@intentius/chant 0.124.40 → 0.124.42

package/dist/components/pr-policy.js

@@ -0,0 +1,150 @@
+/**
+ * Gate-time policy on the pull-request path (#4294): `ci.policy` in the
+ * workspace declaration, run by `chant components pr-plan` and `pr-apply`
+ * over the change-set document the gate binds (`CapabilityPlan.changeSet`,
+ * composed by `planPrSet`).
+ *
+ * The settings and the policy directory are both read at the base the job
+ * measures the change from, so a pull request cannot loosen, edit or delete
+ * the policy that judges it. The engine and its result shapes are
+ * `../gate-policy.ts`.
+ *
+ * - deny: pr-apply applies nothing unless an override counts
+ *   (`../override-gate.ts`, subject the gate's op, such as `pr-12`). The
+ *   first refusal records the denial on `_gates/policy-override.jsonl`, so
+ *   `chant approve policy-override <op> --rule <id> --reason <text>` can
+ *   answer it. The gate's own approval is still needed. The override is
+ *   spent just before anything applies.
+ * - hold: the plan needs a person's approval of its own digest. pr-apply
+ *   always asks for one, so a hold changes one path: a green commit's plan
+ *   no longer applies under the approvals of the merges it carries.
+ * - error: the policy did not run or gave no readable answer. pr-apply
+ *   applies nothing.
+ */
+import { readDeclaration, WorkspaceReadError } from "../workspace/declaration.js";
+import { locateWorkspace } from "../workspace/which-chant.js";
+import { checkGatePolicy, DEFAULT_POLICY_PATH, exportGatePolicy, } from "../gate-policy.js";
+/** Whether the working tree's declaration names a `ci.policy`. */
+function checkoutNamesPolicy(cwd) {
+    try {
+        return readDeclaration(locateWorkspace(cwd).tree).ci?.policy !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The policy a pull-request job in `cwd` runs, from the declaration at
+ * `base`. Throws when the declaration at base cannot be read and the
+ * working tree's names a policy: running none would let the change waive it.
+ */
+export function prLoopPolicyAt(cwd, base) {
+    try {
+        const located = locateWorkspace(cwd, base);
+        const settings = readDeclaration(located.tree).ci?.policy;
+        return { base, ...(settings ? { settings, tree: located.tree } : {}) };
+    }
+    catch (err) {
+        const missing = err instanceof WorkspaceReadError && (err.code === "declaration-missing" || err.code === "not-a-git-repository");
+        const why = err instanceof Error ? err.message : String(err);
+        if (checkoutNamesPolicy(cwd)) {
+            if (missing)
+                return { base, note: `ci.policy: the base ${base.slice(0, 12)} has no workspace declaration, so the policy this change declares runs once it merges` };
+            throw new Error(`ci.policy is read from the workspace declaration at ${base.slice(0, 12)}, and it could not be read (${why}), so the policy cannot be run`);
+        }
+        return missing ? { base } : { base, note: `ci.policy: the declaration at ${base.slice(0, 12)} could not be read (${why}); this checkout names no policy, so none runs` };
+    }
+}
+/** Run the policy over `input`. Undefined when the base sets no policy. */
+export function runPrPolicy(read, input, exec) {
+    if (!read.settings || !read.tree)
+        return undefined;
+    const engine = read.settings.engine ?? "conftest";
+    const path = read.settings.path ?? DEFAULT_POLICY_PATH;
+    const exported = exportGatePolicy(read.tree, path);
+    if ("error" in exported)
+        return { result: "error", engine, denials: [], rules: [], holds: [], warnings: [], error: exported.error };
+    try {
+        return checkGatePolicy({ settings: read.settings, input, policyDir: exported.dir, cwd: process.cwd(), ...(exec ? { exec } : {}) });
+    }
+    finally {
+        exported.cleanup();
+    }
+}
+/** The verdict as the report keeps it. */
+export function prPolicyReport(verdict, base) {
+    return {
+        result: verdict.result,
+        engine: verdict.engine,
+        base,
+        denials: verdict.denials,
+        ...(verdict.rules.length > 0 ? { rules: verdict.rules } : {}),
+        holds: verdict.holds,
+        warnings: verdict.warnings,
+        ...(verdict.error !== undefined ? { error: verdict.error } : {}),
+    };
+}
+/**
+ * Decide a denied plan against the override ledger, as an Op waves job
+ * decides a denied run (`settleDenials` in `../op/op-waves-run.ts`).
+ */
+export async function decidePrPolicyOverride(input) {
+    const og = await import("../override-gate.js");
+    const overriders = og.overridersAt(input.cwd, input.base).principals;
+    const signers = input.sealed ? (await import("../gate-decision.js")).gateSignersAt(input.cwd, input.base) : undefined;
+    const ledger = await input.port.read(og.OVERRIDE_OP);
+    const applied = ((await input.port.readApplied?.(og.OVERRIDE_OP)) ?? []);
+    const now = input.now ?? new Date().toISOString();
+    const verdict = og.decideOverride({
+        ledger,
+        applied,
+        subject: input.subject,
+        planDigest: input.digest,
+        rules: input.rules,
+        overriders,
+        mode: input.sealed ? "sealed" : "ledger",
+        ...(signers ? { signers } : {}),
+        now,
+    });
+    if (verdict.status === "overridden") {
+        const o = verdict.override;
+        return { status: "overridden", override: { by: o.by, at: o.at, reason: o.reason, digest: o.digest } };
+    }
+    let recorded = false;
+    if (input.record && !verdict.standing) {
+        const { version: _v, kind: _k, ...fact } = og.overridePending({
+            subject: input.subject,
+            planDigest: input.digest,
+            rules: input.rules,
+            timestamp: now,
+            expiresAt: new Date(new Date(now).getTime() + 48 * 3600 * 1000).toISOString(),
+            ...(input.description ? { description: input.description } : {}),
+        });
+        await input.port.appendPending(fact);
+        recorded = true;
+    }
+    return {
+        status: "none",
+        refusals: verdict.refusals,
+        command: og.overrideCommand(input.subject, input.rules, input.sealed),
+        overriders,
+        recorded,
+        ...(verdict.status === "moved" ? { moved: { by: verdict.by } } : {}),
+    };
+}
+/**
+ * Spend the override the apply runs under: append its applied record before
+ * anything applies. Throws when it could not be written or did not reach the
+ * remote, and the caller applies nothing.
+ */
+export async function spendPrPolicyOverride(port, subject, override, at = {}) {
+    const og = await import("../override-gate.js");
+    if (!port.appendApplied)
+        throw new Error("this gate ledger cannot record an applied override");
+    const record = og.appliedOverride({ subject, digest: override.digest, at: override.at, by: override.by }, { timestamp: at.now ?? new Date().toISOString(), ...(at.commit ? { commit: at.commit } : {}) });
+    const pushed = await port.appendApplied(record);
+    const { isLifecycleLocalNote } = await import("../lifecycle/local-note.js");
+    if (!pushed.pushed && !isLifecycleLocalNote(pushed.pushWarning)) {
+        throw new Error(`the applied record did not reach the remote the next run reads: ${pushed.pushWarning ?? "the push did not land"}`);
+    }
+}

