@intentius/chant 0.124.46 → 0.124.49

package/dist/components/pr-hooks.d.ts

@@ -17,6 +17,7 @@
  */
 import type { OpWaveHook, OpWaveHookMoment } from "../op/op-waves.js";
 import { type OpWaveExec } from "../op/op-waves-run.js";
+import { type OtherGateHold } from "../op/stage-hooks.js";
 import { type Declaration } from "../workspace/declaration.js";
 import type { PrHookOutcome, PrMember } from "../pr-loop.js";
 /** The hooks a pull-request job runs, by moment, and where they were read. */
@@ -48,12 +49,31 @@ export interface PrHookPlace {
     exec?: OpWaveExec;
     log?: (line: string) => void;
 }
+/** How a gate a hook holds the job on stands (#4323). */
+export interface PrHoldSettled {
+    status: "approved" | "waiting";
+    approvedBy?: string;
+    approvedAt?: string;
+}
+/**
+ * Settle a hold on another gate (#4323): an approval of `hold.request.gate`
+ * at `hold.request.digest`, else a pending fact for it. The pull-request
+ * jobs give this the ledger they decide their own gate by.
+ */
+export type PrHoldSettler = (hold: OtherGateHold) => Promise<PrHoldSettled>;
 /** What one moment's hooks came to on the pull-request path. */
 export interface PrHooksRun {
     outcomes: PrHookOutcome[];
     failed?: string;
     holds: string[];
 }
+/** The run's options: the gate's decision for `after-gate`, and who settles a hold on another gate. */
+export interface PrHooksRunOptions {
+    /** Added to every hook's environment: `after-gate` carries `CHANT_GATE_STATUS`, `CHANT_GATE_OP`, `CHANT_GATE` and `CHANT_GATE_DIGEST`. */
+    env?: Record<string, string>;
+    /** Without it a hold on another gate is a plain hold. */
+    settle?: PrHoldSettler;
+}
 /**
  * Run the hooks of `moment` for `components` (#4288). `plans`, after the
  * plan, gives each component's members and step plans, written where a
@@ -62,5 +82,5 @@ export interface PrHooksRun {
 export declare function runPrHooks(read: PrLoopHooks, moment: OpWaveHookMoment, place: PrHookPlace, components: readonly string[], planned?: {
     members: readonly PrMember[];
     plans: Record<string, Record<string, unknown>>;
-}): PrHooksRun;
+}, options?: PrHooksRunOptions): Promise<PrHooksRun>;
 //# sourceMappingURL=pr-hooks.d.ts.map

package/dist/components/pr-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-hooks.d.ts","sourceRoot":"","sources":["../../src/components/pr-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAe,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EAAiB,KAAK,UAAU,EAA0C,MAAM,oBAAoB,CAAC;AAC5G,OAAO,EAAuC,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGjG,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACvD,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAQD,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC,CAQtJ;AAaD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAiBpE;AAED,oEAAoE;AACpE,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,+FAA+F;IAC/F,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,OAAO,CAAC,EAAE;IAAE,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,GACzF,UAAU,CAmCZ"}
+{"version":3,"file":"pr-hooks.d.ts","sourceRoot":"","sources":["../../src/components/pr-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAe,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EAA4C,KAAK,UAAU,EAA0C,MAAM,oBAAoB,CAAC;AACvI,OAAO,EAAsD,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE3G,OAAO,EAAuC,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGjG,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACvD,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAQD,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC,CAQtJ;AAaD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAiBpE;AAED,oEAAoE;AACpE,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,+FAA+F;IAC/F,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5E,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,uGAAuG;AACvG,MAAM,WAAW,iBAAiB;IAChC,0IAA0I;IAC1I,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,yDAAyD;IACzD,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,OAAO,CAAC,EAAE;IAAE,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,EAC1F,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,UAAU,CAAC,CA0CrB"}

