@intentius/chant 0.124.46 → 0.124.49

package/dist/workspace/declaration.schema.json

@@ -30,6 +30,13 @@
       "$ref": "#/$defs/version",
       "description": "The oldest chant that may read this declaration. An older chant refuses it with reader-too-old."
     },
+    "scope": {
+      "enum": [
+        "repo",
+        "org"
+      ],
+      "description": "What the workspace spans (#3168). repo, the default, is one repository's workspace. org is an org-level workspace: it holds only members of kind repo, each a reference to another repository's workspace, and chant workspace check fails any other member (WSP013). A warden generates an org workspace from its policy, or checks one against the forge's repository list with chant workspace check --forge-repos. Added in schema 1 by chant 0.124.47, so a declaration that uses it sets minReader to 0.124.47 or newer."
+    },
     "members": {
       "type": "array",
       "description": "Members and example groups, in the order readers list them.",
@@ -161,6 +168,33 @@
               "class": {
                 "$ref": "#/$defs/className",
                 "description": "The principal class the signer must be in, read from the role grants at base (#3080, ws-079): human, runner, service, or a domain class a pinned package supplies. A class no pinned package supplies lets no approval through (fail closed). Absent: any signer the signers file lists."
+              },
+              "quorum": {
+                "description": "The approval rules an Op gate of this name takes (#4324), in place of the Op's own approval.quorum: one rule or a list, each with count, and optionally targets globs over the run's environment and roles from .chant/trust.json at base. Read at base, so a change can't lower the quorum its own run needs. notAuthor is refused: an Op gate has no pull request to read the author from. Added in schema 1 by chant 0.124.47, so a declaration that uses it sets minReader to 0.124.47 or newer.",
+                "oneOf": [
+                  { "$ref": "#/$defs/gateQuorumRule" },
+                  { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/gateQuorumRule" } }
+                ]
+              },
+              "policy": {
+                "$ref": "#/$defs/gatePolicyRef",
+                "description": "The policy set an Op gate of this name takes (#4404), in place of the Op's own approval.policy. Read at base, so a change can't swap in a permissive policy for its own run. Build the object with the owning lexicon's helper (the cedar lexicon's gatePolicy()) and paste it here. Added in schema 1 by chant 0.124.49, so a declaration that uses it sets minReader to 0.124.49 or newer."
+              },
+              "mode": {
+                "enum": ["log-only", "enforce"],
+                "description": "Whether the policy's decision binds the gate (#4404), in place of the Op's own approval.mode: log-only records it next to the approval, enforce passes the gate only on a permit. Read at base, so a change can't switch its own gate to a mode that passes it. Added in schema 1 by chant 0.124.49, so a declaration that uses it sets minReader to 0.124.49 or newer."
+              },
+              "context": {
+                "type": "object",
+                "description": "Plan attributes handed to the policy (#4404), over the Op's own approval.context, key by key: a change can't edit a key declared here, and a key only the Op declares still reaches the policy. A value is a plain one, since a step output reference is resolved at run time and a declaration can't hold one. plan is reserved. Added in schema 1 by chant 0.124.49, so a declaration that uses it sets minReader to 0.124.49 or newer.",
+                "additionalProperties": {
+                  "oneOf": [
+                    { "type": "string" },
+                    { "type": "number" },
+                    { "type": "boolean" },
+                    { "type": "array", "items": { "type": "string" } }
+                  ]
+                }
               }
             }
           }
@@ -446,6 +480,31 @@
       "type": "string",
       "pattern": "^[a-z][a-z0-9-]{0,39}$"
     },
+    "gatePolicyRef": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "lexicon", "name", "version", "text"],
+      "description": "A gate policy set a lexicon rendered (#2508), as plain data.",
+      "properties": {
+        "kind": { "const": "gate-policy" },
+        "lexicon": { "type": "string", "minLength": 1, "description": "The lexicon whose gate-policy module evaluates text." },
+        "name": { "type": "string", "minLength": 1, "description": "A name for the policy set, carried into every recorded decision." },
+        "version": { "type": "string", "minLength": 1, "description": "sha256: and the hex digest of text. A recorded permit counts only under the version it was evaluated against." },
+        "text": { "type": "string", "minLength": 1, "description": "The policy set, in the lexicon's own language." }
+      }
+    },
+    "gateQuorumRule": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["count"],
+      "description": "One approval rule (#4290): count distinct human approvers, from roles when it names them.",
