@intentius/chant 0.124.46 → 0.124.48

package/dist/components/verbs/publish-artifact.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `publish-artifact` (aliased `publish-asset`): the object-storage half of the
+ * publish family, owned by core (#4408), the same way `publish-image` is.
+ * "Put this archive file at the deploy target" is one agnostic verb; what
+ * differs per cloud is the upload. Each cloud lexicon contributes that as an
+ * {@link ArtifactStorageBackend} through `CapabilityPlugin.storageBackends()`
+ * (aws: S3, azure: Blob, gcp: GCS), and the environment picks one (see
+ * {@link selectStorageBackend}).
+ *
+ * This is a sibling of `registryBackends()` rather than a reuse of it: a
+ * registry backend only logs a docker client in, while a storage backend
+ * moves bytes, and the two are matched against different destinations.
+ *
+ * Core computes the content digest and the final object URI; the backend only
+ * uploads. No rollback.
+ */
+import type { Capability } from "../capability.js";
+export interface PublishArtifactInput {
+    /** Path of the artifact inside the build archive (e.g. a jar or zip). */
+    from: string;
+    /** Destination (e.g. `$env.s3` resolved by the orchestrator). A trailing `/` appends the file's basename. */
+    to: string;
+    /** Which storage backend to use ("s3", "azure-blob", "gcs"). Normally left out: `$env.publish.backend` or the destination URI picks it. */
+    backend?: string;
+}
+export interface PublishArtifactOutput {
+    /** Location the artifact was published to, referenced downstream as `@<component>.publish.uri`. */
+    uri: string;
+    /** Content hash of the published artifact. */
+    digest: string;
+}
+/** A cloud's way of putting one local file at a storage URI. */
+export interface ArtifactStorageBackend {
+    /** Stable name an environment selects by: "s3", "azure-blob", "gcs". */
+    readonly name: string;
+    /** True when this backend owns the destination URI. */
+    matches(uri: string): boolean;
+    /** Upload the local file `from` to the full object URI `to`. */
+    upload(args: {
+        from: string;
+        to: string;
+    }): Promise<void>;
+}
+export declare class StorageBackendError extends Error {
+    constructor(message: string);
+}
+/**
+ * Pick the storage backend for one publish. Order: the step's `backend`, then
+ * the environment's `ctx.vars.publish.backend`, then the single backend whose
+ * `matches` claims the destination, then the only backend there is.
+ */
+export declare function selectStorageBackend(backends: readonly ArtifactStorageBackend[], uri: string, named?: string): ArtifactStorageBackend;
+/** Implemented by a capability that wants the plugins' storage backends injected when a registry is built. */
+export interface StorageBackendConsumer {
+    withStorageBackends(backends: readonly ArtifactStorageBackend[]): Capability<never, unknown>;
+}
+export declare function isStorageBackendConsumer(value: unknown): value is StorageBackendConsumer;
+export type PublishArtifactCapability = Capability<PublishArtifactInput, PublishArtifactOutput> & StorageBackendConsumer;
+/** Build the `publish-artifact` verb over the storage backends available. */
+export declare function createPublishArtifactCapability(options?: {
+    backends?: readonly ArtifactStorageBackend[];
+}): PublishArtifactCapability;
+/** The starter plugin's `publish-artifact`: storage backends injected from the loaded plugins. */
+export declare const publishArtifactCapability: PublishArtifactCapability;
+//# sourceMappingURL=publish-artifact.d.ts.map

package/dist/components/verbs/publish-artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-artifact.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/publish-artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,EAAE,EAAE,MAAM,CAAC;IACX,2IAA2I;IAC3I,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,mGAAmG;IACnG,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gEAAgE;AAChE,MAAM,WAAW,sBAAsB;IACrC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,gEAAgE;IAChE,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,EAC3C,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,GACb,sBAAsB,CAsBxB;AAED,8GAA8G;AAC9G,MAAM,WAAW,sBAAsB;IACrC,mBAAmB,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CAC9F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAExF;AAED,MAAM,MAAM,yBAAyB,GAAG,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,GAAG,sBAAsB,CAAC;AAEzH,6EAA6E;AAC7E,wBAAgB,+BAA+B,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAAO,GAAG,yBAAyB,CAkBzI;AAED,kGAAkG;AAClG,eAAO,MAAM,yBAAyB,EAAE,yBAA6D,CAAC"}