package/dist/components/pr-hooks.js

@@ -15,10 +15,12 @@
  * names. After the plan, a `perRun` hook's `{plan}` is a JSON file with that
  * component's members and the plans its steps hand the apply.
  */
-import { mkdirSync, writeFileSync } from "node:fs";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
 import { PR_LOOP_HOOK_MOMENTS } from "../op/op-waves.js";
-import { runStageHooks } from "../op/op-waves-run.js";
+import { OP_WAVE_MAX_CHAINED_HOLDS, runStageHooks } from "../op/op-waves-run.js";
+import { readHoldRequest, spawnExec } from "../op/stage-hooks.js";
+import { approveCommand } from "../op/gate.js";
 import { readDeclaration, WorkspaceReadError } from "../workspace/declaration.js";
 import { memberAtCwd } from "../workspace/security.js";
 import { locateWorkspace } from "../workspace/which-chant.js";
@@ -79,7 +81,7 @@ export function prLoopHooksAt(cwd, base) {
  * plan, gives each component's members and step plans, written where a
  * `perRun` hook's `{plan}` points.
  */
-export function runPrHooks(read, moment, place, components, planned) {
+export async function runPrHooks(read, moment, place, components, planned, options = {}) {
     const hooks = read.hooks[moment];
     if (!hooks || hooks.length === 0)
         return { outcomes: [], holds: [] };
@@ -103,11 +105,19 @@ export function runPrHooks(read, moment, place, components, planned) {
         runs,
         runsFile,
         holdFile: join(dir, "hold.json"),
-        env: { CHANT_ENV: place.env, CHANT_PR_STAGE: place.stage, CHANT_HOOKS_BASE: read.base },
+        env: { CHANT_ENV: place.env, CHANT_PR_STAGE: place.stage, CHANT_HOOKS_BASE: read.base, ...options.env },
+        keepOtherGates: options.settle !== undefined,
         cwd: place.cwd,
         ...(place.exec ? { exec: place.exec } : {}),
         ...(place.log ? { log: place.log } : {}),
     });
+    const log = place.log ?? ((line) => console.error(line));
+    const settled = ran.failed || !options.settle ? undefined : await settleHolds(ran.otherGates ?? [], options.settle, place, log);
+    if (settled) {
+        ran.outcomes.push(...settled.outcomes);
+        if (settled.failed)
+            ran.failed = settled.failed;
+    }
     const outcomes = ran.outcomes.map((o) => ({
         moment: o.moment,
         name: o.name,
@@ -117,3 +127,61 @@ export function runPrHooks(read, moment, place, components, planned) {
     }));
     return { outcomes, ...(ran.failed ? { failed: ran.failed } : {}), holds: ran.holds };
 }
+/**
+ * Settle each hook call that held the job on another gate (#4323), as an Op
+ * waves job does (`runHooks` in op-waves-run.ts): once the gate is approved
+ * the hook runs again with `CHANT_HOLD_APPROVED` (and `CHANT_HOLDS_APPROVED`,
+ * the gates approved so far), and it may hold on a further gate, settled in
+ * turn, up to {@link OP_WAVE_MAX_CHAINED_HOLDS}. A gate nobody approved fails
+ * the stage, with the command that approves it.
+ */
+async function settleHolds(holds, settle, place, log) {
+    const outcomes = [];
+    const exec = place.exec ?? spawnExec;
+    for (const first of holds) {
+        let hold = first;
+        const approved = [];
+        for (;;) {
+            const op = hold.request.op ?? place.op;
+            const held = await settle(hold);
+            if (held.status === "waiting") {
+                return { outcomes, failed: `${hold.label} waits on ${op} / ${hold.request.gate}, which nobody approved at ${hold.request.digest}. Approve: ${approveCommand(op, hold.request.gate, undefined, hold.request.digest)}` };
+            }
+            const now = { op, gate: hold.request.gate, digest: hold.request.digest, approvedBy: held.approvedBy ?? "", approvedAt: held.approvedAt ?? "" };
+            approved.push(now);
+            const holdFile = join(place.cwd, hold.env.CHANT_HOLD);
+            rmSync(holdFile, { force: true });
+            let code;
+            try {
+                code = exec(hold.argv, place.cwd, { ...hold.env, CHANT_HOLD_APPROVED: JSON.stringify(now), CHANT_HOLDS_APPROVED: JSON.stringify(approved) });
+            }
+            catch (err) {
+                log(`${hold.label} did not run: ${err instanceof Error ? err.message : String(err)}`);
+                code = 127;
+            }
+            const target = hold.target ? { target: hold.target } : {};
+            if (code === 0) {
+                outcomes.push({ moment: hold.moment, name: hold.name, ...target, exit: code, outcome: "passed" });
+                log(`${hold.label}: ${now.approvedBy} approved ${op} / ${now.gate} at ${now.digest}, and the hook ran again and passed`);
+                break;
+            }
+            const next = readHoldRequest(holdFile, log, hold.label);
+            const nextOp = next ? (next.op ?? place.op) : "";
+            const problem = !next
+                ? `${hold.label} exited ${code} after ${now.approvedBy} approved ${now.gate}`
+                : approved.some((a) => a.op === nextOp && a.gate === next.gate && a.digest === next.digest)
+                    ? `${hold.label} exited ${code} after ${now.approvedBy} approved ${now.gate}, and holds again on ${nextOp} / ${next.gate} at ${next.digest}, which is already approved`
+                    : approved.length >= OP_WAVE_MAX_CHAINED_HOLDS
+                        ? `${hold.label} held the job on ${approved.length} gates in turn and asks for one more; a hook call holds on at most ${OP_WAVE_MAX_CHAINED_HOLDS}`
+                        : undefined;
+            if (problem) {
+                outcomes.push({ moment: hold.moment, name: hold.name, ...target, exit: code, outcome: "failed" });
+                log(problem);
+                return { outcomes, failed: problem };
+            }
+            outcomes.push({ moment: hold.moment, name: hold.name, ...target, exit: code, outcome: "held" });
+            hold = { ...hold, request: next };
+        }
+    }
+    return { outcomes };
+}

