@intentius/chant 0.124.40 → 0.124.41

package/dist/components/pr-pipeline.d.ts

@@ -8,8 +8,11 @@
  * values they read from the forge live here so the three cannot disagree.
  *
  * - The plan job runs `chant components pr-plan` against the pull request's
- *   target commit. It posts the note and the `chant/plan` status and writes
- *   nothing to `chant/lifecycle`, since it runs the pull request's code.
+ *   target commit. It writes nothing to `chant/lifecycle` and holds no forge
+ *   token, since it runs the pull request's code (#4295): it writes the note
+ *   and the status into its report with `--no-status`, and the `plan-note`
+ *   job after it posts them with `chant components pr-post`
+ *   ({@link prLoopPostJob}, ../ci-handover.ts).
  * - The record job (#4168 step 1, the default) runs `chant components
  *   pr-record` against the commit the push replaced. It plans the same
  *   members on the merged commit, stores the change set and writes the merge
@@ -80,6 +83,7 @@
 import type { ForgeKind } from "../pr-forge.js";
 import type { DriverComponent } from "./driver.js";
 import type { GatedWavePipelineOptions } from "./gated-wave-pipeline.js";
+import type { PipelineCloudIdentity } from "../ci-identity.js";
 /** Where both jobs write their reports, kept as a CI artifact. */
 export declare const PR_LOOP_REPORT_DIR = ".chant/pr";
 /**
@@ -156,11 +160,27 @@ export interface PrLoopPipelineOptions {
      * wave. Set from `--wave-gate` beside `--pr-loop` ({@link prLoopWithWaves}).
      */
     waveGate?: string;
+    /**
+     * The plan and apply cloud identities (#4296), from `ci.identity.cloud`
+     * resolved for the pipeline's environment and member
+     * (`resolveCloudIdentity` in ../ci-identity.ts). The plan job trades its
+     * OIDC token for the plan identity before the checkout, the record job
+     * for the plan identity, and the apply jobs for the apply identity.
+     * Absent: no job requests an OIDC token.
+     */
+    identity?: PipelineCloudIdentity;
     /**
      * Which GitHub-shaped forge the workflow is for. Set by the forgejo
      * generator, which reuses the github one; a caller never needs to.
      */
     forge?: "github" | "forgejo";
+    /**
+     * An environment per open pull request (#4298, `ci.prEnvironment`): an
+     * `env-up` job on each opened, updated or reopened pull request, an
+     * `env-down` job when it closes, and an `env-sweep` job on a schedule
+     * ({@link prEnvJobs}). Set from `--pr-env` beside `--pr-loop`. Default false.
+     */
+    prEnvironment?: boolean;
 }
 /** One job's command and the forge values it reads, as environment variables for its step. */
 export interface PrLoopJob {
@@ -215,6 +235,22 @@ export declare function prLoopBuildLines(env: string, options?: PrLoopPipelineOp
  * the commands then run in its directory, so `--output` is relative to it.
  */
 export declare function prLoopJobs(forge: ForgeKind, env: string, options?: PrLoopPipelineOptions, member?: string): PrLoopJob[];
+/** The name of the job that posts the plan's note and status (#4295). */
+export declare const PR_PLAN_NOTE_JOB = "plan-note";
+/**
+ * The plan-note job's command and the values it reads (#4295). It runs in a
+ * fresh job after the plan, at the target branch's commit, and posts the
+ * note and the `chant/plan` status from the report the plan job handed on,
+ * with the forge token the plan job never held. `HEAD_SHA` is the commit
+ * the plan job checked out, `PR_NUMBER` the pull request, and on GitHub and
+ * Forgejo `PLAN_RESULT` the plan job's result, which fails the status when
+ * the plan job failed. `BASE_SHA` is the commit the note job checks out on
+ * GitLab, whose runner checks out the pipeline's own commit.
+ */
+export declare function prLoopPostJob(forge: ForgeKind, env: string, member?: string): {
+    command: string;
+    env: Record<string, string>;
+};
 /**
  * What starts the apply under apply on merge (#4168 step 9): on GitHub the
  * tick's workflow finishing (`workflow_run`, since tags its token pushes start
@@ -290,4 +326,38 @@ export declare function gitlabBaseFallback(branch?: string): string;
  * generators' default.
