@intentius/chant 0.124.40 → 0.124.42

package/dist/workspace/__fixtures__/two-member-workspace.d.ts

@@ -7,5 +7,6 @@
 export declare function twoMemberWorkspace(options?: {
     root?: boolean;
     prefix?: string;
+    extra?: Record<string, unknown>;
 }): string;
 //# sourceMappingURL=two-member-workspace.d.ts.map

package/dist/workspace/__fixtures__/two-member-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"two-member-workspace.d.ts","sourceRoot":"","sources":["../../../src/workspace/__fixtures__/two-member-workspace.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,iGAAiG;AACjG,wBAAgB,kBAAkB,CAAC,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAsB5F"}
+{"version":3,"file":"two-member-workspace.d.ts","sourceRoot":"","sources":["../../../src/workspace/__fixtures__/two-member-workspace.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,iGAAiG;AACjG,wBAAgB,kBAAkB,CAAC,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAO,GAAG,MAAM,CAsB7H"}

package/dist/workspace/__fixtures__/two-member-workspace.js

@@ -20,7 +20,7 @@ export function twoMemberWorkspace(options = {}) {
     if (options.root)
         members.unshift({ name: "platform", dir: ".", kind: "chant" });
     const files = {
-        "chant.workspace.json": JSON.stringify({ name: "shop", schema: 1, members }, null, 2),
+        "chant.workspace.json": JSON.stringify({ name: "shop", schema: 1, members, ...options.extra }, null, 2),
         "services/api/chant.config.ts": "export default {};\n",
         "services/api/src/infra.ts": "\n",
         "apps/web/chant.config.ts": "export default {};\n",

package/dist/workspace/checks/ci-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/ci-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAQrE,eAAO,MAAM,eAAe,WAAW,CAAC;AAaxC,eAAO,MAAM,kBAAkB,EAAE,SAAS,cAAc,EAmGvD,CAAC"}
+{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/ci-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAQrE,eAAO,MAAM,eAAe,WAAW,CAAC;AAexC,eAAO,MAAM,kBAAkB,EAAE,SAAS,cAAc,EA+GvD,CAAC"}

package/dist/workspace/checks/ci-workflow.js

@@ -11,7 +11,7 @@
  * WSP101 to WSP106's to report; this check asks only whether the jobs the
  * workflow needs are there.
  */
-import { appliesOnMerge, STUB_MARKER, workflowOf } from "../ci-workflow.js";
+import { appliesBeforeMerge, appliesOnMerge, STUB_MARKER, workflowOf } from "../ci-workflow.js";
 import { matchesCheckRun } from "../ci-green.js";
 import { staticPromotionOrder } from "../promotion-order.js";
 import { joinPath } from "../tree.js";
@@ -21,6 +21,8 @@ const memberDir = (dir) => (dir === "." ? "" : dir);
 const PLAN = /\bci\s+run\s+plan\b|\bcomponents\s+pr-plan\b/;
 const RECORD = /\bci\s+run\s+record\b|\bcomponents\s+pr-record\b/;
 const APPLY = /\bci\s+run\s+apply\b|\bcomponents\s+pr-apply\b/;
+/** An apply before merge (#4301): `pr-apply --before-merge`, or `ci run apply --apply-before-merge`. */
+const BEFORE_MERGE = /--(?:apply-)?before-merge\b/;
 const TICK = /\bci\s+tick\b/;
 const PUBLISH = /\brelease\s+publish\b/;
 /** The apply job names a required phase could match. */
@@ -106,18 +108,31 @@ export const CI_WORKFLOW_CHECKS = [
             if (missing.length > 0) {
                 finding("ci-workflow-pipeline-missing", `no pipeline file runs ${missing.join(", ")}; generate them with chant build --components --generate <forge> --pr-loop and chant ci workflow`);
             }
+            // #4301: an apply before merge is its own job, allowed only under apply-before-merge.
+            const beforeMerge = under.some((u) => appliesBeforeMerge(u.workflow)) || appliesBeforeMerge(d.ci?.workflow ?? null);
+            const earlyLines = commandLines(ctx, APPLY).filter((c) => BEFORE_MERGE.test(c.text));
+            if (!beforeMerge) {
+                for (const l of earlyLines) {
+                    finding("ci-workflow-pipeline-differs", `${l.path} applies before merge, and no member's workflow is apply-before-merge; regenerate without --apply-before-merge, or set ci.workflow to apply-before-merge`, { treeFile: l.path, line: l.line });
+                }
+            }
+            else if (earlyLines.length === 0 && has(PLAN)) {
+                const l = commandLines(ctx, PLAN)[0];
+                finding("ci-workflow-pipeline-differs", `${l.path} has no job that applies before merge, and the workflow is apply-before-merge; regenerate with --apply-before-merge`, { treeFile: l.path, line: l.line });
+            }
+            const mergeApply = (l) => !BEFORE_MERGE.test(l.text);
             if (!applyOnMerge) {
-                for (const l of commandLines(ctx, APPLY)) {
+                for (const l of commandLines(ctx, APPLY).filter(mergeApply)) {
                     finding("ci-workflow-pipeline-differs", `${l.path} applies on merge, and the workflow is trunk-curated, where a merge records the plan and deploys nothing; regenerate without --apply-on-merge, or set ci.workflow to trunk-curated+apply-on-merge`, { treeFile: l.path, line: l.line });
                 }
             }
-            else if (!has(APPLY) && has(RECORD)) {
+            else if (!commandLines(ctx, APPLY).some(mergeApply) && has(RECORD)) {
                 const l = commandLines(ctx, RECORD)[0];
                 finding("ci-workflow-pipeline-differs", `${l.path} records on merge, and the workflow is trunk-curated+apply-on-merge; regenerate with --apply-on-merge`, { treeFile: l.path, line: l.line });
             }
             else {
                 // #4168 step 9: an apply measured from a push's base applies each merge; the workflow applies green commits.
-                for (const l of commandLines(ctx, APPLY).filter((c) => /--base\b/.test(c.text) || (/\bcomponents\s+pr-apply\b/.test(c.text) && !/--green\b/.test(c.text)))) {
+                for (const l of commandLines(ctx, APPLY).filter(mergeApply).filter((c) => /--base\b/.test(c.text) || (/\bcomponents\s+pr-apply\b/.test(c.text) && !/--green\b/.test(c.text)))) {
                     finding("ci-workflow-pipeline-differs", `${l.path} applies each merge, and under trunk-curated+apply-on-merge the apply applies the newest green commit; regenerate with --apply-on-merge`, { treeFile: l.path, line: l.line });
                 }
             }