package/dist/components/pr-run.d.ts

@@ -87,6 +87,8 @@ export interface PrPlanSetOptions {
     vars?: Record<string, unknown>;
     /** Outputs supplied by the caller (`--seed-outputs`). They win over outputs read here. */
     seededOutputs?: Record<string, Record<string, unknown>>;
+    /** The addresses each component narrows to (#4300), by component: its steps' `DeployContext.targets`. */
+    targets?: Readonly<Record<string, readonly string[]>>;
     /**
      * Where the planning's events go (#4041): a `plan` phase with no
      * component, and in it one `plan` step per component, started as its wave
@@ -174,6 +176,8 @@ export interface PrApplyOptions {
     vars?: Record<string, unknown>;
     /** The set {@link planPrSet} planned and the gate approved, or {@link resumePrSet}'s set. */
     set: PrPlanSet;
+    /** The addresses each component narrows to (#4300), by component: its steps' `DeployContext.targets`. */
+    targets?: Readonly<Record<string, readonly string[]>>;
     onProgress?: (event: RunProgressEvent) => void;
     /** Where the apply's events go (#4041): the fan-out's run events. */
     onRunEvent?: RunEventSink;
@@ -255,6 +259,8 @@ export interface PrResumeOptions {
     env: string;
     vars?: Record<string, unknown>;
     seededOutputs?: Record<string, Record<string, unknown>>;
+    /** The addresses each component narrows to (#4300), by component: its steps' `DeployContext.targets`. */
+    targets?: Readonly<Record<string, readonly string[]>>;
     /** The approved set, from the attempt record. */
     record: PrApplyRecord;
     /** Components an earlier attempt applied. */