  */
 export declare function githubBaseFallback(branch?: string): string;
+/** Where the pull request environment jobs (#4298) write their reports, kept as a CI artifact. */
+export declare const PR_ENV_REPORT_DIR = ".chant/pr-env";
+/** The cron the generated `env-sweep` job runs on (#4298): hourly, at a minute off the hour. */
+export declare const PR_ENV_SWEEP_CRON = "17 * * * *";
+/** One job of a pull request's environment (#4298): its command and the forge values it reads. */
+export interface PrEnvJob {
+    jobName: "env-up" | "env-post" | "env-down" | "env-sweep";
+    /** The command line. `env-up` reads `$BASE_SHA` and `$PR_NUMBER`, `env-down` `$PR_NUMBER`. */
+    command: string;
+    /** Values the command reads, as the forge spells them. `CHANT_ENV` is the pull request's environment. */
+    env: Record<string, string>;
+    /** With `build`: the build and lint lines, run before the command. */
+    build?: string[];
+}
+/** The name of the job that keeps an environment's record and posts its note (#4298, #4295). */
+export declare const PR_ENV_POST_JOB = "env-post";
+/**
+ * The jobs of a pull request's environment (#4298), when `prEnvironment` is
+ * on, in this order:
+ *
+ * - `env-up` runs `chant components pr-env up --no-push`. It runs the
+ *   change's code, so it gets no forge token (#4295): it passes no
+ *   `--forge`, and it hands its report and its record on.
+ * - `env-post` runs `pr-env post` in a fresh job at the target branch's
+ *   commit, with the token: it keeps the record on chant/lifecycle and posts
+ *   the note and the `chant/pr-env` status. On GitHub and Forgejo it reads
+ *   the up job's result as `UP_RESULT`.
+ * - `env-down` runs `pr-env down --reason closed`, and `env-sweep` runs
+ *   `pr-env sweep`. Neither builds the change's code: a teardown reads the
+ *   markers off the live resources.
+ *
+ * Each writes its report under {@link PR_ENV_REPORT_DIR}.
+ */
+export declare function prEnvJobs(forge: ForgeKind, options?: PrLoopPipelineOptions, member?: string): PrEnvJob[];
 //# sourceMappingURL=pr-pipeline.d.ts.map

package/dist/components/pr-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/pr-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAKtE,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,YAAW,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,aAAa,UAEzB,CAAC;AAEF,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAAqC,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sIAAsI;IACtI,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2OAA2O;IAC3O,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACvD;AAED,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE,CAG3F;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAkE3H;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,OAAO,GAAE,qBAA0B,GAAG,SAAS,CAEzG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,EAAE,wBAAwB,GAAG,qBAAqB,CAQ3H;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAW3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,yIAAyI;AACzI,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAErF;AAoBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D"}
+{"version":3,"file":"pr-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/pr-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAK5D,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,YAAW,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,aAAa,UAEzB,CAAC;AAEF,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAAqC,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sIAAsI;IACtI,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2OAA2O;IAC3O,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACvD;AAED,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE,CAG3F;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAoE3H;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAc9H;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,OAAO,GAAE,qBAA0B,GAAG,SAAS,CAEzG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,EAAE,wBAAwB,GAAG,qBAAqB,CAQ3H;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAW3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,yIAAyI;AACzI,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAErF;AAoBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C,kGAAkG;AAClG,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;IAC1D,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,gGAAgG;AAChG,eAAO,MAAM,eAAe,aAAa,CAAC;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,EAAE,CAkC5G"}

package/dist/components/pr-pipeline.js

@@ -8,8 +8,11 @@
  * values they read from the forge live here so the three cannot disagree.
  *
  * - The plan job runs `chant components pr-plan` against the pull request's
- *   target commit. It posts the note and the `chant/plan` status and writes
- *   nothing to `chant/lifecycle`, since it runs the pull request's code.
+ *   target commit. It writes nothing to `chant/lifecycle` and holds no forge
+ *   token, since it runs the pull request's code (#4295): it writes the note
+ *   and the status into its report with `--no-status`, and the `plan-note`
+ *   job after it posts them with `chant components pr-post`
+ *   ({@link prLoopPostJob}, ../ci-handover.ts).
  * - The record job (#4168 step 1, the default) runs `chant components
  *   pr-record` against the commit the push replaced. It plans the same
  *   members on the merged commit, stores the change set and writes the merge
@@ -79,6 +82,7 @@
  */
 import { PR_APPLY_GATE } from "../pr-loop.js";
 import { CI_IMAGE, GITHUB_JOB_TOKEN } from "../ci-jobs.js";
+import { withoutForgeTokens } from "../ci-handover.js";
 import { EMPTY_TREE_SHA } from "./changed-files.js";
 import { layerWaves } from "../gated-waves.js";
 /** The variable `chant ci run` reads its runner key from (`RUNNER_KEY_ENV` in ../workspace/ci-green.ts). */
@@ -152,16 +156,18 @@ export function prLoopJobs(forge, env, options = {}, member) {
         ...(options.reportUrl ? ["--report-url", JSON.stringify(options.reportUrl)] : []),
     ];
     const runEnv = (env) => (github ? { ...env, [RUNNER_KEY_ENV]: `\${{ secrets.${RUNNER_KEY_ENV} }}` } : env);
+    // #4295: the plan runs the pull request's code, so it gets no forge token. It writes the note and the
+    // status into its report (--no-status), and the plan-note job posts them (prLoopPostJob).