package/dist/workspace/ci-branches.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Branch routing and label filters for the pull-request loop (#4292).
+ *
+ * `ci.branches` maps a branch to member-name globs. A member a glob matches
+ * applies from that branch: its generated pull-request pipeline targets it,
+ * and its record or apply job does nothing on a push to any other branch. A
+ * member no glob matches applies from every branch but those, the default
+ * branch included. terragucci's `apply.branches` (`branchLayers`) works the
+ * same way over Terraform roots.
+ *
+ * `ci.labels` maps a pull request label to member-name globs. When a pull
+ * request carries one of the labels, its plan job plans only the members
+ * those labels' globs match, and every other member's plan job plans
+ * nothing. A label never gates: the record and apply jobs on the push never
+ * read labels, and an apply still waits for an approval of the digest it
+ * plans. Anyone with triage access can set a label, so a label may narrow
+ * what a reviewer sees ahead of the merge and no more.
+ */
+/** Branch or label name to member-name globs. */
+export type MemberGlobs = Readonly<Record<string, readonly string[]>>;
+/** The keys of `map` whose globs match `member`, in declaration order. */
+export declare function keysMatching(map: MemberGlobs | undefined, member: string): string[];
+/** The branch `ci.branches` routes `member` to, or null when no glob matches it. */
+export declare function routedBranch(branches: MemberGlobs | undefined, member: string): string | null;
+/** Each member that two branches' globs match, with the branches. The declaration refuses these. */
+export declare function routeConflicts(branches: MemberGlobs | undefined, members: readonly string[]): Array<{
+    member: string;
+    branches: string[];
+}>;
+/**
+ * Whether a push to `pushed` applies `member`, with a line that says why.
+ * A routed member applies only from its branch. Any other member applies
+ * from every branch `ci.branches` does not name.
+ */
+export declare function appliesFrom(branches: MemberGlobs | undefined, member: string, pushed: string): {
+    applies: boolean;
+    note: string;
+};
+/**
+ * Whether a pull request's plan job plans `member`, given the labels the pull
+ * request carries. With none of `ci.labels` on the pull request every member
+ * plans. With some, a member plans only when one of those labels' globs
+ * matches it.
+ */
+export declare function plansUnderLabels(labels: MemberGlobs | undefined, member: string, carried: readonly string[]): {
+    plans: boolean;
+    note?: string;
+};
+/** The branch the job runs on, from the forge's own variables: GitHub and Forgejo's GITHUB_REF_NAME, GitLab's CI_COMMIT_BRANCH. */
+export declare function pushedBranchFromEnv(env?: Record<string, string | undefined>): string | undefined;
+//# sourceMappingURL=ci-branches.d.ts.map

package/dist/workspace/ci-branches.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-branches.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-branches.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAItE,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnF;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7F;AAED,oGAAoG;AACpG,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAE3I;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAWjI;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAO/I;AAED,mIAAmI;AACnI,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,GAAG,SAAS,CAE7G"}

