@intentius/chant 0.124.39 → 0.124.41

package/dist/workspace/status-gates.d.ts

@@ -19,6 +19,7 @@
  * Its human quorum reaches back to `humanQuorumSince` (#3206), as a run's does.
  */
 import { type GateApprovalRule } from "../op/gate.js";
+import type { GateQuorumJudge } from "../op/gate-quorum.js";
 import type { ReleaseRevocation } from "../lifecycle/release-revocation.js";
 /** Why a member's gates can't be listed. Closed: a new code is a contract change. */
 export declare const GATE_REASON_CODES: readonly ["gates-no-ledger", "gates-no-gate-ledger", "gates-ledger-unreadable"];
@@ -145,12 +146,12 @@ export declare function approveCommand(component: string, gate: string, env: str
  * gate whose other facts have one is left out, as a run leaves it out: such a
  * line binds no environment, and `chant approve --expire` writes one.
  */
-export declare function gatesInLedger(component: string, content: string, envs: readonly string[], now: string, rules?: GateRuleLookup): {
+export declare function gatesInLedger(component: string, content: string, envs: readonly string[], now: string, rules?: GateRuleLookup, judge?: GateQuorumJudge): {
     gates: StatusGate[];
     malformed: number;
 };
 /** Read one member's gate ledger directory at `commit` and list its gates. */
-export declare function readMemberGates(dir: string, layout: "members" | "flat", commit: string | null, envs: readonly string[], cwd: string, now: string, read?: GateLedgerReader, rules?: GateRuleLookup, listChangeSets?: ChangeSetLister): Promise<{
+export declare function readMemberGates(dir: string, layout: "members" | "flat", commit: string | null, envs: readonly string[], cwd: string, now: string, read?: GateLedgerReader, rules?: GateRuleLookup, listChangeSets?: ChangeSetLister, judge?: GateQuorumJudge): Promise<{
     gates: StatusGate[];
     ledger: StatusGateLedger;
 }>;

package/dist/workspace/status-gates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status-gates.d.ts","sourceRoot":"","sources":["../../src/workspace/status-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,OAAO,EAAwC,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEzF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AASzE,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,iFAOY,CAAC;AAC3C,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;AAE1E,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,qGAAqG;IACrG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,qFAAqF;IACrF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,SAAS,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,6HAA6H;IAC7H,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kIAAkI;IAClI,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACxC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED,yGAAyG;AACzG,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1D;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;AAMjH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAEjG,eAAO,MAAM,sBAAsB,EAAE,eAMpC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,gBAYrC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,UAAQ,GAAG,MAAM,CAEtI;AA2DD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,cAA2B,GAAG;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAmBtL;AAED,8EAA8E;AAC9E,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,SAAS,GAAG,MAAM,EAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,gBAA0C,EAChD,KAAK,GAAE,cAA2B,EAClC,cAAc,GAAE,eAAwC,GACvD,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC,CA8B5D"}
+{"version":3,"file":"status-gates.d.ts","sourceRoot":"","sources":["../../src/workspace/status-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,OAAO,EAAwC,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AASzE,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,iFAOY,CAAC;AAC3C,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;AAE1E,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,qGAAqG;IACrG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,qFAAqF;IACrF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,SAAS,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,6HAA6H;IAC7H,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kIAAkI;IAClI,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACxC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED,yGAAyG;AACzG,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1D;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;AAMjH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAEjG,eAAO,MAAM,sBAAsB,EAAE,eAMpC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,gBAYrC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,UAAQ,GAAG,MAAM,CAEtI;AA4DD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,cAA2B,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAmB/M;AAED,8EAA8E;AAC9E,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,SAAS,GAAG,MAAM,EAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,gBAA0C,EAChD,KAAK,GAAE,cAA2B,EAClC,cAAc,GAAE,eAAwC,EACxD,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC,CA8B5D"}