     const planEnv = github
-        ? { BASE_SHA: "${{ github.event.pull_request.base.sha }}", PR_NUMBER: "${{ github.event.pull_request.number }}", ...jobEnv }
-        : { BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID", ...jobEnv };
+        ? { BASE_SHA: "${{ github.event.pull_request.base.sha }}", PR_NUMBER: "${{ github.event.pull_request.number }}", ...withoutForgeTokens(jobEnv) }
+        : { BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID", ...withoutForgeTokens(jobEnv) };
     const greenBranch = github ? JSON.stringify(options.branch ?? "main") : options.branch ? JSON.stringify(options.branch) : "$CI_DEFAULT_BRANCH";
     const applyEnv = github ? { BASE_SHA: "${{ github.event.before }}", ...jobEnv } : { BASE_SHA: "$CI_COMMIT_BEFORE_SHA", ...jobEnv };
     return [
         {
             jobName: "plan",
             // With `waveGate` the plan's note says the later waves may stop at their own gates (#4003).
-            command: ["chant", "components", "pr-plan", "--base", '"$BASE_SHA"', "--pr", '"$PR_NUMBER"', ...common, ...(options.waveGate ? ["--wave-gate", options.waveGate] : [])].join(" "),
+            command: ["chant", "components", "pr-plan", "--base", '"$BASE_SHA"', "--pr", '"$PR_NUMBER"', ...common, ...(options.waveGate ? ["--wave-gate", options.waveGate] : []), "--no-status"].join(" "),
             env: planEnv,
             ...build,
             run: { command: ciRun("plan").join(" "), env: runEnv(planEnv) },
@@ -191,6 +197,33 @@ export function prLoopJobs(forge, env, options = {}, member) {
         },
     ];
 }
+/** The name of the job that posts the plan's note and status (#4295). */
+export const PR_PLAN_NOTE_JOB = "plan-note";
+/**
+ * The plan-note job's command and the values it reads (#4295). It runs in a
+ * fresh job after the plan, at the target branch's commit, and posts the
+ * note and the `chant/plan` status from the report the plan job handed on,
+ * with the forge token the plan job never held. `HEAD_SHA` is the commit
+ * the plan job checked out, `PR_NUMBER` the pull request, and on GitHub and
+ * Forgejo `PLAN_RESULT` the plan job's result, which fails the status when
+ * the plan job failed. `BASE_SHA` is the commit the note job checks out on
+ * GitLab, whose runner checks out the pipeline's own commit.
+ */
+export function prLoopPostJob(forge, env, member) {
+    const github = forge !== "gitlab";
+    const command = [
+        "chant", "components", "pr-post", "--pr", '"$PR_NUMBER"', "--head", '"$HEAD_SHA"',
+        "--env", env, "--output", PR_LOOP_REPORT_DIR, "--forge", forge,
+        ...(member ? ["--member", member] : []),
+        ...(github ? ["--result", '"$PLAN_RESULT"'] : []),
+    ].join(" ");
+    return {
+        command,
+        env: github
+            ? { PR_NUMBER: "${{ github.event.pull_request.number }}", HEAD_SHA: "${{ github.sha }}", PLAN_RESULT: "${{ needs.plan.result }}", GITHUB_TOKEN: GITHUB_JOB_TOKEN }
+            : { PR_NUMBER: "$CI_MERGE_REQUEST_IID", HEAD_SHA: "$CI_COMMIT_SHA", BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA" },
+    };
+}
 /**
  * What starts the apply under apply on merge (#4168 step 9): on GitHub the
  * tick's workflow finishing (`workflow_run`, since tags its token pushes start
@@ -324,3 +357,61 @@ export function gitlabBaseFallback(branch) {
 export function githubBaseFallback(branch) {
     return pushBaseFallback(JSON.stringify(branch ?? "main"), "$GITHUB_SHA");
 }
+/** Where the pull request environment jobs (#4298) write their reports, kept as a CI artifact. */
+export const PR_ENV_REPORT_DIR = ".chant/pr-env";
+/** The cron the generated `env-sweep` job runs on (#4298): hourly, at a minute off the hour. */
+export const PR_ENV_SWEEP_CRON = "17 * * * *";
+/** The name of the job that keeps an environment's record and posts its note (#4298, #4295). */
+export const PR_ENV_POST_JOB = "env-post";
+/**
+ * The jobs of a pull request's environment (#4298), when `prEnvironment` is
+ * on, in this order:
+ *
+ * - `env-up` runs `chant components pr-env up --no-push`. It runs the
+ *   change's code, so it gets no forge token (#4295): it passes no
+ *   `--forge`, and it hands its report and its record on.
+ * - `env-post` runs `pr-env post` in a fresh job at the target branch's
+ *   commit, with the token: it keeps the record on chant/lifecycle and posts
+ *   the note and the `chant/pr-env` status. On GitHub and Forgejo it reads
+ *   the up job's result as `UP_RESULT`.