package/dist/workspace/ci-branches.js

@@ -0,0 +1,69 @@
+/**
+ * Branch routing and label filters for the pull-request loop (#4292).
+ *
+ * `ci.branches` maps a branch to member-name globs. A member a glob matches
+ * applies from that branch: its generated pull-request pipeline targets it,
+ * and its record or apply job does nothing on a push to any other branch. A
+ * member no glob matches applies from every branch but those, the default
+ * branch included. terragucci's `apply.branches` (`branchLayers`) works the
+ * same way over Terraform roots.
+ *
+ * `ci.labels` maps a pull request label to member-name globs. When a pull
+ * request carries one of the labels, its plan job plans only the members
+ * those labels' globs match, and every other member's plan job plans
+ * nothing. A label never gates: the record and apply jobs on the push never
+ * read labels, and an apply still waits for an approval of the digest it
+ * plans. Anyone with triage access can set a label, so a label may narrow
+ * what a reviewer sees ahead of the merge and no more.
+ */
+// @ts-ignore: picomatch has no types declaration
+import picomatch from "picomatch";
+const matches = (globs, member) => globs.some((g) => picomatch(g)(member));
+/** The keys of `map` whose globs match `member`, in declaration order. */
+export function keysMatching(map, member) {
+    return Object.keys(map ?? {}).filter((k) => matches(map[k], member));
+}
+/** The branch `ci.branches` routes `member` to, or null when no glob matches it. */
+export function routedBranch(branches, member) {
+    return keysMatching(branches, member)[0] ?? null;
+}
+/** Each member that two branches' globs match, with the branches. The declaration refuses these. */
+export function routeConflicts(branches, members) {
+    return members.map((member) => ({ member, branches: keysMatching(branches, member) })).filter((c) => c.branches.length > 1);
+}
+/**
+ * Whether a push to `pushed` applies `member`, with a line that says why.
+ * A routed member applies only from its branch. Any other member applies
+ * from every branch `ci.branches` does not name.
+ */
+export function appliesFrom(branches, member, pushed) {
+    const own = routedBranch(branches, member);
+    if (own !== null) {
+        return own === pushed
+            ? { applies: true, note: `ci.branches: ${pushed} applies member ${member}` }
+            : { applies: false, note: `ci.branches: member ${member} applies from ${own}, not ${pushed}` };
+    }
+    if (Object.prototype.hasOwnProperty.call(branches ?? {}, pushed)) {
+        return { applies: false, note: `ci.branches: ${pushed} applies only the members its globs match, and member ${member} is not one` };
+    }
+    return { applies: true, note: `ci.branches: member ${member} is routed to no branch, so ${pushed} applies it` };
+}
+/**
+ * Whether a pull request's plan job plans `member`, given the labels the pull
+ * request carries. With none of `ci.labels` on the pull request every member
+ * plans. With some, a member plans only when one of those labels' globs
+ * matches it.
+ */
+export function plansUnderLabels(labels, member, carried) {
+    const set = carried.filter((l) => Object.prototype.hasOwnProperty.call(labels ?? {}, l));
+    if (set.length === 0)
+        return { plans: true };
+    const by = set.filter((l) => matches(labels[l], member));
+    return by.length > 0
+        ? { plans: true, note: `ci.labels: ${by.join(", ")} plan${by.length === 1 ? "s" : ""} member ${member}` }
+        : { plans: false, note: `ci.labels: the pull request's labels ${set.join(", ")} plan other members, so member ${member} is not planned here; its record and apply on merge still plan it` };
+}
+/** The branch the job runs on, from the forge's own variables: GitHub and Forgejo's GITHUB_REF_NAME, GitLab's CI_COMMIT_BRANCH. */
+export function pushedBranchFromEnv(env = process.env) {
+    return env.CI_COMMIT_BRANCH || (env.GITHUB_REF_TYPE === undefined || env.GITHUB_REF_TYPE === "branch" ? env.GITHUB_REF_NAME : undefined) || undefined;
+}

package/dist/workspace/ci-cloud-identity.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The cloud identities a generated pull-request pipeline takes (#4296): the
+ * workspace declaration's `ci.identity.cloud`, resolved for the pipeline's
+ * environment and member (../ci-identity.ts). Read from the working tree of
+ * the workspace that holds `cwd`, as `ci.reportUrl` is (./ci-report-url.ts).
+ * A directory outside a workspace reads nothing.
+ */
+import { type PipelineCloudIdentity } from "../ci-identity.js";
+/** The plan and apply identities of the pipeline for `env` and `member`, or undefined. */
+export declare function declaredCloudIdentity(cwd: string, env: string, member?: string): Promise<PipelineCloudIdentity | undefined>;
+//# sourceMappingURL=ci-cloud-identity.d.ts.map

package/dist/workspace/ci-cloud-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-cloud-identity.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-cloud-identity.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAElF,0FAA0F;AAC1F,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAUjI"}

package/dist/workspace/ci-cloud-identity.js

@@ -0,0 +1,24 @@
+/**
+ * The cloud identities a generated pull-request pipeline takes (#4296): the
+ * workspace declaration's `ci.identity.cloud`, resolved for the pipeline's
+ * environment and member (../ci-identity.ts). Read from the working tree of
+ * the workspace that holds `cwd`, as `ci.reportUrl` is (./ci-report-url.ts).
+ * A directory outside a workspace reads nothing.
+ */
+import { findWorkspaceRoot } from "../project-root.js";
+import { resolveCloudIdentity } from "../ci-identity.js";
+/** The plan and apply identities of the pipeline for `env` and `member`, or undefined. */
+export async function declaredCloudIdentity(cwd, env, member) {
+    const found = findWorkspaceRoot(cwd);
+    if (!found)
+        return undefined;
+    const [{ readDeclaration, WorkspaceReadError }, { workingTree }] = await Promise.all([import("./declaration.js"), import("./tree.js")]);
+    try {
+        return resolveCloudIdentity(readDeclaration(workingTree(found.dir)).ci?.identity?.cloud, env, member);
+    }
+    catch (err) {
+        if (!(err instanceof WorkspaceReadError))
+            throw err;
+        throw Object.assign(new Error(`${err.describe()} [${err.code}]`), { code: err.code });
+    }
+}