+      "properties": {
+        "targets": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "description": "Globs over the run's environment: * within one / segment, ** across segments, ? one character. Absent: every run. A rule with targets never covers a run with no environment." },
+        "count": { "type": "integer", "minimum": 1, "description": "Distinct human approvers the rule needs." },
+        "roles": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "description": "Only an approver .chant/trust.json at base gives one of these roles counts, and only with an approval sealed by a signer listed at base." },
+        "notAuthor": { "type": "boolean", "description": "Refused on an Op gate, which has no author to judge by." }
+      }
+    },
     "className": {
       "type": "string",
       "pattern": "^(?!x-)[a-z][a-z0-9-]{0,39}$",
@@ -573,7 +632,6 @@
       "description": "A member (#2524 D2). Its directory leaves the root project, and it gets its own build, lint and ledger.",
       "required": [
         "name",
-        "dir",
         "kind"
       ],
       "properties": {
@@ -586,7 +644,10 @@
         },
         "kind": {
           "$ref": "#/$defs/kindName",
-          "description": "How to read the member: chant, workspace, other, or a kind a pinned plugin supplies (#2535)."
+          "description": "How to read the member: chant, workspace, repo, other, or a kind a pinned plugin supplies (#2535). Every kind but repo needs dir; a repo member has repo instead (#3168)."
+        },
+        "repo": {
+          "$ref": "#/$defs/repoRef"
         },
         "roles": {
           "type": "array",
@@ -685,6 +746,10 @@
           "type": "boolean",
           "description": "Whether the member goes with an export (#2524 D10, #2552). chant workspace export writes only members that set travel to true into the export member, and refuses to name one that does not. Added in schema 1 by chant 0.101.0, so a declaration that uses it sets minReader to 0.101.0 or newer."
         },
+        "acceptWorkspaceGates": {
+          "type": "boolean",
+          "description": "Whether an approval of a workspace gate may stand in for this member's own gates (#2554, ws-039). It does only when the approval's digest covers the plan the member's run reached its gate with, and only when the declaration at base sets this to true; a working-tree change never opts a member in. Absent or false, a workspace gate never satisfies this member's gates. Added in schema 1 by chant 0.124.47, so a declaration that uses it sets minReader to 0.124.47 or newer."
+        },
         "security": {
           "type": "array",
           "uniqueItems": true,
@@ -706,28 +771,91 @@
         "^x-": true
       },
       "additionalProperties": false,
-      "if": {
-        "type": "object",
-        "properties": {
-          "kind": {
-            "const": "other"
+      "allOf": [
+        {
+          "if": {
+            "type": "object",
+            "properties": {
+              "kind": {
+                "const": "other"
+              }
+            },
+            "required": [
+              "kind"
+            ]
+          },
+          "then": {
+            "type": "object",
+            "properties": {
+              "because": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "because"
+            ]
           }
         },
-        "required": [
-          "kind"
-        ]
-      },
-      "then": {
-        "type": "object",
-        "properties": {
-          "because": {
-            "type": "string"
+        {
+          "if": {
+            "type": "object",
+            "properties": {
+              "kind": {
+                "const": "repo"
+              }
+            },
+            "required": [
+              "kind"
+            ]
+          },
+          "then": {
+            "required": [
+              "repo"
+            ],
+            "properties": {
+              "repo": true,
+              "dir": false
+            }
+          },
+          "else": {
+            "required": [
+              "dir"
+            ],
+            "properties": {
+              "dir": true,
+              "repo": false
+            }
           }
+        }
+      ]
+    },
+    "repoRef": {
+      "type": "object",
+      "description": "Another repository's workspace, named by URL and pinned revision (#3168). A member of kind repo carries it and has no dir. chant reads that workspace read-only through the other repository's own read contract, its chant workspace graph at the revision, the way it reads a nested workspace member, and never writes there. Added in schema 1 by chant 0.124.47, so a declaration that uses it sets minReader to 0.124.47 or newer.",
+      "required": [
+        "url",
+        "rev"
+      ],
+      "properties": {
+        "url": {
+          "type": "string",
+          "pattern": "^[^\\s]+$",
+          "description": "Where git fetches the repository from: an https, ssh or file URL, a local path, or an scp-style git@host:org/repo. A URL that carries a password or token is refused when it is read."