+ * - `env-down` runs `pr-env down --reason closed`, and `env-sweep` runs
+ *   `pr-env sweep`. Neither builds the change's code: a teardown reads the
+ *   markers off the live resources.
+ *
+ * Each writes its report under {@link PR_ENV_REPORT_DIR}.
+ */
+export function prEnvJobs(forge, options = {}, member) {
+    const github = forge !== "gitlab";
+    const out = ["--output", PR_ENV_REPORT_DIR, ...(member ? ["--member", member] : [])];
+    const common = ["--forge", forge, ...out];
+    const token = github ? { GITHUB_TOKEN: GITHUB_JOB_TOKEN } : {};
+    const prNumber = github ? "${{ github.event.pull_request.number }}" : "$CI_MERGE_REQUEST_IID";
+    const prEnv = { CHANT_ENV: `pr-${prNumber}` };
+    const buildLines = prLoopBuildLines('"$CHANT_ENV"', options);
+    return [
+        {
+            jobName: "env-up",
+            // #4295: no --forge and no token; the record stays in the report directory for env-post.
+            command: ["chant", "components", "pr-env", "up", "--base", '"$BASE_SHA"', "--pr", '"$PR_NUMBER"', ...out, "--no-push"].join(" "),
+            env: { BASE_SHA: github ? "${{ github.event.pull_request.base.sha }}" : "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: prNumber, ...prEnv },
+            ...(buildLines.length > 0 ? { build: buildLines } : {}),
+        },
+        {
+            jobName: PR_ENV_POST_JOB,
+            command: ["chant", "components", "pr-env", "post", "--pr", '"$PR_NUMBER"', "--head", '"$HEAD_SHA"', ...common, ...(github ? ["--result", '"$UP_RESULT"'] : [])].join(" "),
+            env: github
+                ? { PR_NUMBER: prNumber, HEAD_SHA: "${{ github.sha }}", UP_RESULT: "${{ needs.env-up.result }}", ...token }
+                : { PR_NUMBER: prNumber, HEAD_SHA: "$CI_COMMIT_SHA", BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA" },
+        },
+        {
+            jobName: "env-down",
+            command: ["chant", "components", "pr-env", "down", "--pr", '"$PR_NUMBER"', "--reason", "closed", ...common].join(" "),
+            env: { PR_NUMBER: prNumber, ...prEnv, ...token },
+        },
+        {
+            jobName: "env-sweep",
+            command: ["chant", "components", "pr-env", "sweep", ...common].join(" "),
+            env: { ...token },
+        },
+    ];
+}

package/dist/components/pr-policy.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Gate-time policy on the pull-request path (#4294): `ci.policy` in the
+ * workspace declaration, run by `chant components pr-plan` and `pr-apply`
+ * over the change-set document the gate binds (`CapabilityPlan.changeSet`,
+ * composed by `planPrSet`).
+ *
+ * The settings and the policy directory are both read at the base the job
+ * measures the change from, so a pull request cannot loosen, edit or delete
+ * the policy that judges it. The engine and its result shapes are
+ * `../gate-policy.ts`.
+ *
+ * - deny: pr-apply applies nothing unless an override counts
+ *   (`../override-gate.ts`, subject the gate's op, such as `pr-12`). The
+ *   first refusal records the denial on `_gates/policy-override.jsonl`, so
+ *   `chant approve policy-override <op> --rule <id> --reason <text>` can
+ *   answer it. The gate's own approval is still needed. The override is
+ *   spent just before anything applies.
+ * - hold: the plan needs a person's approval of its own digest. pr-apply
+ *   always asks for one, so a hold changes one path: a green commit's plan
+ *   no longer applies under the approvals of the merges it carries.
+ * - error: the policy did not run or gave no readable answer. pr-apply
+ *   applies nothing.
+ */
+import type { WorkspaceTree } from "../workspace/tree.js";
+import { type GatePolicyExec, type GatePolicySettings, type GatePolicyVerdict } from "../gate-policy.js";
+import type { ChangeSetDocument } from "../change-set.js";
+import type { GateLedgerPort } from "../op/gate.js";
+import type { PrPolicyReport } from "../pr-loop.js";
+/** `ci.policy` as read at base. */
+export interface PrLoopPolicy {
+    /** Absent when the declaration at base sets none. */
+    settings?: GatePolicySettings;
+    /** The commit it was read at. */
+    base: string;
+    /** The tree of the declaration's directory at base, where the policy directory is read. */
+    tree?: WorkspaceTree;
+    /** A line for the log when no policy runs because the base has no declaration, or could not be read. */
+    note?: string;
+}
+/**
+ * The policy a pull-request job in `cwd` runs, from the declaration at
+ * `base`. Throws when the declaration at base cannot be read and the
+ * working tree's names a policy: running none would let the change waive it.