package/dist/components/verbs/publish-artifact.js

@@ -0,0 +1,74 @@
+/**
+ * `publish-artifact` (aliased `publish-asset`): the object-storage half of the
+ * publish family, owned by core (#4408), the same way `publish-image` is.
+ * "Put this archive file at the deploy target" is one agnostic verb; what
+ * differs per cloud is the upload. Each cloud lexicon contributes that as an
+ * {@link ArtifactStorageBackend} through `CapabilityPlugin.storageBackends()`
+ * (aws: S3, azure: Blob, gcp: GCS), and the environment picks one (see
+ * {@link selectStorageBackend}).
+ *
+ * This is a sibling of `registryBackends()` rather than a reuse of it: a
+ * registry backend only logs a docker client in, while a storage backend
+ * moves bytes, and the two are matched against different destinations.
+ *
+ * Core computes the content digest and the final object URI; the backend only
+ * uploads. No rollback.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { archiveRelativePath } from "./build-archive.js";
+export class StorageBackendError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "StorageBackendError";
+    }
+}
+/**
+ * Pick the storage backend for one publish. Order: the step's `backend`, then
+ * the environment's `ctx.vars.publish.backend`, then the single backend whose
+ * `matches` claims the destination, then the only backend there is.
+ */
+export function selectStorageBackend(backends, uri, named) {
+    const names = backends.map((b) => b.name).sort().join(", ") || "none";
+    if (named) {
+        const found = backends.find((b) => b.name === named);
+        if (!found) {
+            throw new StorageBackendError(`publish-artifact: no storage backend "${named}" is registered (available: ${names}); declare the lexicon that contributes it in chant.config.ts`);
+        }
+        return found;
+    }
+    const matched = backends.filter((b) => b.matches(uri));
+    if (matched.length === 1)
+        return matched[0];
+    if (matched.length > 1) {
+        throw new StorageBackendError(`publish-artifact: destination "${uri}" matches several backends (${matched.map((b) => b.name).join(", ")}); set $env.publish.backend`);
+    }
+    if (backends.length === 1)
+        return backends[0];
+    throw new StorageBackendError(`publish-artifact: cannot tell which storage backend serves "${uri}" (available: ${names}); set $env.publish.backend`);
+}
+export function isStorageBackendConsumer(value) {
+    return typeof value === "object" && value !== null && typeof value.withStorageBackends === "function";
+}
+/** Build the `publish-artifact` verb over the storage backends available. */
+export function createPublishArtifactCapability(options = {}) {
+    const backends = options.backends ?? [];
+    return {
+        kind: "publish-artifact",
+        withStorageBackends(next) {
+            return createPublishArtifactCapability({ backends: next });
+        },
+        async run(ctx, input) {
+            const localPath = archiveRelativePath(input.from);
+            const digest = `sha256:${createHash("sha256").update(readFileSync(localPath)).digest("hex")}`;
+            const basename = localPath.split("/").pop() ?? localPath;
+            const uri = input.to.endsWith("/") ? `${input.to}${basename}` : input.to;
+            const envBackend = ctx.vars?.publish?.backend;
+            const backend = selectStorageBackend(backends, uri, input.backend ?? (typeof envBackend === "string" ? envBackend : undefined));
+            await backend.upload({ from: localPath, to: uri });
+            return { uri, digest };
+        },
+    };
+}
+/** The starter plugin's `publish-artifact`: storage backends injected from the loaded plugins. */
+export const publishArtifactCapability = createPublishArtifactCapability();