package/dist/workspace/status-gates.js

@@ -74,7 +74,7 @@ export function approveCommand(component, gate, env, planDigest, signed = false)
 }
 const approvalOf = (r) => ({ principal: r.resolvedBy, channel: r.origin ?? null, relayedBy: r.relayedBy ?? null, at: r.timestamp });
 /** One gate in one environment, decided against its newest pending fact. */
-function decide(component, standing, facts, all, now, rule) {
+function decide(component, standing, facts, all, now, rule, judge) {
     const gate = standing.gate;
     // #3163: under identity.gates, an unsigned approval, or one from outside the class, doesn't count, as a run reads it.
     // #4045: nor does an approval for another release, and an `empty` pass is never an approval.
@@ -93,8 +93,9 @@ function decide(component, standing, facts, all, now, rule) {
     let mismatched;
     if (standing.approval) {
         // #3206: a human approval from before a fact re-recorded for a mode or context change still counts.
-        const tally = tallyGateApprovals(own, gate, since, planDigest, standing.approval, humanQuorumSince(facts, standing));
-        approved = tally.permit !== undefined || tally.counted.length >= tally.need;
+        // #4290: approval rules count roles from .chant/trust.json at base, for a proven approver.
+        const tally = tallyGateApprovals(own, gate, since, planDigest, standing.approval, humanQuorumSince(facts, standing), judge);
+        approved = tally.permit !== undefined || tally.met;
         approvals = tally.permit && !tally.counted.includes(tally.permit) ? [...tally.counted, tally.permit] : tally.counted;
         needed = tally.need;
         mismatched = tally.mismatched;
@@ -133,7 +134,7 @@ function decide(component, standing, facts, all, now, rule) {
  * gate whose other facts have one is left out, as a run leaves it out: such a
  * line binds no environment, and `chant approve --expire` writes one.
  */
-export function gatesInLedger(component, content, envs, now, rules = () => null) {
+export function gatesInLedger(component, content, envs, now, rules = () => null, judge) {
     const { pending, resolutions, malformed } = parseGateLedger(content);
     const gates = [];
     for (const gate of [...new Set(pending.map((p) => p.gate))].sort()) {
@@ -150,13 +151,13 @@ export function gatesInLedger(component, content, envs, now, rules = () => null)
         }
         for (const env of [...byEnv.keys()].sort((a, b) => envs.indexOf(a ?? "") - envs.indexOf(b ?? ""))) {
             const envFacts = byEnv.get(env);
-            gates.push(decide(component, latestPendingGate(envFacts, gate), envFacts, resolutions, now, rules(gate)));
+            gates.push(decide(component, latestPendingGate(envFacts, gate), envFacts, resolutions, now, rules(gate), judge));
         }
     }
     return { gates, malformed };
 }
 /** Read one member's gate ledger directory at `commit` and list its gates. */
-export async function readMemberGates(dir, layout, commit, envs, cwd, now, read = defaultGateLedgerReader, rules = () => null, listChangeSets = defaultChangeSetLister) {
+export async function readMemberGates(dir, layout, commit, envs, cwd, now, read = defaultGateLedgerReader, rules = () => null, listChangeSets = defaultChangeSetLister, judge) {
     const ledger = { layout, path: dir, shared: false, malformed: 0, reason: null };
     if (commit === null) {
         return { gates: [], ledger: { ...ledger, reason: { code: "gates-no-ledger", message: "the checkout has no chant/lifecycle branch, so no gate is recorded in it" } } };
@@ -174,7 +175,7 @@ export async function readMemberGates(dir, layout, commit, envs, cwd, now, read
     }
     const gates = [];
     for (const component of [...files.keys()].sort()) {
-        const read = gatesInLedger(component, files.get(component), envs, now, rules);
+        const read = gatesInLedger(component, files.get(component), envs, now, rules, judge);
         gates.push(...read.gates);
         ledger.malformed += read.malformed;
     }

package/dist/workspace/status.d.ts

@@ -31,7 +31,7 @@
  * `box-isolation.ts`), so a runtime reads them instead of choosing its own.
  */
 import type { CommandContext } from "../cli/registry.js";
-import { type ReleaseRecord } from "../lifecycle/release-ledger.js";
+import { type ReleaseDigestKind, type ReleaseRecord } from "../lifecycle/release-ledger.js";
 import { type RevokedRelease } from "../lifecycle/release-revocation.js";
 import { type ReleasePlan } from "../lifecycle/plan-ledger.js";
 import { type DeployOutcome } from "../lifecycle/deploy-outcome.js";
@@ -100,6 +100,8 @@ export interface StatusRelease {
     releaseLabel: string | null;
     /** Read flags, such as `legacy-digest` (#2514). */
     flags: string[];
+    /** What `digest` names when it is not an artifact digest (#4274): `plan`, `deploy-input` or `templates`. Absent for an artifact digest. */
+    digestKind?: ReleaseDigestKind;
     /**
      * The release plan `digest` names, read from `_plans/<digest>.json` on
      * chant/lifecycle (ws-055, #2733) — the work items and evidence this