+ */
+export declare function prLoopPolicyAt(cwd: string, base: string): PrLoopPolicy;
+/** What the engine reads as `input`. */
+export interface PrPolicyInput {
+    version: 1;
+    stage: "plan" | "apply";
+    /** The gate's op, `pr-<n>`. */
+    op: string;
+    gate: string;
+    env: string;
+    pr: number | null;
+    base: string;
+    head: string;
+    /** The change-set document the gate binds. Its `entries` are every change the plan proposes. */
+    changeSet: ChangeSetDocument;
+}
+/** Run the policy over `input`. Undefined when the base sets no policy. */
+export declare function runPrPolicy(read: PrLoopPolicy, input: PrPolicyInput, exec?: GatePolicyExec): GatePolicyVerdict | undefined;
+/** The verdict as the report keeps it. */
+export declare function prPolicyReport(verdict: GatePolicyVerdict, base: string): PrPolicyReport;
+export interface PrPolicyOverrideInput {
+    port: GateLedgerPort;
+    /** The override's subject: the gate's op. */
+    subject: string;
+    /** The digest the gate binds: the change-set document's. */
+    digest: string;
+    rules: readonly string[];
+    /** The commit the overriders and signers are read at. */
+    base: string;
+    cwd: string;
+    /** Count only sealed overrides, as a sealed gate counts only sealed approvals. */
+    sealed: boolean;
+    /** Record the denial when no override counts and none stands. The plan stage records nothing. */
+    record: boolean;
+    description?: string;
+    now?: string;
+}
+/** Where an override of a denial stands. */
+export type PrPolicyOverride = {
+    status: "overridden";
+    override: NonNullable<PrPolicyReport["override"]>;
+} | {
+    status: "none";
+    refusals: string[];
+    command: string;
+    overriders: string[];
+    recorded: boolean;
+    moved?: {
+        by: string;
+    };
+};
+/**
+ * Decide a denied plan against the override ledger, as an Op waves job
+ * decides a denied run (`settleDenials` in `../op/op-waves-run.ts`).
+ */
+export declare function decidePrPolicyOverride(input: PrPolicyOverrideInput): Promise<PrPolicyOverride>;
+/**
+ * Spend the override the apply runs under: append its applied record before
+ * anything applies. Throws when it could not be written or did not reach the
+ * remote, and the caller applies nothing.
+ */
+export declare function spendPrPolicyOverride(port: GateLedgerPort, subject: string, override: NonNullable<PrPolicyReport["override"]>, at?: {
+    now?: string;
+    commit?: string;
+}): Promise<void>;
+//# sourceMappingURL=pr-policy.d.ts.map

package/dist/components/pr-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-policy.d.ts","sourceRoot":"","sources":["../../src/components/pr-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,wGAAwG;IACxG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CActE;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,SAAS,EAAE,iBAAiB,CAAC;CAC9B;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAW1H;AAED,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAWvF;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,cAAc,CAAC;IACrB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,MAAM,EAAE,OAAO,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4CAA4C;AAC5C,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;CAAE,GAC3E;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE7H;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2CpG;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/L"}

package/dist/components/pr-policy.js

@@ -0,0 +1,150 @@
+/**
+ * Gate-time policy on the pull-request path (#4294): `ci.policy` in the
+ * workspace declaration, run by `chant components pr-plan` and `pr-apply`
+ * over the change-set document the gate binds (`CapabilityPlan.changeSet`,
+ * composed by `planPrSet`).
+ *
+ * The settings and the policy directory are both read at the base the job
+ * measures the change from, so a pull request cannot loosen, edit or delete
+ * the policy that judges it. The engine and its result shapes are
+ * `../gate-policy.ts`.
+ *
+ * - deny: pr-apply applies nothing unless an override counts
+ *   (`../override-gate.ts`, subject the gate's op, such as `pr-12`). The
+ *   first refusal records the denial on `_gates/policy-override.jsonl`, so
+ *   `chant approve policy-override <op> --rule <id> --reason <text>` can
+ *   answer it. The gate's own approval is still needed. The override is
+ *   spent just before anything applies.
+ * - hold: the plan needs a person's approval of its own digest. pr-apply
+ *   always asks for one, so a hold changes one path: a green commit's plan
+ *   no longer applies under the approvals of the merges it carries.
+ * - error: the policy did not run or gave no readable answer. pr-apply
+ *   applies nothing.
+ */
+import { readDeclaration, WorkspaceReadError } from "../workspace/declaration.js";
+import { locateWorkspace } from "../workspace/which-chant.js";
+import { checkGatePolicy, DEFAULT_POLICY_PATH, exportGatePolicy, } from "../gate-policy.js";
+/** Whether the working tree's declaration names a `ci.policy`. */
+function checkoutNamesPolicy(cwd) {
+    try {
+        return readDeclaration(locateWorkspace(cwd).tree).ci?.policy !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The policy a pull-request job in `cwd` runs, from the declaration at
+ * `base`. Throws when the declaration at base cannot be read and the
+ * working tree's names a policy: running none would let the change waive it.
