@intentius/chant 0.124.46 → 0.124.48

package/dist/workspace/declaration.schema.json

@@ -30,6 +30,13 @@
       "$ref": "#/$defs/version",
       "description": "The oldest chant that may read this declaration. An older chant refuses it with reader-too-old."
     },
+    "scope": {
+      "enum": [
+        "repo",
+        "org"
+      ],
+      "description": "What the workspace spans (#3168). repo, the default, is one repository's workspace. org is an org-level workspace: it holds only members of kind repo, each a reference to another repository's workspace, and chant workspace check fails any other member (WSP013). A warden generates an org workspace from its policy, or checks one against the forge's repository list with chant workspace check --forge-repos. Added in schema 1 by chant 0.124.47, so a declaration that uses it sets minReader to 0.124.47 or newer."
+    },
     "members": {
       "type": "array",
       "description": "Members and example groups, in the order readers list them.",
@@ -161,6 +168,13 @@
               "class": {
                 "$ref": "#/$defs/className",
                 "description": "The principal class the signer must be in, read from the role grants at base (#3080, ws-079): human, runner, service, or a domain class a pinned package supplies. A class no pinned package supplies lets no approval through (fail closed). Absent: any signer the signers file lists."
+              },
+              "quorum": {
+                "description": "The approval rules an Op gate of this name takes (#4324), in place of the Op's own approval.quorum: one rule or a list, each with count, and optionally targets globs over the run's environment and roles from .chant/trust.json at base. Read at base, so a change can't lower the quorum its own run needs. notAuthor is refused: an Op gate has no pull request to read the author from. Added in schema 1 by chant 0.124.47, so a declaration that uses it sets minReader to 0.124.47 or newer.",
+                "oneOf": [
+                  { "$ref": "#/$defs/gateQuorumRule" },
+                  { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/gateQuorumRule" } }
+                ]
               }
             }
           }
@@ -446,6 +460,18 @@
       "type": "string",
       "pattern": "^[a-z][a-z0-9-]{0,39}$"
     },
+    "gateQuorumRule": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["count"],
+      "description": "One approval rule (#4290): count distinct human approvers, from roles when it names them.",
+      "properties": {
+        "targets": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "description": "Globs over the run's environment: * within one / segment, ** across segments, ? one character. Absent: every run. A rule with targets never covers a run with no environment." },
+        "count": { "type": "integer", "minimum": 1, "description": "Distinct human approvers the rule needs." },
+        "roles": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "description": "Only an approver .chant/trust.json at base gives one of these roles counts, and only with an approval sealed by a signer listed at base." },
+        "notAuthor": { "type": "boolean", "description": "Refused on an Op gate, which has no author to judge by." }
+      }
+    },
     "className": {
       "type": "string",
       "pattern": "^(?!x-)[a-z][a-z0-9-]{0,39}$",
@@ -573,7 +599,6 @@
       "description": "A member (#2524 D2). Its directory leaves the root project, and it gets its own build, lint and ledger.",
       "required": [
         "name",
-        "dir",
         "kind"
       ],
       "properties": {
@@ -586,7 +611,10 @@
         },
         "kind": {
           "$ref": "#/$defs/kindName",
-          "description": "How to read the member: chant, workspace, other, or a kind a pinned plugin supplies (#2535)."
+          "description": "How to read the member: chant, workspace, repo, other, or a kind a pinned plugin supplies (#2535). Every kind but repo needs dir; a repo member has repo instead (#3168)."
+        },
+        "repo": {
+          "$ref": "#/$defs/repoRef"
         },
         "roles": {
           "type": "array",
@@ -685,6 +713,10 @@
           "type": "boolean",
           "description": "Whether the member goes with an export (#2524 D10, #2552). chant workspace export writes only members that set travel to true into the export member, and refuses to name one that does not. Added in schema 1 by chant 0.101.0, so a declaration that uses it sets minReader to 0.101.0 or newer."
         },
+        "acceptWorkspaceGates": {
+          "type": "boolean",
+          "description": "Whether an approval of a workspace gate may stand in for this member's own gates (#2554, ws-039). It does only when the approval's digest covers the plan the member's run reached its gate with, and only when the declaration at base sets this to true; a working-tree change never opts a member in. Absent or false, a workspace gate never satisfies this member's gates. Added in schema 1 by chant 0.124.47, so a declaration that uses it sets minReader to 0.124.47 or newer."