package/dist/workspace/ci-init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-init.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAItD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAgB,WAAW,EAAkB,MAAM,eAAe,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,CAAC;AAGvB,OAAO,EAAyD,KAAK,UAAU,EAAoB,MAAM,eAAe,CAAC;AAEzH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAA2B,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAKxF,oDAAoD;AACpD,eAAO,MAAM,oBAAoB,YAAI,SAAS,EAAE,MAAM,CAAU,CAAC;AAEjE,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gGAAgG;AAChG,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CACrC;AAMD,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAKxE;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAInD;AAWD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBxI;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAerH;AASD,2HAA2H;AAC3H,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAgB7E;AAED,oIAAoI;AACpI,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,GAAE,SAAS,MAAM,EAAyB,GAAG,MAAM,GAAG,IAAI,CAKtH;AAgBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,cAAc,CAqFlF;AAED,8GAA8G;AAC9G,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAmCnF;AAED,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,MAAM,EAAE,CAO5E;AAoBD,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2EpE"}
+{"version":3,"file":"ci-init.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAItD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAgB,WAAW,EAAsC,MAAM,eAAe,CAAC;AAE9F,OAAO,EAAE,WAAW,EAAE,CAAC;AAGvB,OAAO,EAAyD,KAAK,UAAU,EAAoB,MAAM,eAAe,CAAC;AAEzH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAA2B,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAKxF,oDAAoD;AACpD,eAAO,MAAM,oBAAoB,YAAI,SAAS,EAAE,MAAM,CAAU,CAAC;AAEjE,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gGAAgG;AAChG,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CACrC;AAMD,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAKxE;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAInD;AAWD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBxI;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAerH;AASD,2HAA2H;AAC3H,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAgB7E;AAED,oIAAoI;AACpI,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,GAAE,SAAS,MAAM,EAAyB,GAAG,MAAM,GAAG,IAAI,CAKtH;AAgBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,cAAc,CAsFlF;AAED,8GAA8G;AAC9G,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAmCnF;AAED,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,MAAM,EAAE,CAO5E;AAoBD,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2EpE"}

package/dist/workspace/ci-init.js

@@ -34,7 +34,7 @@ import { basename, join } from "node:path";
 import { formatError, formatSuccess } from "../cli/format.js";
 import { parseYAMLDocument } from "../yaml.js";
 import { CI_WORKFLOW_CHECKS } from "./checks/ci-workflow.js";
-import { CI_WORKFLOWS, STUB_MARKER, appliesOnMerge } from "./ci-workflow.js";
+import { CI_WORKFLOWS, STUB_MARKER, appliesBeforeMerge, appliesOnMerge } from "./ci-workflow.js";
 export { STUB_MARKER };
 import { CI_GREEN_WORKFLOW_FILE, jobCheckRuns, readWorkflowSources, workflowsHolding } from "./ci-green-workflow.js";
 import { findWorkspaceRoot } from "../project-root.js";
@@ -43,7 +43,7 @@ import { staticPromotionOrder } from "./promotion-order.js";
 import { SECURITY_GROUPS } from "./security.js";
 import { gitTop, workingTree } from "./tree.js";
 import { RELEASE_WORKFLOW_FORGES } from "./release-workflow.js";
-const USAGE = "chant ci init --workflow trunk-curated|trunk-curated+apply-on-merge [--forge github|gitlab|forgejo] [--security <group>]... [--yes]";
+const USAGE = "chant ci init --workflow trunk-curated|trunk-curated+apply-on-merge|apply-before-merge [--forge github|gitlab|forgejo] [--security <group>]... [--yes]";
 /** The environments a config with none is given. */
 export const DEFAULT_ENVIRONMENTS = ["staging", "prod"];
 const memberDir = (dir) => (dir === "." ? "" : dir);
@@ -253,11 +253,12 @@ export function proposeCiInit(root, options) {
         if (reported("ci-workflow-pipeline-missing") || reported("ci-workflow-pipeline-differs")) {
             for (const m of releasing) {
                 const env = firstEnv.get(m.name);
+                const workflow = m.ciWorkflow ?? proposed.ci.workflow;
                 commands.push({
                     cwd: memberDir(m.dir) || ".",
                     // The root member builds alone: at a workspace root, chant build refuses without --root-only (WSP000).
-                    args: ["build", "--components", "--generate", forge, "--pr-loop", ...(m.dir === "." ? ["--root-only"] : []), ...(env ? ["--env", env] : []), ...(appliesOnMerge(m.ciWorkflow ?? proposed.ci.workflow) ? ["--apply-on-merge"] : [])],
-                    why: `the pull-request pipeline for ${m.name}: plan on a pull request, ${appliesOnMerge(m.ciWorkflow ?? proposed.ci.workflow) ? "apply" : "record"} on merge`,
+                    args: ["build", "--components", "--generate", forge, "--pr-loop", ...(m.dir === "." ? ["--root-only"] : []), ...(env ? ["--env", env] : []), ...(appliesOnMerge(workflow) ? ["--apply-on-merge"] : []), ...(appliesBeforeMerge(workflow) ? ["--apply-before-merge"] : [])],
+                    why: `the pull-request pipeline for ${m.name}: plan on a pull request, ${appliesBeforeMerge(workflow) ? "apply on request before merge, record" : appliesOnMerge(workflow) ? "apply" : "record"} on merge`,
                 });
             }
             if (forge === "github") {

package/dist/workspace/ci-locks.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `ci.locks` (#4293): when a pull request takes its target locks
+ * (../lifecycle/target-lock.ts). Read from the declaration at base, the
+ * target branch's tip, as the security groups are (./security.ts), so a
+ * pull request cannot turn its own locks off. Null outside a workspace and
+ * when the declaration sets none.
+ */
+import type { CiLocks } from "./declaration.js";
+export declare const CI_LOCKS: readonly ["apply", "plan"];
+/** The `ci.locks` of the workspace holding `cwd`, read at `at` when given, else at base, else from the working tree. */
+export declare function ciLocksAt(cwd: string, at?: string): CiLocks | null;
+//# sourceMappingURL=ci-locks.d.ts.map

package/dist/workspace/ci-locks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-locks.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-locks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG7C,eAAO,MAAM,QAAQ,4BAA0D,CAAC;AAEhF,wHAAwH;AACxH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAElE"}