package/dist/components/verbs/publish-image.d.ts

@@ -0,0 +1,129 @@
+/**
+ * `publish-image`: the registry half of the publish family, owned by core
+ * (#3142, #3143). "Make the image available at the deploy target" is one
+ * agnostic verb; what differs per cloud is how the local docker client logs in
+ * to the registry. Each cloud lexicon contributes that as a
+ * {@link RegistryLoginBackend} through `CapabilityPlugin.registryBackends()`
+ * (aws: ECR, azure: ACR, gcp: Artifact Registry), and the environment picks
+ * one (see {@link selectRegistryBackend}). So a project may declare several
+ * clouds without two plugins registering the same verb.
+ *
+ * Promotion is by digest and unchanged from the aws-only implementation: load
+ * the archived tarball, tag for the destination, log in, push, read the digest
+ * back from the push. Optional SBOM/BOM referrers attach via `oras`, best
+ * effort. No rollback: a pushed, content-addressed image is not something to
+ * undo. See docs/components/build-archive.mdx.
+ */
+import type { Capability } from "../capability.js";
+import { type DockerClient } from "./cloud-executor.js";
+import { type ProcessRunner } from "./process-runner.js";
+/**
+ * Common input shape both image-publish backends accept (`publish-image` here, `load-image-on-host` in the aws lexicon): promote the image
+ * bytes at archive path `from` to wherever the deploy target can consume
+ * them. `to` (registry) and `host` (bare host) are each meaningful to only
+ * one backend, so a component authors one step shape (see
+ * docs/components/build-archive.mdx) and the env-selected backend (see
+ * `selectPublishBackend` below) reads whichever field it needs — the
+ * unselected backend's field is simply unused, never a pipeline fork.
+ */
+export interface PublishImageInput {
+    /** Path of the image tarball inside the build archive (as produced by `docker-build`; an `archive:`-prefixed reference is accepted and stripped). */
+    from: string;
+    /** Destination registry — required by `publish-image`, ignored by `load-image-on-host` (e.g. `$env.registry` resolved by the orchestrator). */
+    to?: string;
+    /** Target host — required by `load-image-on-host`, ignored by `publish-image` (SSM instance id, hostname, or host group). */
+    host?: string;
+    /** Destination path for the tarball on the host, used only by `load-image-on-host`. Default: `/tmp/chant-archive/<basename of from>`. */
+    hostPath?: string;
+    /**
+     * Which registry login backend to use ("ecr", "acr", "artifact-registry").
+     * Normally left out: the environment config (`ctx.vars.publish.backend`) or
+     * the registry host picks it.
+     */
+    backend?: string;
+    /** Additional tags to apply alongside the digest, used only by `publish-image`. */
+    tags?: string[];
+    /**
+     * #610: the artifact's software SBOM (typically wired from a prior
+     * `generate-sbom` step's `sbom` output — see ./sbom.ts's
+     * `GenerateSbomOutput`) to attach as an OCI referrer on the pushed image
+     * digest, via `oras attach`. Used only by `publish-image`; ignored by
+     * `load-image-on-host` (registry-less — nothing to attach to). Omit to
+     * skip the attach step entirely (the archive-carried copy remains the
+     * SBOM's home either way).
+     */
+    sbom?: {
+        bytes: string;
+        mediaType: string;
+    };
+    /**
+     * #610: the component-level aggregate BOM (wired from
+     * ./component-bom.ts's `aggregateComponentBom` output), attached as a
+     * second OCI referrer alongside `sbom` when supplied. Optional and
+     * independent of `sbom` — a caller may attach either, both, or neither.
+     */
+    componentBom?: {
+        bytes: string;
+        mediaType: string;
+    };
+}
+/** Result of `publish-image`'s best-effort OCI-referrer attach step (#610) — always present when `input.sbom`/`input.componentBom` was supplied, `undefined` when neither was (nothing to attach, attach step skipped entirely). */
+export interface ReferrerAttachResult {
+    /** True once every requested attach (`sbom`, `componentBom`) succeeded. `false` if `oras` was unavailable or any `oras attach` invocation failed. */
+    attached: boolean;
+    /** Human-readable reason `attached` is `false` (e.g. "oras is not installed"), omitted when `attached` is `true`. */
+    reason?: string;
+}
+export interface PublishImageOutput {
+    /** Content-addressed digest of the promoted image (`sha256:...`) — what the apply step references. */
+    digest: string;
+    /** Image reference the apply step can pull/run: `registry/repo@sha256:...` for `publish-image`, a host-local reference for `load-image-on-host`. */
+    uri: string;
+    /** #610: outcome of the best-effort SBOM/component-BOM referrer attach, when `input.sbom`/`input.componentBom` was supplied. `undefined` for `load-image-on-host` (no attach concept — registry-less) and for `publish-image` calls that supplied neither. */
+    referrerAttach?: ReferrerAttachResult;
+}
+/**
+ * Common shape both image-publish backends satisfy: promote the image bytes
+ * held in the build archive to wherever the deploy target can consume them,
+ * and return the identity the apply step references. The backend is
+ * selected per environment (`selectPublishBackend`), never per component.
+ */
+export type PublishImageBackend = Capability<PublishImageInput, PublishImageOutput>;
+/** A cloud's way of authenticating the local docker client to its registry. */
+export interface RegistryLoginBackend {
+    /** Stable name an environment selects by: "ecr", "acr", "artifact-registry". */
+    readonly name: string;
+    /** True when this backend owns the registry host (used when the environment does not name one). */
+    matches(registry: string): boolean;
+    /** Authenticate docker against `registry` (host part of the destination). */
+    login(registry: string): Promise<void>;
+}
+export declare class RegistryBackendError extends Error {
+    constructor(message: string);
+}
+/**
+ * Pick the login backend for one publish. Order: the step's `backend`, then the
+ * environment's `ctx.vars.publish.backend`, then the single backend whose
+ * `matches` claims the registry host, then the only backend there is.
+ */
+export declare function selectRegistryBackend(backends: readonly RegistryLoginBackend[], registry: string, named?: string): RegistryLoginBackend;
+/** Implemented by a capability that wants the plugins' registry backends injected when a registry is built. */
+export interface RegistryBackendConsumer {
+    withRegistryBackends(backends: readonly RegistryLoginBackend[]): Capability<never, unknown>;
+}
+export declare function isRegistryBackendConsumer(value: unknown): value is RegistryBackendConsumer;
+export interface PublishImageOptions {
+    docker: DockerClient;
+    backends?: readonly RegistryLoginBackend[];
+    processRunner?: ProcessRunner;
+}
+export type PublishImageCapability = PublishImageBackend & RegistryBackendConsumer;
+/**
+ * Build the `publish-image` verb over a docker client and the registry login
+ * backends available. Load, tag, log in via the selected backend, push, and
+ * return the pushed digest.
+ */
+export declare function createPublishImageCapability(options: PublishImageOptions): PublishImageCapability;
+/** The starter plugin's `publish-image`: real docker, backends injected from the loaded plugins. */
+export declare const publishImageCapability: PublishImageCapability;
+//# sourceMappingURL=publish-image.d.ts.map