         },
-        "required": [
-          "because"
-        ]
-      }
+        "rev": {
+          "type": "string",
+          "pattern": "^([0-9a-f]{40}|[0-9a-f]{64})$",
+          "description": "The pinned revision, a full commit id. A branch or tag is not a pin."
+        },
+        "workspace": {
+          "$ref": "#/$defs/dir",
+          "description": "The workspace root inside that repository, relative to its git root. Defaults to \".\"."
+        }
+      },
+      "patternProperties": {
+        "^x-": true
+      },
+      "additionalProperties": false
     },
     "memberFields": {
       "type": "object",
@@ -1696,10 +1824,24 @@
       ],
       "properties": {
         "branch": {
-          "type": "string",
-          "minLength": 1,
-          "pattern": "^[^\\s~^:?*\\[\\\\]+$",
-          "description": "The branch whose commits are tagged, such as main. Only its first-parent commits count."
+          "oneOf": [
+            {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "^[^\\s~^:?*\\[\\\\]+$"
+            },
+            {
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^[^\\s~^:?*\\[\\\\]+$"
+              }
+            }
+          ],
+          "description": "The branch whose commits are tagged, such as main. Only its first-parent commits count. A list judges each branch, so a branch ci.branches routes members to gets a green verdict and can release (#4325); the first is the trunk that readers use when they are not told a branch. A string reads as it always did."
         },
         "window": {
           "type": "string",

package/dist/workspace/environments.d.ts

@@ -23,6 +23,13 @@
  * would take it, or left out with `environments-component-undeclared` when
  * the config's environments don't cover it.
  *
+ * Each environment also names its `executor` (#4402): the forge and committed
+ * workflow that deploys it, as the member's config declares on the
+ * environment's entry (`{ name: "prod", executor: { forge: "github",
+ * workflow: "deploy-prod.yml" } }`), a literal entry before a pattern. When
+ * none is declared, `forge` and `workflow` are null and `reason` says why.
+ * chant never derives it from a generated workflow's name.
+ *
  * `chant run --env` refuses a name the config's `environments` doesn't cover
  * whenever it declares any (`unknownEnvError` in `../env.ts`), so a ledger
  * environment the config no longer covers is left out, with a reason. The
@@ -34,7 +41,7 @@
  * `--at` exported. The ledger is always the local `chant/lifecycle` branch,
  * as for `workspace status`, and is never fetched.
