *
  * - `quorum`: how many distinct human approvers the gate needs, and
- *   optionally which roles count toward it.
+ *   optionally which roles count toward it. Since #4290 it may be a list of
+ *   rules, each scoped by `targets` globs over the run's environment
+ *   (`./gate-quorum.ts`).
  * - `policy`: a policy set a lexicon rendered (the cedar lexicon's
  *   `gatePolicy()`), evaluated for each approval as a `PassGate` request.
  * - `mode`: `"log-only"` records the policy's decision next to the approval
@@ -30,14 +32,17 @@
  * decision also records the digest of the context it was asked about, and a
  * permit counts only while the run resolves that same context (#3774).
  *
- * The trust boundary is unchanged from `../lifecycle/gate-ledger.ts`: a
- * resolution is a local fact, not a signed one, and roles on it are what the
- * approver claimed.
+ * A resolution is a local fact, not a signed one (`../lifecycle/gate-ledger.ts`).
+ * Roles on it are what the approver claimed, and since #4290 the quorum
+ * never reads them: a role counts only when `.chant/trust.json` at base
+ * grants it and a seal proves the approver (`./gate-quorum.ts`). A policy
+ * still sees the claimed roles in its request.
  */
 import { createHash } from "node:crypto";
 import { lexiconModulePath, importLexiconPackage } from "../lexicon-module.js";
 import { isStepOutputRef } from "./step-output-ref.js";
 import { GATE_PLAN_CONTEXT_KEY } from "./gate-plan-context.js";
+import { quorumProblems } from "./gate-quorum.js";
 export const GATE_APPROVAL_MODES = ["log-only", "enforce"];
 /** The version of a gate policy: `sha256:` and the hex digest of its text. A lexicon's helper stamps it, and OPS015 checks it still matches. */
 export function gatePolicyVersion(text) {
@@ -79,20 +84,10 @@ export function gateApprovalProblems(approval) {
     const a = approval;
     const problems = [];
     if (a.quorum !== undefined) {
-        const q = a.quorum;
-        if (typeof q !== "object" || q === null) {
-            problems.push("`approval.quorum` must be an object");
-        }
-        else {
-            if (typeof q.count !== "number" || !Number.isInteger(q.count) || q.count < 1) {
-                problems.push("`approval.quorum.count` must be an integer of at least 1");
-            }
-            if (q.roles !== undefined) {
-                if (!Array.isArray(q.roles) || q.roles.length === 0 || q.roles.some((r) => typeof r !== "string" || r === "")) {
-                    problems.push("`approval.quorum.roles` must be a non-empty list of role names");
-                }
-            }
-        }
+        if (typeof a.quorum !== "object" || a.quorum === null)
+            problems.push("`approval.quorum` must be an object or a list of rules");
+        else
+            problems.push(...quorumProblems(a.quorum, "approval.quorum", { notAuthor: false }));
     }
     if (a.policy !== undefined) {
         if (!isGatePolicyRef(a.policy)) {