package/dist/components/verbs/publish-image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-image.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/publish-image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,qJAAqJ;IACrJ,IAAI,EAAE,MAAM,CAAC;IACb,+IAA+I;IAC/I,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,6HAA6H;IAC7H,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yIAAyI;IACzI,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;;;;;OAKG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED,oOAAoO;AACpO,MAAM,WAAW,oBAAoB;IACnC,qJAAqJ;IACrJ,QAAQ,EAAE,OAAO,CAAC;IAClB,qHAAqH;IACrH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,sGAAsG;IACtG,MAAM,EAAE,MAAM,CAAC;IACf,oJAAoJ;IACpJ,GAAG,EAAE,MAAM,CAAC;IACZ,8PAA8P;IAC9P,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AAIpF,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,6EAA6E;IAC7E,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,GACb,oBAAoB,CAsBtB;AAED,+GAA+G;AAC/G,MAAM,WAAW,uBAAuB;IACtC,oBAAoB,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CAC7F;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,uBAAuB,CAE1F;AA4DD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,GAAG,uBAAuB,CAAC;AAEnF;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,mBAAmB,GAAG,sBAAsB,CAqCjG;AAED,oGAAoG;AACpG,eAAO,MAAM,sBAAsB,EAAE,sBAA6E,CAAC"}

package/dist/components/verbs/publish-image.js

@@ -0,0 +1,145 @@
+/**
+ * `publish-image`: the registry half of the publish family, owned by core
+ * (#3142, #3143). "Make the image available at the deploy target" is one
+ * agnostic verb; what differs per cloud is how the local docker client logs in
+ * to the registry. Each cloud lexicon contributes that as a
+ * {@link RegistryLoginBackend} through `CapabilityPlugin.registryBackends()`
+ * (aws: ECR, azure: ACR, gcp: Artifact Registry), and the environment picks
+ * one (see {@link selectRegistryBackend}). So a project may declare several
+ * clouds without two plugins registering the same verb.
+ *
+ * Promotion is by digest and unchanged from the aws-only implementation: load
+ * the archived tarball, tag for the destination, log in, push, read the digest
+ * back from the push. Optional SBOM/BOM referrers attach via `oras`, best
+ * effort. No rollback: a pushed, content-addressed image is not something to
+ * undo. See docs/components/build-archive.mdx.
+ */
+import { archiveRelativePath } from "./build-archive.js";
+import { realDocker } from "./cloud-executor.js";
+import { defaultProcessRunner, q } from "./process-runner.js";
+export class RegistryBackendError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "RegistryBackendError";
+    }
+}
+/**
+ * Pick the login backend for one publish. Order: the step's `backend`, then the
+ * environment's `ctx.vars.publish.backend`, then the single backend whose
+ * `matches` claims the registry host, then the only backend there is.
+ */
+export function selectRegistryBackend(backends, registry, named) {
+    const names = backends.map((b) => b.name).sort().join(", ") || "none";
+    if (named) {
+        const found = backends.find((b) => b.name === named);
+        if (!found) {
+            throw new RegistryBackendError(`publish-image: no registry backend "${named}" is registered (available: ${names}); declare the lexicon that contributes it in chant.config.ts`);
+        }
+        return found;
+    }
+    const matched = backends.filter((b) => b.matches(registry));
+    if (matched.length === 1)
+        return matched[0];
+    if (matched.length > 1) {
+        throw new RegistryBackendError(`publish-image: registry "${registry}" matches several backends (${matched.map((b) => b.name).join(", ")}); set $env.publish.backend`);
+    }
+    if (backends.length === 1)
+        return backends[0];
+    throw new RegistryBackendError(`publish-image: cannot tell which registry backend serves "${registry}" (available: ${names}); set $env.publish.backend`);
+}
+export function isRegistryBackendConsumer(value) {
+    return typeof value === "object" && value !== null && typeof value.withRegistryBackends === "function";
+}
+// ── publish-image ────────────────────────────────────────────────────────────
+/**
+ * Attempt to `oras attach` one referrer document (SBOM or component BOM) to
+ * `imageRef`'s digest. Writes the document's bytes to a scratch file (`oras
+ * attach` reads from a file path, not stdin) and shells out through
+ * `runner`. Never throws — a failure here is reported back to the caller as
+ * `{ ok: false, reason }` so a missing/erroring `oras` never fails the
+ * publish itself (see `attachReferrers`'s doc comment for why).
+ */
+async function attachOneReferrer(runner, imageRef, doc, label) {
+    try {
+        const scratchFile = `/tmp/chant-referrer-attach/${label}-${Date.now()}.json`;
+        await runner.run(`mkdir -p ${q("/tmp/chant-referrer-attach")}`);
+        await runner.run(`printf '%s' ${q(doc.bytes)} > ${q(scratchFile)}`);
+        await runner.run(`oras attach --artifact-type ${q(doc.mediaType)} ${q(imageRef)} ${q(scratchFile)}:${q(doc.mediaType)}`);
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, reason: err instanceof Error ? err.message : String(err) };
+    }
+}
+/**
+ * Best-effort OCI-referrer attach for a just-pushed image (#610): attaches
+ * `input.sbom` and/or `input.componentBom`, when supplied, to `imageRef` via
+ * `oras attach`. Guarded on `oras` availability — a missing binary is
+ * reported back as `{ attached: false, reason }` rather than thrown, since
+ * the image itself is already successfully promoted by the time this step
+ * runs (attach is additive registry-side convenience on top of the
+ * archive-carried copy, per this module's doc comment, never a condition the
+ * core promote-by-digest job depends on). Returns `undefined` when neither
+ * `input.sbom` nor `input.componentBom` was supplied — nothing to attach,
+ * skipped entirely, no `oras` call at all.
+ */
+async function attachReferrers(runner, imageRef, input) {
+    if (!input.sbom && !input.componentBom)
+        return undefined;
+    if (!(await runner.available("oras"))) {
+        return { attached: false, reason: `"oras" is not installed or not on PATH — required to attach OCI referrers` };
+    }
+    const results = [];
+    if (input.sbom)
+        results.push(await attachOneReferrer(runner, imageRef, input.sbom, "sbom"));
+    if (input.componentBom)
+        results.push(await attachOneReferrer(runner, imageRef, input.componentBom, "component-bom"));
+    const failed = results.find((r) => !r.ok);
+    return failed ? { attached: false, reason: failed.reason } : { attached: true };
+}
+/**
+ * Build the `publish-image` verb over a docker client and the registry login
+ * backends available. Load, tag, log in via the selected backend, push, and
+ * return the pushed digest.
+ */
+export function createPublishImageCapability(options) {
+    const { docker } = options;
+    const backends = options.backends ?? [];
+    const processRunner = options.processRunner ?? defaultProcessRunner();
+    return {
+        kind: "publish-image",
+        withRegistryBackends(next) {
+            return createPublishImageCapability({ docker, processRunner, backends: next });
+        },
+        async run(ctx, input) {
+            if (!input.to)
+                throw new Error(`publish-image "${input.from}": "to" (destination registry) is required`);
+            const repo = input.to.replace(/\/+$/, "");
+            const registry = repo.split("/")[0];
+            const envBackend = ctx.vars?.publish?.backend;
+            const backend = selectRegistryBackend(backends, registry, input.backend ?? (typeof envBackend === "string" ? envBackend : undefined));
+            // `docker load` reports the archived image's local reference: a name:tag
+            // for a tagged build, or an image id. It is a valid `docker tag` source
+            // but never a registry digest, so the promoted digest is read back from
+            // the push below.
+            const { digest: localRef } = await docker.load({ inFile: archiveRelativePath(input.from) });
+            // Publish under a tag: docker can neither tag nor push a digest-qualified
+            // reference, so the transport is a tag and the stable identifier is the
+            // digest the push returns.
+            const pushRef = `${repo}:latest`;
+            await docker.tag({ source: localRef, target: pushRef });
+            await backend.login(registry);
+            const { digest: pushed } = await docker.push({ image: pushRef });
+            const digest = pushed.includes("@") ? pushed.slice(pushed.indexOf("@") + 1) : pushed;
+            for (const tag of input.tags ?? []) {
+                const tagged = `${repo}:${tag}`;
+                await docker.tag({ source: localRef, target: tagged });
+                await docker.push({ image: tagged });
+            }
+            const referrerAttach = await attachReferrers(processRunner, `${repo}@${digest}`, input);
+            return { digest, uri: `${repo}@${digest}`, ...(referrerAttach ? { referrerAttach } : {}) };
+        },
+    };
+}
+/** The starter plugin's `publish-image`: real docker, backends injected from the loaded plugins. */
+export const publishImageCapability = createPublishImageCapability({ docker: realDocker });