  */
-import { type EnvironmentDeclaration } from "../config.js";
+import { type EnvironmentDeclaration, type EnvironmentExecutor } from "../config.js";
 import type { ComponentEnvironmentDeclaration } from "../components/component.js";
 import { type MemberRuntimes } from "./runtimes.js";
 /** The environment `chant run --components` deploys to without `--env`. */
@@ -42,6 +49,19 @@ export declare const LOCAL_ENVIRONMENT = "local";
 /** Why a member's environments are only `local`, or leave out one the ledger has. Closed: part of the read contract. */
 export declare const ENVIRONMENT_REASON_CODES: readonly ["runtimes-config-unreadable", "environments-none-declared", "environments-ledger-undeclared", "environments-ledger-unreadable", "environments-component-undeclared"];
 export type EnvironmentReasonCode = (typeof ENVIRONMENT_REASON_CODES)[number];
+/** Why an environment names no executor (#4402). Closed: part of the read contract. */
+export declare const EXECUTOR_REASON_CODES: readonly ["executor-none-declared", "executor-config-unreadable"];
+export type ExecutorReasonCode = (typeof EXECUTOR_REASON_CODES)[number];
+/** The forge workflow that deploys an environment (#4402), or why none is named. */
+export interface ComponentExecutor {
+    forge: EnvironmentExecutor["forge"] | null;
+    workflow: string | null;
+    /** Null when `forge` and `workflow` are set. */
+    reason: {
+        code: ExecutorReasonCode;
+        message: string;
+    } | null;
+}
 export interface EnvironmentReason {
     code: EnvironmentReasonCode;
     message: string;
@@ -56,6 +76,8 @@ export interface ComponentEnvironment {
     source: "config" | "ledger" | "builtin" | "component";
     /** Where a release of the component goes in this environment, as the component declares it (#3153), or null when it declares nothing for it. */
     site: ComponentSite | null;
+    /** The forge and committed workflow that deploys this environment, from the member's config (#4402). */
+    executor: ComponentExecutor;
     /** The command that deploys the component there, on the site's runtime when the member hosts it and else the default runtime, run in the member's directory. */
     command: string;
 }
@@ -79,7 +101,7 @@ export type LedgerEnvironmentReader = (member: {
 /** What one member's config and ledger say about environments. */
 export interface MemberEnvironments {
     /** Each environment in list order, without the per-component site and command. */
-    environments: Omit<ComponentEnvironment, "command" | "site">[];
+    environments: Omit<ComponentEnvironment, "command" | "site" | "executor">[];
     reasons: EnvironmentReason[];
     /** The config's environments, for whether `chant run --env` takes a name: null when the config couldn't be read, `[]` when it declares none. */
     declared?: EnvironmentDeclaration[] | null;
@@ -93,6 +115,8 @@ export interface MemberEnvironments {
 export declare const readLedgerEnvironments: LedgerEnvironmentReader;
 /** Join a member's config and ledger into its environment list, `local` first, then config order, then the ledger's. */
 export declare function memberEnvironments(runtimes: MemberRuntimes | undefined, ledger: LedgerEnvironments | undefined): MemberEnvironments;
+/** The executor the member's config declares for `env`, or why there is none. */
+export declare function executorFor(env: string, member: MemberEnvironments | undefined): ComponentExecutor;
 /**
  * The environments one component may deploy to, each with its command line.
  * `declared` is what the component's contract says (#3153): an environment

package/dist/workspace/environments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../src/workspace/environments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,EAAqE,KAAK,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC3H,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAE/E,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAGhE,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,wHAAwH;AACxH,eAAO,MAAM,wBAAwB,gLAWK,CAAC;AAC3C,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAC;IACjB,yHAAyH;IACzH,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,gJAAgJ;IAChJ,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,gKAAgK;IAChK,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAClC;AAED,0EAA0E;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,EAAE,MAAM,KAAK,kBAAkB,CAAC;AAEjH,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,YAAY,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC;IAC/D,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,gJAAgJ;IAChJ,QAAQ,CAAC,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC;CAC5C;AAeD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,uBAkBpC,CAAC;AAEF,wHAAwH;AACxH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,EAAE,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,kBAAkB,CA8BnI;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,OAAO,SAAgB,EACvB,QAAQ,GAAE,SAAS,+BAA+B,EAAO,EACzD,KAAK,GAAE,SAAS,MAAM,EAAO,EAC7B,OAAO,GAAE,iBAAiB,EAAO,GAChC,oBAAoB,EAAE,CAqBxB"}
+{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../src/workspace/environments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAGH,OAAO,EAA0F,KAAK,sBAAsB,EAAE,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC1K,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAE/E,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAGhE,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,wHAAwH;AACxH,eAAO,MAAM,wBAAwB,gLAWK,CAAC;AAC3C,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,uFAAuF;AACvF,eAAO,MAAM,qBAAqB,mEAKQ,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gDAAgD;IAChD,MAAM,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9D;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAC;IACjB,yHAAyH;IACzH,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,gJAAgJ;IAChJ,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,wGAAwG;IACxG,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,gKAAgK;IAChK,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAClC;AAED,0EAA0E;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,EAAE,MAAM,KAAK,kBAAkB,CAAC;AAEjH,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,YAAY,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IAC5E,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,gJAAgJ;IAChJ,QAAQ,CAAC,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC;CAC5C;AAeD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,uBAkBpC,CAAC;AAEF,wHAAwH;AACxH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,EAAE,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,kBAAkB,CA8BnI;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,iBAAiB,CAOlG;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,OAAO,SAAgB,EACvB,QAAQ,GAAE,SAAS,+BAA+B,EAAO,EACzD,KAAK,GAAE,SAAS,MAAM,EAAO,EAC7B,OAAO,GAAE,iBAAiB,EAAO,GAChC,oBAAoB,EAAE,CAqBxB"}

package/dist/workspace/environments.js

@@ -23,6 +23,13 @@
  * would take it, or left out with `environments-component-undeclared` when
  * the config's environments don't cover it.