package/dist/op/gate-quorum.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Approval rules (#4290): a gate's quorum as a list of rules, each with the
+ * targets it covers, how many approvers it needs, the roles that count, and
+ * whether one of them must not be the change's author.
+ *
+ *   quorum: [
+ *     { targets: ["prod-*"], count: 2, roles: ["platform"], notAuthor: true },
+ *     { count: 1 },
+ *   ]
+ *
+ * A gate takes every rule whose `targets` glob matches one of its targets
+ * (a rule with no `targets` covers every target), and passes once each rule
+ * it takes is met by distinct human approvers of its plan. A gate that takes
+ * no rule needs one human approval, the rule every gate had before.
+ *
+ * Roles come from `.chant/trust.json` at base (`roles`: role name to the
+ * principals that hold it), never from the approver's own claim. An
+ * approver counts toward `roles`, and as someone who is not the author, only
+ * when the approval proves who they are: a seal that verifies against the
+ * signers file at base, or under `pr-review` the forge review of the merged
+ * pull request. The judge of a gate decides that ({@link GateQuorumJudge});
+ * with none, no approval proves anything, so a rule naming roles or
+ * `notAuthor` is never met.
+ *
+ * This module is pure: no git, no file reads, no package, so
+ * `@intentius/chant/gate-decision` bundles it. The judge is built by the
+ * caller from the trust policy it read at base ({@link trustQuorumJudge}).
+ */
+import { type GateSigners } from "../lifecycle/gate-seal.js";
+import type { GateResolutionRecord } from "../lifecycle/gate-ledger.js";
+/** One approval rule. */
+export interface GateQuorumRule {
+    /** Globs over the gate's targets (an Op wave's run targets, an Op gate's environment). Absent, the rule covers every target. */
+    targets?: string[];
+    /** Distinct human approvers the rule needs. At least 1. */
+    count: number;
+    /** When set, only an approver `.chant/trust.json` at base gives one of these roles counts, and only with a proven approval. */
+    roles?: string[];
+    /** When true, at least one counted approver is proven and is not the change's author. */
+    notAuthor?: boolean;
+}
+/** A gate's quorum: one rule (the form before #4290), or a list of them. */
+export type GateQuorumSpec = GateQuorumRule | readonly GateQuorumRule[];
+/** What a judge says about one approval. */
+export interface QuorumJudgement {
+    /** The approval proves who `resolvedBy` is: a verified seal, or the forge's review. */
+    proven: boolean;
+    /** The roles `.chant/trust.json` at base gives the approver. Empty unless `proven`. */
+    roles: string[];
+    /** Whether the approver is the change's author. Undefined when nobody knows who the author is. */
+    author?: boolean;
+}
+/** Judges one approval for the rules. */
+export type GateQuorumJudge = (approval: GateResolutionRecord) => QuorumJudgement;
+/** The judge with nothing to judge by: no approval proves anyone, and nobody's author is known. */
+export declare const UNPROVEN_JUDGE: GateQuorumJudge;
+/** How far one rule is met. */
+export interface GateQuorumRuleProgress {
+    targets?: string[];
+    count: number;
+    roles?: string[];
+    notAuthor?: boolean;
+    /** The approvers it counts, oldest first. */
+    approvers: string[];
+    met: boolean;
+    /** Why the author could not be told apart, when `notAuthor` is set and nobody knows the author. */
