@intentius/chant 0.124.40 → 0.124.42

package/dist/workspace/ci-workflow.js

@@ -1,10 +1,18 @@
 /** The marker a component stub `chant ci init` writes carries until someone fills it in. WSP151 reports a member whose only components carry it. */
 export const STUB_MARKER = "TODO(chant ci init)";
-export const CI_WORKFLOWS = ["trunk-curated", "trunk-curated+apply-on-merge"];
+export const CI_WORKFLOWS = ["trunk-curated", "trunk-curated+apply-on-merge", "apply-before-merge"];
 /** Whether `workflow` turns the apply on merge back on. */
 export function appliesOnMerge(workflow) {
     return workflow === "trunk-curated+apply-on-merge";
 }
+/**
+ * Whether `workflow` lets an open pull request's plan apply from its head
+ * before it merges (#4301, ws-106). Only `apply-before-merge` does, so with
+ * no workflow or either trunk-curated one nothing applies before merge.
+ */
+export function appliesBeforeMerge(workflow) {
+    return workflow === "apply-before-merge";
+}
 /** The workflow `member` follows: its own `ci.workflow`, else the top level's, else null. */
 export function workflowOf(declaration, member) {
     return member?.ciWorkflow ?? declaration.ci?.workflow ?? null;
@@ -22,7 +30,7 @@ export const CI_WORKFLOW_REQUIREMENTS = [
     { code: "ci-workflow-no-environments", requirement: "the member's `chant.config.ts` declares `environments`, the promotion order", fix: "`environments` in `chant.config.ts`", perMember: true },
     { code: "ci-workflow-ungated-env", requirement: "each component has a gate, so a promote to the last environment waits on an approval", fix: "a `gate()` step in the component", perMember: true },
     { code: "ci-workflow-pipeline-missing", requirement: "a pipeline file runs the plan job, the record job (`ci run record`) and `chant ci tick`", fix: "`chant build --components --generate <forge> --pr-loop` and `chant ci workflow`", perMember: false },
-    { code: "ci-workflow-pipeline-differs", requirement: "the pipeline matches the workflow: no apply job under `trunk-curated`, and under `trunk-curated+apply-on-merge` an apply job that applies the newest green commit, not each merge", fix: "regenerate the pull-request pipeline, with `--apply-on-merge` only under apply on merge", perMember: false },
+    { code: "ci-workflow-pipeline-differs", requirement: "the pipeline matches the workflow: no apply job under `trunk-curated`, and under `trunk-curated+apply-on-merge` an apply job that applies the newest green commit, not each merge; a job that applies before merge only, and always, under `apply-before-merge`", fix: "regenerate the pull-request pipeline, with `--apply-on-merge` only under apply on merge and `--apply-before-merge` only under apply before merge", perMember: false },
     { code: "ci-workflow-publish-missing", requirement: "a pipeline file runs `chant release publish`", fix: "`chant release workflow`", perMember: false },
 ];
 export const CI_WORKFLOW_FINDING_CODES = CI_WORKFLOW_REQUIREMENTS.map((r) => r.code);

package/dist/workspace/declaration.d.ts

@@ -16,10 +16,13 @@
  * runs. The level-0 goldens (#2526) fail if a level-0 command loads it.
  */
 import { type RetentionOverride } from "../lifecycle/retention-policy.js";
+import { type CloudIdentityDeclaration } from "../ci-identity.js";
 import { EXAMPLES_KIND } from "./kinds.js";
 import { type TextLocation } from "./jsonc.js";
 import type { SecurityGroup } from "./security.js";
 import { type WorkspaceTree } from "./tree.js";
+import { type OpWaveHooks } from "../op/op-waves.js";
+import { type GatePolicySettings } from "../gate-policy.js";
 export declare const DECLARATION_SCHEMA_ID: string;
 export declare const DECLARATION_FILES: readonly ["chant.workspace.json", "chant.workspace.jsonc"];
 export declare const DECLARATION_SCHEMA_VERSION = 1;
@@ -191,15 +194,28 @@ export type CiSource = "checks" | "runs";
  * A prescribed delivery workflow (#4168 section 7). `trunk-curated`: a merge
  * records the plan and deploys nothing, and releases are cut from green
  * commits and promoted through the environments. `trunk-curated+apply-on-merge`
- * adds the apply on merge as an opt-in. `chant workspace check` reports what a
- * member under one still lacks (./checks/ci-workflow.ts, WSP151).
+ * adds the apply on merge as an opt-in. `apply-before-merge` (#4301, ws-106)
+ * is `trunk-curated` with an open pull request's plan applied from its head
+ * on request, once it is approved, mergeable, undiverged and green. `chant
+ * workspace check` reports what a member under one still lacks
+ * (./checks/ci-workflow.ts, WSP151).
  */
-export type CiWorkflow = "trunk-curated" | "trunk-curated+apply-on-merge";
+export type CiWorkflow = "trunk-curated" | "trunk-curated+apply-on-merge" | "apply-before-merge";
+/**
+ * When a pull request takes its target locks (#4293, ../lifecycle/target-lock.ts).
+ * `apply`: its apply takes them, and `chant lock` does by hand. `plan`: its
+ * plan takes them too, through `chant lock --stage plan` in a job that runs
+ * the target branch's code. Under either, an apply refuses a target another
+ * open pull request holds.
+ */
+export type CiLocks = "apply" | "plan";
 /** The declaration's `ci` block (#3573). */
 export interface CiDeclaration {
     green: CiGreen | null;
     /** `ci.workflow` (#4168 step 6): the workflow every member follows unless it names its own; absent when the declaration sets none. */
     workflow?: CiWorkflow;
+    /** `ci.locks` (#4293): when a pull request takes its target locks; absent when the declaration sets none, and then nothing is locked. */
+    locks?: CiLocks;
     /**
      * `ci.reportUrl` (#4160): where the pull-request jobs copy their reports
      * and `chant ci run` keeps the run index, `<reportUrl>/runs/index.json`.
@@ -208,7 +224,55 @@ export interface CiDeclaration {
      * the declaration sets none.
      */
     reportUrl: string | null;
+    /**
+     * `ci.hooks` (#4288): the stage hooks the pull-request jobs run, in the
+     * shape an Op waves spec's `hooks` takes. `chant components pr-plan`,
+     * `pr-record` and `pr-apply` read them from the declaration at base.
+     * Absent when the declaration sets none.
+     */
+    hooks?: OpWaveHooks;
+    /**
+     * `ci.branches` (#4292): branch name to member-name globs. A member a glob
+     * matches applies from that branch alone; the others apply from every
+     * branch the map does not name (./ci-branches.ts). Absent when unset.
+     */
+    branches?: Record<string, string[]>;
+    /**
+     * `ci.labels` (#4292): pull request label to member-name globs. A labelled
+     * pull request plans only the members its labels match. Never a gate.
+     * Absent when unset.
+     */
+    labels?: Record<string, string[]>;
+    /**
+     * `ci.policy` (#4294): the policy engine the pull-request jobs run over
+     * the change set, read with the policy from the declaration at base.
+     * Absent when the declaration sets none.
+     */
+    policy?: GatePolicySettings;
+    /**
+     * `ci.identity` (#4296): `cloud` gives each cloud's plan and apply
+     * identities by environment and member globs (../ci-identity.ts).
+     * Absent when unset.
+     */
+    identity?: {
+        cloud: CloudIdentityDeclaration;
+    };
+    /**
+     * `ci.prEnvironment` (#4298): an environment per open pull request,
+     * derived from `template`, torn down on close or after `ttl`
+     * (../components/pr-environment.ts). Absent when unset.
+     */
+    prEnvironment?: CiPrEnvironment;
+}
+/** The `ci.prEnvironment` block (#4298), with its default TTL. */
+export interface CiPrEnvironment {
+    /** The declared environment `pr-<n>` takes its endpoint from. */
+    template: string;
+    /** How long the environment lives after its last apply: `72h` when absent. */
+    ttl: string;
 }
+/** The default `ci.prEnvironment.ttl`. */
+export declare const DEFAULT_PR_ENVIRONMENT_TTL = "72h";
 export interface MemberRole {
     name: string;
     /** Relative to the member's directory, or null for the whole member. */
@@ -511,6 +575,8 @@ export interface Member {
     security: SecurityGroup[];
     /** The member's own `ci.workflow` (#4168 step 6), which wins over the top level's; null when it names none. */
     ciWorkflow: CiWorkflow | null;
+    /** The member's own `ci.hooks` (#4288), run after the top level's; null when it names none. */
+    ciHooks: OpWaveHooks | null;
     suppress: Suppression[];
     /** The entry's JSON Pointer in the file, for messages. */
     pointer: string;