+ */
+export function prLoopPolicyAt(cwd, base) {
+    try {
+        const located = locateWorkspace(cwd, base);
+        const settings = readDeclaration(located.tree).ci?.policy;
+        return { base, ...(settings ? { settings, tree: located.tree } : {}) };
+    }
+    catch (err) {
+        const missing = err instanceof WorkspaceReadError && (err.code === "declaration-missing" || err.code === "not-a-git-repository");
+        const why = err instanceof Error ? err.message : String(err);
+        if (checkoutNamesPolicy(cwd)) {
+            if (missing)
+                return { base, note: `ci.policy: the base ${base.slice(0, 12)} has no workspace declaration, so the policy this change declares runs once it merges` };
+            throw new Error(`ci.policy is read from the workspace declaration at ${base.slice(0, 12)}, and it could not be read (${why}), so the policy cannot be run`);
+        }
+        return missing ? { base } : { base, note: `ci.policy: the declaration at ${base.slice(0, 12)} could not be read (${why}); this checkout names no policy, so none runs` };
+    }
+}
+/** Run the policy over `input`. Undefined when the base sets no policy. */
+export function runPrPolicy(read, input, exec) {
+    if (!read.settings || !read.tree)
+        return undefined;
+    const engine = read.settings.engine ?? "conftest";
+    const path = read.settings.path ?? DEFAULT_POLICY_PATH;
+    const exported = exportGatePolicy(read.tree, path);
+    if ("error" in exported)
+        return { result: "error", engine, denials: [], rules: [], holds: [], warnings: [], error: exported.error };
+    try {
+        return checkGatePolicy({ settings: read.settings, input, policyDir: exported.dir, cwd: process.cwd(), ...(exec ? { exec } : {}) });
+    }
+    finally {
+        exported.cleanup();
+    }
+}
+/** The verdict as the report keeps it. */
+export function prPolicyReport(verdict, base) {
+    return {
+        result: verdict.result,
+        engine: verdict.engine,
+        base,
+        denials: verdict.denials,
+        ...(verdict.rules.length > 0 ? { rules: verdict.rules } : {}),
+        holds: verdict.holds,
+        warnings: verdict.warnings,
+        ...(verdict.error !== undefined ? { error: verdict.error } : {}),
+    };
+}
+/**
+ * Decide a denied plan against the override ledger, as an Op waves job
+ * decides a denied run (`settleDenials` in `../op/op-waves-run.ts`).
+ */
+export async function decidePrPolicyOverride(input) {
+    const og = await import("../override-gate.js");
+    const overriders = og.overridersAt(input.cwd, input.base).principals;
+    const signers = input.sealed ? (await import("../gate-decision.js")).gateSignersAt(input.cwd, input.base) : undefined;
+    const ledger = await input.port.read(og.OVERRIDE_OP);
+    const applied = ((await input.port.readApplied?.(og.OVERRIDE_OP)) ?? []);
+    const now = input.now ?? new Date().toISOString();
+    const verdict = og.decideOverride({
+        ledger,
+        applied,
+        subject: input.subject,
+        planDigest: input.digest,
+        rules: input.rules,
+        overriders,
+        mode: input.sealed ? "sealed" : "ledger",
+        ...(signers ? { signers } : {}),
+        now,
+    });
+    if (verdict.status === "overridden") {
+        const o = verdict.override;
+        return { status: "overridden", override: { by: o.by, at: o.at, reason: o.reason, digest: o.digest } };
+    }
+    let recorded = false;
+    if (input.record && !verdict.standing) {
+        const { version: _v, kind: _k, ...fact } = og.overridePending({
+            subject: input.subject,
+            planDigest: input.digest,
+            rules: input.rules,
+            timestamp: now,
+            expiresAt: new Date(new Date(now).getTime() + 48 * 3600 * 1000).toISOString(),
+            ...(input.description ? { description: input.description } : {}),
+        });
+        await input.port.appendPending(fact);
+        recorded = true;
+    }
+    return {
+        status: "none",
+        refusals: verdict.refusals,
+        command: og.overrideCommand(input.subject, input.rules, input.sealed),
+        overriders,
+        recorded,
+        ...(verdict.status === "moved" ? { moved: { by: verdict.by } } : {}),
+    };
+}
+/**
+ * Spend the override the apply runs under: append its applied record before
+ * anything applies. Throws when it could not be written or did not reach the
+ * remote, and the caller applies nothing.