package/dist/components/pr-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-run.d.ts","sourceRoot":"","sources":["../../src/components/pr-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAA2C,KAAK,iBAAiB,EAA2C,MAAM,eAAe,CAAC;AACzI,OAAO,EAAgB,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAML,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,MAAM,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAC;AAElB,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAmB,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,gBAAgB;IAC/B,uHAAuH;IACvH,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,qFAAqF;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,0FAA0F;IAC1F,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD;;;;OAIG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED,mEAAmE;AACnE,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACxB,oFAAoF;IACpF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;CACjB;AAWD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAuG7E;AA0BD;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC5C,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,GAAG,SAAS,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAQnE;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAOvD;AAED,uDAAuD;AACvD,wBAAsB,YAAY,CAChC,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAI5G;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAIxG;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6FAA6F;IAC7F,GAAG,EAAE,SAAS,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC/C,qEAAqE;IACrE,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IACpF,4FAA4F;IAC5F,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KAAK,IAAI,CAAC;IAC3G,8GAA8G;IAC9G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACtH;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,UAAU,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,kFAAkF;IAClF,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,0EAA0E;IAC1E,GAAG,EAAE,eAAe,CAAC;IACrB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAmBD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAuFhF;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAqDvH;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,yGAAyG;IACzG,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,iDAAiD;IACjD,MAAM,EAAE,aAAa,CAAC;IACtB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,QAAQ,GAChB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,+CAA+C;IAC/C,IAAI,EAAE,UAAU,CAAC;IACjB,mGAAmG;IACnG,GAAG,EAAE,SAAS,CAAC;IACf,wDAAwD;IACxD,KAAK,EAAE,SAAS,CAAC;CAClB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8B7E;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,SAAS,MAAM,EAAO,GAAG,UAAU,CASvI;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,GAAE,SAAS,QAAQ,EAAO,GAAG,MAAM,EAAE,CAgBzI;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,GAAG,EAAE,SAAS,CAAC;IACf,QAAQ,EAAE,UAAU,CAAC;IACrB,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAED,iCAAiC;AACjC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,QAAQ,CAkCvD"}
+{"version":3,"file":"pr-run.d.ts","sourceRoot":"","sources":["../../src/components/pr-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAA2C,KAAK,iBAAiB,EAA2C,MAAM,eAAe,CAAC;AACzI,OAAO,EAAgB,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAML,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,MAAM,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAC;AAElB,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAmB,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,gBAAgB;IAC/B,uHAAuH;IACvH,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,qFAAqF;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,0FAA0F;IAC1F,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,yGAAyG;IACzG,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED,mEAAmE;AACnE,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACxB,oFAAoF;IACpF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;CACjB;AAWD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAuG7E;AA0BD;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC5C,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,GAAG,SAAS,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAQnE;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAOvD;AAED,uDAAuD;AACvD,wBAAsB,YAAY,CAChC,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAI5G;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAIxG;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6FAA6F;IAC7F,GAAG,EAAE,SAAS,CAAC;IACf,yGAAyG;IACzG,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC/C,qEAAqE;IACrE,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IACpF,4FAA4F;IAC5F,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KAAK,IAAI,CAAC;IAC3G,8GAA8G;IAC9G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACtH;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,UAAU,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,kFAAkF;IAClF,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,0EAA0E;IAC1E,GAAG,EAAE,eAAe,CAAC;IACrB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAmBD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA4FhF;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAqDvH;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,yGAAyG;IACzG,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,yGAAyG;IACzG,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,iDAAiD;IACjD,MAAM,EAAE,aAAa,CAAC;IACtB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,QAAQ,GAChB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,+CAA+C;IAC/C,IAAI,EAAE,UAAU,CAAC;IACjB,mGAAmG;IACnG,GAAG,EAAE,SAAS,CAAC;IACf,wDAAwD;IACxD,KAAK,EAAE,SAAS,CAAC;CAClB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+B7E;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,SAAS,MAAM,EAAO,GAAG,UAAU,CASvI;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,GAAE,SAAS,QAAQ,EAAO,GAAG,MAAM,EAAE,CAgBzI;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,GAAG,EAAE,SAAS,CAAC;IACf,QAAQ,EAAE,UAAU,CAAC;IACrB,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAED,iCAAiC;AACjC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,QAAQ,CAkCvD"}

package/dist/components/pr-run.js

@@ -329,6 +329,7 @@ export async function applyPrSet(options) {
         env: options.env,
         ...(options.vars ? { vars: options.vars } : {}),
         plans,
+        ...(options.targets ? { targets: options.targets } : {}),
         componentOutputs: outputs,
         hold: (name, now) => heldReason(byName.get(name), read, now, inChange),
         ...(options.onProgress ? { onProgress: options.onProgress } : {}),
@@ -352,6 +353,7 @@ export async function applyPrSet(options) {
             env: options.env,
             ...(options.vars ? { vars: options.vars } : {}),
             seededOutputs: run.componentOutputs,
+            ...(options.targets ? { targets: options.targets } : {}),
         });
         for (const name of plan.order)
             roundOf.set(name, { round, set });
@@ -375,7 +377,7 @@ export async function applyPrSet(options) {
     }
     const completed = new Set(run.completed);
     const held = new Map((run.held ?? []).map((h) => [h.component, h]));
-    const blocked = new Set(run.blocked.map((b) => b.component));
+    const blocked = new Map(run.blocked.map((b) => [b.component, b.blockedBy]));
     const errorOf = (component) => {
         const result = [...run.results].reverse().find((r) => r.component === component);
         if (result?.status === "gated")
@@ -395,8 +397,10 @@ export async function applyPrSet(options) {
             return { ...asPlanned, status: "waiting", held: h.heldBy ? `${h.heldBy} is held: ${h.reason}` : h.reason };
         if (fresh?.status === "plan-failed")
             return { ...asPlanned, status: "plan-failed", ...(fresh.error ? { error: fresh.error } : {}) };
-        if (blocked.has(m.component))
-            return { ...asPlanned, status: "blocked" };
+        if (blocked.has(m.component)) {
+            const by = blocked.get(m.component);
+            return { ...asPlanned, status: "blocked", ...(by ? { blockedBy: by } : {}) };
+        }
         const error = errorOf(m.component);
         return { ...asPlanned, status: "failed", ...(error ? { error } : {}) };
     });
@@ -516,6 +520,7 @@ export async function resumePrSet(options) {
         env: options.env,
         ...(options.vars ? { vars: options.vars } : {}),
         seededOutputs: { ...(options.seededOutputs ?? {}), ...options.record.planOutputs },
+        ...(options.targets ? { targets: options.targets } : {}),
     });
     const reasons = fresh.doc.members
         .map((m) => planCoveredBy(options.record.changeSet, fresh.doc, m.member))