  *
+ * Each environment also names its `executor` (#4402): the forge and committed
+ * workflow that deploys it, as the member's config declares on the
+ * environment's entry (`{ name: "prod", executor: { forge: "github",
+ * workflow: "deploy-prod.yml" } }`), a literal entry before a pattern. When
+ * none is declared, `forge` and `workflow` are null and `reason` says why.
+ * chant never derives it from a generated workflow's name.
+ *
  * `chant run --env` refuses a name the config's `environments` doesn't cover
  * whenever it declares any (`unknownEnvError` in `../env.ts`), so a ledger
  * environment the config no longer covers is left out, with a reason. The
@@ -35,7 +42,7 @@
  * as for `workspace status`, and is never fetched.
  */
 import { execFileSync } from "node:child_process";
-import { environmentName, isEnvironmentPattern, matchesDeclaredEnvironment } from "../config.js";
+import { environmentExecutor, environmentName, isEnvironmentPattern, matchesDeclaredEnvironment } from "../config.js";
 import { LOCAL_RUNTIME } from "./runtimes.js";
 import { ENV_PATTERN, LIFECYCLE_REF, MEMBERS_DIR } from "./status.js";
 /** The environment `chant run --components` deploys to without `--env`. */
@@ -53,6 +60,13 @@ export const ENVIRONMENT_REASON_CODES = [
     /** A component declares an environment the config's environments don't cover, so chant run --env would refuse it (#3153). */
     "environments-component-undeclared",
 ];
+/** Why an environment names no executor (#4402). Closed: part of the read contract. */
+export const EXECUTOR_REASON_CODES = [
+    /** The member's chant.config.ts declares no executor for the environment, so nothing says which forge workflow deploys it. */
+    "executor-none-declared",
+    /** The member's chant.config.ts could not be read, so whether a forge workflow deploys the environment is unknown. */
+    "executor-config-unreadable",
+];
 function git(cwd, args, input) {
     return execFileSync("git", args, { cwd, encoding: "utf-8", input, stdio: [input === undefined ? "ignore" : "pipe", "pipe", "pipe"] });
 }
@@ -129,6 +143,16 @@ export function memberEnvironments(runtimes, ledger) {
             add(name, "ledger");
     return { environments: out, reasons, declared };
 }
+/** The executor the member's config declares for `env`, or why there is none. */
+export function executorFor(env, member) {
+    if (member && member.declared === null) {
+        return { forge: null, workflow: null, reason: { code: "executor-config-unreadable", message: `chant.config.ts could not be read, so no executor is known for ${env}` } };
+    }
+    const found = environmentExecutor(member?.declared ?? undefined, env);
+    if (found)
+        return { forge: found.forge, workflow: found.workflow, reason: null };
+    return { forge: null, workflow: null, reason: { code: "executor-none-declared", message: `chant.config.ts declares no executor for ${env}` } };
+}
 /**
  * The environments one component may deploy to, each with its command line.