package/dist/config-environments.d.ts

@@ -19,12 +19,26 @@ import type { ChantConfig } from "./config.js";
  * `./workspace/promotion-order.ts`), and `canary: true` marks a step as the
  * canary step of that order. The canary is declared and surfaced; chant does
  * not yet act on it.
+ *
+ * `executor` names the forge and the committed workflow that deploys the
+ * environment (#4402), so a reader such as behold knows a release there runs
+ * through CI rather than a local `chant run`. chant declares and prints it
+ * (`chant workspace graph --composites`); it never dispatches it.
  */
 export type EnvironmentDeclaration = string | {
     name: string;
     endpoint?: string;
     canary?: boolean;
+    executor?: EnvironmentExecutor;
 };
+/** The forges an environment's executor can name (#4402). */
+export declare const EXECUTOR_FORGES: readonly ["github", "gitlab", "forgejo"];
+/** The forge workflow that deploys one environment (#4402). */
+export interface EnvironmentExecutor {
+    forge: (typeof EXECUTOR_FORGES)[number];
+    /** The committed workflow file the forge runs, such as `deploy-prod.yml` under `.github/workflows/`, or `.gitlab-ci.yml`. */
+    workflow: string;
+}
 /**
  * `ownership.env`: a literal environment identity, or a reference to a
  * declared build parameter whose resolved value becomes the identity (#1396).
@@ -78,6 +92,12 @@ export declare function matchesDeclaredEnvironment(environments: EnvironmentDecl
  * `pr-*` resolves `pr-special` to the literal entry's endpoint (or none).
  */
 export declare function environmentEndpoint(environments: EnvironmentDeclaration[] | undefined, name: string): string | undefined;
+/**
+ * The executor `name` declares (#4402), resolved like {@link
+ * environmentEndpoint}: a literal entry wins over a pattern, and a literal
+ * entry with no executor does not fall through to a pattern's.
+ */
+export declare function environmentExecutor(environments: EnvironmentDeclaration[] | undefined, name: string): EnvironmentExecutor | undefined;
 /** Whether an `ownership.env` entry is a build-parameter reference rather than a literal. */
 export declare function isOwnershipParamRef(env: OwnershipEnv | undefined): env is {
     param: string;