package/dist/components/wave-plan.d.ts

@@ -27,7 +27,7 @@
  * `@<component>.publish.*`) resolves.
  */
 import { type DriverComponent, type DriverPhase, type DriverStep } from "./driver.js";
-import type { CapabilityRegistry, DeployContext, PlannedOutputs } from "./capability.js";
+import type { CapabilityPlan, CapabilityRegistry, DeployContext, PlannedOutputs } from "./capability.js";
 import type { WaveMember } from "../gated-waves.js";
 import type { ChangeSetPart } from "../change-set.js";
 /**
@@ -59,6 +59,19 @@ export declare function capabilitySteps(phases: readonly DriverPhase[]): DriverS
 export declare function planContext(ctx: DeployContext, stepInput: Record<string, unknown>, componentOutputs: Record<string, Record<string, unknown>>): DeployContext;
 /** Plan one component against the outputs earlier waves produced. Never throws: a failure comes back as `error`. */
 export declare function planWaveComponent(component: DriverComponent, registry: CapabilityRegistry, ctx: DeployContext, componentOutputs: Record<string, Record<string, unknown>>): Promise<WaveComponentPlan>;
+/**
+ * A member's digest with its targets in it (#4300), the way terragucci's
+ * cone plan digest binds a cone: the digest over the plan's own digest and
+ * the sorted targets, so an approval of one narrowing covers no other.
+ */
+export declare function targetedPlanDigest(planDigest: string, targets: readonly string[]): string;
+/**
+ * A step's plan made with `ctx.targets` (#4300), its digest bound to them.
+ * The plan must give back the targets it was asked for, which says it planned
+ * those alone; one that gives back others, or none, refuses. Without
+ * `ctx.targets`, the plan as it came.
+ */
+export declare function bindTargets(kind: string, ctx: DeployContext, planned: CapabilityPlan): CapabilityPlan;
 /**
  * The outputs `component` exposes now, read from each step whose capability
  * has `outputs` (#3183), merged the way the driver merges a run's outputs.

package/dist/components/wave-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wave-plan.d.ts","sourceRoot":"","sources":["../../src/components/wave-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAA6C,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAI9H,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAA;CAAE,GAC9H;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAWzC,0GAA0G;AAC1G,eAAO,MAAM,gBAAgB,cAAe,MAAM,KAAG,MAA+B,CAAC;AAErF,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,UAAU,EAAE,CAc5E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,aAAa,EAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,aAAa,CAGf;AAED,oHAAoH;AACpH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,eAAe,EAC1B,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,aAAa,EAClB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,OAAO,CAAC,iBAAiB,CAAC,CAgD5B;AAUD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,eAAe,EAC1B,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,aAAa,EAClB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAU9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,EAChD,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,aAAa,EAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC/C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAYnC"}
+{"version":3,"file":"wave-plan.d.ts","sourceRoot":"","sources":["../../src/components/wave-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAoE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAIrJ,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACtG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAA;CAAE,GAC9H;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAWzC,0GAA0G;AAC1G,eAAO,MAAM,gBAAgB,cAAe,MAAM,KAAG,MAA+B,CAAC;AAErF,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,UAAU,EAAE,CAc5E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,aAAa,EAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,aAAa,CAGf;AAED,oHAAoH;AACpH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,eAAe,EAC1B,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,aAAa,EAClB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,OAAO,CAAC,iBAAiB,CAAC,CAkD5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEzF;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,GAAG,cAAc,CAgBrG;AAUD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,eAAe,EAC1B,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,aAAa,EAClB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAU9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,EAChD,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,aAAa,EAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC/C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAYnC"}