package/dist/workspace/declaration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"declaration.d.ts","sourceRoot":"","sources":["../../src/workspace/declaration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAIxF,OAAO,EAAE,aAAa,EAAqB,MAAM,SAAS,CAAC;AAC3D,OAAO,EAA+B,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAItD,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAChD,eAAO,MAAM,iBAAiB,YAAI,sBAAsB,EAAE,uBAAuB,CAAU,CAAC;AAC5F,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,gFAAgF;AAChF,eAAO,MAAM,cAAc,YAAI,YAAY,EAAE,UAAU,CAAU,CAAC;AAClE,eAAO,MAAM,YAAY,QAA8B,CAAC;AAIxD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,uNAmBQ,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,kBAAkB;IAEjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa;IAHnC,YACW,IAAI,EAAE,kBAAkB,EACjC,OAAO,EAAE,MAAM,EACN,QAAQ,CAAC,EAAE,aAAa,YAAA,EAIlC;IAED,yDAAyD;IACzD,QAAQ,IAAI,MAAM,CAGjB;CACF;AAID,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,CAAC;AAEjE,kHAAkH;AAClH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD,6HAA6H;AAC7H,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,QAAQ,EAAE,cAAc,CAAC;IACzB,mHAAmH;IACnH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,6HAA6H;AAC7H,eAAO,MAAM,iBAAiB,YAAI,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAClF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AACpE,uFAAuF;AACvF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAEpC,wEAAwE;AACxE,eAAO,MAAM,WAAW,YAAI,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AACxE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,yJAAyJ;IACzJ,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,2GAA2G;IAC3G,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5C,iIAAiI;IACjI,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAE5D,4GAA4G;AAC5G,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,sIAAsI;IACtI,WAAW,EAAE,KAAK,GAAG,YAAY,CAAC;IAClC,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAExC;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEzC,+EAA+E;AAC/E,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8HAA8H;IAC9H,OAAO,EAAE,SAAS,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,6EAA6E;AAC7E,MAAM,WAAW,OAAO;IACtB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;OAOG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;OAMG;IACH,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,uFAAuF;AACvF,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,8BAA8B,CAAC;AAE1E,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtB,sIAAsI;IACtI,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gEAAgE;IAChE,WAAW,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxC,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,4FAA4F;AAC5F,eAAO,MAAM,aAAa,YAAI,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC;AAClF,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,kHAAkH;AAClH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,yJAAyJ;IACzJ,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,uIAAuI;IACvI,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,eAAe,CAAC;IAC1B,uSAAuS;IACvS,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oEAAoE;IACpE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,kIAAkI;IAClI,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,oEAAoE;IACpE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,8GAA8G;IAC9G,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,aAAa,EAAE,CAAC;IAC9B,oIAAoI;IACpI,SAAS,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B,uGAAuG;IACvG,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iHAAiH;IACjH,SAAS,EAAE,YAAY,GAAG,IAAI,CAAC;IAC/B,wGAAwG;IACxG,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IACrB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,SAAS,CAAC;AACxC,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,0GAA0G;IAC1G,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8HAA8H;AAC9H,eAAO,MAAM,qBAAqB,YAAI,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AAChF,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,YAAI,MAAM,EAAE,SAAS,CAAU,CAAC;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,kEAAkE;AAClE,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC1B,EAAE,EAAE,gBAAgB,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,YAAI,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAU,CAAC;AAC7F,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,IAAI,CAAC;IACtD,oHAAoH;IACpH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,wIAAwI;IACxI,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,kGAAkG;IAClG,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,6GAA6G;AAC7G,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvB,sFAAsF;IACtF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,mHAAmH;AACnH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,QAAQ,CAAC;IAChB,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B,gBAAgB,CAAC;AAE3D,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,UAAU;IACzB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,oHAAoH;IACpH,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+JAA+J;IAC/J,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mGAAmG;IACnG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oHAAoH;IACpH,QAAQ,EAAE,OAAO,CAAC;IAClB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0HAA0H;AAC1H,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,wEAAwE;IACxE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,yEAAyE;AACzE,eAAO,MAAM,kBAAkB,kCAAkC,CAAC;AAElE,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,iHAAiH;IACjH,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,mFAAmF;IACnF,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,yJAAyJ;IACzJ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,yEAAyE;IACzE,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,oEAAoE;IACpE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,yEAAyE;IACzE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qEAAqE;IACrE,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,yGAAyG;IACzG,MAAM,EAAE,OAAO,CAAC;IAChB,8IAA8I;IAC9I,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,+GAA+G;IAC/G,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,aAAa,CAAC;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AAEnC,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yCAAyC;IACzC,OAAO,EAAE,KAAK,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtC,+GAA+G;IAC/G,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2HAA2H;IAC3H,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,iIAAiI;IACjI,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qDAAqD;IACrD,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,wGAAwG;IACxG,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,0FAA0F;IAC1F,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,iDAAiD;IACjD,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,oJAAoJ;IACpJ,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,iHAAiH;IACjH,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC;;;;;OAKG;IACH,OAAO,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,qJAAqJ;IACrJ,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wEAAwE;AACxE,eAAO,MAAM,aAAa,qBAAqB,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAGtC;AAID,qHAAqH;AACrH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAY5D;AA+DD,MAAM,WAAW,WAAW;IAC1B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,+GAA+G;AAC/G,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAMxG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,WAAW,CAiQrI;AAKD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI/F;AAgVD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,UAAU,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA+B/H;AAyED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,WAAW,GAAG,qBAAqB,EAAE,CAErF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,EAAE,CAE/E;AAED,2FAA2F;AAC3F,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAG3D;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,SAAK,EAAE,OAAO,GAAE,WAAgB,GAAG,WAAW,CAarG;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzF;AAID,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,qEAAqE;IACrE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uEAAuE;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,GAAG,aAAa,EAAE,CA8B5F;AAID;;;;;;GAMG;AACH,wBAAgB,OAAO,CACrB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,aAAa,EAAE,EACvB,IAAI,EAAE,MAAM,GACX;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAWlE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAWlH"}