package/dist/workspace/ci-locks.js

@@ -0,0 +1,6 @@
+import { scopeSource } from "./write-scope.js";
+export const CI_LOCKS = ["apply", "plan"];
+/** The `ci.locks` of the workspace holding `cwd`, read at `at` when given, else at base, else from the working tree. */
+export function ciLocksAt(cwd, at) {
+    return scopeSource(cwd, at).declaration?.ci?.locks ?? null;
+}

package/dist/workspace/ci-run.d.ts

@@ -45,6 +45,16 @@
  * commit: `pending` when it starts, `success` or `failure` when it settles.
  * A status the forge refuses is a warning and never fails the job.
  *
+ * The plan runs the pull request's code, so no step of the plan job gets a
+ * forge token (#4295, ../ci-handover.ts): every name in `FORGE_TOKEN_VARS`
+ * is left out of its steps' environment, from the runner, a secret or the
+ * forge job alike, and `pr-plan` runs with `--no-status`. Once the steps
+ * settle, the runner posts the note and the `chant/plan` status from the
+ * report with its own token (`postPlanReport`, ../pr-post.ts). In place, a
+ * generated job holds no token and its `plan-note` job posts; a job that
+ * still holds one was generated before #4295, and the runner posts for it
+ * with a warning to regenerate.
+ *
  * Signing is opt-in (#4156). With no runner key the record is unsigned, and
  * a reader counts it with no signer. A key `.chant/trust.json` does not list
  * leaves it unsigned with a note `--verbose` prints, unless the declaration
@@ -70,7 +80,7 @@
  * a CI one does.
  */
 import { type PrLoopJob, type PrLoopPipelineOptions } from "../components/pr-pipeline.js";
-import { type CommitStatus, type ForgeKind } from "../pr-forge.js";
+import { type CommitStatus, type ForgeKind, type PrForge } from "../pr-forge.js";
 import type { CommandContext } from "../cli/registry.js";
 import { type RunOrigin } from "../lifecycle/release-ledger.js";
 import { type OpRunResult, type StepRecord } from "../op/local-executor.js";
@@ -270,6 +280,12 @@ export interface CiRunRequest {
     secrets?: CiSecrets;
     /** `--output`: where the job's report is copied, from `cwd`. Default `.chant/pr`. */
     output?: string;
+    /**
+     * The forge client that posts the plan's note and `chant/plan` status from
+     * its report once the steps settle (#4295). Default: one built from the
+     * runner's environment when it holds a forge token.
+     */
+    planForge?: PrForge;
     /** `--run-index-limit`: how many runs the index at `loop.reportUrl` keeps (#4098). Default 200. */
     runIndexLimit?: number;
     /** A runner key, PEM, that signs the run's record. */

package/dist/workspace/ci-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-run.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAMH,OAAO,EAA+E,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACpK,OAAO,EAAiE,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE/H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAA4E,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAKvI,OAAO,EAA8B,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAMvD,OAAO,EAA2D,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AASvG,mGAAmG;AACnG,MAAM,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;AAC7C,eAAO,MAAM,YAAY,EAAE,SAAS,SAAS,EAAgC,CAAC;AAE9E,qEAAqE;AACrE,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAA+D,CAAC;AASjH,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,SAA8B,CAAC;AAEjE,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,EAAE,SAA8B,CAAC;AAEhE,uEAAuE;AACvE,eAAO,MAAM,eAAe,YAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAU,CAAC;AAEnI;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,eAAe,CACP,CAAC;AAKX,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,SAAS,EACd,KAAK,EAAE;IACL,KAAK,EAAE,SAAS,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GACA,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BxB;AAED,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,uCAAuC;IACvC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,iHAAiH;IACjH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,0IAA0I;AAC1I,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,QAAQ,CAoBrD;AAWD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGlG;AAKD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,GAAG,SAAS,CAmCvJ;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,+IAA+I;IAC/I,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAOD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAMjJ;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,aAAa,CAAC,CAKpK;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB/L;AAED,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,0CAA0C;IAC1C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2HAA2H;IAC3H,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,sDAAsD;IACtD,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oDAAoD;IACpD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sGAAsG;IACtG,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,IAAI,CAAC;CACd;AA4BD,0GAA0G;AAC1G,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAMrF;AAiFD;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA2CnE;AA8DD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASrH;AA+ID;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAc5D;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAUlD;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAWjF;AAuBD,iIAAiI;AACjI,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,SAAS,GAAG,SAAS,CAGlI;AA0BD,uDAAuD;AACvD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2DnE"}
+{"version":3,"file":"ci-run.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAMH,OAAO,EAA+E,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACpK,OAAO,EAAiE,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAI7I,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAA4E,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAKvI,OAAO,EAA8B,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAMvD,OAAO,EAA2D,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AASvG,mGAAmG;AACnG,MAAM,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;AAC7C,eAAO,MAAM,YAAY,EAAE,SAAS,SAAS,EAAgC,CAAC;AAE9E,qEAAqE;AACrE,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAA+D,CAAC;AASjH,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,SAA8B,CAAC;AAEjE,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,EAAE,SAA8B,CAAC;AAEhE,uEAAuE;AACvE,eAAO,MAAM,eAAe,YAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAU,CAAC;AAEnI;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,eAAe,CACP,CAAC;AAKX,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,SAAS,EACd,KAAK,EAAE;IACL,KAAK,EAAE,SAAS,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GACA,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BxB;AAED,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,uCAAuC;IACvC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,iHAAiH;IACjH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,0IAA0I;AAC1I,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,QAAQ,CAoBrD;AAWD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGlG;AAKD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,GAAG,SAAS,CAmCvJ;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,+IAA+I;IAC/I,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAOD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAMjJ;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,aAAa,CAAC,CAKpK;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB/L;AAED,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mGAAmG;IACnG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,0CAA0C;IAC1C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2HAA2H;IAC3H,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,sDAAsD;IACtD,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oDAAoD;IACpD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sGAAsG;IACtG,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,IAAI,CAAC;CACd;AA4BD,0GAA0G;AAC1G,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAMrF;AAiFD;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAiDnE;AA0GD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASrH;AA+ID;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAc5D;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAUlD;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAYjF;AAuBD,iIAAiI;AACjI,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,SAAS,GAAG,SAAS,CAGlI;AA0BD,uDAAuD;AACvD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2DnE"}