package/dist/components/wave-plan.js

@@ -26,7 +26,7 @@
  * plans as `undefined`. Cross-component wiring (`stackOutput()`,
  * `@<component>.publish.*`) resolves.
  */
-import { resolveStepInput, unresolvedWiringSources } from "./driver.js";
+import { assertTargetsAccepted, resolveStepInput, unresolvedWiringSources } from "./driver.js";
 import { componentPlanDigest } from "./gate-plan.js";
 import { componentDeployInputs } from "./deploy-inputs.js";
 import { computePlanDigest } from "../lifecycle/plan-digest.js";
@@ -73,13 +73,14 @@ export async function planWaveComponent(component, registry, ctx, componentOutpu
         const plans = {};
         const parts = [];
         let outputs;
+        assertTargetsAccepted(component, registry, ctx);
         for (const step of capabilitySteps(component.deploy)) {
             const capability = registry.resolve(step.kind);
             if (!capability.plan)
                 continue;
             const { kind: _kind, ...rest } = step;
             const input = resolveStepInput(rest, {}, componentOutputs);
-            const planned = await capability.plan(planContext(ctx, rest, componentOutputs), input);
+            const planned = bindTargets(step.kind, ctx, await capability.plan(planContext(ctx, rest, componentOutputs), input));
             const member = { member: planned.member, planDigest: planned.planDigest };
             members.push(member);
             parts.push(planned.changeSet ?? emptyPart(member));
@@ -99,6 +100,7 @@ export async function planWaveComponent(component, registry, ctx, componentOutpu
                     component,
                     ...(ctx.vars ? { vars: ctx.vars } : {}),
                     inputs: read.inputs,
+                    ...(ctx.targets ? { targets: ctx.targets } : {}),
                 }),
             };
             members.push(member);
@@ -121,6 +123,36 @@ export async function planWaveComponent(component, registry, ctx, componentOutpu
         return { component: component.name, error: err instanceof Error ? err.message : String(err) };
     }
 }
+/**
+ * A member's digest with its targets in it (#4300), the way terragucci's
+ * cone plan digest binds a cone: the digest over the plan's own digest and
+ * the sorted targets, so an approval of one narrowing covers no other.
+ */
+export function targetedPlanDigest(planDigest, targets) {
+    return computePlanDigest("capability-targets", { plan: planDigest, targets: [...new Set(targets)].sort() });
+}
+/**
+ * A step's plan made with `ctx.targets` (#4300), its digest bound to them.
+ * The plan must give back the targets it was asked for, which says it planned
+ * those alone; one that gives back others, or none, refuses. Without
+ * `ctx.targets`, the plan as it came.
+ */
+export function bindTargets(kind, ctx, planned) {
+    const asked = ctx.targets;
+    if (!asked || asked.length === 0)
+        return planned;
+    const want = [...new Set(asked)].sort();
+    const got = [...new Set(planned.targets ?? [])].sort();
+    if (got.length !== want.length || got.some((t, i) => t !== want[i])) {
+        throw new Error(`component "${ctx.component}": ${kind} was asked to plan ${want.join(", ")} but its plan of ${planned.member} ` +
+            (got.length === 0 ? "names no targets" : `names ${got.join(", ")}`));
+    }
+    const planDigest = targetedPlanDigest(planned.planDigest, want);
+    const changeSet = planned.changeSet
+        ? { ...planned.changeSet, member: { ...planned.changeSet.member, planDigest } }
+        : undefined;
+    return { ...planned, planDigest, targets: want, ...(changeSet ? { changeSet } : {}) };
+}
 /** `next` over `prior`, as a later step's outputs win over an earlier one's in a run. */
 function mergePlannedOutputs(prior, next) {
     const known = { ...(prior?.known ?? {}), ...next.known };