+        },
         "security": {
           "type": "array",
           "uniqueItems": true,
@@ -706,28 +738,91 @@
         "^x-": true
       },
       "additionalProperties": false,
-      "if": {
-        "type": "object",
-        "properties": {
-          "kind": {
-            "const": "other"
+      "allOf": [
+        {
+          "if": {
+            "type": "object",
+            "properties": {
+              "kind": {
+                "const": "other"
+              }
+            },
+            "required": [
+              "kind"
+            ]
+          },
+          "then": {
+            "type": "object",
+            "properties": {
+              "because": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "because"
+            ]
           }
         },
-        "required": [
-          "kind"
-        ]
-      },
-      "then": {
-        "type": "object",
-        "properties": {
-          "because": {
-            "type": "string"
+        {
+          "if": {
+            "type": "object",
+            "properties": {
+              "kind": {
+                "const": "repo"
+              }
+            },
+            "required": [
+              "kind"
+            ]
+          },
+          "then": {
+            "required": [
+              "repo"
+            ],
+            "properties": {
+              "repo": true,
+              "dir": false
+            }
+          },
+          "else": {
+            "required": [
+              "dir"
+            ],
+            "properties": {
+              "dir": true,
+              "repo": false
+            }
           }
+        }
+      ]
+    },
+    "repoRef": {
+      "type": "object",
+      "description": "Another repository's workspace, named by URL and pinned revision (#3168). A member of kind repo carries it and has no dir. chant reads that workspace read-only through the other repository's own read contract, its chant workspace graph at the revision, the way it reads a nested workspace member, and never writes there. Added in schema 1 by chant 0.124.47, so a declaration that uses it sets minReader to 0.124.47 or newer.",
+      "required": [
+        "url",
+        "rev"
+      ],
+      "properties": {
+        "url": {
+          "type": "string",
+          "pattern": "^[^\\s]+$",
+          "description": "Where git fetches the repository from: an https, ssh or file URL, a local path, or an scp-style git@host:org/repo. A URL that carries a password or token is refused when it is read."
         },
-        "required": [
-          "because"
-        ]
-      }
+        "rev": {
+          "type": "string",
+          "pattern": "^([0-9a-f]{40}|[0-9a-f]{64})$",
+          "description": "The pinned revision, a full commit id. A branch or tag is not a pin."
+        },
+        "workspace": {
+          "$ref": "#/$defs/dir",
+          "description": "The workspace root inside that repository, relative to its git root. Defaults to \".\"."
+        }
+      },
+      "patternProperties": {
+        "^x-": true
+      },
+      "additionalProperties": false
     },
     "memberFields": {
       "type": "object",
@@ -1696,10 +1791,24 @@
       ],
       "properties": {
         "branch": {
-          "type": "string",
-          "minLength": 1,
-          "pattern": "^[^\\s~^:?*\\[\\\\]+$",
-          "description": "The branch whose commits are tagged, such as main. Only its first-parent commits count."
+          "oneOf": [
+            {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "^[^\\s~^:?*\\[\\\\]+$"
+            },
+            {
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^[^\\s~^:?*\\[\\\\]+$"
+              }
+            }
+          ],
+          "description": "The branch whose commits are tagged, such as main. Only its first-parent commits count. A list judges each branch, so a branch ci.branches routes members to gets a green verdict and can release (#4325); the first is the trunk that readers use when they are not told a branch. A string reads as it always did."
         },
         "window": {
           "type": "string",

package/dist/workspace/environments.d.ts

@@ -23,6 +23,13 @@
  * would take it, or left out with `environments-component-undeclared` when
  * the config's environments don't cover it.
  *
+ * Each environment also names its `executor` (#4402): the forge and committed
+ * workflow that deploys it, as the member's config declares on the
+ * environment's entry (`{ name: "prod", executor: { forge: "github",
+ * workflow: "deploy-prod.yml" } }`), a literal entry before a pattern. When
+ * none is declared, `forge` and `workflow` are null and `reason` says why.
+ * chant never derives it from a generated workflow's name.