package/dist/config-environments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-environments.d.ts","sourceRoot":"","sources":["../src/config-environments.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpG;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAEzG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAehF;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,EAClD,IAAI,EAAE,MAAM,GACX,OAAO,CAIT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKxH;AAED,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,GAAG,IAAI;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAE3F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,MAAM,GAAG,SAAS,CAIhG"}
+{"version":3,"file":"config-environments.d.ts","sourceRoot":"","sources":["../src/config-environments.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAEpI,6DAA6D;AAC7D,eAAO,MAAM,eAAe,YAAI,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAExE,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;IACxC,6HAA6H;IAC7H,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAEzG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAehF;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,EAClD,IAAI,EAAE,MAAM,GACX,OAAO,CAIT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKxH;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAKrI;AAED,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,GAAG,IAAI;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAE3F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,MAAM,GAAG,SAAS,CAIhG"}

package/dist/config-environments.js

@@ -4,6 +4,8 @@
  * them. They import nothing at runtime, so ./components/pr-environment.ts and
  * ./live-endpoint.ts use them without bundling the config loader.
  */
+/** The forges an environment's executor can name (#4402). */
+export const EXECUTOR_FORGES = ["github", "gitlab", "forgejo"];
 /** The declared name of one `environments` entry, whichever form it takes. */
 export function environmentName(entry) {
     return typeof entry === "string" ? entry : entry.name;
@@ -84,6 +86,16 @@ export function environmentEndpoint(environments, name) {
         environments?.find((e) => isEnvironmentPattern(environmentName(e)) && matchesEnvironmentPattern(environmentName(e), name));
     return found && typeof found !== "string" ? found.endpoint : undefined;
 }
+/**
+ * The executor `name` declares (#4402), resolved like {@link
+ * environmentEndpoint}: a literal entry wins over a pattern, and a literal
+ * entry with no executor does not fall through to a pattern's.
+ */
+export function environmentExecutor(environments, name) {
+    const found = environments?.find((e) => environmentName(e) === name) ??
+        environments?.find((e) => isEnvironmentPattern(environmentName(e)) && matchesEnvironmentPattern(environmentName(e), name));
+    return found && typeof found !== "string" ? found.executor : undefined;
+}
 /** Whether an `ownership.env` entry is a build-parameter reference rather than a literal. */
 export function isOwnershipParamRef(env) {
     return typeof env === "object" && env !== null && typeof env.param === "string";