package/dist/workspace/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/workspace/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD,OAAO,EAAyC,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACxG,OAAO,EAAsF,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAC1J,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAyD,KAAK,gBAAgB,EAAqB,MAAM,gCAAgC,CAAC;AACjJ,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAqC,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAgC,KAAK,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAE5E,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EAAyC,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAqD,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACtI,OAAO,EAA2G,KAAK,aAAa,EAAe,MAAM,eAAe,CAAC;AAEzK,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,KAAK,EAAuB,aAAa,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEjF,OAAO,EAAiD,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEjH,OAAO,EAAsC,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACnI,OAAO,EAAwB,kBAAkB,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAIzH,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,8EAA8E,CAAC;AAEnH,wCAAwC;AACxC,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAE/C,gFAAgF;AAChF,eAAO,MAAM,WAAW,aAAa,CAAC;AAItC;;;GAGG;AACH,eAAO,MAAM,mBAAmB,oDAKU,CAAC;AAC3C,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,iFAAoB,CAAC;AAE1D,uGAAuG;AACvG,eAAO,MAAM,2BAA2B,kFAAuB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,0NAYW,CAAC;AAC3C,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,wHAAwH;AACxH,eAAO,MAAM,WAAW,QAAsC,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0GAA0G;IAC1G,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,wKAAwK;IACxK,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,kMAAkM;IAClM,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,yKAAyK;IACzK,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mDAAmD;IACnD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;;OAOG;IACH,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,oBAAoB,CAAC;CAChC;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,MAAM,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3D;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,CAAC;AAE5E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;CAC/G;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC/B,yEAAyE;IACzE,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,mCAAmC;IACnC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,4FAA4F;IAC5F,QAAQ,EAAE,OAAO,CAAC;IAClB,iGAAiG;IACjG,UAAU,EAAE,gBAAgB,CAAC;IAC7B,2GAA2G;IAC3G,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,6HAA6H;IAC7H,GAAG,EAAE,SAAS,GAAG,IAAI,CAAC;IACtB,4HAA4H;IAC5H,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,kEAAkE;IAClE,cAAc,EAAE;QAAE,IAAI,EAAE,iBAAiB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/D;;;;;;OAMG;IACH,cAAc,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IACvC;;;;;;OAMG;IACH,WAAW,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IACvC;;;;;;;OAOG;IACH,YAAY,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;CAC1C;AAED,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,4HAA4H;IAC5H,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,qHAAqH;IACrH,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,0FAA0F;IAC1F,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,kHAAkH;IAClH,KAAK,EAAE,OAAO,CAAC;IACf,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,yEAAyE;IACzE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,qBAAqB,CAAC;CACvC;AAED,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,0IAA0I;IAC1I,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACxG;;;;;;OAMG;IACH,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CACpD;AAED,mEAAmE;AACnE,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACzE,kIAAkI;IAClI,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC;;;;;OAKG;IACH,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,0IAA0I;IAC1I,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,wHAAwH;IACxH,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,gIAAgI;IAChI,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,iHAAiH;IACjH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qIAAqI;IACrI,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,0IAA0I;IAC1I,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,EAAE,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1F;AAED,yHAAyH;AACzH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC;IAC9D,wHAAwH;IACxH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,cAAc,GACtB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClD,8HAA8H;IAC9H,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,mHAAmH;IACnH,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,mJAAmJ;IACnJ,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,6IAA6I;IAC7I,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B,iIAAiI;IACjI,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACrC;;;;;;OAMG;IACH,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC9F,GACD;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAA;KAAE,CAAC;CACnF,CAAC;AAEN,KAAK,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5G,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,iIAAiI;IACjI,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,YAAY,CAAC,EAAE,OAAO,kBAAkB,CAAC;IACzC,yGAAyG;IACzG,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC;CACvE;AA8FD,kFAAkF;AAClF,KAAK,aAAa,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;AAO7E,gJAAgJ;AAChJ,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAqID,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,GAAG,aAAa,CAW7F;AAED,6FAA6F;AAC7F,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CA4IjF;AAiFD,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuC7E;AAeD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,MAAM,CA0GvF"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/workspace/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD,OAAO,EAAyC,KAAK,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAChI,OAAO,EAAsF,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAC1J,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAyD,KAAK,gBAAgB,EAAqB,MAAM,gCAAgC,CAAC;AACjJ,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAqC,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAgC,KAAK,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAE5E,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EAAyC,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAqD,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACtI,OAAO,EAA2G,KAAK,aAAa,EAAe,MAAM,eAAe,CAAC;AAEzK,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,KAAK,EAAuB,aAAa,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEjF,OAAO,EAAiD,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEjH,OAAO,EAAsC,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEnI,OAAO,EAAwB,kBAAkB,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAIzH,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,8EAA8E,CAAC;AAEnH,wCAAwC;AACxC,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAE/C,gFAAgF;AAChF,eAAO,MAAM,WAAW,aAAa,CAAC;AAItC;;;GAGG;AACH,eAAO,MAAM,mBAAmB,oDAKU,CAAC;AAC3C,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,iFAAoB,CAAC;AAE1D,uGAAuG;AACvG,eAAO,MAAM,2BAA2B,kFAAuB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,0NAYW,CAAC;AAC3C,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,wHAAwH;AACxH,eAAO,MAAM,WAAW,QAAsC,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0GAA0G;IAC1G,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,wKAAwK;IACxK,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,kMAAkM;IAClM,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,yKAAyK;IACzK,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mDAAmD;IACnD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,2IAA2I;IAC3I,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;;;;;;;OAOG;IACH,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,oBAAoB,CAAC;CAChC;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,MAAM,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3D;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,CAAC;AAE5E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;CAC/G;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC/B,yEAAyE;IACzE,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,mCAAmC;IACnC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,4FAA4F;IAC5F,QAAQ,EAAE,OAAO,CAAC;IAClB,iGAAiG;IACjG,UAAU,EAAE,gBAAgB,CAAC;IAC7B,2GAA2G;IAC3G,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,6HAA6H;IAC7H,GAAG,EAAE,SAAS,GAAG,IAAI,CAAC;IACtB,4HAA4H;IAC5H,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,kEAAkE;IAClE,cAAc,EAAE;QAAE,IAAI,EAAE,iBAAiB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/D;;;;;;OAMG;IACH,cAAc,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IACvC;;;;;;OAMG;IACH,WAAW,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IACvC;;;;;;;OAOG;IACH,YAAY,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;CAC1C;AAED,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,4HAA4H;IAC5H,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,qHAAqH;IACrH,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,0FAA0F;IAC1F,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,kHAAkH;IAClH,KAAK,EAAE,OAAO,CAAC;IACf,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,yEAAyE;IACzE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,qBAAqB,CAAC;CACvC;AAED,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,0IAA0I;IAC1I,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACxG;;;;;;OAMG;IACH,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CACpD;AAED,mEAAmE;AACnE,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACzE,kIAAkI;IAClI,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC;;;;;OAKG;IACH,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,0IAA0I;IAC1I,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,wHAAwH;IACxH,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,gIAAgI;IAChI,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,iHAAiH;IACjH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qIAAqI;IACrI,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,0IAA0I;IAC1I,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,EAAE,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1F;AAED,yHAAyH;AACzH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC;IAC9D,wHAAwH;IACxH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,cAAc,GACtB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClD,8HAA8H;IAC9H,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,mHAAmH;IACnH,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,mJAAmJ;IACnJ,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,6IAA6I;IAC7I,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B,iIAAiI;IACjI,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACrC;;;;;;OAMG;IACH,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC9F,GACD;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAA;KAAE,CAAC;CACnF,CAAC;AAEN,KAAK,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5G,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,iIAAiI;IACjI,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,YAAY,CAAC,EAAE,OAAO,kBAAkB,CAAC;IACzC,yGAAyG;IACzG,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC;CACvE;AA8FD,kFAAkF;AAClF,KAAK,aAAa,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;AAO7E,gJAAgJ;AAChJ,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAuID,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,GAAG,aAAa,CAW7F;AAED,6FAA6F;AAC7F,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CA8IjF;AAiFD,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuC7E;AAeD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,MAAM,CA0GvF"}