+ *
  * `chant run --env` refuses a name the config's `environments` doesn't cover
  * whenever it declares any (`unknownEnvError` in `../env.ts`), so a ledger
  * environment the config no longer covers is left out, with a reason. The
@@ -34,7 +41,7 @@
  * `--at` exported. The ledger is always the local `chant/lifecycle` branch,
  * as for `workspace status`, and is never fetched.
  */
-import { type EnvironmentDeclaration } from "../config.js";
+import { type EnvironmentDeclaration, type EnvironmentExecutor } from "../config.js";
 import type { ComponentEnvironmentDeclaration } from "../components/component.js";
 import { type MemberRuntimes } from "./runtimes.js";
 /** The environment `chant run --components` deploys to without `--env`. */
@@ -42,6 +49,19 @@ export declare const LOCAL_ENVIRONMENT = "local";
 /** Why a member's environments are only `local`, or leave out one the ledger has. Closed: part of the read contract. */
 export declare const ENVIRONMENT_REASON_CODES: readonly ["runtimes-config-unreadable", "environments-none-declared", "environments-ledger-undeclared", "environments-ledger-unreadable", "environments-component-undeclared"];
 export type EnvironmentReasonCode = (typeof ENVIRONMENT_REASON_CODES)[number];
+/** Why an environment names no executor (#4402). Closed: part of the read contract. */
+export declare const EXECUTOR_REASON_CODES: readonly ["executor-none-declared", "executor-config-unreadable"];
+export type ExecutorReasonCode = (typeof EXECUTOR_REASON_CODES)[number];
+/** The forge workflow that deploys an environment (#4402), or why none is named. */
+export interface ComponentExecutor {
+    forge: EnvironmentExecutor["forge"] | null;
+    workflow: string | null;
+    /** Null when `forge` and `workflow` are set. */
+    reason: {
+        code: ExecutorReasonCode;
+        message: string;
+    } | null;
+}
 export interface EnvironmentReason {
     code: EnvironmentReasonCode;
     message: string;
@@ -56,6 +76,8 @@ export interface ComponentEnvironment {
     source: "config" | "ledger" | "builtin" | "component";
     /** Where a release of the component goes in this environment, as the component declares it (#3153), or null when it declares nothing for it. */
     site: ComponentSite | null;
+    /** The forge and committed workflow that deploys this environment, from the member's config (#4402). */
+    executor: ComponentExecutor;
     /** The command that deploys the component there, on the site's runtime when the member hosts it and else the default runtime, run in the member's directory. */
     command: string;
 }
@@ -79,7 +101,7 @@ export type LedgerEnvironmentReader = (member: {
 /** What one member's config and ledger say about environments. */
 export interface MemberEnvironments {
     /** Each environment in list order, without the per-component site and command. */
-    environments: Omit<ComponentEnvironment, "command" | "site">[];
+    environments: Omit<ComponentEnvironment, "command" | "site" | "executor">[];
     reasons: EnvironmentReason[];
     /** The config's environments, for whether `chant run --env` takes a name: null when the config couldn't be read, `[]` when it declares none. */
     declared?: EnvironmentDeclaration[] | null;
@@ -93,6 +115,8 @@ export interface MemberEnvironments {
 export declare const readLedgerEnvironments: LedgerEnvironmentReader;
 /** Join a member's config and ledger into its environment list, `local` first, then config order, then the ledger's. */
 export declare function memberEnvironments(runtimes: MemberRuntimes | undefined, ledger: LedgerEnvironments | undefined): MemberEnvironments;
+/** The executor the member's config declares for `env`, or why there is none. */
+export declare function executorFor(env: string, member: MemberEnvironments | undefined): ComponentExecutor;
 /**
  * The environments one component may deploy to, each with its command line.