+    authorUnknown?: boolean;
+}
+/** The rules of a quorum, as a list. Absent, none. */
+export declare function quorumRules(quorum: GateQuorumSpec | undefined): GateQuorumRule[];
+/**
+ * Whether `target` matches `glob`: `*` within a `/` segment, `**` across
+ * segments (and `a/**\/b` across none), `?` one character. The same reading
+ * as the terraform lexicon's unit globs, so a Terragrunt root's glob means
+ * one thing in both.
+ */
+export declare function targetGlobMatch(glob: string, target: string): boolean;
+/** The rules a gate whose targets are `targets` takes: those with no `targets`, and those a glob of matches one. */
+export declare function quorumRulesFor(rules: readonly GateQuorumRule[], targets: readonly string[]): GateQuorumRule[];
+/** The most approvers any rule needs, 1 with none. */
+export declare function quorumNeed(rules: readonly GateQuorumRule[]): number;
+/**
+ * Everything wrong with a quorum, one line each. `where` names it
+ * (`approval.quorum`). With `notAuthor: false`, a rule naming `notAuthor` is
+ * refused, since that caller has no author to judge by.
+ */
+export declare function quorumProblems(value: unknown, where: string, opts: {
+    notAuthor: boolean;
+}): string[];
+/** Whether two principals name the same person, compared trimmed and lower-cased. */
+export declare const samePrincipal: (a: string, b: string) => boolean;
+/** The roles `roles` (`.chant/trust.json`'s role grants) gives `who`, sorted. */
+export declare function rolesOf(who: string, roles: Readonly<Record<string, readonly string[]>>): string[];
+/** One approver as a rule counts them. */
+export interface QuorumApprover {
+    who: string;
+    at: string;
+    judged: QuorumJudgement;
+}
+/** How far `rule` is met by `approvers`: each counted once, by name, oldest first. */
+export declare function quorumRuleProgress(rule: GateQuorumRule, approvers: readonly QuorumApprover[]): GateQuorumRuleProgress;
+/**
+ * Where a rule stands, in one line: `prod-*: 1 of 2 approvals (github:alice),
+ * needs 1 more from platform`.
+ */
+export declare function quorumRuleLine(p: GateQuorumRuleProgress): string;
+/** The rules that are not met, one line each joined by `; `. */
+export declare function quorumWaiting(progress: readonly GateQuorumRuleProgress[]): string;
+/** Whether a rule needs a proven approver: it names roles, or `notAuthor`. */
+export declare const ruleNeedsProof: (rule: GateQuorumRule) => boolean;
+/** What {@link trustQuorumJudge} judges by. */
+export interface TrustQuorumInput {
+    /** The signers at base: an approval whose seal verifies for its approver against them is proven. */
+    signers: GateSigners;
+    /** `.chant/trust.json`'s role grants at base. */
+    roles: Readonly<Record<string, readonly string[]>>;
+    /** The change's authors, as principals. Absent, nobody knows who they are. */
+    authors?: readonly string[];
+    /**
+     * Under `pr-review`, the merged pull request's review, read from the forge
+     * in this run: a resolution that names this review's head and one of its
+     * approvers as `resolvedBy` is proven.
+     */
+    review?: {
+        head: string;
+        approvers: readonly string[];
+    };
+}
+/** The judge a gate's rules are met by: proof from a seal or the live review, roles from trust.json at base. */
+export declare function trustQuorumJudge(input: TrustQuorumInput): GateQuorumJudge;
+//# sourceMappingURL=gate-quorum.d.ts.map