package/dist/workspace/status.js

@@ -55,6 +55,7 @@ import { gateAdmissionFrom, releaseRuleFrom } from "./identity.js";
 import { checkReleaseSignature } from "./identity-gate-rule.js";
 import { scopeSource } from "./write-scope.js";
 import { GATE_REASON_CODES, readMemberGates } from "./status-gates.js";
+import { trustQuorumJudge } from "../op/gate-quorum.js";
 import { STEWARD_REASON_CODES, readMemberStewards } from "./status-stewards.js";
 import { gitTop, workingTree } from "./tree.js";
 import { handToRootChant } from "./which-chant.js";
@@ -265,6 +266,7 @@ async function readEnvironment(member, env, cwd, read, revokedOf = async () => n
         releaseDigest: r.releaseDigest ?? null,
         releaseLabel: (r.releaseDigest !== undefined ? labels.get(r.releaseDigest) : undefined) ?? null,
         flags: [...(r.flags ?? [])],
+        ...(r.digestKind ? { digestKind: r.digestKind } : {}),
         plan: await readReleasePlan(r.digest, { cwd, prefix: planPrefix }),
         ...(await revokedItem(r, env, revokedOf, back)),
     })));
@@ -311,8 +313,8 @@ async function supersedeRevokedGates(gates, revokedOf) {
         return { ...g, state: g.state === "expired" ? g.state : "superseded", revoked: revocation };
     }));
 }
-/** The digest two environments are compared on: the input side when there is one. */
-const compareKey = (r) => r.inputDigest ?? r.digest;
+/** The digest two environments are compared on: the input side when there is one, the commit for an apply (#4274). */
+const compareKey = (r) => r.digestKind === "plan" || r.digestKind === "deploy-input" ? `git:${r.gitSha}` : r.inputDigest ?? r.digest;
 export function compareEnvironments(a, b) {
     const left = new Map(a.releases.map((r) => [r.component, r]));
     const right = new Map(b.releases.map((r) => [r.component, r]));
@@ -355,6 +357,8 @@ export async function workspaceStatus(query) {
         const ruleSource = scopeSource(found.dir);
         const rules = (gate) => gateAdmissionFrom(ruleSource, gate);
         const releaseRule = releaseRuleFrom(ruleSource).rule;
+        // #4290: approval rules read roles from the trust policy at base, for a proven approver.
+        const judge = trustQuorumJudge({ signers: ruleSource.policy, roles: ruleSource.policy.roles });
         // #4033 (ws-105): revoked commits, read from local tags once and only when a release is met.
         // Tags that can't be judged read as none revoked; workspace check reports the declaration.
         let revokedCommits;
@@ -368,7 +372,7 @@ export async function workspaceStatus(query) {
             for (const env of envs)
                 environments.push(await readEnvironment(m, env, found.dir, read, revokedOf, query.readOutcomes));
             const own = await hasMemberLedger(m, found.dir);
-            const gates = await readMemberGates(own ? `${MEMBERS_DIR}/${m.name}/${GATES_DIR}` : GATES_DIR, own ? "members" : "flat", commit, envs, found.dir, now, query.readGates, rules);
+            const gates = await readMemberGates(own ? `${MEMBERS_DIR}/${m.name}/${GATES_DIR}` : GATES_DIR, own ? "members" : "flat", commit, envs, found.dir, now, query.readGates, rules, undefined, judge);
             const stewards = await (query.readStewards ?? readMemberStewards)(resolve(found.dir, m.dir), query.env, now, m.kind, m.box);
             // The declaration's x- keys go back on the objects that hold them (#3595).
             const x = (pointer) => extensionsAt(declaration, pointer);

package/dist/workspace/status.schema.json

@@ -1149,6 +1149,7 @@
         "releaseDigest": { "type": ["string", "null"], "pattern": "^(?:jcs1-)?sha256:[0-9a-f]{64}$", "description": "Added in contract 1 by #4043, written by chant 0.124.29 and newer. The release this deploy was made from: the releaseDigest of _releases/<releaseDigest>.json. A promote with --release writes it, a run --components with --release writes it, and a rollback or redeploy copies it from the record it restores. Null for a deploy that named no release. With the item's environment it names the release target." },
         "releaseLabel": { "type": ["string", "null"], "description": "Added in contract 1 by #4043, written by chant 0.124.29 and newer. The label that release was cut with, from _releases/cuts.jsonl. Null when releaseDigest is null, when the release has no label, and when the cuts can't be read." },
         "flags": { "type": "array", "items": { "enum": ["legacy-digest"] } },
+        "digestKind": { "enum": ["plan", "deploy-input", "templates"], "description": "Added in contract 1 by #4274, written by chant 0.124.35 and newer. What digest names when it is not an artifact digest: plan, the plan digest a pr-apply of a component that published nothing applied under its approval; deploy-input, that component's deploy-input digest when nothing planned; templates, the digest of the templates a release records for the component (#4222). Absent for an artifact digest. Compare joins a plan or deploy-input record on gitSha." },
         "plan": {
           "type": ["object", "null"],
           "description": "The release plan digest names, read from _plans/<digest>.json on chant/lifecycle (ws-055, #2733): the work items and evidence this release shipped. Null when this checkout has no plan stored under that digest — most releases carry no plan, and a plan not yet fetched also reads null."