+ */
+export async function spendPrPolicyOverride(port, subject, override, at = {}) {
+    const og = await import("../override-gate.js");
+    if (!port.appendApplied)
+        throw new Error("this gate ledger cannot record an applied override");
+    const record = og.appliedOverride({ subject, digest: override.digest, at: override.at, by: override.by }, { timestamp: at.now ?? new Date().toISOString(), ...(at.commit ? { commit: at.commit } : {}) });
+    const pushed = await port.appendApplied(record);
+    const { isLifecycleLocalNote } = await import("../lifecycle/local-note.js");
+    if (!pushed.pushed && !isLifecycleLocalNote(pushed.pushWarning)) {
+        throw new Error(`the applied record did not reach the remote the next run reads: ${pushed.pushWarning ?? "the push did not land"}`);
+    }
+}

package/dist/components/pr-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-run.d.ts","sourceRoot":"","sources":["../../src/components/pr-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAA2C,KAAK,iBAAiB,EAA2C,MAAM,eAAe,CAAC;AACzI,OAAO,EAAgB,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAML,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,MAAM,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAC;AAElB,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAmB,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,gBAAgB;IAC/B,uHAAuH;IACvH,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,qFAAqF;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,0FAA0F;IAC1F,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD;;;;OAIG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED,mEAAmE;AACnE,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACxB,oFAAoF;IACpF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;CACjB;AAWD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAuG7E;AA0BD;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC5C,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,GAAG,SAAS,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAQnE;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAOvD;AAED,uDAAuD;AACvD,wBAAsB,YAAY,CAChC,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAI5G;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAIxG;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6FAA6F;IAC7F,GAAG,EAAE,SAAS,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC/C,qEAAqE;IACrE,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IACpF,4FAA4F;IAC5F,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KAAK,IAAI,CAAC;IAC3G,8GAA8G;IAC9G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACtH;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,UAAU,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,kFAAkF;IAClF,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,0EAA0E;IAC1E,GAAG,EAAE,eAAe,CAAC;IACrB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAmBD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAuFhF;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAqDvH;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,yGAAyG;IACzG,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,iDAAiD;IACjD,MAAM,EAAE,aAAa,CAAC;IACtB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,QAAQ,GAChB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,+CAA+C;IAC/C,IAAI,EAAE,UAAU,CAAC;IACjB,mGAAmG;IACnG,GAAG,EAAE,SAAS,CAAC;IACf,wDAAwD;IACxD,KAAK,EAAE,SAAS,CAAC;CAClB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8B7E;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,SAAS,MAAM,EAAO,GAAG,UAAU,CASvI;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,GAAE,SAAS,QAAQ,EAAO,GAAG,MAAM,EAAE,CAgBzI;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,GAAG,EAAE,SAAS,CAAC;IACf,QAAQ,EAAE,UAAU,CAAC;IACrB,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAED,iCAAiC;AACjC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,QAAQ,CAkCvD"}
+{"version":3,"file":"pr-run.d.ts","sourceRoot":"","sources":["../../src/components/pr-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAA2C,KAAK,iBAAiB,EAA2C,MAAM,eAAe,CAAC;AACzI,OAAO,EAAgB,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAML,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,MAAM,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAC;AAElB,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAmB,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,gBAAgB;IAC/B,uHAAuH;IACvH,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,qFAAqF;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,0FAA0F;IAC1F,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD;;;;OAIG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED,mEAAmE;AACnE,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACxB,oFAAoF;IACpF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;CACjB;AAWD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAuG7E;AA0BD;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC5C,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,GAAG,SAAS,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAQnE;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAOvD;AAED,uDAAuD;AACvD,wBAAsB,YAAY,CAChC,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAI5G;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAIxG;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6FAA6F;IAC7F,GAAG,EAAE,SAAS,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC/C,qEAAqE;IACrE,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IACpF,4FAA4F;IAC5F,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KAAK,IAAI,CAAC;IAC3G,8GAA8G;IAC9G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACtH;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,UAAU,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,kFAAkF;IAClF,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,0EAA0E;IAC1E,GAAG,EAAE,eAAe,CAAC;IACrB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAmBD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA0FhF;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAqDvH;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,yGAAyG;IACzG,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,iDAAiD;IACjD,MAAM,EAAE,aAAa,CAAC;IACtB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,QAAQ,GAChB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,+CAA+C;IAC/C,IAAI,EAAE,UAAU,CAAC;IACjB,mGAAmG;IACnG,GAAG,EAAE,SAAS,CAAC;IACf,wDAAwD;IACxD,KAAK,EAAE,SAAS,CAAC;CAClB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8B7E;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,SAAS,MAAM,EAAO,GAAG,UAAU,CASvI;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,GAAE,SAAS,QAAQ,EAAO,GAAG,MAAM,EAAE,CAgBzI;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,GAAG,EAAE,SAAS,CAAC;IACf,QAAQ,EAAE,UAAU,CAAC;IACrB,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAED,iCAAiC;AACjC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,QAAQ,CAkCvD"}

package/dist/components/pr-run.js

@@ -375,7 +375,7 @@ export async function applyPrSet(options) {
     }
     const completed = new Set(run.completed);
     const held = new Map((run.held ?? []).map((h) => [h.component, h]));
-    const blocked = new Set(run.blocked.map((b) => b.component));
+    const blocked = new Map(run.blocked.map((b) => [b.component, b.blockedBy]));
     const errorOf = (component) => {
         const result = [...run.results].reverse().find((r) => r.component === component);
         if (result?.status === "gated")
@@ -395,8 +395,10 @@ export async function applyPrSet(options) {
             return { ...asPlanned, status: "waiting", held: h.heldBy ? `${h.heldBy} is held: ${h.reason}` : h.reason };
         if (fresh?.status === "plan-failed")
             return { ...asPlanned, status: "plan-failed", ...(fresh.error ? { error: fresh.error } : {}) };
-        if (blocked.has(m.component))
-            return { ...asPlanned, status: "blocked" };
+        if (blocked.has(m.component)) {
+            const by = blocked.get(m.component);
+            return { ...asPlanned, status: "blocked", ...(by ? { blockedBy: by } : {}) };
+        }
         const error = errorOf(m.component);
         return { ...asPlanned, status: "failed", ...(error ? { error } : {}) };
     });

package/dist/gate-decision.d.ts

@@ -27,6 +27,11 @@
  * counts for nothing, as terragucci's wave gate has it: the caller hands in
  * the lines of `_gates/<op>/applied.jsonl` ({@link parseAppliedGateLines}).