+{"version":3,"file":"declaration.d.ts","sourceRoot":"","sources":["../../src/workspace/declaration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAIxF,OAAO,EAAiC,KAAK,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE9F,OAAO,EAAE,aAAa,EAAqB,MAAM,SAAS,CAAC;AAC3D,OAAO,EAA+B,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAGtD,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEnF,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAChD,eAAO,MAAM,iBAAiB,YAAI,sBAAsB,EAAE,uBAAuB,CAAU,CAAC;AAC5F,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,gFAAgF;AAChF,eAAO,MAAM,cAAc,YAAI,YAAY,EAAE,UAAU,CAAU,CAAC;AAClE,eAAO,MAAM,YAAY,QAA8B,CAAC;AAIxD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,uNAmBQ,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,kBAAkB;IAEjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa;IAHnC,YACW,IAAI,EAAE,kBAAkB,EACjC,OAAO,EAAE,MAAM,EACN,QAAQ,CAAC,EAAE,aAAa,YAAA,EAIlC;IAED,yDAAyD;IACzD,QAAQ,IAAI,MAAM,CAGjB;CACF;AAID,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,CAAC;AAEjE,kHAAkH;AAClH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD,6HAA6H;AAC7H,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,QAAQ,EAAE,cAAc,CAAC;IACzB,mHAAmH;IACnH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,6HAA6H;AAC7H,eAAO,MAAM,iBAAiB,YAAI,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAClF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AACpE,uFAAuF;AACvF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAEpC,wEAAwE;AACxE,eAAO,MAAM,WAAW,YAAI,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AACxE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,yJAAyJ;IACzJ,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,2GAA2G;IAC3G,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5C,iIAAiI;IACjI,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAE5D,4GAA4G;AAC5G,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,sIAAsI;IACtI,WAAW,EAAE,KAAK,GAAG,YAAY,CAAC;IAClC,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAExC;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEzC,+EAA+E;AAC/E,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8HAA8H;IAC9H,OAAO,EAAE,SAAS,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,6EAA6E;AAC7E,MAAM,WAAW,OAAO;IACtB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;OAOG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;OAMG;IACH,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,uFAAuF;AACvF,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,8BAA8B,GAAG,oBAAoB,CAAC;AAEjG;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AAEvC,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtB,sIAAsI;IACtI,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,yIAAyI;IACzI,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,wBAAwB,CAAA;KAAE,CAAC;IAC/C;;;;OAIG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;CACjC;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;CACb;AAED,0CAA0C;AAC1C,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAEhD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gEAAgE;IAChE,WAAW,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxC,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,4FAA4F;AAC5F,eAAO,MAAM,aAAa,YAAI,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC;AAClF,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,kHAAkH;AAClH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,yJAAyJ;IACzJ,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,uIAAuI;IACvI,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,eAAe,CAAC;IAC1B,uSAAuS;IACvS,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oEAAoE;IACpE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,kIAAkI;IAClI,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,oEAAoE;IACpE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,8GAA8G;IAC9G,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,aAAa,EAAE,CAAC;IAC9B,oIAAoI;IACpI,SAAS,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B,uGAAuG;IACvG,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iHAAiH;IACjH,SAAS,EAAE,YAAY,GAAG,IAAI,CAAC;IAC/B,wGAAwG;IACxG,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IACrB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,SAAS,CAAC;AACxC,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,0GAA0G;IAC1G,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8HAA8H;AAC9H,eAAO,MAAM,qBAAqB,YAAI,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AAChF,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,YAAI,MAAM,EAAE,SAAS,CAAU,CAAC;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,kEAAkE;AAClE,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC1B,EAAE,EAAE,gBAAgB,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,YAAI,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAU,CAAC;AAC7F,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,IAAI,CAAC;IACtD,oHAAoH;IACpH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,wIAAwI;IACxI,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,kGAAkG;IAClG,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,6GAA6G;AAC7G,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvB,sFAAsF;IACtF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,mHAAmH;AACnH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,QAAQ,CAAC;IAChB,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B,gBAAgB,CAAC;AAE3D,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,UAAU;IACzB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,oHAAoH;IACpH,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+JAA+J;IAC/J,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mGAAmG;IACnG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oHAAoH;IACpH,QAAQ,EAAE,OAAO,CAAC;IAClB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0HAA0H;AAC1H,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,wEAAwE;IACxE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,yEAAyE;AACzE,eAAO,MAAM,kBAAkB,kCAAkC,CAAC;AAElE,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,iHAAiH;IACjH,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,mFAAmF;IACnF,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,yJAAyJ;IACzJ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,yEAAyE;IACzE,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,oEAAoE;IACpE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,yEAAyE;IACzE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qEAAqE;IACrE,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,yGAAyG;IACzG,MAAM,EAAE,OAAO,CAAC;IAChB,8IAA8I;IAC9I,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,+GAA+G;IAC/G,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,+FAA+F;IAC/F,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,aAAa,CAAC;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AAEnC,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yCAAyC;IACzC,OAAO,EAAE,KAAK,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtC,+GAA+G;IAC/G,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2HAA2H;IAC3H,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,iIAAiI;IACjI,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qDAAqD;IACrD,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,wGAAwG;IACxG,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,0FAA0F;IAC1F,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,iDAAiD;IACjD,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,oJAAoJ;IACpJ,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,iHAAiH;IACjH,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC;;;;;OAKG;IACH,OAAO,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,qJAAqJ;IACrJ,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wEAAwE;AACxE,eAAO,MAAM,aAAa,qBAAqB,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAGtC;AAID,qHAAqH;AACrH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAY5D;AA+DD,MAAM,WAAW,WAAW;IAC1B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,+GAA+G;AAC/G,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAMxG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,WAAW,CA2QrI;AAKD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI/F;AAyYD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,UAAU,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA+B/H;AAyED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,WAAW,GAAG,qBAAqB,EAAE,CAErF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,EAAE,CAE/E;AAED,2FAA2F;AAC3F,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAG3D;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,SAAK,EAAE,OAAO,GAAE,WAAgB,GAAG,WAAW,CAarG;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzF;AAID,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,qEAAqE;IACrE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uEAAuE;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,GAAG,aAAa,EAAE,CA8B5F;AAID;;;;;;GAMG;AACH,wBAAgB,OAAO,CACrB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,aAAa,EAAE,EACvB,IAAI,EAAE,MAAM,GACX;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAWlE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAWlH"}