package/dist/op/gate-quorum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-quorum.d.ts","sourceRoot":"","sources":["../../src/op/gate-quorum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,yBAAyB;AACzB,MAAM,WAAW,cAAc;IAC7B,gIAAgI;IAChI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,+HAA+H;IAC/H,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,cAAc,EAAE,CAAC;AAExE,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kGAAkG;IAClG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,oBAAoB,KAAK,eAAe,CAAC;AAElF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,eAAsD,CAAC;AAEpF,+BAA+B;AAC/B,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,mGAAmG;IACnG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,EAAE,CAGhF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBrE;AAED,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,EAAE,CAE7G;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CA0BpG;AAID,qFAAqF;AACrF,eAAO,MAAM,aAAa,MAAO,MAAM,KAAK,MAAM,KAAG,OAA8B,CAAC;AAEpF,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAKjG;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,sBAAsB,CAoBrH;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAUhE;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,GAAG,MAAM,CAEjF;AAED,8EAA8E;AAC9E,eAAO,MAAM,cAAc,SAAU,cAAc,KAAG,OAAmE,CAAC;AAE1H,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,OAAO,EAAE,WAAW,CAAC;IACrB,iDAAiD;IACjD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACzD;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,CAYzE"}

package/dist/op/gate-quorum.js

@@ -0,0 +1,183 @@
+/**
+ * Approval rules (#4290): a gate's quorum as a list of rules, each with the
+ * targets it covers, how many approvers it needs, the roles that count, and
+ * whether one of them must not be the change's author.
+ *
+ *   quorum: [
+ *     { targets: ["prod-*"], count: 2, roles: ["platform"], notAuthor: true },
+ *     { count: 1 },
+ *   ]
+ *
+ * A gate takes every rule whose `targets` glob matches one of its targets
+ * (a rule with no `targets` covers every target), and passes once each rule
+ * it takes is met by distinct human approvers of its plan. A gate that takes
+ * no rule needs one human approval, the rule every gate had before.
+ *
+ * Roles come from `.chant/trust.json` at base (`roles`: role name to the
+ * principals that hold it), never from the approver's own claim. An
+ * approver counts toward `roles`, and as someone who is not the author, only
+ * when the approval proves who they are: a seal that verifies against the
+ * signers file at base, or under `pr-review` the forge review of the merged
+ * pull request. The judge of a gate decides that ({@link GateQuorumJudge});
+ * with none, no approval proves anything, so a rule naming roles or
+ * `notAuthor` is never met.
+ *
+ * This module is pure: no git, no file reads, no package, so
+ * `@intentius/chant/gate-decision` bundles it. The judge is built by the
+ * caller from the trust policy it read at base ({@link trustQuorumJudge}).
+ */
+import { gateSealRefusal } from "../lifecycle/gate-seal.js";
+/** The judge with nothing to judge by: no approval proves anyone, and nobody's author is known. */
+export const UNPROVEN_JUDGE = () => ({ proven: false, roles: [] });
+/** The rules of a quorum, as a list. Absent, none. */
+export function quorumRules(quorum) {
+    if (quorum === undefined)
+        return [];
+    return Array.isArray(quorum) ? [...quorum] : [quorum];
+}
+/**
+ * Whether `target` matches `glob`: `*` within a `/` segment, `**` across
+ * segments (and `a/**\/b` across none), `?` one character. The same reading
+ * as the terraform lexicon's unit globs, so a Terragrunt root's glob means
+ * one thing in both.
+ */
+export function targetGlobMatch(glob, target) {
+    const g = glob.replace(/\\/g, "/").replace(/\/+$/, "");
+    let re = "";
+    for (let i = 0; i < g.length; i++) {
+        const c = g[i];
+        if (c === "*" && g[i + 1] === "*") {
+            if (g[i + 2] === "/") {
+                re += "(?:.*/)?";
+                i += 2;
+            }
+            else {
+                re += ".*";
+                i += 1;
+            }
+        }
+        else if (c === "*")
+            re += "[^/]*";
+        else if (c === "?")
+            re += "[^/]";
+        else
+            re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+    return new RegExp(`^${re}$`).test(target.replace(/\\/g, "/").replace(/\/+$/, ""));
+}
+/** The rules a gate whose targets are `targets` takes: those with no `targets`, and those a glob of matches one. */
+export function quorumRulesFor(rules, targets) {
+    return rules.filter((r) => r.targets === undefined || r.targets.some((g) => targets.some((t) => targetGlobMatch(g, t))));
+}
+/** The most approvers any rule needs, 1 with none. */
+export function quorumNeed(rules) {
+    return rules.reduce((n, r) => Math.max(n, r.count), 1);
+}
+/**
+ * Everything wrong with a quorum, one line each. `where` names it
+ * (`approval.quorum`). With `notAuthor: false`, a rule naming `notAuthor` is
+ * refused, since that caller has no author to judge by.
+ */
+export function quorumProblems(value, where, opts) {
+    const list = Array.isArray(value) ? value : [value];
+    const problems = [];
+    if (Array.isArray(value) && value.length === 0)
+        problems.push(`\`${where}\` must name at least one rule`);
+    list.forEach((rule, i) => {