  * `declared` is what the component's contract says (#3153): an environment

package/dist/workspace/environments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../src/workspace/environments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,EAAqE,KAAK,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC3H,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAE/E,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAGhE,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,wHAAwH;AACxH,eAAO,MAAM,wBAAwB,gLAWK,CAAC;AAC3C,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAC;IACjB,yHAAyH;IACzH,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,gJAAgJ;IAChJ,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,gKAAgK;IAChK,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAClC;AAED,0EAA0E;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,EAAE,MAAM,KAAK,kBAAkB,CAAC;AAEjH,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,YAAY,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC;IAC/D,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,gJAAgJ;IAChJ,QAAQ,CAAC,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC;CAC5C;AAeD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,uBAkBpC,CAAC;AAEF,wHAAwH;AACxH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,EAAE,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,kBAAkB,CA8BnI;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,OAAO,SAAgB,EACvB,QAAQ,GAAE,SAAS,+BAA+B,EAAO,EACzD,KAAK,GAAE,SAAS,MAAM,EAAO,EAC7B,OAAO,GAAE,iBAAiB,EAAO,GAChC,oBAAoB,EAAE,CAqBxB"}
+{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../src/workspace/environments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAGH,OAAO,EAA0F,KAAK,sBAAsB,EAAE,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC1K,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAE/E,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAGhE,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,wHAAwH;AACxH,eAAO,MAAM,wBAAwB,gLAWK,CAAC;AAC3C,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,uFAAuF;AACvF,eAAO,MAAM,qBAAqB,mEAKQ,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gDAAgD;IAChD,MAAM,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9D;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAC;IACjB,yHAAyH;IACzH,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,gJAAgJ;IAChJ,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,wGAAwG;IACxG,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,gKAAgK;IAChK,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAClC;AAED,0EAA0E;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,EAAE,MAAM,KAAK,kBAAkB,CAAC;AAEjH,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,YAAY,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IAC5E,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,gJAAgJ;IAChJ,QAAQ,CAAC,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC;CAC5C;AAeD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,uBAkBpC,CAAC;AAEF,wHAAwH;AACxH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,EAAE,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,kBAAkB,CA8BnI;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,iBAAiB,CAOlG;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,OAAO,SAAgB,EACvB,QAAQ,GAAE,SAAS,+BAA+B,EAAO,EACzD,KAAK,GAAE,SAAS,MAAM,EAAO,EAC7B,OAAO,GAAE,iBAAiB,EAAO,GAChC,oBAAoB,EAAE,CAqBxB"}

package/dist/workspace/environments.js

@@ -23,6 +23,13 @@
  * would take it, or left out with `environments-component-undeclared` when
  * the config's environments don't cover it.
  *
+ * Each environment also names its `executor` (#4402): the forge and committed
+ * workflow that deploys it, as the member's config declares on the
+ * environment's entry (`{ name: "prod", executor: { forge: "github",
+ * workflow: "deploy-prod.yml" } }`), a literal entry before a pattern. When
+ * none is declared, `forge` and `workflow` are null and `reason` says why.
+ * chant never derives it from a generated workflow's name.
+ *
  * `chant run --env` refuses a name the config's `environments` doesn't cover
  * whenever it declares any (`unknownEnvError` in `../env.ts`), so a ledger
  * environment the config no longer covers is left out, with a reason. The
@@ -35,7 +42,7 @@
  * as for `workspace status`, and is never fetched.
  */
 import { execFileSync } from "node:child_process";
-import { environmentName, isEnvironmentPattern, matchesDeclaredEnvironment } from "../config.js";
+import { environmentExecutor, environmentName, isEnvironmentPattern, matchesDeclaredEnvironment } from "../config.js";
 import { LOCAL_RUNTIME } from "./runtimes.js";
 import { ENV_PATTERN, LIFECYCLE_REF, MEMBERS_DIR } from "./status.js";
 /** The environment `chant run --components` deploys to without `--env`. */
@@ -53,6 +60,13 @@ export const ENVIRONMENT_REASON_CODES = [
     /** A component declares an environment the config's environments don't cover, so chant run --env would refuse it (#3153). */
     "environments-component-undeclared",
 ];
+/** Why an environment names no executor (#4402). Closed: part of the read contract. */
+export const EXECUTOR_REASON_CODES = [
+    /** The member's chant.config.ts declares no executor for the environment, so nothing says which forge workflow deploys it. */
+    "executor-none-declared",
+    /** The member's chant.config.ts could not be read, so whether a forge workflow deploys the environment is unknown. */
+    "executor-config-unreadable",
+];
 function git(cwd, args, input) {
     return execFileSync("git", args, { cwd, encoding: "utf-8", input, stdio: [input === undefined ? "ignore" : "pipe", "pipe", "pipe"] });
 }
@@ -129,6 +143,16 @@ export function memberEnvironments(runtimes, ledger) {
             add(name, "ledger");
     return { environments: out, reasons, declared };
 }
+/** The executor the member's config declares for `env`, or why there is none. */
+export function executorFor(env, member) {
+    if (member && member.declared === null) {
+        return { forge: null, workflow: null, reason: { code: "executor-config-unreadable", message: `chant.config.ts could not be read, so no executor is known for ${env}` } };
+    }
+    const found = environmentExecutor(member?.declared ?? undefined, env);
+    if (found)
+        return { forge: found.forge, workflow: found.workflow, reason: null };
+    return { forge: null, workflow: null, reason: { code: "executor-none-declared", message: `chant.config.ts declares no executor for ${env}` } };
+}
 /**
  * The environments one component may deploy to, each with its command line.