package/dist/workspace/declaration.js

@@ -18,12 +18,16 @@
 import { RETENTION_KINDS } from "../lifecycle/retention-policy.js";
 import { parseReportUrl } from "../pr-report-url.js";
 import schema from "./declaration.schema.json" with { type: "json" };
+import { routeConflicts } from "./ci-branches.js";
+import { cloudIdentityProblems, CLOUDS } from "../ci-identity.js";
 import { expandGlob } from "./glob.js";
 import { EXAMPLES_KIND, holdsChantProject } from "./kinds.js";
 import { parseJsonText, pointerToken } from "./jsonc.js";
 import { joinPath } from "./tree.js";
 import { loadAjv2020 } from "./ajv2020.js";
 import { readChantPackageVersion } from "../package-version.js";
+import { assertPrLoopHooks } from "../op/op-waves.js";
+import { assertGatePolicySettings } from "../gate-policy.js";
 export const DECLARATION_SCHEMA_ID = schema.$id;
 export const DECLARATION_FILES = ["chant.workspace.json", "chant.workspace.jsonc"];
 export const DECLARATION_SCHEMA_VERSION = 1;
@@ -74,6 +78,8 @@ export const PRINCIPAL_CLASSES = ["human", "agent", "runner", "service"];
 export const WRITE_VERBS = ["new", "amend", "review", "close"];
 /** The default `ci.green.window`. */
 export const DEFAULT_CI_WINDOW = "24h";
+/** The default `ci.prEnvironment.ttl`. */
+export const DEFAULT_PR_ENVIRONMENT_TTL = "72h";
 /** A renderer a diagram is pinned to (#2764): a closed list of tools chant does not run. */
 export const DIAGRAM_TOOLS = ["d2", "mermaid", "graphviz", "excalidraw"];
 /** The gate a ship Op stops at when the block names none (ws-100). */
@@ -282,6 +288,7 @@ export function parseDeclaration(text, file, reader = readerVersion(), options =
             travel: e.travel === true,
             security: [...(e.security ?? [])],
             ciWorkflow: (e.ci?.workflow) ?? null,
+            ciHooks: ciHooksOf(e.ci?.hooks, `${pointer}/ci/hooks`, at),
             suppress,
             pointer,
         };
@@ -386,6 +393,11 @@ export function parseDeclaration(text, file, reader = readerVersion(), options =
     if (tierSession)
         throw new WorkspaceReadError("declaration-invalid", tierSession.message, at(tierSession.pointer));
     const ci = ciOf(obj.ci, at);
+    // #4292: a member applies from one branch, so two branches may not both route it.
+    const [conflict] = routeConflicts(ci?.branches, members.map((m) => m.name));
+    if (conflict) {
+        throw new WorkspaceReadError("declaration-invalid", `ci.branches routes member ${conflict.member} to both ${conflict.branches.join(" and ")}; a member applies from one branch`, at(`/ci/branches/${pointerToken(conflict.branches[1])}`));
+    }
     const pins = (obj.pins ?? []).map((p) => ({
         package: p.package ?? null,
         version: p.version ?? null,
@@ -500,11 +512,70 @@ function retentionOf(raw) {
     }
     return out;
 }
+/** A `ci.hooks` block (#4288), refused when a pull-request job could not run it. Null when absent. */
+function ciHooksOf(raw, pointer, at) {
+    if (raw === undefined)
+        return null;
+    try {
+        assertPrLoopHooks(pointer.slice(1).replace(/\//g, "."), raw);
+    }
+    catch (err) {
+        throw new WorkspaceReadError("declaration-invalid", err instanceof Error ? err.message : String(err), at(pointer));
+    }
+    return structuredClone(raw);
+}
+/** A `ci.branches` or `ci.labels` map, copied without its `x-` keys. */
+function globMap(raw) {
+    return Object.fromEntries(Object.entries(raw).filter(([k]) => !k.startsWith("x-")).map(([k, v]) => [k, [...v]]));
+}
+/** A `ci.policy` block (#4294), refused when the pull-request jobs could not run it. Null when absent. */
+function ciPolicyOf(raw, at) {
+    if (raw === undefined)
+        return null;
+    try {
+        assertGatePolicySettings("ci.policy", raw);
+    }
+    catch (err) {
+        throw new WorkspaceReadError("declaration-invalid", err instanceof Error ? err.message : String(err), at("/ci/policy"));
+    }
+    return structuredClone(raw);
+}
+/**
+ * `ci.identity.cloud` (#4296), copied without its `x-` keys. A rule that
+ * plans as an identity some rule applies as is refused: the plan runs the
+ * pull request's code.
+ */
+function cloudIdentityOf(raw, at) {
+    const out = {};
+    for (const cloud of CLOUDS) {
+        const c = raw[cloud];
+        if (c === undefined)
+            continue;
+        const kept = Object.fromEntries(Object.entries(c).filter(([k]) => !k.startsWith("x-")));
+        const rules = c.rules.map((r) => Object.fromEntries(Object.entries(r).filter(([k]) => !k.startsWith("x-")).map(([k, v]) => [k, Array.isArray(v) ? [...v] : v])));
+        out[cloud] = { ...kept, rules };
+    }
+    const [problem] = cloudIdentityProblems(out);
+    if (problem)
+        throw new WorkspaceReadError("declaration-invalid", problem.message, at(problem.pointer));
+    return out;
+}
 function ciOf(raw, at) {
     if (raw === undefined)
         return null;
     const block = raw;
-    const workflow = block.workflow !== undefined ? { workflow: block.workflow } : {};
+    const hooks = ciHooksOf(block.hooks, "/ci/hooks", at);
+    const policy = ciPolicyOf(block.policy, at);
+    const workflow = {
+        ...(block.workflow !== undefined ? { workflow: block.workflow } : {}),
+        ...(hooks ? { hooks } : {}),
+        ...(block.branches !== undefined ? { branches: globMap(block.branches) } : {}),
+        ...(block.labels !== undefined ? { labels: globMap(block.labels) } : {}),
+        ...(block.locks !== undefined ? { locks: block.locks } : {}),
+        ...(policy ? { policy } : {}),
+        ...(block.identity?.cloud !== undefined ? { identity: { cloud: cloudIdentityOf(block.identity.cloud, at) } } : {}),
+        ...(block.prEnvironment !== undefined ? { prEnvironment: { template: block.prEnvironment.template, ttl: block.prEnvironment.ttl ?? DEFAULT_PR_ENVIRONMENT_TTL } } : {}),
+    };
     let reportUrl = null;
     if (block.reportUrl !== undefined) {
         // #4160: refused here as pr-plan and ci run refuse the flag, so a reader never gets a URL no job can write to.