+        const at = Array.isArray(value) ? `${where}[${i}]` : where;
+        if (typeof rule !== "object" || rule === null || Array.isArray(rule)) {
+            problems.push(`\`${at}\` must be an object`);
+            return;
+        }
+        const q = rule;
+        if (typeof q.count !== "number" || !Number.isInteger(q.count) || q.count < 1)
+            problems.push(`\`${at}.count\` must be an integer of at least 1`);
+        if (q.roles !== undefined && (!Array.isArray(q.roles) || q.roles.length === 0 || q.roles.some((r) => typeof r !== "string" || r === ""))) {
+            problems.push(`\`${at}.roles\` must be a non-empty list of role names`);
+        }
+        if (q.targets !== undefined && (!Array.isArray(q.targets) || q.targets.length === 0 || q.targets.some((t) => typeof t !== "string" || t === ""))) {
+            problems.push(`\`${at}.targets\` must be a non-empty list of globs`);
+        }
+        if (q.notAuthor !== undefined && typeof q.notAuthor !== "boolean")
+            problems.push(`\`${at}.notAuthor\` must be true or false`);
+        if (q.notAuthor === true && !opts.notAuthor) {
+            problems.push(`\`${at}.notAuthor\` is not read here: an Op gate has no author to judge by. An Op waves spec's \`approvals.quorum\` reads it from the merged pull request`);
+        }
+        const known = new Set(["targets", "count", "roles", "notAuthor"]);
+        for (const key of Object.keys(q))
+            if (!known.has(key))
+                problems.push(`\`${at}.${key}\` is not a quorum field; use targets, count, roles or notAuthor`);
+    });
+    return problems;
+}
+const norm = (s) => s.normalize("NFKC").trim().toLowerCase();
+/** Whether two principals name the same person, compared trimmed and lower-cased. */
+export const samePrincipal = (a, b) => norm(a) === norm(b);
+/** The roles `roles` (`.chant/trust.json`'s role grants) gives `who`, sorted. */
+export function rolesOf(who, roles) {
+    return Object.entries(roles)
+        .filter(([, principals]) => principals.some((p) => samePrincipal(p, who)))
+        .map(([role]) => role)
+        .sort();
+}
+/** How far `rule` is met by `approvers`: each counted once, by name, oldest first. */
+export function quorumRuleProgress(rule, approvers) {
+    const seen = new Set();
+    const counted = [];
+    for (const a of [...approvers].sort((x, y) => Date.parse(x.at) - Date.parse(y.at))) {
+        if (seen.has(norm(a.who)))
+            continue;
+        if (rule.roles?.length && !(a.judged.proven && a.judged.roles.some((r) => rule.roles.includes(r))))
+            continue;
+        seen.add(norm(a.who));
+        counted.push(a);
+    }
+    const notAuthor = !rule.notAuthor || counted.some((a) => a.judged.proven && a.judged.author === false);
+    const authorUnknown = rule.notAuthor === true && !notAuthor && counted.some((a) => a.judged.proven && a.judged.author === undefined);
+    return {
+        ...(rule.targets ? { targets: [...rule.targets] } : {}),
+        count: rule.count,
+        ...(rule.roles?.length ? { roles: [...rule.roles] } : {}),
+        ...(rule.notAuthor ? { notAuthor: true } : {}),
+        approvers: counted.map((a) => a.who),
+        met: counted.length >= rule.count && notAuthor,
+        ...(authorUnknown ? { authorUnknown: true } : {}),
+    };
+}
+/**
+ * Where a rule stands, in one line: `prod-*: 1 of 2 approvals (github:alice),
+ * needs 1 more from platform`.
+ */
+export function quorumRuleLine(p) {
+    const scope = p.targets ? p.targets.join(", ") : "every target";
+    const have = `${p.approvers.length} of ${p.count} approval${p.count === 1 ? "" : "s"}${p.approvers.length ? ` (${p.approvers.join(", ")})` : ""}`;
+    if (p.met)
+        return `${scope}: ${have}, met`;
+    const more = p.count - p.approvers.length;
+    const needs = [];
+    if (more > 0)
+        needs.push(`${more} more${p.roles?.length ? ` from ${p.roles.join(" or ")}` : ""}`);
+    if (p.notAuthor)
+        needs.push(more > 0 ? "one of them not the author" : "an approver who is not the author");
+    const unknown = p.authorUnknown ? " (the change's author is not known, so no approver can show they are someone else)" : "";
+    return `${scope}: ${have}, needs ${needs.join(", ")}${unknown}`;
+}
+/** The rules that are not met, one line each joined by `; `. */
+export function quorumWaiting(progress) {
+    return progress.filter((p) => !p.met).map(quorumRuleLine).join("; ");
+}
+/** Whether a rule needs a proven approver: it names roles, or `notAuthor`. */
+export const ruleNeedsProof = (rule) => (rule.roles?.length ?? 0) > 0 || rule.notAuthor === true;
+/** The judge a gate's rules are met by: proof from a seal or the live review, roles from trust.json at base. */
+export function trustQuorumJudge(input) {
+    return (r) => {
+        const sealed = r.seal !== undefined && r.seal !== null && gateSealRefusal(input.signers, r) === null;
+        const reviewed = input.review !== undefined && r.review?.head === input.review.head && input.review.approvers.some((a) => samePrincipal(a, r.resolvedBy));
+        const proven = sealed || reviewed;
+        return {
+            proven,
+            roles: proven ? rolesOf(r.resolvedBy, input.roles) : [],
+            ...(input.authors !== undefined ? { author: input.authors.some((a) => samePrincipal(a, r.resolvedBy)) } : {}),
+        };
+    };
+}