  * `declared` is what the component's contract says (#3153): an environment
@@ -159,6 +183,6 @@ export function componentEnvironments(component, member, runtime = LOCAL_RUNTIME
     return list.map((e) => {
         const site = sites.get(e.name) ?? null;
         const on = site?.runtime && (site.runtime === LOCAL_RUNTIME || hosts.includes(site.runtime)) ? site.runtime : runtime;
-        return { ...e, site, command: `chant run --components ${component}${on === LOCAL_RUNTIME ? "" : ` --on ${on}`}${e.default ? "" : ` --env ${e.name}`}` };
+        return { ...e, site, executor: executorFor(e.name, member), command: `chant run --components ${component}${on === LOCAL_RUNTIME ? "" : ` --on ${on}`}${e.default ? "" : ` --env ${e.name}`}` };
     });
 }

package/dist/workspace/flyway-dir.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The `flyway-dir` reader (#4400): the migrations of a Flyway project, in the
+ * order `flyway migrate` applies them. It reads the layout with
+ * `./flyway-layout.ts`, the reading `yodel check` shares, and never runs
+ * Flyway or substitutes placeholders (a replay does that).
+ *
+ * File names follow Flyway's migration naming
+ * (https://documentation.red-gate.com/fd/migrations-271585107.html):
+ *
+ * - versioned `V<version>__<description>.sql`, the version digits joined by
+ *   `.` or `_`;
+ * - repeatable `R__<description>.sql`, run after every versioned migration,
+ *   in the order of their descriptions;
+ * - baseline `B<version>__<description>.sql`, listed with the versioned ones;
+ * - undo `U<version>__<description>.sql`, which is the `down` file of the
+ *   versioned migration with that version and is not listed on its own.
+ *
+ * The prefixes, the separator and the suffixes come from the configuration.
+ * Versions compare part by part as numbers, so `V2` comes before `V10` and
+ * `V1.1` before `V1.2`. Callbacks are not migrations, and a Java or Kotlin
+ * migration is a gap: its code is not SQL.
+ */
+import type { KindLinkRead, KindReadMigration, KindReaderInput } from "./kind-link-readers.js";
+import { type FlywayConfig } from "./flyway-layout.js";
+/** Compare dotted versions part by part as numbers; a missing part is 0. */
+export declare function compareVersions(a: string, b: string): number;
+export interface FlywayFile {
+    type: KindReadMigration["type"];
+    /** The version written with `.` between its parts; empty for a repeatable migration. */
+    version: string;
+    description: string;
+    file: string;
+}
+/** The file's migration role under `config`'s naming, or undefined when its name is not a migration's. */
+export declare function classifyFlywayFile(file: string, config: FlywayConfig): FlywayFile | undefined;
+/** The configuration file the replay depends on, besides the migrations: it holds the placeholders. */
+export declare function flywayReplayFiles(input: Pick<KindReaderInput, "tree" | "dir">): string[];
+export declare const readFlywayDir: (input: KindReaderInput) => KindLinkRead;
+//# sourceMappingURL=flyway-dir.d.ts.map

package/dist/workspace/flyway-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flyway-dir.d.ts","sourceRoot":"","sources":["../../src/workspace/flyway-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAe,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACzG,OAAO,EAAwE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAK1H,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAS5D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChC,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,SAAS,CAoB7F;AAED,uGAAuG;AACvG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC,GAAG,MAAM,EAAE,CAGxF;AAED,eAAO,MAAM,aAAa,UAAW,eAAe,KAAG,YAAiG,CAAC"}

package/dist/workspace/flyway-dir.js

@@ -0,0 +1,104 @@
+/**
+ * The `flyway-dir` reader (#4400): the migrations of a Flyway project, in the
+ * order `flyway migrate` applies them. It reads the layout with
+ * `./flyway-layout.ts`, the reading `yodel check` shares, and never runs
+ * Flyway or substitutes placeholders (a replay does that).