package/dist/components/pr-pipeline.d.ts

@@ -73,6 +73,10 @@
  * forge's run as its `runOrigin`. `ci run` runs `command` in the job's own
  * checkout with the job's environment, less the key. The plan passes
  * `--no-push`, so it still writes nothing to the remote `chant/lifecycle`.
+ * The plan job gets no `CHANT_RUNNER_KEY` (#4328): it runs the pull request's
+ * code, and a key in the job's environment is one that code could read and
+ * sign with, whatever `ci run` leaves out of its steps. Its record is
+ * unsigned.
  *
  * In a workspace member (#3465) both commands run in the member's directory
  * and pass `--member <name>`, so the member's gate (`pr-<number>-<member>`),
@@ -191,6 +195,14 @@ export interface PrLoopPipelineOptions {
      * ({@link prEnvJobs}). Set from `--pr-env` beside `--pr-loop`. Default false.
      */
     prEnvironment?: boolean;
+    /**
+     * `ci.locks: plan` (#4293, #4327): a `lock` job after the plan that runs
+     * `chant lock --from-report`, and an `unlock` job when the pull request
+     * closes that runs `chant unlock`. Both check out the target branch's
+     * commit, so neither runs the change's code. Set from the declaration at
+     * base; GitHub and Forgejo only. Absent: neither job.
+     */
+    locks?: "plan";
     /**
      * The cloud identity a pull request environment's jobs take (#4330), from
      * `ci.identity.cloud` (`resolvePrEnvCloudIdentity` in ../ci-identity.ts):
@@ -201,6 +213,13 @@ export interface PrLoopPipelineOptions {
      */
     prEnvIdentity?: CloudTradeSpec;
 }
+/** The lock job's step names and commands (#4327), shared by the GitHub-shaped generators. */
+export declare const PR_LOCK_JOB = "lock";
+export declare const PR_UNLOCK_JOB = "unlock";
+/** `chant lock --from-report` for the plan's report in {@link PR_LOOP_REPORT_DIR}; reads `PR_NUMBER` and `HEAD_SHA`. */
+export declare function prLockCommand(forge: ForgeKind): string;
+/** `chant unlock` for the pull request that closed; reads `PR_NUMBER`. */
+export declare const PR_UNLOCK_COMMAND = "chant unlock --pr \"$PR_NUMBER\"";
 /** One job's command and the forge values it reads, as environment variables for its step. */
 export interface PrLoopJob {
     /** `plan`, `apply` or `record` (#4168). */
@@ -237,8 +256,10 @@ export interface PrLoopJob {
      * <job> --in-place` with the same environment, gate, forge, events and
      * report URL, which runs `command` and records the run. `env` is the
      * job's `env` and, on GitHub and Forgejo, `CHANT_RUNNER_KEY` from the
-     * repository secret of that name. GitLab hands its CI/CD variables to a
-     * job itself.
+     * repository secret of that name, except for the plan, which runs the
+     * pull request's code (#4328). GitLab hands its CI/CD variables to a job
+     * itself, so there the key is a protected variable, which a merge request
+     * pipeline never gets.
      */
     run: {
         command: string;
@@ -257,19 +278,33 @@ export declare function prLoopJobs(forge: ForgeKind, env: string, options?: PrLo
 /** The name of the job that posts the plan's note and status (#4295). */
 export declare const PR_PLAN_NOTE_JOB = "plan-note";
 /**
- * The plan-note job's command and the values it reads (#4295). It runs in a
- * fresh job after the plan, at the target branch's commit, and posts the
- * note and the `chant/plan` status from the report the plan job handed on,
- * with the forge token the plan job never held. `HEAD_SHA` is the commit
- * the plan job checked out, `PR_NUMBER` the pull request, and on GitHub and
- * Forgejo `PLAN_RESULT` the plan job's result, which fails the status when
- * the plan job failed. `BASE_SHA` is the commit the note job checks out on
- * GitLab, whose runner checks out the pipeline's own commit.
+ * The plan-note job's command and the values it reads (#4295). On GitHub
+ * and Forgejo it runs in a fresh job after the plan, at the target branch's
+ * commit, and posts the note and the `chant/plan` status from the report
+ * the plan job handed on, with the forge token the plan job never held.
+ * `HEAD_SHA` is the commit the plan job checked out, `PR_NUMBER` the pull
+ * request, and `PLAN_RESULT` the plan job's result, which fails the status
+ * when the plan job failed.
+ *
+ * On GitLab (#4328) it runs `pr-post --open` in a pipeline of the target
+ * branch, which GitLab builds from that branch's files and gives the
+ * protected `CHANT_FORGE_TOKEN`. A merge request pipeline is built from the
+ * merge request's files, so no job in it holds the token. `pr-post --open`
+ * asks GitLab for each open merge request's plan job and reads its report
+ * from the job's artifacts.
  */
 export declare function prLoopPostJob(forge: ForgeKind, env: string, member?: string): {
     command: string;
     env: Record<string, string>;
 };
+/** The plan job's name in a GitLab merge request pipeline (#3465, #4328): `plan`, or `<member>-plan` in a workspace member's included file. */
+export declare function gitlabPlanJobName(member?: string): string;
+/**
+ * The GitLab variable a pipeline schedule (or a person starting a pipeline
+ * of the target branch) sets to `1` to post the open merge requests' plan
+ * notes (#4328).
+ */
+export declare const GITLAB_PLAN_NOTES_VAR = "CHANT_PLAN_NOTES";
 /**
  * What starts the apply under apply on merge (#4168 step 9): on GitHub the
  * tick's workflow finishing (`workflow_run`, since tags its token pushes start