package/dist/workspace/declaration.schema.json

@@ -181,10 +181,116 @@
         "workflow": {
           "$ref": "#/$defs/ciWorkflow"
         },
+        "hooks": {
+          "$ref": "#/$defs/ciHooks"
+        },
+        "locks": {
+          "enum": ["apply", "plan"],
+          "description": "When a pull request takes its target locks, _locks/<gate>.json on chant/lifecycle (#4293). apply: the pull request's apply takes them, and chant lock takes them by hand. plan: its plan takes them too, through chant lock --stage plan in a job that runs the target branch's code. Under either, chant components pr-apply refuses a target that another open pull request holds, and a lock whose pull request merged or closed reads as released. Absent: nothing is locked. Read from the declaration at base. Added in schema 1 by chant 0.124.41, so a declaration that uses it sets minReader to 0.124.41 or newer."
+        },
+        "policy": {
+          "$ref": "#/$defs/ciPolicy"
+        },
         "reportUrl": {
           "type": "string",
           "minLength": 1,
           "description": "Where the pull-request jobs copy their reports and events, and where chant ci run keeps the run index, <reportUrl>/runs/index.json (#4160): an s3://<bucket>/<prefix> or file://<directory> URL, as --report-url takes. chant build --pr-loop, chant ci run, chant ci serve and chant ci runs use it when --report-url is not given, and the flag wins. Readers find it in chant workspace ls --json as ci.reportUrl. Added in schema 1 by chant 0.124.32, so a declaration that uses it sets minReader to 0.124.32 or newer."
+        },
+        "branches": {
+          "type": "object",
+          "description": "Branch routing (#4292): a branch name to member-name globs. A member a glob matches applies from that branch alone: chant build --pr-loop targets its pipeline at the branch, and its record and apply jobs plan nothing on a push to any other branch. A member no glob matches applies from every branch the map does not name. One member may not be matched by two branches. Added in schema 1 by chant 0.124.41, so a declaration that uses it sets minReader to 0.124.41 or newer.",
+          "patternProperties": {
+            "^x-": true,
+            "^(?!x-)[^\\s]+$": { "$ref": "#/$defs/ciMemberGlobs" }
+          },
+          "additionalProperties": false
+        },
+        "labels": {
+          "type": "object",
+          "description": "Label filters (#4292): a pull request label to member-name globs. When a pull request carries one of these labels, its plan jobs plan only the members those labels match. A label never gates: the record and apply jobs never read labels, and an apply still needs an approval of the digest it plans. Added in schema 1 by chant 0.124.41, so a declaration that uses it sets minReader to 0.124.41 or newer.",
+          "patternProperties": {
+            "^x-": true,
+            "^(?!x-).+$": { "$ref": "#/$defs/ciMemberGlobs" }
+          },
+          "additionalProperties": false
+        },
+        "identity": {
+          "type": "object",
+          "additionalProperties": false,
+          "patternProperties": { "^x-": true },
+          "description": "Cloud identities for the pull-request jobs (#4296). Added in schema 1 by chant 0.124.41, so a declaration that uses it sets minReader to 0.124.41 or newer.",
+          "properties": {
+            "cloud": {
+              "type": "object",
+              "additionalProperties": false,
+              "patternProperties": { "^x-": true },
+              "description": "Each cloud's plan and apply identities, as rules over environment and member globs. chant build --pr-loop takes the first rule that matches the pipeline's environment and member. The plan job trades its OIDC token for the plan identity before the change is checked out, the record job takes the plan identity, and the apply jobs the apply identity. A rule may not plan as an identity any rule applies as.",
+              "properties": {
+                "aws": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "patternProperties": { "^x-": true },
+                  "required": ["rules"],
+                  "description": "AWS roles, assumed through STS AssumeRoleWithWebIdentity.",
+                  "properties": {
+                    "region": { "type": "string", "minLength": 1, "description": "The STS region. Default us-east-1." },
+                    "audience": { "type": "string", "minLength": 1, "description": "The OIDC token's audience. Default sts.amazonaws.com." },
+                    "endpoint": { "type": "string", "pattern": "^https?://", "description": "The STS endpoint, for an emulator. Default the region's, or AWS_ENDPOINT_URL_STS in the job." },
+                    "rules": { "$ref": "#/$defs/ciCloudIdentityRules" }
+                  }
+                },
+                "gcp": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "patternProperties": { "^x-": true },
+                  "required": ["provider", "rules"],
+                  "description": "GCP service accounts, reached through a workload identity provider and impersonated with IAM generateAccessToken.",
+                  "properties": {
+                    "provider": { "type": "string", "pattern": "^(//iam\\.googleapis\\.com/)?projects/[^/]+/locations/global/workloadIdentityPools/[^/]+/providers/[^/]+$", "description": "The workload identity provider: projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<provider>." },
+                    "audience": { "type": "string", "minLength": 1, "description": "The OIDC token's audience. Default https://iam.googleapis.com/<provider>." },
+                    "stsEndpoint": { "type": "string", "pattern": "^https?://", "description": "Google's STS, for an emulator. Default https://sts.googleapis.com." },
+                    "iamEndpoint": { "type": "string", "pattern": "^https?://", "description": "IAM credentials, for an emulator. Default https://iamcredentials.googleapis.com." },
+                    "rules": { "$ref": "#/$defs/ciCloudIdentityRules" }
+                  }
+                },
+                "azure": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "patternProperties": { "^x-": true },
+                  "required": ["tenantId", "rules"],
+                  "description": "Entra application clients, each with a federated credential for the forge's tokens. The rules' identities are client ids.",
+                  "properties": {
+                    "tenantId": { "type": "string", "minLength": 1, "description": "The Entra tenant." },
+                    "subscriptionId": { "type": "string", "minLength": 1, "description": "Set as AZURE_SUBSCRIPTION_ID and ARM_SUBSCRIPTION_ID when given." },