+ *
+ * File names follow Flyway's migration naming
+ * (https://documentation.red-gate.com/fd/migrations-271585107.html):
+ *
+ * - versioned `V<version>__<description>.sql`, the version digits joined by
+ *   `.` or `_`;
+ * - repeatable `R__<description>.sql`, run after every versioned migration,
+ *   in the order of their descriptions;
+ * - baseline `B<version>__<description>.sql`, listed with the versioned ones;
+ * - undo `U<version>__<description>.sql`, which is the `down` file of the
+ *   versioned migration with that version and is not listed on its own.
+ *
+ * The prefixes, the separator and the suffixes come from the configuration.
+ * Versions compare part by part as numbers, so `V2` comes before `V10` and
+ * `V1.1` before `V1.2`. Callbacks are not migrations, and a Java or Kotlin
+ * migration is a gap: its code is not SQL.
+ */
+import { codeMigrations, findFlywayConfig, isCallback, readFlywayConfig, walk } from "./flyway-layout.js";
+import { fieldString, withReplay } from "./migration-dirs.js";
+const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** Compare dotted versions part by part as numbers; a missing part is 0. */
+export function compareVersions(a, b) {
+    const pa = a.split(/[._]/).map(BigInt);
+    const pb = b.split(/[._]/).map(BigInt);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const x = pa[i] ?? 0n;
+        const y = pb[i] ?? 0n;
+        if (x !== y)
+            return x < y ? -1 : 1;
+    }
+    return 0;
+}
+/** The file's migration role under `config`'s naming, or undefined when its name is not a migration's. */
+export function classifyFlywayFile(file, config) {
+    const name = file.split("/").pop() ?? file;
+    if (isCallback(name))
+        return undefined;
+    const suffix = config.sqlMigrationSuffixes.find((s) => name.endsWith(s));
+    if (!suffix)
+        return undefined;
+    const stem = name.slice(0, -suffix.length);
+    const sep = escape(config.sqlMigrationSeparator);
+    const repeatable = new RegExp(`^${escape(config.repeatableSqlMigrationPrefix)}${sep}(.+)$`).exec(stem);
+    if (repeatable)
+        return { type: "repeatable", version: "", description: repeatable[1].replace(/_/g, " "), file };
+    const roles = [
+        ["versioned", config.sqlMigrationPrefix],
+        ["baseline", config.baselineMigrationPrefix],
+        ["undo", config.undoSqlMigrationPrefix],
+    ];
+    for (const [type, prefix] of roles) {
+        if (!prefix)
+            continue;
+        const m = new RegExp(`^${escape(prefix)}([0-9]+(?:[._][0-9]+)*)${sep}(.+)$`).exec(stem);
+        if (m)
+            return { type, version: m[1].replace(/_/g, "."), description: m[2].replace(/_/g, " "), file };
+    }
+    return undefined;
+}
+/** The configuration file the replay depends on, besides the migrations: it holds the placeholders. */
+export function flywayReplayFiles(input) {
+    const f = findFlywayConfig(input.tree, input.dir);
+    return f === undefined ? [] : [f];
+}
+export const readFlywayDir = (input) => withReplay(listFlywayDir(input), input.tree, input.dir, flywayReplayFiles(input));
+function listFlywayDir(input) {
+    const { tree, dir } = input;
+    const gaps = [];
+    const result = { reader: "flyway-dir", links: [], gaps, migrations: [] };
+    const configFile = findFlywayConfig(tree, dir);
+    let config;
+    try {
+        config = readFlywayConfig(tree, configFile, dir);
+    }
+    catch (err) {
+        gaps.push({ file: configFile ?? dir, line: 1, message: `the Flyway configuration could not be read (${err.message}), so no migration was listed` });
+        return result;
+    }