  *
+ * Approval rules (#4290), a quorum as a list of `{ targets, count, roles,
+ * notAuthor }`, are judged with `./op/gate-quorum.ts`, re-exported here:
+ * {@link trustRolesAt} and {@link gateSignersAt} read what
+ * `trustQuorumJudge` judges by, at base.
+ *
  * The module reads the ledger lines and the review it is handed; reading
  * them is the caller's. It imports no TypeScript, esbuild, zod, ajv, lint,
  * fold or codegen module, no package's code, and none of chant's git ledger
@@ -36,19 +41,20 @@
  * `gate-decision.test.ts` decides the same ledgers both ways.
  */
 import { type AppliedGateRecord } from "./lifecycle/gate-applied.js";
-import { type GateSigners, type SealedGateApproval } from "./workspace/trust/gate-seal.js";
+import { type GateSigners, type SealedGateApproval } from "./lifecycle/gate-seal.js";
 import { type ClassGrant } from "./workspace/identity-gate-rule.js";
 import type { GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-ledger.js";
 import type { MergedReview } from "./op/gate-review.js";
 import type { GateApprovalSource } from "./op/op-waves.js";
 export { GATE_APPROVAL_SOURCES, type GateApprovalSource } from "./op/op-waves.js";
 export { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, latestResolutionSince, type PlanBoundResolution, } from "./lifecycle/gate-ledger-select.js";
-export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, type GateSigners, type SealedGateApproval, type SshSignatureCheck, } from "./workspace/trust/gate-seal.js";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, type GateSigners, type SealedGateApproval, type SshSignatureCheck, } from "./lifecycle/gate-seal.js";
 export { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, trustConfigProblems, type Signer, type SignerSet, } from "./workspace/trust/trust-files.js";
 export type { GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-ledger.js";
 export { CORE_CLASSES, admitApprover, grantedClasses, type ClassGrant, type GateAdmissionRule, type PrincipalClass, } from "./workspace/identity-gate-rule.js";
 export { appliedGateApplies, appliedGatePath, isApprovalSpent, parseAppliedGateLines, type AppliedGateRecord, } from "./lifecycle/gate-applied.js";
 export type { MergedReview } from "./op/gate-review.js";
+export { quorumNeed, quorumProblems, quorumRuleLine, quorumRuleProgress, quorumRules, quorumRulesFor, quorumWaiting, rolesOf, ruleNeedsProof, samePrincipal, targetGlobMatch, trustQuorumJudge, UNPROVEN_JUDGE, type GateQuorumJudge, type GateQuorumRule, type GateQuorumRuleProgress, type GateQuorumSpec, type QuorumApprover, type QuorumJudgement, type TrustQuorumInput, } from "./op/gate-quorum.js";
 /**
  * The commit a gate's rule is read at when the default branch applies its
  * own commit: the first parent of HEAD, the branch as it stood before the
@@ -65,6 +71,13 @@ export declare function baseCommit(repo: string): string;
  * commit the repository holds, such as {@link baseCommit}'s answer.
  */
 export declare function gateSignersAt(repo: string, base: string): GateSigners;
+/**
+ * The role grants of `.chant/trust.json` at `base` (#4290): role name to the
+ * principals that hold it, as chant reads them. A missing file gives none,
+ * and so does one that is not valid, which turns chant's trust off.
+ * {@link trustQuorumJudge} takes them with {@link gateSignersAt}'s signers.
+ */
+export declare function trustRolesAt(repo: string, base: string): Record<string, string[]>;
 /** A gate the declaration at base names under `identity.gates`, and the principal class its signer must be in, if any. */
 export interface IdentityGate {
     gate: string;