+                    "audience": { "type": "string", "minLength": 1, "description": "The OIDC token's audience. Default api://AzureADTokenExchange." },
+                    "authority": { "type": "string", "pattern": "^https?://", "description": "The Entra authority host, for an emulator. Default https://login.microsoftonline.com." },
+                    "rules": { "$ref": "#/$defs/ciCloudIdentityRules" }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "prEnvironment": {
+          "type": "object",
+          "description": "An environment per open pull request (#4298): chant components pr-env up applies the pull request's components to pr-<number>, which takes the template environment's declared endpoint, and pr-env down tears down only what carries that environment's ownership marker. A pull request's environment is never a release target. Read from the declaration at base, so a pull request cannot change its own template or TTL. Added in schema 1 by chant 0.124.42, so a declaration that uses it sets minReader to 0.124.42 or newer.",
+          "required": ["template"],
+          "additionalProperties": false,
+          "patternProperties": {
+            "^x-": true
+          },
+          "properties": {
+            "template": {
+              "type": "string",
+              "pattern": "^[a-z0-9][a-z0-9-]*$",
+              "description": "The declared environment a pull request's environment is derived from: pr-<number> takes its endpoint unless a pr-* entry declares one."
+            },
+            "ttl": {
+              "type": "string",
+              "pattern": "^[1-9][0-9]*(m|h|d)$",
+              "description": "How long a pull request's environment lives after its last apply, such as 72h, 90m or 7d. chant components pr-env sweep tears down one whose TTL passed. 72h when absent."
+            }
+          }
         }
       }
     },
@@ -254,6 +360,36 @@
   },
   "additionalProperties": false,
   "$defs": {
+    "ciCloudIdentityRules": {
+      "type": "array",
+      "minItems": 1,
+      "description": "Rules, first match wins: a rule matches a pipeline when its environments match the pipeline's environment and its members match the pipeline's member. A rule with no environments matches every environment, and one with no members every member and a pipeline outside a member.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "patternProperties": { "^x-": true },
+        "required": ["plan", "apply"],
+        "properties": {
+          "environments": {
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": { "type": "string", "minLength": 1 },
+            "description": "Environment-name globs, such as prod or staging-*."
+          },
+          "members": { "$ref": "#/$defs/ciMemberGlobs" },
+          "plan": { "type": "string", "minLength": 1, "description": "The identity the plan and record jobs take: a role ARN, a service account email or a client id." },
+          "apply": { "type": "string", "minLength": 1, "description": "The identity the apply jobs take." }
+        }
+      }
+    },
+    "ciMemberGlobs": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1, "pattern": "^[a-z0-9*?\\[\\]{},!-]+$" },
+      "description": "Globs over member names, such as prod-* or [\"api\", \"web\"]: * and ? within the name, [...] classes, {a,b} alternatives."
+    },
     "retentionDays": {
       "type": "integer",
       "minimum": 0,
@@ -504,6 +640,9 @@
           "properties": {
             "workflow": {
               "$ref": "#/$defs/ciWorkflow"
+            },
+            "hooks": {
+              "$ref": "#/$defs/ciHooks"
             }
           }
         },
@@ -1579,8 +1718,16 @@
       "additionalProperties": false
     },
     "ciWorkflow": {
-      "enum": ["trunk-curated", "trunk-curated+apply-on-merge"],
-      "description": "A prescribed delivery workflow (#4168). trunk-curated: a merge records the plan and deploys nothing; releases are cut from green commits and promoted through each member's environments, gated in the last. trunk-curated+apply-on-merge: the same, with the apply on merge turned back on. chant workspace check reports what a member under one still lacks (WSP151), and chant ci init writes it. At the top level for every member, or on a member, which wins. Added in schema 1 by chant 0.124.34, so a declaration that uses it sets minReader to 0.124.34 or newer."
+      "enum": ["trunk-curated", "trunk-curated+apply-on-merge", "apply-before-merge"],
+      "description": "A prescribed delivery workflow (#4168). trunk-curated: a merge records the plan and deploys nothing; releases are cut from green commits and promoted through each member's environments, gated in the last. trunk-curated+apply-on-merge: the same, with the apply on merge turned back on. apply-before-merge (#4301, ws-106): the same as trunk-curated, and a person may also apply an open pull request's plan from its head under its gate, once it is approved, mergeable, undiverged and its checks passed (chant components pr-apply --before-merge); added by chant 0.124.42, so a declaration that uses it sets minReader to 0.124.42 or newer. chant workspace check reports what a member under one still lacks (WSP151), and chant ci init writes it. At the top level for every member, or on a member, which wins. Added in schema 1 by chant 0.124.34, so a declaration that uses it sets minReader to 0.124.34 or newer."
+    },
+    "ciHooks": {
+      "type": "object",
+      "description": "Stage hooks the pull-request jobs run (#4288), in the shape an Op waves spec's hooks take: before.observe, before.plan, after.plan, before.apply and after.apply, each a list of { command, name?, onFailure?, perRun?, targets? }. targets are component names or patterns. chant components pr-plan, pr-record and pr-apply read them from the declaration at base, the top level's first and then the member's. after.gate and apply.runBy are refused. Added in schema 1 by chant 0.124.41, so a declaration that uses it sets minReader to 0.124.41 or newer."
+    },
+    "ciPolicy": {
+      "type": "object",
+      "description": "Gate-time policy on the pull-request jobs (#4294): a policy engine run over the change set, with the policy read at base. engine names the result shape the command prints, conftest (the default) or opa. path is the policy directory, relative to the declaration (default policy). namespace is the package to read. command replaces the engine's own argv, with {policy} for the policy directory exported from base and {input} for the input file. deny rules refuse the apply unless an override counts; hold rules make the plan wait for a person's approval; warn rules are advice. There is no unattended outcome. Added in schema 1 by chant 0.124.41, so a declaration that uses it sets minReader to 0.124.41 or newer."
     },
     "ciPhaseName": {
       "type": "string",