package/dist/config.d.ts

@@ -9,7 +9,7 @@ import type { BuildParamProvenance } from "./provenance.js";
 import { type LexiconDeclaration } from "./lexicon-module.js";
 import { type DecideConfig } from "./op/decide-config.js";
 import { type PublishDeclaration } from "./lifecycle/publish-declaration.js";
-export { environmentEndpoint, environmentName, environmentNames, isEnvironmentPattern, isOwnershipParamRef, matchesDeclaredEnvironment, matchesEnvironmentPattern, resolveOwnershipStack, type EnvironmentDeclaration, type OwnershipEnv, } from "./config-environments.js";
+export { environmentEndpoint, environmentExecutor, environmentName, EXECUTOR_FORGES, environmentNames, isEnvironmentPattern, isOwnershipParamRef, matchesDeclaredEnvironment, matchesEnvironmentPattern, resolveOwnershipStack, type EnvironmentDeclaration, type EnvironmentExecutor, type OwnershipEnv, } from "./config-environments.js";
 import { type EnvironmentDeclaration, type OwnershipEnv } from "./config-environments.js";
 export declare const ChantConfigSchema: z.ZodObject<{
     lexicons: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
@@ -22,6 +22,14 @@ export declare const ChantConfigSchema: z.ZodObject<{
         name: z.ZodString;
         endpoint: z.ZodOptional<z.ZodString>;
         canary: z.ZodOptional<z.ZodBoolean>;
+        executor: z.ZodOptional<z.ZodObject<{
+            forge: z.ZodEnum<{
+                forgejo: "forgejo";
+                github: "github";
+                gitlab: "gitlab";
+            }>;
+            workflow: z.ZodString;
+        }, z.core.$strict>>;
     }, z.core.$strip>]>>>;
     sourceDir: z.ZodOptional<z.ZodString>;
     lint: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD,OAAO,EAA8D,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvH,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAKpG,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAA8C,KAAK,sBAAsB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAuBnI,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4Ed,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAEhC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAExC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,0EAA0E;QAC1E,IAAI,EAAE,MAAM,CAAC;QACb,8EAA8E;QAC9E,GAAG,EAAE,MAAM,CAAC;QACZ;mFAC2E;QAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IAEH,8DAA8D;IAC9D,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;KAC1B,CAAC;IAEF;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE;QACV,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IAEF;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,2EAA2E;QAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;;;;;WASG;QACH,GAAG,CAAC,EAAE,YAAY,CAAC;QACnB,kEAAkE;QAClE,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;OAEG;IACH,KAAK,CAAC,EAAE;QACN;;;;;;;WAOG;QACH,IAAI,CAAC,EAAE,OAAO,CAAC;QAEf;;;;;;;WAOG;QACH,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,8KAA8K;QAC9K,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB;;;;WAIG;QACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;KAChC,CAAC;IAEF,4DAA4D;IAC5D,GAAG,CAAC,EAAE;QACJ;;;;WAIG;QACH,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;IAEF;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,+OAA+O;QAC/O,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,4cAA4c;QAC5c,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE;QACR,wJAAwJ;QACxJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,sRAAsR;QACtR,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,2IAA2I;QAC3I,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,0IAA0I;QAC1I,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,4UAA4U;QAC5U,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE;QACX,kEAAkE;QAClE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,2EAA2E;QAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,gEAAgE;QAChE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,wEAAwE;QACxE,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,0FAA0F;QAC1F,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,0FAA0F;QAC1F,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,0EAA0E;QAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,8DAA8D;QAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,wEAAwE;QACxE,yBAAyB,CAAC,EAAE,OAAO,CAAC;QACpC,+EAA+E;QAC/E,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAChD,yKAAyK;QACzK,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAC5B,kHAAkH;QAClH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IAEF;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE;QACV,iFAAiF;QACjF,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QACR,qFAAqF;QACrF,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,MAAM,EAAE,iBAAiB,CAAC;IAE1B,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,iBAAsB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAkB1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAIrF;AAED,sGAAsG;AACtG,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAQrG;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAcjG;AAwBD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAY9D;AAsCD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC5C,eAAe,GAAG,SAAS,CAI7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAG1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAIlF;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAGrF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,CAE1F;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,gJAAgJ;IAChJ,OAAO,EAAE,OAAO,CAAC;IACjB,qIAAqI;IACrI,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,6RAA6R;IAC7R,sBAAsB,EAAE;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,uBAAuB,CAanF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAiB1E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACnB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAAlD,YAAY,OAAO,EAAE,MAAM,EAAW,GAAG,CAAC,EAAE,MAAM,YAAA,EAEjD;CACF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD,OAAO,EAA8D,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvH,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAKpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAA+D,KAAK,sBAAsB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AA2BpJ,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4Ed,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAEhC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAExC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,0EAA0E;QAC1E,IAAI,EAAE,MAAM,CAAC;QACb,8EAA8E;QAC9E,GAAG,EAAE,MAAM,CAAC;QACZ;mFAC2E;QAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IAEH,8DAA8D;IAC9D,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;KAC1B,CAAC;IAEF;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE;QACV,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IAEF;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,2EAA2E;QAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;;;;;WASG;QACH,GAAG,CAAC,EAAE,YAAY,CAAC;QACnB,kEAAkE;QAClE,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;OAEG;IACH,KAAK,CAAC,EAAE;QACN;;;;;;;WAOG;QACH,IAAI,CAAC,EAAE,OAAO,CAAC;QAEf;;;;;;;WAOG;QACH,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,8KAA8K;QAC9K,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB;;;;WAIG;QACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;KAChC,CAAC;IAEF,4DAA4D;IAC5D,GAAG,CAAC,EAAE;QACJ;;;;WAIG;QACH,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;IAEF;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,+OAA+O;QAC/O,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,4cAA4c;QAC5c,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE;QACR,wJAAwJ;QACxJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,sRAAsR;QACtR,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,2IAA2I;QAC3I,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,0IAA0I;QAC1I,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,4UAA4U;QAC5U,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE;QACX,kEAAkE;QAClE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,2EAA2E;QAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,gEAAgE;QAChE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,wEAAwE;QACxE,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,0FAA0F;QAC1F,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,0FAA0F;QAC1F,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,0EAA0E;QAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,8DAA8D;QAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,wEAAwE;QACxE,yBAAyB,CAAC,EAAE,OAAO,CAAC;QACpC,+EAA+E;QAC/E,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAChD,yKAAyK;QACzK,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAC5B,kHAAkH;QAClH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IAEF;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE;QACV,iFAAiF;QACjF,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QACR,qFAAqF;QACrF,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,MAAM,EAAE,iBAAiB,CAAC;IAE1B,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,iBAAsB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAkB1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAIrF;AAED,sGAAsG;AACtG,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAQrG;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAcjG;AAwBD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAY9D;AAsCD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC5C,eAAe,GAAG,SAAS,CAI7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAG1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAIlF;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAGrF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,CAE1F;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,gJAAgJ;IAChJ,OAAO,EAAE,OAAO,CAAC;IACjB,qIAAqI;IACrI,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,6RAA6R;IAC7R,sBAAsB,EAAE;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,uBAAuB,CAanF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAiB1E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACnB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAAlD,YAAY,OAAO,EAAE,MAAM,EAAW,GAAG,CAAC,EAAE,MAAM,YAAA,EAEjD;CACF"}