package/dist/gate-decision.d.ts

@@ -27,6 +27,11 @@
  * counts for nothing, as terragucci's wave gate has it: the caller hands in
  * the lines of `_gates/<op>/applied.jsonl` ({@link parseAppliedGateLines}).
  *
+ * Approval rules (#4290), a quorum as a list of `{ targets, count, roles,
+ * notAuthor }`, are judged with `./op/gate-quorum.ts`, re-exported here:
+ * {@link trustRolesAt} and {@link gateSignersAt} read what
+ * `trustQuorumJudge` judges by, at base.
+ *
  * The module reads the ledger lines and the review it is handed; reading
  * them is the caller's. It imports no TypeScript, esbuild, zod, ajv, lint,
  * fold or codegen module, no package's code, and none of chant's git ledger
@@ -36,19 +41,20 @@
  * `gate-decision.test.ts` decides the same ledgers both ways.
  */
 import { type AppliedGateRecord } from "./lifecycle/gate-applied.js";
-import { type GateSigners, type SealedGateApproval } from "./workspace/trust/gate-seal.js";
+import { type GateSigners, type SealedGateApproval } from "./lifecycle/gate-seal.js";
 import { type ClassGrant } from "./workspace/identity-gate-rule.js";
 import type { GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-ledger.js";
 import type { MergedReview } from "./op/gate-review.js";
 import type { GateApprovalSource } from "./op/op-waves.js";
 export { GATE_APPROVAL_SOURCES, type GateApprovalSource } from "./op/op-waves.js";
 export { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, latestResolutionSince, type PlanBoundResolution, } from "./lifecycle/gate-ledger-select.js";
-export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, type GateSigners, type SealedGateApproval, type SshSignatureCheck, } from "./workspace/trust/gate-seal.js";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, type GateSigners, type SealedGateApproval, type SshSignatureCheck, } from "./lifecycle/gate-seal.js";
 export { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, trustConfigProblems, type Signer, type SignerSet, } from "./workspace/trust/trust-files.js";
 export type { GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-ledger.js";
 export { CORE_CLASSES, admitApprover, grantedClasses, type ClassGrant, type GateAdmissionRule, type PrincipalClass, } from "./workspace/identity-gate-rule.js";
 export { appliedGateApplies, appliedGatePath, isApprovalSpent, parseAppliedGateLines, type AppliedGateRecord, } from "./lifecycle/gate-applied.js";
 export type { MergedReview } from "./op/gate-review.js";
+export { quorumNeed, quorumProblems, quorumRuleLine, quorumRuleProgress, quorumRules, quorumRulesFor, quorumWaiting, rolesOf, ruleNeedsProof, samePrincipal, targetGlobMatch, trustQuorumJudge, UNPROVEN_JUDGE, type GateQuorumJudge, type GateQuorumRule, type GateQuorumRuleProgress, type GateQuorumSpec, type QuorumApprover, type QuorumJudgement, type TrustQuorumInput, } from "./op/gate-quorum.js";
 /**
  * The commit a gate's rule is read at when the default branch applies its
  * own commit: the first parent of HEAD, the branch as it stood before the
@@ -65,6 +71,13 @@ export declare function baseCommit(repo: string): string;
  * commit the repository holds, such as {@link baseCommit}'s answer.
  */
 export declare function gateSignersAt(repo: string, base: string): GateSigners;
+/**
+ * The role grants of `.chant/trust.json` at `base` (#4290): role name to the
+ * principals that hold it, as chant reads them. A missing file gives none,
+ * and so does one that is not valid, which turns chant's trust off.
+ * {@link trustQuorumJudge} takes them with {@link gateSignersAt}'s signers.
+ */
+export declare function trustRolesAt(repo: string, base: string): Record<string, string[]>;
 /** A gate the declaration at base names under `identity.gates`, and the principal class its signer must be in, if any. */
 export interface IdentityGate {
     gate: string;

package/dist/gate-decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-decision.d.ts","sourceRoot":"","sources":["../src/gate-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAWH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAQzG,OAAO,EAA+B,KAAK,UAAU,EAA+C,MAAM,gCAAgC,CAAC;AAE3I,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAcrD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/C;AAwBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAErE;AAED,0HAA0H;AAC1H,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAmBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAG1E;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,YAAY,CAAC;IAC1B,+HAA+H;IAC/H,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAAC;CACtD;AAoDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,qBAAqB,GAAG,IAAI,CAc9B;AAID,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7F;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAmBnH;AAID,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,sIAAsI;IACtI,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iHAAiH;IACjH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5D,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;CAAE,GAC1E;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,wHAAwH;IACxH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,yGAAyG;IACzG,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,iFAAiF;IACjF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,yDAAyD;IACzD,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,wHAAwH;IACxH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAIN;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,oBAAoB,CA6CjF"}
+{"version":3,"file":"gate-decision.d.ts","sourceRoot":"","sources":["../src/gate-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAWH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAQnG,OAAO,EAA+B,KAAK,UAAU,EAA+C,MAAM,gCAAgC,CAAC;AAE3I,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EACL,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,aAAa,EACb,OAAO,EACP,cAAc,EACd,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAc1B;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/C;AAwBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAEjF;AAED,0HAA0H;AAC1H,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAmBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAG1E;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,YAAY,CAAC;IAC1B,+HAA+H;IAC/H,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAAC;CACtD;AAoDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,qBAAqB,GAAG,IAAI,CAc9B;AAID,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7F;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAmBnH;AAID,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,sIAAsI;IACtI,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iHAAiH;IACjH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5D,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;CAAE,GAC1E;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,wHAAwH;IACxH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,yGAAyG;IACzG,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,iFAAiF;IACjF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,yDAAyD;IACzD,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,wHAAwH;IACxH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAIN;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,oBAAoB,CA6CjF"}