package/dist/workspace/trust/seal.d.ts

@@ -23,8 +23,8 @@
  */
 import type { SealCode } from "../records.js";
 import { type TrustPolicy } from "./policy.js";
-import { type SealedGateApproval } from "./gate-seal.js";
-export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealVersion, sealedFieldsOf, type SealedGateApproval } from "./gate-seal.js";
+import { type SealedGateApproval } from "../../lifecycle/gate-seal.js";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealVersion, sealedFieldsOf, type SealedGateApproval } from "../../lifecycle/gate-seal.js";
 /** The ssh signature namespace of a verdict seal. */
 export declare const REVIEW_SEAL_NAMESPACE = "chant-review";
 /** The ssh signature namespace of a record's author seal (#2688). */

package/dist/workspace/trust/seal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAmG,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGvJ,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE7H,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kKAAkK;IAClK,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvH;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9G;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf;AAoBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,GAAG,SAAS,CAYjF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,GAAG,SAAS,CAgB/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,SAAS,CASnF;AAgFD,oCAAoC;AACpC,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAuBzG;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE9I;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAEpI;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,GAAG,WAAW,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAEnJ"}
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAmG,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGrK,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE3I,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kKAAkK;IAClK,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvH;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9G;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf;AAoBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,GAAG,SAAS,CAYjF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,GAAG,SAAS,CAgB/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,SAAS,CASnF;AAgFD,oCAAoC;AACpC,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAuBzG;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE9I;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAEpI;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,GAAG,WAAW,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAEnJ"}

package/dist/workspace/trust/seal.js

@@ -26,9 +26,9 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { sshKeygen, verifySshSignature } from "./ssh-commit.js";
-import { GATE_SEAL_NAMESPACE, gateSealPayload, namespaceAllowed, sshSignatureKey, verifySshSignatureWith } from "./gate-seal.js";
+import { GATE_SEAL_NAMESPACE, gateSealPayload, namespaceAllowed, sshSignatureKey, verifySshSignatureWith } from "../../lifecycle/gate-seal.js";
 import { RELEASE_SEAL_NAMESPACE, releaseSealPayload } from "../identity-gate-rule.js";
-export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealVersion, sealedFieldsOf } from "./gate-seal.js";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealVersion, sealedFieldsOf } from "../../lifecycle/gate-seal.js";
 /** The ssh signature namespace of a verdict seal. */
 export const REVIEW_SEAL_NAMESPACE = "chant-review";
 /** The ssh signature namespace of a record's author seal (#2688). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.124.39",
+  "version": "0.124.41",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/__fixtures__/oidc-emulator.ts