  * `declared` is what the component's contract says (#3153): an environment
@@ -159,6 +183,6 @@ export function componentEnvironments(component, member, runtime = LOCAL_RUNTIME
     return list.map((e) => {
         const site = sites.get(e.name) ?? null;
         const on = site?.runtime && (site.runtime === LOCAL_RUNTIME || hosts.includes(site.runtime)) ? site.runtime : runtime;
-        return { ...e, site, command: `chant run --components ${component}${on === LOCAL_RUNTIME ? "" : ` --on ${on}`}${e.default ? "" : ` --env ${e.name}`}` };
+        return { ...e, site, executor: executorFor(e.name, member), command: `chant run --components ${component}${on === LOCAL_RUNTIME ? "" : ` --on ${on}`}${e.default ? "" : ` --env ${e.name}`}` };
     });
 }

package/dist/workspace/exit-cli.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `chant workspace exit [<member>...] [--dry-run] [--drill] [--output <file>] [--json]`
+ * (#3177).
+ *
+ * Stages the exit in a git worktree (see ./exit.ts), checks the staged tree
+ * with the same static checks the exit drill uses, then decides a gate. The
+ * gate is `workspace-exit/<scope>` on the gate ledger and binds the digest of
+ * the patch, as `workspace upgrade` does: the first run records the pending
+ * fact and exits 3; after `chant approve workspace-exit <scope>` the same
+ * command stages the same patch and applies it to the tree.
+ *
+ * `--drill` skips the worktree and the gate: it runs the exit on a scratch
+ * copy and prints the per-member result, the check CI runs on every commit.
+ */
+import type { CommandContext } from "../cli/registry.js";
+import { type GateLedgerPort } from "../op/gate.js";
+import { type DrillReport, type ExitBuildRunner, type ExitResult } from "./exit.js";
+/** The exit code of a gated exit: the same as `chant run`'s gated run. */
+export declare const EXIT_GATED = 3;
+export interface ExitCommandOptions {
+    root: string;
+    members?: string[];
+    dryRun?: boolean;
+    drill?: boolean;
+    output?: string;
+    json?: boolean;
+    /** For tests. */
+    runBuild?: ExitBuildRunner;
+    ledger?: GateLedgerPort;
+    now?: string;
+}
+export type ExitOutcome = "drill" | "nothing-to-exit" | "checks-failed" | "dry-run" | "gated" | "applied";
+export interface ExitCommandResult {
+    outcome: ExitOutcome;
+    exitCode: number;
+    result?: ExitResult;
+    report?: DrillReport;
+    digest?: string;
+}
+export declare function exitCommand(opts: ExitCommandOptions): Promise<ExitCommandResult>;
+/** One line per member, for the terminal. */
+export declare function describeExit(result: ExitResult, digest: string): string[];
+export declare function runWorkspaceExit(ctx: CommandContext): Promise<number>;
+//# sourceMappingURL=exit-cli.d.ts.map

package/dist/workspace/exit-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/exit-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAuF,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAGtI,OAAO,EAA2E,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAK1J,0EAA0E;AAC1E,eAAO,MAAM,UAAU,IAAI,CAAC;AAI5B,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iBAAiB;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,iBAAiB,GAAG,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE1G,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAQD,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAsGtF;AAgBD,6CAA6C;AAC7C,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAYzE;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB3E"}

package/dist/workspace/exit-cli.js

@@ -0,0 +1,198 @@
+/**
+ * `chant workspace exit [<member>...] [--dry-run] [--drill] [--output <file>] [--json]`
+ * (#3177).
+ *
+ * Stages the exit in a git worktree (see ./exit.ts), checks the staged tree
+ * with the same static checks the exit drill uses, then decides a gate. The
+ * gate is `workspace-exit/<scope>` on the gate ledger and binds the digest of
+ * the patch, as `workspace upgrade` does: the first run records the pending
+ * fact and exits 3; after `chant approve workspace-exit <scope>` the same
+ * command stages the same patch and applies it to the tree.
+ *
+ * `--drill` skips the worktree and the gate: it runs the exit on a scratch
+ * copy and prints the per-member result, the check CI runs on every commit.