package/dist/workspace/ci-run.js

@@ -45,6 +45,16 @@
  * commit: `pending` when it starts, `success` or `failure` when it settles.
  * A status the forge refuses is a warning and never fails the job.
  *
+ * The plan runs the pull request's code, so no step of the plan job gets a
+ * forge token (#4295, ../ci-handover.ts): every name in `FORGE_TOKEN_VARS`
+ * is left out of its steps' environment, from the runner, a secret or the
+ * forge job alike, and `pr-plan` runs with `--no-status`. Once the steps
+ * settle, the runner posts the note and the `chant/plan` status from the
+ * report with its own token (`postPlanReport`, ../pr-post.ts). In place, a
+ * generated job holds no token and its `plan-note` job posts; a job that
+ * still holds one was generated before #4295, and the runner posts for it
+ * with a warning to regenerate.
+ *
  * Signing is opt-in (#4156). With no runner key the record is unsigned, and
  * a reader counts it with no signer. A key `.chant/trust.json` does not list
  * leaves it unsigned with a note `--verbose` prints, unless the declaration
@@ -75,6 +85,8 @@ import { tmpdir } from "node:os";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prLoopJobs, prLoopSetup, PR_LOOP_IMAGE } from "../components/pr-pipeline.js";
 import { detectForge, ForgeEnvironmentError, forgeFromEnv, FORGE_KINDS } from "../pr-forge.js";
+import { holdsForgeToken, withoutForgeTokens } from "../ci-handover.js";
+import { postPlanReport } from "../pr-post.js";
 import { PR_APPLY_GATE } from "../pr-loop.js";
 import { formatError, formatWarning } from "../cli/format.js";
 import { CHANT_CI_RUN_FORGE_ENV, CHANT_CI_RUN_ID_ENV, FORGE_RUN_ENV, resolveCiJob } from "../lifecycle/release-ledger.js";
@@ -480,7 +492,8 @@ export async function ciRun(req) {
     const started = req.requireRunnerStart || isolated ? runnerStartFor(req, { top, commit, hostEnv }) : undefined;
     // A generated wave job's command, as prLoopWaveJobs writes it. #4161: a local job's command posts no status or note.
     const forgeCommand = req.noForge ? found.command.replace(` --forge ${req.forge}`, "") : found.command;
-    const command = `${forgeCommand}${req.wave !== undefined ? ` --wave ${req.wave}` : ""}${req.local ? " --no-status" : ""}`;
+    const noStatus = req.local && !/ --no-status(?: |$)/.test(forgeCommand);
+    const command = `${forgeCommand}${req.wave !== undefined ? ` --wave ${req.wave}` : ""}${noStatus ? " --no-status" : ""}`;
     const job = { ...found, command, ...(req.wave !== undefined ? { wave: req.wave } : {}) };
     const own = ciJobEnv(job, {
         forge: req.forge,
@@ -491,14 +504,19 @@ export async function ciRun(req) {
         secrets: ciSecretsFor(req.secrets, req.job),
     });
     // #4156: in place, the forge job's environment is the job's, less the runner key.
-    const jobEnv = req.inPlace ? { ...definedEnv(hostEnv), ...own } : own;
+    // #4295: the plan runs the pull request's code, so no step of it gets a forge token, whatever gave it one.
+    const merged = req.inPlace ? { ...definedEnv(hostEnv), ...own } : own;
+    const jobEnv = req.job === "plan" ? withoutForgeTokens(merged) : merged;
     delete jobEnv[RUNNER_KEY_ENV];
+    const poster = req.job === "plan" ? planPoster(req, hostEnv) : undefined;
     // #4096: the secrets and the job's secret-looking variables, redacted from everything the run writes and returns.
     // In place the forge's own variables come too; one whose value is short, such as a flag, is left out, so it can't blank common words.
     const redact = ciRedactor(req.inPlace ? { ...longValues(jobEnv), ...own } : jobEnv, req.secrets);
     try {
         const ran = await runCiJob(req, { cwd, top, commit, place, job, jobEnv, ...(redact ? { redact } : {}) });
-        const result = started ? { ...ran, notes: [started, ...ran.notes] } : ran;
+        const posted = poster ? await postFromReport(req, poster, ran, { commit, ...(place.member ? { member: place.member } : {}) }) : [];
+        const withPosts = posted.length > 0 ? { ...ran, warnings: [...ran.warnings, ...posted] } : ran;
+        const result = started ? { ...withPosts, notes: [started, ...withPosts.notes] } : withPosts;
         return redact ? { ...result, warnings: result.warnings.map(redact), notes: result.notes.map(redact), ...(result.pushWarning ? { pushWarning: redact(result.pushWarning) } : {}) } : result;
     }
     catch (err) {
@@ -507,6 +525,49 @@ export async function ciRun(req) {
         throw err;
     }
 }
+/**
+ * Who posts the plan's note and `chant/plan` status (#4295): the runner,
+ * from the report, once the plan's steps settled, with the forge token the
+ * steps never got. None on `--local`, for a plain git server (`noForge`), or
+ * without a token. In place, a token means the job was generated before the
+ * plan-note job existed: the runner still posts, and says to regenerate.
+ */
+function planPoster(req, hostEnv) {
+    if (req.local || req.noForge || req.pr === undefined)
+        return undefined;
+    const warning = req.inPlace
+        ? "this plan job holds a forge token, which the pull request's code runs beside in the same job; regenerate the pipeline, whose plan-note job posts the note from a fresh job (#4295)"
+        : undefined;
+    if (req.planForge)
+        return { forge: req.planForge, ...(warning ? { warning } : {}) };
+    if (!holdsForgeToken(hostEnv))
+        return undefined;
+    try {
+        return { forge: forgeFromEnv(req.forge, hostEnv), ...(warning ? { warning } : {}) };
+    }
+    catch (err) {
+        return { error: `the plan's note and status will not be posted: ${message(err)}` };
+    }
+}
+/** Post the plan's note and status from the report the job wrote (#4295), and return the warnings. */
+async function postFromReport(req, poster, ran, at) {
+    if ("error" in poster)
+        return [poster.error];
+    const warnings = poster.warning ? [poster.warning] : [];
+    const dir = ran.report ?? resolve(req.cwd, req.output ?? PR_LOOP_REPORT_DIR);
+    const posted = await postPlanReport({
+        forge: poster.forge,
+        dir,
+        pr: req.pr,
+        head: at.commit,
+        env: req.env,
+        ...(at.member ? { member: at.member } : {}),
+        result: ran.status === "ok" ? "success" : "failure",
+    });
+    if (posted.refused)
+        warnings.push(`the plan report was not posted: ${posted.refused}`);
+    return [...warnings, ...posted.warnings];
+}
 /**
  * `--require-runner-start` (#4147): the runner-start statement for this
  * forge job, checked against `.chant/trust.json` at `--base` (the commit
@@ -784,11 +845,12 @@ export function ciLoopOptions(args) {
         ...(args.prBuildCommand ? { buildCommand: args.prBuildCommand } : {}),
         ...(args.waveGate ? { waveGate: args.waveGate } : {}),
         ...(args.requireReview === true ? { requireReview: true } : {}),
+        ...(args.applyBeforeMerge ? { applyBeforeMerge: true } : {}),
     };
 }
 const USAGE = "chant ci run plan|record|apply --env <env> --base <sha> [--pr <n>] [--commit <sha>] [--forge github|gitlab|forgejo] " +
     "[--gate <name>] [--wave-gate <name>] [--wave <k>] [--branch <name>] [--events-json] [--report-url <url>] [--run-index-limit <n>] [--image <image>] [--before-script <line>]... " +
-    "[--pr-build] [--pr-build-command <line>] [--require-review] [--no-status] [--status-url <url template>] " +
+    "[--pr-build] [--pr-build-command <line>] [--require-review] [--apply-before-merge] [--no-status] [--status-url <url template>] " +
     "[--chant <command>] [--pass-env <NAME>]... [--secrets <file>] [--key <runner key.pem>] [-o <dir>] [--in-place | --local] [--no-push] [--verbose] | chant ci run --at <sha> | chant ci run --setup-key [--trust [--principal <name>]] [--state <dir>] [--branch <name>]";
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /** The host's runner key in `--state`, or in ci serve's default state directory, when `--setup-key` made one there (#4099). */