@@ -0,0 +1,118 @@
+/**
+ * A local emulator of every service the OIDC trade (#4296, ../ci-identity.ts)
+ * talks to, for tests: the forge's token request URL, AWS STS, Google's STS
+ * and IAM credentials, and Entra's token endpoint. It answers with test
+ * values only and keeps every request, so a test can say which identity
+ * was asked for and how many tokens were minted.
+ */
+
+import { createServer, type IncomingMessage, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import type { CloudTradeSpec } from "../ci-identity";
+
+/** What the emulator was asked. */
+export interface EmulatorLog {
+  /** Each OIDC token minted: its audience. */
+  minted: string[];
+  /** Each AWS role assumed, with the token it was assumed with. */
+  assumed: Array<{ role: string; token: string }>;
+  /** Each GCP service account impersonated. */
+  impersonated: string[];
+  /** Each Azure client a token was traded for, with the token. */
+  clients: Array<{ clientId: string; token: string }>;
+}
+
+export interface OidcEmulator {
+  url: string;
+  log: EmulatorLog;
+  /** The forge's token request variables, as a GitHub or Forgejo job with `id-token: write` has them. */
+  requestEnv: { ACTIONS_ID_TOKEN_REQUEST_URL: string; ACTIONS_ID_TOKEN_REQUEST_TOKEN: string };
+  /** `spec` with each cloud pointed at the emulator. */
+  pointAt(spec: CloudTradeSpec): CloudTradeSpec;
+  close(): Promise<void>;
+}
+
+/** The request token the emulator accepts, and the prefix of every token it mints. */
+export const EMULATED_REQUEST_TOKEN = "emulated-oidc-request-token-4296";
+export const EMULATED_JWT_PREFIX = "eyJemulated4296";
+
+/** The test credentials the emulator hands out for an identity: they name it, so a test can tell which was traded. */
+export function emulatedCredentials(identity: string): { accessKeyId: string; secret: string; token: string } {
+  const tag = identity.replace(/[^A-Za-z0-9]/g, "").slice(-24);
+  return { accessKeyId: `ASIATEST${tag}`, secret: `secret-${tag}`, token: `session-${tag}` };
+}
+
+const body = (req: IncomingMessage): Promise<string> =>
+  new Promise((ok) => {
+    let b = "";
+    req.on("data", (c) => (b += c));
+    req.on("end", () => ok(b));
+  });
+
+/** Start the emulator on a free local port. */
+export async function startOidcEmulator(): Promise<OidcEmulator> {
+  const log: EmulatorLog = { minted: [], assumed: [], impersonated: [], clients: [] };
+  const server: Server = createServer(async (req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    const text = await body(req);
+    const send = (status: number, payload: unknown, type = "application/json") => {
+      res.writeHead(status, { "content-type": type });
+      res.end(typeof payload === "string" ? payload : JSON.stringify(payload));
+    };
+    if (url.pathname === "/oidc") {
+      if (req.headers.authorization !== `bearer ${EMULATED_REQUEST_TOKEN}`) return send(401, { message: "bad request token" });
+      const aud = url.searchParams.get("audience") ?? "";
+      log.minted.push(aud);
+      return send(200, { value: `${EMULATED_JWT_PREFIX}.${Buffer.from(aud).toString("base64url")}.${log.minted.length}` });
+    }
+    if (url.pathname === "/aws/") {
+      const form = new URLSearchParams(text);
+      const role = form.get("RoleArn") ?? "";
+      const token = form.get("WebIdentityToken") ?? "";
+      if (form.get("Action") !== "AssumeRoleWithWebIdentity" || !token.startsWith("eyJ")) return send(400, "<Error>bad request</Error>", "text/xml");
+      log.assumed.push({ role, token });
+      const c = emulatedCredentials(role);
+      return send(
+        200,
+        `<AssumeRoleWithWebIdentityResponse><AssumeRoleWithWebIdentityResult><Credentials><AccessKeyId>${c.accessKeyId}</AccessKeyId><SecretAccessKey>${c.secret}</SecretAccessKey><SessionToken>${c.token}</SessionToken><Expiration>2026-10-22T23:00:00Z</Expiration></Credentials></AssumeRoleWithWebIdentityResult></AssumeRoleWithWebIdentityResponse>`,
+        "text/xml",
+      );
+    }
+    if (url.pathname === "/gcp-sts/v1/token") {
+      const j = JSON.parse(text) as { subjectToken?: string };
+      if (!j.subjectToken?.startsWith("eyJ")) return send(400, { error: "bad subject token" });
+      return send(200, { access_token: "federated-test-token", token_type: "Bearer" });
+    }
+    const sa = /^\/gcp-iam\/v1\/projects\/-\/serviceAccounts\/([^/:]+):generateAccessToken$/.exec(url.pathname);
+    if (sa) {
+      if (req.headers.authorization !== "Bearer federated-test-token") return send(401, { error: "bad federated token" });
+      const name = decodeURIComponent(sa[1]!);
+      log.impersonated.push(name);
+      return send(200, { accessToken: `ya29.${emulatedCredentials(name).token}`, expireTime: "2026-10-22T23:00:00Z" });
+    }
+    if (/^\/azure\/[^/]+\/oauth2\/v2\.0\/token$/.test(url.pathname)) {
+      const form = new URLSearchParams(text);
+      const clientId = form.get("client_id") ?? "";
+      const token = form.get("client_assertion") ?? "";
+      if (form.get("grant_type") !== "client_credentials" || !token.startsWith("eyJ")) return send(400, { error: "bad grant" });
+      log.clients.push({ clientId, token });
+      return send(200, { access_token: `azure.${emulatedCredentials(clientId).token}`, token_type: "Bearer" });
+    }
+    send(404, { message: `no route ${url.pathname}` });
+  });
+  await new Promise<void>((ok) => server.listen(0, "127.0.0.1", ok));
+  const url = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+  return {
+    url,
+    log,
+    requestEnv: { ACTIONS_ID_TOKEN_REQUEST_URL: `${url}/oidc?api-version=2.0`, ACTIONS_ID_TOKEN_REQUEST_TOKEN: EMULATED_REQUEST_TOKEN },
+    pointAt(spec) {
+      return {
+        ...(spec.aws ? { aws: { ...spec.aws, endpoint: `${url}/aws` } } : {}),
+        ...(spec.gcp ? { gcp: { ...spec.gcp, stsEndpoint: `${url}/gcp-sts`, iamEndpoint: `${url}/gcp-iam` } } : {}),
+        ...(spec.azure ? { azure: { ...spec.azure, authority: `${url}/azure` } } : {}),
+      };
+    },
+    close: () => new Promise<void>((ok) => server.close(() => ok())),
+  };
+}