package/dist/components/pr-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/pr-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAK5E,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,YAAW,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,aAAa,UAEzB,CAAC;AAEF,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAAqC,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sIAAsI;IACtI,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2OAA2O;IAC3O,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACvD;AAED,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE,CAG3F;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CA0F3H;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAc9H;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,OAAO,GAAE,qBAA0B,GAAG,SAAS,CAEzG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,EAAE,wBAAwB,GAAG,qBAAqB,CAQ3H;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAW3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,yIAAyI;AACzI,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAErF;AAoBD,8HAA8H;AAC9H,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,oFAAoF;AACpF,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAG5D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C,kGAAkG;AAClG,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;IAC1D,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,gGAAgG;AAChG,eAAO,MAAM,eAAe,aAAa,CAAC;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,EAAE,CAkC5G"}
+{"version":3,"file":"pr-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/pr-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAK5E,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,YAAW,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,aAAa,UAEzB,CAAC;AAEF,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAAqC,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sIAAsI;IACtI,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2OAA2O;IAC3O,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,8FAA8F;AAC9F,eAAO,MAAM,WAAW,SAAS,CAAC;AAClC,eAAO,MAAM,aAAa,WAAW,CAAC;AAEtC,wHAAwH;AACxH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAEtD;AAED,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,qCAAmC,CAAC;AAElE,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;OASG;IACH,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACvD;AAED,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE,CAG3F;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CA2F3H;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAiB9H;AAED,+IAA+I;AAC/I,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,OAAO,GAAE,qBAA0B,GAAG,SAAS,CAEzG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,EAAE,wBAAwB,GAAG,qBAAqB,CAQ3H;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAW3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,yIAAyI;AACzI,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAErF;AAoBD,8HAA8H;AAC9H,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,oFAAoF;AACpF,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAG5D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C,kGAAkG;AAClG,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;IAC1D,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,gGAAgG;AAChG,eAAO,MAAM,eAAe,aAAa,CAAC;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,EAAE,CAkC5G"}