package/dist/workspace/ci-workflow-at.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `ci.workflow` read at base (#4301, ws-106), as `ci.locks` is
+ * (./ci-locks.ts): the target branch's tip, so a pull request that sets
+ * `apply-before-merge` in its own copy of the declaration gets nothing from it.
+ */
+import type { CiWorkflow } from "./declaration.js";
+/**
+ * The workflow the member holding `cwd` follows, or `member` when given:
+ * its own `ci.workflow`, else the top level's, read at `at` when given, else
+ * at base, else from the working tree. Null outside a workspace and when
+ * neither sets one.
+ */
+export declare function ciWorkflowAt(cwd: string, at?: string, member?: string): CiWorkflow | null;
+//# sourceMappingURL=ci-workflow-at.d.ts.map

package/dist/workspace/ci-workflow-at.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-workflow-at.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-workflow-at.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAKhD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAMzF"}

package/dist/workspace/ci-workflow-at.js

@@ -0,0 +1,17 @@
+import { workflowOf } from "./ci-workflow.js";
+import { memberAtCwd } from "./security.js";
+import { scopeSource } from "./write-scope.js";
+/**
+ * The workflow the member holding `cwd` follows, or `member` when given:
+ * its own `ci.workflow`, else the top level's, read at `at` when given, else
+ * at base, else from the working tree. Null outside a workspace and when
+ * neither sets one.
+ */
+export function ciWorkflowAt(cwd, at, member) {
+    const source = scopeSource(cwd, at);
+    const d = source.declaration;
+    if (!d)
+        return null;
+    const name = member ?? memberAtCwd(source, cwd);
+    return workflowOf(d, d.members.find((m) => m.name === name) ?? null);
+}