package/src/ci-handover.test.ts

@@ -0,0 +1,209 @@
+/**
+ * #4295: the forge token handover. A step that runs the pull request's code
+ * starts again without the forge token variables, the report it writes goes
+ * to the next job as data, and the checkout keeps no credentials.
+ *
+ * Each test runs the generated shell for real, with `sh`, in a temp
+ * directory, with every token variable set to a value it then looks for.
+ */
+
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gzipSync } from "node:zlib";
+import { afterAll, describe, expect, test } from "vitest";
+import {
+  CHECKOUT_TOKEN_ENV,
+  checkoutScript,
+  dropForgeTokens,
+  FORGE_TOKEN_VARS,
+  GITLAB_DROP_FORGE_TOKENS,
+  HANDOVER_LIMITS,
+  handoverKeys,
+  handoverTrap,
+  holdsForgeToken,
+  packJs,
+  UNPACK_JS,
+  withoutForgeTokens,
+} from "./ci-handover";
+
+const dirs: string[] = [];
+afterAll(() => {
+  for (const d of dirs) rmSync(d, { recursive: true, force: true });
+});
+function scratch(prefix: string): string {
+  const d = mkdtempSync(join(tmpdir(), prefix));
+  dirs.push(d);
+  return d;
+}
+
+const SECRET = "ghs_handover_secret_4295";
+/** Every forge token variable, set to a value a leak would show. */
+const TOKENS = Object.fromEntries(FORGE_TOKEN_VARS.map((v) => [v, `${SECRET}_${v}`]));
+const BASE = { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: process.env.HOME ?? "/tmp" };
+
+/** Run `body` after the drop line as a script file, as a forge runs a step, and return what `env` printed in it. */
+function stepEnv(body: string, extra: Record<string, string> = {}): { env: string; status: number | null } {
+  const dir = scratch("chant-handover-step-");
+  const out = join(dir, "env.txt");
+  const file = join(dir, "step.sh");
+  writeFileSync(file, `${dropForgeTokens("sh")}\n${body.replaceAll("$OUT", out)}\n`);
+  const r = spawnSync("sh", ["-e", file], { cwd: dir, env: { ...BASE, ...TOKENS, ...extra }, encoding: "utf-8" });
+  return { env: existsSync(out) ? readFileSync(out, "utf-8") : "", status: r.status };
+}
+
+describe("a step that runs the change's code holds no forge token (#4295)", () => {
+  test("the step's shell and every process it starts see none of the token variables", () => {
+    const { env, status } = stepEnv('env > "$OUT"; sh -c \'env\' >> "$OUT"');
+    expect(status).toBe(0);
+    expect(env).not.toContain(SECRET);
+    for (const name of FORGE_TOKEN_VARS) expect(env).not.toMatch(new RegExp(`^${name}=`, "m"));
+    // It restarted once, which the marker says, so it does not loop.
+    expect(env).toMatch(/^CHANT_NO_FORGE_TOKEN=1$/m);
+  });
+
+  test.skipIf(process.platform !== "linux")("the restart leaves no token in the shell's own initial environment, which a child reads from /proc", () => {
+    const { env } = stepEnv('tr "\\0" "\\n" < /proc/$$/environ > "$OUT"; sh -c \'tr "\\0" "\\n" < /proc/$PPID/environ\' >> "$OUT"');
+    expect(env).toContain("CHANT_NO_FORGE_TOKEN=1");
+    expect(env).not.toContain(SECRET);
+  });
+
+  test("a step's exit code is its own after the restart", () => {
+    expect(stepEnv("exit 3").status).toBe(3);
+  });
+
+  test("a shell that cannot restart, such as sh -c, unsets them", () => {
+    const r = spawnSync("sh", ["-c", `${dropForgeTokens("sh")}\nenv`], { env: { ...BASE, ...TOKENS }, encoding: "utf-8" });
+    expect(r.status).toBe(0);
+    expect(r.stdout).not.toContain(SECRET);
+  });
+
+  test("bash restarts with pipefail", () => {
+    const dir = scratch("chant-handover-bash-");
+    const file = join(dir, "step.sh");
+    writeFileSync(file, `${dropForgeTokens("bash")}\nenv\n`);
+    const r = spawnSync("bash", ["-e", file], { env: { ...BASE, ...TOKENS }, encoding: "utf-8" });
+    expect(r.stdout).not.toContain(SECRET);
+    expect(r.stdout).toContain("CHANT_NO_FORGE_TOKEN=1");
+  });
+
+  test("GitLab's line unsets them for every line after it in the job's one shell", () => {
+    const r = spawnSync("sh", ["-c", `${GITLAB_DROP_FORGE_TOKENS}\nenv`], { env: { ...BASE, ...TOKENS }, encoding: "utf-8" });
+    expect(r.stdout).not.toContain(SECRET);
+  });
+
+  test("withoutForgeTokens and holdsForgeToken cover chant's, GitHub's, Forgejo's and GitLab's names", () => {
+    const env = { ...TOKENS, AWS_ACCESS_KEY_ID: "floci", GITHUB_REPOSITORY: "acme/estate" };
+    expect(withoutForgeTokens(env)).toEqual({ AWS_ACCESS_KEY_ID: "floci", GITHUB_REPOSITORY: "acme/estate" });
+    expect(holdsForgeToken(env)).toBe(true);
+    expect(holdsForgeToken({ GITHUB_TOKEN: "" })).toBe(false);
+    for (const name of ["GITHUB_TOKEN", "GH_TOKEN", "CHANT_FORGE_TOKEN", "FORGEJO_TOKEN", "GITLAB_TOKEN", "CI_JOB_TOKEN", "ACTIONS_RUNTIME_TOKEN"]) {
+      expect(FORGE_TOKEN_VARS).toContain(name);
+    }
+  });
+});
+
+/** Run the plan step's trap with `files` in its report directory, and return the outputs it wrote. */
+function handOn(files: Record<string, string>, forge: "github" | "forgejo" = "github"): string {
+  const dir = scratch("chant-handover-pack-");
+  for (const [name, body] of Object.entries(files)) {
+    mkdirSync(join(dir, ".chant/pr", name, ".."), { recursive: true });
+    writeFileSync(join(dir, ".chant/pr", name), body);
+  }
+  const output = join(dir, "github-output");
+  const file = join(dir, "step.sh");