package/dist/components/pr-pipeline.js

@@ -73,6 +73,10 @@
  * forge's run as its `runOrigin`. `ci run` runs `command` in the job's own
  * checkout with the job's environment, less the key. The plan passes
  * `--no-push`, so it still writes nothing to the remote `chant/lifecycle`.
+ * The plan job gets no `CHANT_RUNNER_KEY` (#4328): it runs the pull request's
+ * code, and a key in the job's environment is one that code could read and
+ * sign with, whatever `ci run` leaves out of its steps. Its record is
+ * unsigned.
  *
  * In a workspace member (#3465) both commands run in the member's directory
  * and pass `--member <name>`, so the member's gate (`pr-<number>-<member>`),
@@ -116,6 +120,15 @@ export function prLoopSetup(image) {
  * artifact carries them.
  */
 export const PR_LOOP_EVENTS_DIR = `${PR_LOOP_REPORT_DIR}/run-events`;
+/** The lock job's step names and commands (#4327), shared by the GitHub-shaped generators. */
+export const PR_LOCK_JOB = "lock";
+export const PR_UNLOCK_JOB = "unlock";
+/** `chant lock --from-report` for the plan's report in {@link PR_LOOP_REPORT_DIR}; reads `PR_NUMBER` and `HEAD_SHA`. */
+export function prLockCommand(forge) {
+    return ["chant", "lock", "--from-report", `${PR_LOOP_REPORT_DIR}/pr-plan.json`, "--pr", '"$PR_NUMBER"', "--head", '"$HEAD_SHA"', "--stage", "plan", "--forge", forge].join(" ");
+}
+/** `chant unlock` for the pull request that closed; reads `PR_NUMBER`. */
+export const PR_UNLOCK_COMMAND = 'chant unlock --pr "$PR_NUMBER"';
 /** The lines `build` (#4088) runs before a job's command: the build, then the lint. Empty without the option. */
 export function prLoopBuildLines(env, options = {}) {
     if (!options.build && !options.buildCommand)
@@ -209,7 +222,8 @@ export function prLoopJobs(forge, env, options = {}, member) {
             command: ["chant", "components", "pr-plan", "--base", '"$BASE_SHA"', "--pr", '"$PR_NUMBER"', ...common, ...(options.waveGate ? ["--wave-gate", options.waveGate] : []), "--no-status"].join(" "),
             env: planEnv,
             ...build,
-            run: { command: ciRun("plan").join(" "), env: runEnv(planEnv) },
+            // #4328: no runner key either. The step drops it, but the job's environment is the pull request's code's too.
+            run: { command: ciRun("plan").join(" "), env: planEnv },
         },
         early ? earlyApply : greenApply,
         {
@@ -225,30 +239,49 @@ export function prLoopJobs(forge, env, options = {}, member) {
 /** The name of the job that posts the plan's note and status (#4295). */
 export const PR_PLAN_NOTE_JOB = "plan-note";
 /**
- * The plan-note job's command and the values it reads (#4295). It runs in a
- * fresh job after the plan, at the target branch's commit, and posts the
- * note and the `chant/plan` status from the report the plan job handed on,
- * with the forge token the plan job never held. `HEAD_SHA` is the commit
- * the plan job checked out, `PR_NUMBER` the pull request, and on GitHub and
- * Forgejo `PLAN_RESULT` the plan job's result, which fails the status when
- * the plan job failed. `BASE_SHA` is the commit the note job checks out on
- * GitLab, whose runner checks out the pipeline's own commit.
+ * The plan-note job's command and the values it reads (#4295). On GitHub