package/dist/workspace/identity-gate-rule.d.ts

@@ -13,7 +13,7 @@
  * The module imports node:crypto through `./trust/gate-seal.ts` and nothing
  * else: no zod, no ajv, no package loading, so it bundles small.
  */
-import { type SealedGateApproval } from "./trust/gate-seal.js";
+import { type SealedGateApproval } from "../lifecycle/gate-seal.js";
 import type { Signer } from "./trust/trust-files.js";
 /** The core classes, in the order a principal's roles are tried; `human` holds no role and is the rest. */
 export declare const CORE_PRINCIPAL_CLASSES: readonly ["human", "agent", "runner", "service"];

package/dist/workspace/identity-gate-rule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-gate-rule.d.ts","sourceRoot":"","sources":["../../src/workspace/identity-gate-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAsH,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAChL,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,2GAA2G;AAC3G,eAAO,MAAM,sBAAsB,YAAI,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,YAAY,EAAE,SAAS,cAAc,EAKjD,CAAC;AAEF,kHAAkH;AAClH,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;AAE/D,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8EAA8E;IAC9E,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC9E,6DAA6D;IAC7D,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,gFAAgF;IAChF,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,iIAAiI;AACjI,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAIrJ;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAQ3F;AAoBD,gFAAgF;AAChF,eAAO,MAAM,YAAY,YAAY,CAAC;AAEtC,oHAAoH;AACpH,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,GAAG,MAAM,CAEnF;AAcD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAM7F;AAED,sGAAsG;AACtG,MAAM,WAAW,qBAAqB;IACpC,mLAAmL;IACnL,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;IAC/C,0GAA0G;IAC1G,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oHAAoH;AACpH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,qBAAqB,CAO3G"}
+{"version":3,"file":"identity-gate-rule.d.ts","sourceRoot":"","sources":["../../src/workspace/identity-gate-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAsH,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACrL,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,2GAA2G;AAC3G,eAAO,MAAM,sBAAsB,YAAI,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,YAAY,EAAE,SAAS,cAAc,EAKjD,CAAC;AAEF,kHAAkH;AAClH,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;AAE/D,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8EAA8E;IAC9E,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC9E,6DAA6D;IAC7D,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,gFAAgF;IAChF,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,iIAAiI;AACjI,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAIrJ;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAQ3F;AAoBD,gFAAgF;AAChF,eAAO,MAAM,YAAY,YAAY,CAAC;AAEtC,oHAAoH;AACpH,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,GAAG,MAAM,CAEnF;AAcD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAM7F;AAED,sGAAsG;AACtG,MAAM,WAAW,qBAAqB;IACpC,mLAAmL;IACnL,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;IAC/C,0GAA0G;IAC1G,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oHAAoH;AACpH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,GAAG,qBAAqB,CAO3G"}

package/dist/workspace/identity-gate-rule.js

@@ -13,7 +13,7 @@
  * The module imports node:crypto through `./trust/gate-seal.ts` and nothing
  * else: no zod, no ajv, no package loading, so it bundles small.
  */
-import { GATE_SEAL_NAMESPACE, gateSealPayload, namespaceAllowed, sshKeyFingerprint, sshSignatureKey, verifySshSignatureWith } from "./trust/gate-seal.js";
+import { GATE_SEAL_NAMESPACE, gateSealPayload, namespaceAllowed, sshKeyFingerprint, sshSignatureKey, verifySshSignatureWith } from "../lifecycle/gate-seal.js";
 /** The core classes, in the order a principal's roles are tried; `human` holds no role and is the rest. */
 export const CORE_PRINCIPAL_CLASSES = ["human", "agent", "runner", "service"];
 export const CORE_CLASSES = [