+  writeFileSync(file, [dropForgeTokens("sh"), ...handoverTrap(".chant/pr", forge), "cd /", "exit 1", ""].join("\n"));
+  spawnSync("sh", ["-e", file], { cwd: dir, env: { ...BASE, ...TOKENS, GITHUB_OUTPUT: output }, encoding: "utf-8" });
+  return readFileSync(output, "utf-8");
+}
+
+/** What the note job writes back from `outputs`, one `key=value` a line, as toJSON hands each value in. */
+function takeBack(outputs: string, forge: "github" | "forgejo" = "github"): { dir: string; log: string } {
+  const values = Object.fromEntries(outputs.trimEnd().split("\n").map((l) => [l.slice(0, l.indexOf("=")), l.slice(l.indexOf("=") + 1)]));
+  const stdin = handoverKeys(forge).map((k) => JSON.stringify(values[k] ?? "")).join("\n") + "\n";
+  const dir = scratch("chant-handover-take-");
+  const log = execFileSync("node", ["-e", UNPACK_JS, join(dir, ".chant/pr")], { input: stdin, encoding: "utf-8" });
+  return { dir: join(dir, ".chant/pr"), log };
+}
+
+describe("the plan step hands its report to the note job as data (#4295)", () => {
+  test("every file goes on as the job's outputs, even when the step fails after changing directory, and comes back the same", () => {
+    const files = { "pr-plan.json": '{"stage":"plan"}\n', "pr-note.md": "note\n", "run-events/a.jsonl": "{}\n" };
+    const outputs = handOn(files);
+    expect(outputs).toMatch(/^report_0=/);
+    // The output carries no token, though the step started with every one.
+    expect(outputs).not.toContain(Buffer.from(SECRET).toString("base64").slice(0, 12));
+    const { dir, log } = takeBack(outputs);
+    expect(log).toContain("took 3 report files");
+    for (const [name, body] of Object.entries(files)) expect(readFileSync(join(dir, name), "utf-8")).toBe(body);
+  });
+
+  test("a path that leaves the directory is left out", () => {
+    const payload = gzipSync(JSON.stringify({ "../escape": Buffer.from("x").toString("base64"), "ok.txt": Buffer.from("y").toString("base64") })).toString("base64");
+    const { dir, log } = takeBack(`report_0=${payload}\n`);
+    expect(log).toContain('left out "../escape"');
+    expect(existsSync(join(dir, "..", "escape"))).toBe(false);
+    expect(readFileSync(join(dir, "ok.txt"), "utf-8")).toBe("y");
+  });
+
+  test("outputs that do not read hand on nothing, and the note job carries on", () => {
+    expect(takeBack("report_0=not-base64-gzip\n").log).toContain("does not read");
+    expect(takeBack("").log).toContain("handed on no report");
+  });
+
+  test("a report too large is cut to the plan report and the note", () => {
+    const saved = { ...HANDOVER_LIMITS.github };
+    HANDOVER_LIMITS.github.chunk = 2_000;
+    try {
+      expect(packJs("github")).toContain("CHUNK=2000");
+      const big = Array.from({ length: 4000 }, (_, i) => `${i}-${Math.random()}`).join("\n");
+      const { dir } = takeBack(handOn({ "pr-plan.json": "{}", "pr-note.md": "n", "change-set.json": big }));
+      expect(existsSync(join(dir, "pr-plan.json"))).toBe(true);
+      expect(existsSync(join(dir, "change-set.json"))).toBe(false);
+    } finally {
+      Object.assign(HANDOVER_LIMITS.github, saved);
+    }
+  });
+
+  test("Forgejo hands on up to four outputs of a MiB each", () => {
+    expect(handoverKeys("forgejo")).toEqual(["report_0", "report_1", "report_2", "report_3"]);
+    expect(handoverKeys("github")).toEqual(["report_0"]);
+  });
+});
+
+describe("the checkout keeps no credentials (#4295)", () => {
+  test("it checks the run's commit out with the token in the fetch's environment alone, and fetches chant/lifecycle while it can", () => {
+    const top = scratch("chant-handover-checkout-");
+    const origin = join(top, "acme", "estate");
+    const seed = join(top, "seed");
+    mkdirSync(origin, { recursive: true });
+    mkdirSync(seed);
+    const g = (cwd: string, ...args: string[]) => execFileSync("git", ["-c", "user.name=t", "-c", "user.email=t@example.com", "-c", "commit.gpgsign=false", ...args], { cwd, encoding: "utf-8" }).trim();
+    g(origin, "init", "-q", "--bare");
+    g(seed, "init", "-q");
+    writeFileSync(join(seed, "a.txt"), "a\n");
+    g(seed, "add", "-A");
+    g(seed, "commit", "-q", "-m", "a");
+    const sha = g(seed, "rev-parse", "HEAD");
+    g(seed, "push", "-q", origin, "HEAD:refs/heads/main", "HEAD:refs/heads/chant/lifecycle", "HEAD:refs/pull/7/merge");
+
+    const work = join(top, "work");
+    mkdirSync(work);
+    const file = join(top, "checkout.sh");
+    writeFileSync(file, checkoutScript(true, true) + "\n");
+    const r = spawnSync("sh", ["-e", file], {
+      cwd: work,
+      env: { ...BASE, GIT_CONFIG_GLOBAL: join(top, "gitconfig"), [CHECKOUT_TOKEN_ENV]: SECRET, GITHUB_SERVER_URL: `file://${top}`, GITHUB_REPOSITORY: "acme/estate", GITHUB_REF: "refs/pull/7/merge", GITHUB_SHA: sha },
+      encoding: "utf-8",
+    });
+    expect(r.stderr).toBe("");
+    expect(r.status).toBe(0);
+    expect(g(work, "rev-parse", "HEAD")).toBe(sha);
+    expect(g(work, "rev-parse", "chant/lifecycle")).toBe(sha);
+    // Nothing of the token is left in the repository's config.
+    const config = readFileSync(join(work, ".git", "config"), "utf-8");
+    expect(config).not.toContain("extraheader");
+    expect(config).not.toContain(Buffer.from(`x-access-token:${SECRET}`).toString("base64"));
+  });
+});