+ */
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative, resolve, sep } from "node:path";
+import { formatError, formatInfo, formatSuccess, formatWarning } from "../cli/format.js";
+import { approveCommand, describeGateMismatch, evaluateGate, gateIsSealed, gitGateLedgerPort } from "../op/gate.js";
+import { WORKSPACE_EXIT_GATE_OP } from "../op/gate-name.js";
+import { findWorkspaceRoot } from "../project-root.js";
+import { describeDrill, ExitError, exitInDir, planExit, runExitDrill, verifyExit } from "./exit.js";
+import { spawnChant } from "./lineage-upgrade.js";
+const USAGE = "chant workspace exit [<member>...] [--member <name>] [--dry-run] [--drill] [--output <patch file>] [--json]";
+/** The exit code of a gated exit: the same as `chant run`'s gated run. */
+export const EXIT_GATED = 3;
+const EXIT_DIR = ".chant/exit";
+function git(cwd, args) {
+    return execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 256 * 1024 * 1024 });
+}
+const defaultBuild = (command, cwd, args) => spawnChant(command, cwd, args);
+export async function exitCommand(opts) {
+    const runBuild = opts.runBuild ?? defaultBuild;
+    const names = opts.members ?? [];
+    const print = (lines) => {
+        if (!opts.json)
+            console.log(lines.join("\n"));
+    };
+    if (opts.drill) {
+        const report = await runExitDrill({ root: opts.root, members: names, runBuild });
+        if (opts.json)
+            console.log(JSON.stringify({ outcome: "drill", ...report }, null, 2));
+        else
+            print(describeDrill(report));
+        return { outcome: "drill", exitCode: report.ok ? 0 : 1, report };
+    }
+    let repo;
+    let head;
+    try {
+        repo = git(opts.root, ["rev-parse", "--show-toplevel"]).trim();
+        head = git(opts.root, ["rev-parse", "HEAD"]).trim();
+    }
+    catch {
+        throw new ExitError("chant workspace exit stages its change in a git worktree, so the project must be in a git repository with at least one commit");
+    }
+    const dirty = git(repo, ["status", "--porcelain", "--untracked-files=all"])
+        .split("\n")
+        .filter(Boolean)
+        .filter((l) => !l.slice(3).includes(`${EXIT_DIR}/`));
+    if (dirty.length > 0) {
+        throw new ExitError(`the tree has uncommitted changes (${dirty.slice(0, 5).map((l) => l.slice(3)).join(", ")}${dirty.length > 5 ? ", ..." : ""}). Commit them: the exit stages from HEAD and applies its patch to the tree.`);
+    }
+    const rel = relative(repo, opts.root).split(sep).join("/");
+    const holder = join(opts.root, EXIT_DIR);
+    mkdirSync(holder, { recursive: true });
+    const worktree = mkdtempSync(join(holder, "wt-"));
+    rmSync(worktree, { recursive: true, force: true });
+    git(repo, ["worktree", "add", "--detach", "-q", worktree, head]);
+    const dispose = () => {
+        try {
+            git(repo, ["worktree", "remove", "--force", worktree]);
+        }
+        catch {
+            rmSync(worktree, { recursive: true, force: true });
+        }
+    };
+    try {
+        const project = rel ? join(worktree, rel) : worktree;
+        const plan = planExit(project, names);
+        const result = await exitInDir(plan, runBuild);
+        const report = verifyExit(project, result);
+        git(worktree, ["add", "-A"]);
+        const patch = git(worktree, ["diff", "--cached", "--binary", "HEAD"]);
+        const digest = `sha256:${createHash("sha256").update(patch).digest("hex").slice(0, 16)}`;
+        if (opts.json) {
+            // printed once, below
+        }
+        else {
+            print(describeExit(result, digest));
+            print(describeDrill(report));
+        }
+        const out = (outcome, exitCode, extra = {}) => {
+            if (opts.json)
+                console.log(JSON.stringify({ outcome, digest, ...result, report, ...extra }, null, 2));
+            return { outcome, exitCode, result, report, digest };
+        };
+        if (opts.output)
+            writeFileSync(resolve(opts.output), patch);