+    const dialect = fieldString(input.fields, "dialect", config.dialect ?? "postgres");
+    for (const l of config.outside)
+        gaps.push({ file: configFile ?? dir, line: 1, message: `the location ${l} lies outside the workspace, so its migrations were not listed` });
+    const files = [...new Set(config.locations.flatMap((d) => walk(tree, d)))];
+    const classified = files.map((f) => classifyFlywayFile(f, config)).filter((f) => f !== undefined);
+    for (const code of codeMigrations(tree, config))
+        gaps.push({ file: code, line: 1, message: `${code.split("/").pop()} is a code migration; its code is not SQL, so it is not listed` });
+    const undo = new Map(classified.filter((f) => f.type === "undo").map((f) => [f.version, f.file]));
+    const ordered = classified.filter((f) => f.type === "versioned" || f.type === "baseline").sort((a, b) => compareVersions(a.version, b.version) || (a.type === "baseline" ? -1 : 1) || (a.file < b.file ? -1 : 1));
+    const repeatable = classified.filter((f) => f.type === "repeatable").sort((a, b) => (a.description < b.description ? -1 : a.description > b.description ? 1 : a.file < b.file ? -1 : 1));
+    const seen = new Map();
+    for (const f of ordered.filter((x) => x.type === "versioned")) {
+        const prior = [...seen.keys()].find((v) => compareVersions(v, f.version) === 0);
+        if (prior !== undefined)
+            gaps.push({ file: f.file, line: 1, message: `version ${f.version} is also ${seen.get(prior)}; Flyway refuses two migrations with one version` });
+        else
+            seen.set(f.version, f.file);
+    }
+    [...ordered, ...repeatable].forEach((f, i) => result.migrations.push({ position: i + 1, version: f.version, name: f.description, type: f.type, file: f.file, line: 1, down: f.type === "versioned" ? (undo.get(f.version) ?? false) : false, dialect }));
+    return result;
+}

package/dist/workspace/flyway-layout.d.ts

@@ -0,0 +1,96 @@
+/**
+ * A Flyway project's layout, read from a workspace tree (#4400): its
+ * `flyway.toml` or `flyway.conf`, the locations it names, read recursively,
+ * and the placeholders it substitutes.
+ *
+ * This is the layout reading of sql-yodeler's `src/check/flyway.ts` (#250),
+ * moved here so the workspace kind and `yodel check` share one reader. It
+ * works on a {@link WorkspaceTree} and tree-relative paths instead of the
+ * file system, and it never runs Flyway or connects to a database.
+ *
+ * The configuration is the first `flyway.toml`, else `flyway.conf`, found in
+ * the directory checked or a directory above it, up to the tree's root. Its
+ * locations are read relative to the file's own directory:
+ *
+ *   filesystem:<path>   that directory
+ *   classpath:<path>    src/main/resources/<path> (and, for code
+ *   <path>              migrations, src/main/java/<path> and src/main/kotlin/<path>)
+ *
+ * With no configuration, or one that names no location, the directory
+ * checked is the one location. A location outside the tree is reported by
+ * {@link FlywayConfig.outside}, not read. A Java or Kotlin migration in a
+ * location is not SQL and is reported by {@link codeMigrations}.
+ *
+ * Placeholders are `${name}` (the prefix and suffix are configurable), from
+ * `flyway.placeholders.<name>` (conf) or `[flyway.placeholders]` (toml), plus
+ * Flyway's own: `flyway:defaultSchema`, `flyway:user`, `flyway:database`,
+ * `flyway:timestamp`, `flyway:filename`, `flyway:workingDirectory`,
+ * `flyway:table` and `flyway:environment`. {@link substitute} replaces them
+ * for a replay; the reader that lists migrations leaves the text as it is.