package/dist/workspace/identity.d.ts

@@ -28,7 +28,7 @@ import type { Declaration, SignedGate } from "./declaration.js";
 import { type GateAdmissionRule } from "./identity-gate-rule.js";
 import { type ClassRegistry } from "./principal-classes.js";
 import type { TrustPolicy } from "./trust/policy.js";
-import type { SealedGateApproval } from "./trust/gate-seal.js";
+import type { SealedGateApproval } from "../lifecycle/gate-seal.js";
 /** The forges a forge identity can name. */
 export declare const FORGES: readonly ["github", "gitlab", "forgejo", "gitea"];
 export type Forge = (typeof FORGES)[number];

package/dist/workspace/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/workspace/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAA+B,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAA4C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGnG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,4CAA4C;AAC5C,eAAO,MAAM,MAAM,YAAI,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AACxE,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAK5C,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;CACf;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAO1E;AAED,8HAA8H;AAC9H,wBAAgB,cAAc,CAAC,EAAE,EAAE,aAAa,GAAG,MAAM,CAExD;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;IACnB,+EAA+E;IAC/E,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;CAC7B;AAID;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAE,WAAW,GAAG,IAAW,GAAG,UAAU,CAQnH;AAED,uDAAuD;AACvD,eAAO,MAAM,cAAc,qCAAsE,CAAC;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAA4B;IACvD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,8GAA8G;AAC9G,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,IAAI,CAS7I;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAElD,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAAC;CACpD;AAED,sHAAsH;AACtH,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAM5F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG;IAAE,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAInH;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAE5F"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/workspace/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAA+B,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAA4C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGnG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,4CAA4C;AAC5C,eAAO,MAAM,MAAM,YAAI,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AACxE,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAK5C,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;CACf;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAO1E;AAED,8HAA8H;AAC9H,wBAAgB,cAAc,CAAC,EAAE,EAAE,aAAa,GAAG,MAAM,CAExD;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;IACnB,+EAA+E;IAC/E,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;CAC7B;AAID;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAE,WAAW,GAAG,IAAW,GAAG,UAAU,CAQnH;AAED,uDAAuD;AACvD,eAAO,MAAM,cAAc,qCAAsE,CAAC;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAA4B;IACvD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,8GAA8G;AAC9G,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,IAAI,CAS7I;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAElD,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAAC;CACpD;AAED,sHAAsH;AACtH,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAM5F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG;IAAE,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAInH;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAE5F"}

package/dist/workspace/lineage-upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lineage-upgrade.d.ts","sourceRoot":"","sources":["../../src/workspace/lineage-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAOH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,OAAO,EAEL,SAAS,EAOT,KAAK,OAAO,EAGZ,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAkC,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAOpE,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,kEAAkE;AAClE,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,qBAAa,YAAa,SAAQ,SAAS;IAChC,IAAI,SAAkB;CAChC;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,iBAAiB,GAAG,WAAW,CAAC;IACzD,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE9I;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,WAarB,CAAC;AAIL,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC3C,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAgGD,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8DAA8D;IAC9D,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,wGAAwG;IACxG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,gCAAgC;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,uGAAuG;IACvG,eAAe,EAAE,oBAAoB,EAAE,CAAC;IACxC,0GAA0G;IAC1G,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAC;IACjB,iHAAiH;IACjH,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,IAAI,IAAI,CAAC;CACjB;AA+OD,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAoFD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAyBjI;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA0QlF;AAyBD,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAa9D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBlG;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CAmC9D"}
+{"version":3,"file":"lineage-upgrade.d.ts","sourceRoot":"","sources":["../../src/workspace/lineage-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAOH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAIhE,OAAO,EAEL,SAAS,EAOT,KAAK,OAAO,EAGZ,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAkC,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAOpE,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,kEAAkE;AAClE,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,qBAAa,YAAa,SAAQ,SAAS;IAChC,IAAI,SAAkB;CAChC;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,iBAAiB,GAAG,WAAW,CAAC;IACzD,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE9I;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,WAarB,CAAC;AAIL,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC3C,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAgGD,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8DAA8D;IAC9D,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,wGAAwG;IACxG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,gCAAgC;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,uGAAuG;IACvG,eAAe,EAAE,oBAAoB,EAAE,CAAC;IACxC,0GAA0G;IAC1G,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAC;IACjB,iHAAiH;IACjH,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,IAAI,IAAI,CAAC;CACjB;AA+OD,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAsFD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAyBjI;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA0QlF;AAyBD,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAa9D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBlG;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CAmC9D"}

package/dist/workspace/lineage-upgrade.js

@@ -40,6 +40,7 @@ import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync,
 import { tmpdir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { computePlanDigest } from "../lifecycle/plan-digest.js";
+import { quorumRules } from "../op/gate-quorum.js";
 import { checkLineage, findingKey } from "./lineage-check.js";
 import { dirLabel, git, parseDirSpec, parseTemplateSource, portableUrl, readTemplateDir, readTemplateTree, recordedDirPath } from "./lineage-init.js";
 import { LOCK_FILE, LockError, contentDigest, fileHash, readLock, renderLock, scopeKey, writeLock, } from "./lineage-lock.js";
@@ -419,11 +420,13 @@ async function rulesAtHead(repo, paths) {
                 const rel = relative(repo, filePath).split(sep).join("/");
                 if (!opFiles.has(rel))
                     continue;
+                // #4290: a quorum may be a list of rules; the strictest count is asked for.
                 for (const approval of gateApprovals(config)) {
-                    const need = approval.quorum?.count ?? 1;
-                    if (need > count) {
-                        count = need;
-                        roles = approval.quorum?.roles;
+                    for (const rule of quorumRules(approval.quorum)) {
+                        if (rule.count > count) {
+                            count = rule.count;
+                            roles = rule.roles;
+                        }
                     }
                 }
             }
@@ -886,7 +889,7 @@ export function describeStaged(staged) {
     for (const s of staged.manualSteps)
         lines.push(`  manual step: ${at(s.path)} (${s.reason})`);
     if (staged.governance) {
-        const q = staged.governance.approval.quorum;
+        const q = quorumRules(staged.governance.approval.quorum)[0];
         lines.push(`  governance: ${staged.governance.paths.join(", ")}; needs ${q.count} human approval(s)${q.roles ? ` with a role in ${q.roles.join(", ")}` : ""}, from the rules at ${staged.governance.rules.slice(0, 12)}`);
     }
     for (const c of staged.checks) {