package/dist/workspace/ci-workflow.d.ts

@@ -7,6 +7,8 @@
  * from a green commit and promoted through the member's environments, gated
  * in the last (4.2). `trunk-curated+apply-on-merge` is the same, and each
  * newest green commit is also applied (section 5, step 9).
+ * `apply-before-merge` (#4301, ws-106) is `trunk-curated`, and a person may
+ * also apply an open pull request's plan from its head before it merges.
  *
  * A workflow requires no security group: those are opt-in on their own
  * (./security.ts). `chant workspace check` reports what a member under a
@@ -17,9 +19,15 @@
 import type { CiWorkflow, Declaration, Member } from "./declaration.js";
 /** The marker a component stub `chant ci init` writes carries until someone fills it in. WSP151 reports a member whose only components carry it. */
 export declare const STUB_MARKER = "TODO(chant ci init)";
-export declare const CI_WORKFLOWS: readonly ["trunk-curated", "trunk-curated+apply-on-merge"];
+export declare const CI_WORKFLOWS: readonly ["trunk-curated", "trunk-curated+apply-on-merge", "apply-before-merge"];
 /** Whether `workflow` turns the apply on merge back on. */
 export declare function appliesOnMerge(workflow: CiWorkflow): boolean;
+/**
+ * Whether `workflow` lets an open pull request's plan apply from its head
+ * before it merges (#4301, ws-106). Only `apply-before-merge` does, so with
+ * no workflow or either trunk-curated one nothing applies before merge.
+ */
+export declare function appliesBeforeMerge(workflow: CiWorkflow | null): boolean;
 /** The workflow `member` follows: its own `ci.workflow`, else the top level's, else null. */
 export declare function workflowOf(declaration: Pick<Declaration, "ci">, member: Pick<Member, "ciWorkflow"> | null): CiWorkflow | null;
 /** One requirement of the workflows, with the `workspace check` code that reports it missing. */
@@ -75,8 +83,8 @@ export declare const CI_WORKFLOW_REQUIREMENTS: readonly [{
     readonly perMember: false;
 }, {
     readonly code: "ci-workflow-pipeline-differs";
-    readonly requirement: "the pipeline matches the workflow: no apply job under `trunk-curated`, and under `trunk-curated+apply-on-merge` an apply job that applies the newest green commit, not each merge";
-    readonly fix: "regenerate the pull-request pipeline, with `--apply-on-merge` only under apply on merge";
+    readonly requirement: "the pipeline matches the workflow: no apply job under `trunk-curated`, and under `trunk-curated+apply-on-merge` an apply job that applies the newest green commit, not each merge; a job that applies before merge only, and always, under `apply-before-merge`";
+    readonly fix: "regenerate the pull-request pipeline, with `--apply-on-merge` only under apply on merge and `--apply-before-merge` only under apply before merge";
     readonly perMember: false;
 }, {
     readonly code: "ci-workflow-publish-missing";

package/dist/workspace/ci-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAErE,oJAAoJ;AACpJ,eAAO,MAAM,WAAW,wBAAwB,CAAC;AAEjD,eAAO,MAAM,YAAY,4DAA6F,CAAC;AAEvH,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAE5D;AAED,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,IAAI,GAAG,UAAU,GAAG,IAAI,CAE7H;AAED,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;mBAC3B,8BAA8B;0BAAe,6FAA6F;kBAAO,qDAAqD;;;mBACtM,0BAA0B;0BAAe,iGAAiG;kBAAO,0BAA0B;;;mBAC3K,4BAA4B;0BAAe,0FAA0F;kBAAO,uDAAuD;;;mBACnM,2BAA2B;0BAAe,oDAAoD;kBAAO,+BAA+B;;;mBACpI,6BAA6B;0BAAe,6EAA6E;kBAAO,qCAAqC;;;mBACrK,yBAAyB;0BAAe,sFAAsF;kBAAO,kCAAkC;;;mBACvK,8BAA8B;0BAAe,yFAAyF;kBAAO,iFAAiF;;;mBAC9N,8BAA8B;0BAAe,mLAAmL;kBAAO,yFAAyF;;;mBAChU,6BAA6B;0BAAe,8CAA8C;kBAAO,0BAA0B;;EAChF,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E,eAAO,MAAM,yBAAyB,EAAkD,SAAS,cAAc,EAAE,CAAC;AAElH,sEAAsE;AACtE,wBAAgB,eAAe,IAAI,MAAM,CAGxC"}
+{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAErE,oJAAoJ;AACpJ,eAAO,MAAM,WAAW,wBAAwB,CAAC;AAEjD,eAAO,MAAM,YAAY,kFAAmH,CAAC;AAE7I,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAEvE;AAED,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,IAAI,GAAG,UAAU,GAAG,IAAI,CAE7H;AAED,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;mBAC3B,8BAA8B;0BAAe,6FAA6F;kBAAO,qDAAqD;;;mBACtM,0BAA0B;0BAAe,iGAAiG;kBAAO,0BAA0B;;;mBAC3K,4BAA4B;0BAAe,0FAA0F;kBAAO,uDAAuD;;;mBACnM,2BAA2B;0BAAe,oDAAoD;kBAAO,+BAA+B;;;mBACpI,6BAA6B;0BAAe,6EAA6E;kBAAO,qCAAqC;;;mBACrK,yBAAyB;0BAAe,sFAAsF;kBAAO,kCAAkC;;;mBACvK,8BAA8B;0BAAe,yFAAyF;kBAAO,iFAAiF;;;mBAC9N,8BAA8B;0BAAe,iQAAiQ;kBAAO,kJAAkJ;;;mBACvc,6BAA6B;0BAAe,8CAA8C;kBAAO,0BAA0B;;EAChF,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E,eAAO,MAAM,yBAAyB,EAAkD,SAAS,cAAc,EAAE,CAAC;AAElH,sEAAsE;AACtE,wBAAgB,eAAe,IAAI,MAAM,CAGxC"}