package/dist/config.js

@@ -10,8 +10,8 @@ import { PublishDeclarationSchema } from "./lifecycle/publish-declaration.js";
 // The environment and ownership helpers that read a config already loaded
 // live in ./config-environments.ts, which loads nothing, so a bundle that
 // needs only them stays clear of the loader below (#4356 follow-up).
-export { environmentEndpoint, environmentName, environmentNames, isEnvironmentPattern, isOwnershipParamRef, matchesDeclaredEnvironment, matchesEnvironmentPattern, resolveOwnershipStack, } from "./config-environments.js";
-import { isOwnershipParamRef, resolveOwnershipStack } from "./config-environments.js";
+export { environmentEndpoint, environmentExecutor, environmentName, EXECUTOR_FORGES, environmentNames, isEnvironmentPattern, isOwnershipParamRef, matchesDeclaredEnvironment, matchesEnvironmentPattern, resolveOwnershipStack, } from "./config-environments.js";
+import { EXECUTOR_FORGES, isOwnershipParamRef, resolveOwnershipStack } from "./config-environments.js";
 /**
  * Zod schema for ChantConfig validation.
  */
@@ -21,6 +21,10 @@ const EnvironmentEntrySchema = z.union([
         name: z.string().min(1),
         endpoint: z.string().min(1).optional(),
         canary: z.boolean().optional(),
+        executor: z.object({
+            forge: z.enum(EXECUTOR_FORGES),
+            workflow: z.string().min(1),
+        }).strict().optional(),
     }),
 ]);
 const LexiconEntrySchema = z.union([

package/dist/gate-decision.d.ts

@@ -30,7 +30,10 @@
  * Approval rules (#4290), a quorum as a list of `{ targets, count, roles,
  * notAuthor }`, are judged with `./op/gate-quorum.ts`, re-exported here:
  * {@link trustRolesAt} and {@link gateSignersAt} read what
- * `trustQuorumJudge` judges by, at base.
+ * `trustQuorumJudge` judges by, at base. A product's own review lines
+ * (#4333) become one approval per reviewer with `recordedReviewApprovals`,
+ * and `changeInvolvement` names everyone involved in a change for the
+ * judge to leave out.
  *
  * The module reads the ledger lines and the review it is handed; reading
  * them is the caller's. It imports no TypeScript, esbuild, zod, ajv, lint,
@@ -45,6 +48,7 @@ import { type GateSigners, type SealedGateApproval } from "./lifecycle/gate-seal
 import { type ClassGrant } from "./workspace/identity-gate-rule.js";
 import type { GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-ledger.js";
 import type { MergedReview } from "./op/gate-review.js";
+import { type GateQuorumSpec as QuorumSpec } from "./op/gate-quorum.js";
 import type { GateApprovalSource } from "./op/op-waves.js";
 export { GATE_APPROVAL_SOURCES, type GateApprovalSource } from "./op/op-waves.js";
 export { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, latestResolutionSince, type PlanBoundResolution, } from "./lifecycle/gate-ledger-select.js";
@@ -54,7 +58,7 @@ export type { GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-l
 export { CORE_CLASSES, admitApprover, grantedClasses, type ClassGrant, type GateAdmissionRule, type PrincipalClass, } from "./workspace/identity-gate-rule.js";
 export { appliedGateApplies, appliedGatePath, isApprovalSpent, parseAppliedGateLines, type AppliedGateRecord, } from "./lifecycle/gate-applied.js";
 export type { MergedReview } from "./op/gate-review.js";
-export { quorumNeed, quorumProblems, quorumRuleLine, quorumRuleProgress, quorumRules, quorumRulesFor, quorumWaiting, rolesOf, ruleNeedsProof, samePrincipal, targetGlobMatch, trustQuorumJudge, UNPROVEN_JUDGE, type GateQuorumJudge, type GateQuorumRule, type GateQuorumRuleProgress, type GateQuorumSpec, type QuorumApprover, type QuorumJudgement, type TrustQuorumInput, } from "./op/gate-quorum.js";
+export { quorumNeed, quorumProblems, quorumRuleLine, quorumRuleProgress, quorumRules, quorumRulesFor, quorumWaiting, rolesOf, ruleNeedsProof, samePrincipal, targetGlobMatch, trustQuorumJudge, UNPROVEN_JUDGE, changeInvolvement, involvedWhy, principalNames, recordedReviewApprovals, recordedReviewOf, requestedByTrailers, type QuorumInvolvement, type RecordedReview, type GateQuorumJudge, type GateQuorumRule, type GateQuorumRuleProgress, type GateQuorumSpec, type QuorumApprover, type QuorumJudgement, type TrustQuorumInput, } from "./op/gate-quorum.js";
 /**
  * The commit a gate's rule is read at when the default branch applies its
  * own commit: the first parent of HEAD, the branch as it stood before the
@@ -82,6 +86,11 @@ export declare function trustRolesAt(repo: string, base: string): Record<string,
 export interface IdentityGate {
     gate: string;
     class: string | null;
+    /**
+     * `identity.gates.<gate>.quorum` (#4324): the approval rules an Op gate of
+     * this name takes in place of its own. Absent when the entry sets none.
+     */
+    quorum?: QuorumSpec;
 }
 /**
  * The gates `chant.workspace.json` (or `.jsonc`) at `base` names under