+        if (!patch) {
+            if (!opts.json)
+                console.error(formatInfo("nothing to exit: no member changed"));
+            return out("nothing-to-exit", 0);
+        }
+        if (!report.ok) {
+            if (!opts.json)
+                console.error(formatError({ message: "the exit was not gated: its checks must pass first. The tree is unchanged." }));
+            return out("checks-failed", 1);
+        }
+        if (opts.dryRun) {
+            if (!opts.json)
+                console.error(formatInfo("--dry-run: staged and checked; no gate recorded, the tree is unchanged"));
+            return out("dry-run", 0);
+        }
+        const gate = names.length > 0 ? names.join("+") : "workspace";
+        const check = await evaluateGate(opts.ledger ?? gitGateLedgerPort({ cwd: repo }), {
+            op: WORKSPACE_EXIT_GATE_OP,
+            gate,
+            description: `leave chant: ${gate}`,
+            planDigest: digest,
+            ...(opts.now ? { now: opts.now } : {}),
+        });
+        if (!check.satisfied) {
+            if (!opts.json) {
+                const sealed = await gateIsSealed(gate);
+                if (check.mismatch)
+                    console.error(formatWarning({ message: describeGateMismatch(WORKSPACE_EXIT_GATE_OP, gate, check.mismatch, sealed) }));
+                console.error(formatInfo(`Gated: the patch ${digest} waits for approval. Review it (--output <file> writes it), then run \`${approveCommand(WORKSPACE_EXIT_GATE_OP, gate, undefined, undefined, sealed)}\` and repeat this command to apply it.`));
+            }
+            return out("gated", EXIT_GATED, { pending: check.pending });
+        }
+        applyPatch(repo, patch);
+        if (!opts.json)
+            console.error(formatSuccess(`applied the approved exit (${digest}), approved by ${check.resolution.resolvedBy}. Review and commit it.`));
+        return out("applied", 0, { approvedBy: check.resolution.resolvedBy });
+    }
+    finally {
+        dispose();
+    }
+}
+function applyPatch(repo, patch) {
+    const dir = mkdtempSync(join(tmpdir(), "chant-exit-patch-"));
+    const file = join(dir, "exit.patch");
+    try {
+        writeFileSync(file, patch);
+        git(repo, ["apply", "--binary", "--whitespace=nowarn", file]);
+    }
+    catch (err) {
+        const stderr = err.stderr?.toString().trim();
+        throw new ExitError(`the approved patch no longer applies to the tree${stderr ? `: ${stderr}` : ""}`);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/** One line per member, for the terminal. */
+export function describeExit(result, digest) {
+    const lines = [];
+    for (const m of result.members) {
+        lines.push(`${m.name}  ${m.kind}  ${m.status}${m.detail ? ` (${m.detail})` : ""}`);
+        for (const n of m.native)
+            lines.push(`  native: ${n}`);
+        for (const d of m.deploy)
+            lines.push(`  deploy: ${d}`);
+        for (const c of m.ci)
+            lines.push(`  ci: ${c}`);
+        for (const o of m.ops)
+            lines.push(`  kept: ${o}`);
+        for (const s of m.steps)
+            lines.push(`  step: ${s}`);
+    }
+    lines.push(`  patch: ${digest}`);
+    return lines;
+}
+export async function runWorkspaceExit(ctx) {
+    const { args } = ctx;
+    // positionals are ["exit", <member>...]
+    const named = [...(args.positionals ?? []).slice(1), ...(args.members ?? [])];
+    const root = findWorkspaceRoot(process.cwd())?.dir ?? process.cwd();
+    try {
+        const result = await exitCommand({
+            root,
+            members: [...new Set(named)],
+            dryRun: args.dryRun,
+            drill: args.drill,
+            output: args.output,
+            json: args.json,
+        });
+        return result.exitCode;
+    }
+    catch (err) {
+        if (!(err instanceof ExitError))
+            throw err;
+        console.error(formatError({ message: err.message, hint: USAGE }));
+        return 1;
+    }
+}