package/dist/gate-decision.js

@@ -27,6 +27,11 @@
  * counts for nothing, as terragucci's wave gate has it: the caller hands in
  * the lines of `_gates/<op>/applied.jsonl` ({@link parseAppliedGateLines}).
  *
+ * Approval rules (#4290), a quorum as a list of `{ targets, count, roles,
+ * notAuthor }`, are judged with `./op/gate-quorum.ts`, re-exported here:
+ * {@link trustRolesAt} and {@link gateSignersAt} read what
+ * `trustQuorumJudge` judges by, at base.
+ *
  * The module reads the ledger lines and the review it is handed; reading
  * them is the caller's. It imports no TypeScript, esbuild, zod, ajv, lint,
  * fold or codegen module, no package's code, and none of chant's git ledger
@@ -41,17 +46,18 @@ import { join, posix } from "node:path";
 import { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, } from "./lifecycle/gate-ledger-select.js";
 import { samePlanDigest } from "./lifecycle/plan-digest.js";
 import { isApprovalSpent } from "./lifecycle/gate-applied.js";
-import { gateSealRefusal } from "./workspace/trust/gate-seal.js";
+import { gateSealRefusal } from "./lifecycle/gate-seal.js";
 import { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, trustConfigProblems, } from "./workspace/trust/trust-files.js";
 import { parseJsonText } from "./workspace/jsonc.js";
 import { CORE_CLASSES, admitApprover } from "./workspace/identity-gate-rule.js";
 import { diskFiles, findInstalledPackage, mergePinClasses, parseClassDataByHand, readClassFiles } from "./workspace/class-data.js";
 export { GATE_APPROVAL_SOURCES } from "./op/op-waves.js";
 export { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, latestResolutionSince, } from "./lifecycle/gate-ledger-select.js";
-export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, } from "./workspace/trust/gate-seal.js";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, } from "./lifecycle/gate-seal.js";
 export { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, trustConfigProblems, } from "./workspace/trust/trust-files.js";
 export { CORE_CLASSES, admitApprover, grantedClasses, } from "./workspace/identity-gate-rule.js";
 export { appliedGateApplies, appliedGatePath, isApprovalSpent, parseAppliedGateLines, } from "./lifecycle/gate-applied.js";
+export { quorumNeed, quorumProblems, quorumRuleLine, quorumRuleProgress, quorumRules, quorumRulesFor, quorumWaiting, rolesOf, ruleNeedsProof, samePrincipal, targetGlobMatch, trustQuorumJudge, UNPROVEN_JUDGE, } from "./op/gate-quorum.js";
 // ── reading at base ──────────────────────────────────────────────────────
 function git(repo, args) {
     return spawnSync("git", args, { cwd: repo, encoding: "utf-8" });
@@ -118,6 +124,15 @@ function trustAt(repo, base) {
 export function gateSignersAt(repo, base) {
     return trustAt(repo, base).signers;
 }
+/**
+ * The role grants of `.chant/trust.json` at `base` (#4290): role name to the
+ * principals that hold it, as chant reads them. A missing file gives none,
+ * and so does one that is not valid, which turns chant's trust off.
+ * {@link trustQuorumJudge} takes them with {@link gateSignersAt}'s signers.
+ */
+export function trustRolesAt(repo, base) {
+    return trustAt(repo, base).roles;
+}
 /** The declaration at `base`, parsed, or null when there is none. Throws when it cannot be parsed. */
 function declarationAt(repo, base) {
     for (const file of ["chant.workspace.json", "chant.workspace.jsonc"]) {