+ */
+import { type WorkspaceTree } from "./tree.js";
+export interface FlywayConfig {
+    /** The configuration file, tree-relative; undefined with none. */
+    file?: string;
+    /** Where file names are relative to: the configuration's directory, else the directory checked. Tree-relative. */
+    root: string;
+    /** The SQL locations, tree-relative directories. */
+    locations: string[];
+    /** Directories code migrations (Java, Kotlin) of a classpath location would be in. */
+    codeLocations: string[];
+    /** Locations the configuration names that lie outside the tree, as written. */
+    outside: string[];
+    placeholders: Record<string, string>;
+    placeholderPrefix: string;
+    placeholderSuffix: string;
+    placeholderReplacement: boolean;
+    sqlMigrationPrefix: string;
+    repeatableSqlMigrationPrefix: string;
+    baselineMigrationPrefix: string;
+    undoSqlMigrationPrefix: string;
+    sqlMigrationSeparator: string;
+    sqlMigrationSuffixes: string[];
+    defaultSchema?: string;
+    user?: string;
+    database?: string;
+    /** The JDBC URL, when the configuration has one. */
+    url?: string;
+    /** The dialect the URL names: `postgres` or `clickhouse`; undefined for another or none. */
+    dialect?: string;
+    table: string;
+    environment?: string;
+}
+/** The first `flyway.toml`, else `flyway.conf`, in `dir` or a directory above it, up to the tree's root. */
+export declare function findFlywayConfig(tree: WorkspaceTree, dir: string): string | undefined;
+type Values = Record<string, string | string[] | boolean>;
+/** Java-properties `flyway.*` keys, without the `flyway.` prefix. */
+export declare function parseFlywayConf(text: string): Values;
+/** A TOML document, as far as Flyway's configuration uses it: tables, strings, arrays of strings, booleans and numbers. */
+export declare function parseToml(text: string): Record<string, Values>;
+/** The configuration `file` holds, or the defaults with `dir` as the one location when there is none. */
+export declare function readFlywayConfig(tree: WorkspaceTree, file: string | undefined, dir: string): FlywayConfig;
+/** Every file under `dir`, recursively, tree-relative, sorted; none when it does not exist. */
+export declare function walk(tree: WorkspaceTree, dir: string): string[];
+/** A Flyway SQL callback (`beforeMigrate.sql`, `afterEachMigrate__notify.sql`, ...): run around a migrate, not a migration. */
+export declare const isCallback: (file: string) => boolean;
+/** The code migrations (Java, Kotlin) in `config`'s locations, relative to the tree. */
+export declare function codeMigrations(tree: WorkspaceTree, config: FlywayConfig): string[];
+/** A placeholder with no value; `file` is as the caller passed it, `line` is from 1. */
+export declare class FlywayPlaceholderError extends Error {
+    readonly file: string;
+    readonly line: number;
+    readonly placeholder: string;
+    readonly name: string;
+    readonly where: string;
+    constructor(file: string, line: number, placeholder: string, name: string, where: string);
+}
+/**
+ * `text` with its placeholders replaced, line by line so line numbers hold.
+ * A placeholder with no value throws a {@link FlywayPlaceholderError} naming
+ * `file` and the line, as Flyway's own run would fail.
+ */
+export declare function substitute(text: string, file: string, config: FlywayConfig, fallback?: {
+    defaultSchema?: string | undefined;
+}): string;
+export {};
+//# sourceMappingURL=flyway-layout.d.ts.map

package/dist/workspace/flyway-layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flyway-layout.d.ts","sourceRoot":"","sources":["../../src/workspace/flyway-layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEtD,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kHAAkH;IAClH,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sFAAsF;IACtF,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,OAAO,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,4BAA4B,EAAE,MAAM,CAAC;IACrC,uBAAuB,EAAE,MAAM,CAAC;IAChC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,4GAA4G;AAC5G,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUrF;AAED,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;AAE1D,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAepD;AAED,2HAA2H;AAC3H,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAyB9D;AAgDD,yGAAyG;AACzG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAkFzG;AAED,+FAA+F;AAC/F,wBAAgB,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAU/D;AAID,+HAA+H;AAC/H,eAAO,MAAM,UAAU,SAAU,MAAM,KAAG,OAA8E,CAAC;AAEzH,wFAAwF;AACxF,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,CAKlF;AAkBD,wFAAwF;AACxF,qBAAa,sBAAuB,SAAQ,KAAK;IAE7C,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM;IALxB,YACW,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EAGvB;CACF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GAAG,MAAM,CAkB1I"}