package/dist/op/gate-resume.d.ts

@@ -8,6 +8,7 @@
  * `./gate`'s quorum rules.
  */
 import type { GateResolutionRecord, PendingGateRecord } from "../lifecycle/gate-ledger.js";
+import type { GateQuorumJudge } from "./gate-quorum.js";
 export { isGateRunLocator, resolveGateRunLocator, resumeGateRun, resumeTokenFromEnv, type GateResumeOutcome, type GateRunLocator, type ResumeGateRunOptions, } from "../gate-resume-run.js";
 /**
  * The resolution that answers `standing`, read the way a run decides the gate
@@ -15,7 +16,8 @@ export { isGateRunLocator, resolveGateRunLocator, resumeGateRun, resumeTokenFrom
  * gate ledger's pending facts, which place the human quorum's anchor (#3206);
  * without them it is `standing` itself. A workspace's
  * `identity.gates` rule is not applied here: the resumed job applies it, and
- * waits again when the approval does not count.
+ * waits again when the approval does not count. `judge` proves approvers
+ * for approval rules that name roles (#4290); absent, none is proven.
  */
-export declare function resolutionAnswering(resolutions: readonly GateResolutionRecord[], standing: PendingGateRecord, pending?: readonly PendingGateRecord[]): GateResolutionRecord | undefined;
+export declare function resolutionAnswering(resolutions: readonly GateResolutionRecord[], standing: PendingGateRecord, pending?: readonly PendingGateRecord[], judge?: GateQuorumJudge): GateResolutionRecord | undefined;
 //# sourceMappingURL=gate-resume.d.ts.map

package/dist/op/gate-resume.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-resume.d.ts","sourceRoot":"","sources":["../../src/op/gate-resume.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIxF,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,SAAS,iBAAiB,EAAe,GACjD,oBAAoB,GAAG,SAAS,CASlC"}
+{"version":3,"file":"gate-resume.d.ts","sourceRoot":"","sources":["../../src/op/gate-resume.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGxF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,SAAS,iBAAiB,EAAe,EAClD,KAAK,CAAC,EAAE,eAAe,GACtB,oBAAoB,GAAG,SAAS,CASlC"}

package/dist/op/gate-resume.js

@@ -16,16 +16,17 @@ export { isGateRunLocator, resolveGateRunLocator, resumeGateRun, resumeTokenFrom
  * gate ledger's pending facts, which place the human quorum's anchor (#3206);
  * without them it is `standing` itself. A workspace's
  * `identity.gates` rule is not applied here: the resumed job applies it, and
- * waits again when the approval does not count.
+ * waits again when the approval does not count. `judge` proves approvers
+ * for approval rules that name roles (#4290); absent, none is proven.
  */
-export function resolutionAnswering(resolutions, standing, pending = [standing]) {
+export function resolutionAnswering(resolutions, standing, pending = [standing], judge) {
     const env = standing.environment;
     const mine = resolutions.filter((r) => env === undefined || r.environment === env);
     if (standing.approval) {
-        const tally = tallyGateApprovals(mine, standing.gate, standing.timestamp, standing.planDigest, standing.approval, humanQuorumSince(pending, standing));
+        const tally = tallyGateApprovals(mine, standing.gate, standing.timestamp, standing.planDigest, standing.approval, humanQuorumSince(pending, standing), judge);
         if (tally.permit)
             return tally.permit;
-        return tally.counted.length >= tally.need ? tally.counted[tally.counted.length - 1] : undefined;
+        return tally.met ? tally.counted[tally.counted.length - 1] : undefined;
     }
     return latestResolutionForPlan(mine, standing.gate, standing.timestamp, standing.planDigest).resolution;
 }

package/dist/op/gate-review.js

@@ -29,7 +29,7 @@
  * back. The author's own review never counts.
  */
 import { readFileSync } from "node:fs";
-import { gateSealRefusal } from "../workspace/trust/gate-seal.js";
+import { gateSealRefusal } from "../lifecycle/gate-seal.js";
 import { readTrustPolicy } from "../workspace/trust/policy.js";
 import { gitRevisionSource } from "../workspace/record-source.js";
 import { forgePrincipalOf, ForgeApiError } from "../pr-forge.js";