package/dist/gate-policy.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Gate-time policy (#4294): a policy engine run over a plan's change set,
+ * with the policy read at base, whose rules deny a plan or hold it for a
+ * person.
+ *
+ * The engine is any command that prints conftest's JSON result
+ * (`conftest test --output json`) or OPA's (`opa eval --format json`). The
+ * rules are counted as conftest counts them:
+ *
+ * - `deny`, `violation`, `deny_<name>` and `violation_<name>` deny the plan.
+ *   A denied plan applies only under an override that counts
+ *   (`./override-gate.ts`), on top of the gate's own approval.
+ * - `hold` and `hold_<name>` hold the plan: it waits for a person's approval
+ *   of its digest, even where the gate would let it through without one.
+ *   conftest runs only deny and warn rules, so a hold needs the opa shape.
+ * - `warn` and `warn_<name>` are advice. They fail nothing.
+ *
+ * There is no outcome that lets a plan apply with nobody approving it: a
+ * non-empty change set always waits for a person (ws-104, ws-080). A rule
+ * named `allow_unattended` is read as no rule at all.
+ *
+ * A policy that cannot run, or gives no answer this module can read, is an
+ * error, and the caller stops the apply: no path waives a policy.
+ *
+ * Like `./override-gate.ts` this module reads what it is handed and imports
+ * only node built-ins, so a product can bundle it into one file
+ * (`gate-policy-bundle.test.ts`). The pull-request jobs' use of it is in
+ * `./components/pr-policy.ts`.
+ */
+/** The result shapes chant reads: conftest's and OPA's. */
+export declare const GATE_POLICY_ENGINES: readonly ["conftest", "opa"];
+export type GatePolicyEngine = (typeof GATE_POLICY_ENGINES)[number];
+/** Where the policy is read when the settings name no `path`. */
+export declare const DEFAULT_POLICY_PATH = "policy";
+/** The settings of one policy step, read at base. */
+export interface GatePolicySettings {
+    /** The result shape, and the default command. Default `conftest`. */
+    engine?: GatePolicyEngine;
+    /** The policy directory, relative to the declaration at base. Default {@link DEFAULT_POLICY_PATH}. */
+    path?: string;
+    /** The package to read. conftest default: every namespace. opa default: `main`. */
+    namespace?: string;
+    /**
+     * The command to run instead of the engine's own, as argv. `{policy}` is
+     * the policy directory exported from base and `{input}` the input file. It
+     * prints the result shape `engine` names.
+     */
+    command?: string[];
+}
+/** A rule that matched, and what it said. */
+export interface GatePolicyFinding {
+    /** `<package>.<rule>`, such as `main.deny_public_bucket`. */
+    rule: string;
+    message: string;
+}
+/** What an engine's answer holds. */
+export interface GatePolicyFindings {
+    denials: GatePolicyFinding[];
+    holds: GatePolicyFinding[];
+    warnings: string[];
+}
+/**
+ * One policy check's outcome. `denied` wins over `held`. `error`: the
+ * policy did not run or gave no readable answer, and the apply stops.
+ */
+export interface GatePolicyVerdict {
+    result: "passed" | "denied" | "held" | "error";
+    engine: GatePolicyEngine;
+    denials: GatePolicyFinding[];
+    /** The ids of the rules that denied, sorted, each once: what an override names. */
+    rules: string[];
+    holds: GatePolicyFinding[];
+    warnings: string[];
+    error?: string;
+}
+export declare const DENY_RULE: RegExp;
+export declare const WARN_RULE: RegExp;
+export declare const HOLD_RULE: RegExp;
+/** The findings in `conftest test --output json`. Undefined when it is not that shape. */
+export declare function conftestFindings(stdout: string): GatePolicyFindings | undefined;
+/**
+ * The findings in `opa eval --format json data.<namespace>`. The query's
+ * value is the package: its rules are read by name. An array value is a
+ * deny set named after the query. A query that is undefined has no rule
+ * that matched. Undefined when the output is not that shape.
+ */
+export declare function opaFindings(stdout: string, namespace?: string): GatePolicyFindings | undefined;
+/** A verdict from what the engine found. */
+export declare function gatePolicyVerdict(engine: GatePolicyEngine, found: GatePolicyFindings): GatePolicyVerdict;
+/** The argv one check runs: the settings' `command` with its placeholders filled, or the engine's own. */
+export declare function gatePolicyArgv(settings: GatePolicySettings, at: {
+    policy: string;
+    input: string;
+}): string[];
+/** What one run of the engine printed and how it exited. `status` is null when it did not start. */
+export interface GatePolicyRun {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+export type GatePolicyExec = (argv: string[], cwd: string) => GatePolicyRun;
+/** Runs the engine with the job's environment. */
+export declare const defaultGatePolicyExec: GatePolicyExec;
+export interface CheckGatePolicyOptions {
+    settings: GatePolicySettings;
+    /** The input document, or its JSON text. */
+    input: unknown;
+    /** The policy directory, already exported from base. */
+    policyDir: string;
+    /** Where the engine runs. Default the policy directory. */
+    cwd?: string;
+    exec?: GatePolicyExec;
+}
+/** Run the engine once over `input` and read its answer. */
+export declare function checkGatePolicy(options: CheckGatePolicyOptions): GatePolicyVerdict;
+/** The part of a tree a policy is exported from: a workspace tree at base fits. */
+export interface GatePolicyTree {
+    stat(path: string): "file" | "dir" | undefined;
+    list(path: string): Array<{
+        name: string;
+        type: "file" | "dir";
+    }> | undefined;
+    read(path: string): string;
+    bytes?(path: string): Uint8Array;
+}
+/**
+ * Copy the policy directory `path` out of `tree` (the tree at base) into a
+ * new temporary directory, so the engine reads the policy as the base has
+ * it and never the change's copy. Returns the directory and how to remove
+ * it, or the reason there is no policy to read.
+ */
+export declare function exportGatePolicy(tree: GatePolicyTree, path: string): {
+    dir: string;
+    cleanup: () => void;
+} | {
+    error: string;
+};
+/** The settings, checked. Throws with what is wrong. `where` names them, such as `ci.policy`. */
+export declare function assertGatePolicySettings(where: string, raw: unknown): asserts raw is GatePolicySettings;
+//# sourceMappingURL=gate-policy.d.ts.map

package/dist/gate-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-policy.d.ts","sourceRoot":"","sources":["../src/gate-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAOH,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,YAAI,UAAU,EAAE,KAAK,CAAU,CAAC;AAChE,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC/C,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,mFAAmF;IACnF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,SAAS,QAAuC,CAAC;AAC9D,eAAO,MAAM,SAAS,QAA2B,CAAC;AAClD,eAAO,MAAM,SAAS,QAA2B,CAAC;AAUlD,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAmB/E;AAmBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAkB9F;AAED,4CAA4C;AAC5C,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,GAAG,iBAAiB,CAUxG;AAID,0GAA0G;AAC1G,wBAAgB,cAAc,CAAC,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAM5G;AAED,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,aAAa,CAAC;AAE5E,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,EAAE,cAGnC,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,4CAA4C;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAID,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,iBAAiB,CAkBlF;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAC9E,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA0B7H;AAED,iGAAiG;AACjG,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,kBAAkB,CAiBvG"}