+ * and Forgejo it runs in a fresh job after the plan, at the target branch's
+ * commit, and posts the note and the `chant/plan` status from the report
+ * the plan job handed on, with the forge token the plan job never held.
+ * `HEAD_SHA` is the commit the plan job checked out, `PR_NUMBER` the pull
+ * request, and `PLAN_RESULT` the plan job's result, which fails the status
+ * when the plan job failed.
+ *
+ * On GitLab (#4328) it runs `pr-post --open` in a pipeline of the target
+ * branch, which GitLab builds from that branch's files and gives the
+ * protected `CHANT_FORGE_TOKEN`. A merge request pipeline is built from the
+ * merge request's files, so no job in it holds the token. `pr-post --open`
+ * asks GitLab for each open merge request's plan job and reads its report
+ * from the job's artifacts.
  */
 export function prLoopPostJob(forge, env, member) {
-    const github = forge !== "gitlab";
+    if (forge === "gitlab") {
+        return {
+            command: ["chant", "components", "pr-post", "--open", "--env", env, "--output", PR_LOOP_REPORT_DIR, "--forge", forge, ...(member ? ["--member", member] : [])].join(" "),
+            env: {},
+        };
+    }
     const command = [
         "chant", "components", "pr-post", "--pr", '"$PR_NUMBER"', "--head", '"$HEAD_SHA"',
         "--env", env, "--output", PR_LOOP_REPORT_DIR, "--forge", forge,
         ...(member ? ["--member", member] : []),
-        ...(github ? ["--result", '"$PLAN_RESULT"'] : []),
+        "--result", '"$PLAN_RESULT"',
     ].join(" ");
     return {
         command,
-        env: github
-            ? { PR_NUMBER: "${{ github.event.pull_request.number }}", HEAD_SHA: "${{ github.sha }}", PLAN_RESULT: "${{ needs.plan.result }}", GITHUB_TOKEN: GITHUB_JOB_TOKEN }
-            : { PR_NUMBER: "$CI_MERGE_REQUEST_IID", HEAD_SHA: "$CI_COMMIT_SHA", BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA" },
+        env: { PR_NUMBER: "${{ github.event.pull_request.number }}", HEAD_SHA: "${{ github.sha }}", PLAN_RESULT: "${{ needs.plan.result }}", GITHUB_TOKEN: GITHUB_JOB_TOKEN },
     };
 }
+/** The plan job's name in a GitLab merge request pipeline (#3465, #4328): `plan`, or `<member>-plan` in a workspace member's included file. */
+export function gitlabPlanJobName(member) {
+    return member ? `${member}-plan` : "plan";
+}
+/**
+ * The GitLab variable a pipeline schedule (or a person starting a pipeline
+ * of the target branch) sets to `1` to post the open merge requests' plan
+ * notes (#4328).
+ */
+export const GITLAB_PLAN_NOTES_VAR = "CHANT_PLAN_NOTES";
 /**
  * What starts the apply under apply on merge (#4168 step 9): on GitHub the
  * tick's workflow finishing (`workflow_run`, since tags its token pushes start

package/dist/components/pr-policy.d.ts

@@ -20,12 +20,17 @@
  *   no longer applies under the approvals of the merges it carries.
  * - error: the policy did not run or gave no readable answer. pr-apply
  *   applies nothing.
+ *
+ * A policy also reads `input.review` (#4326): the risk the pull request's
+ * review note names, when the review agent posted one ({@link policyReviewOf}).
  */
 import type { WorkspaceTree } from "../workspace/tree.js";
 import { type GatePolicyExec, type GatePolicySettings, type GatePolicyVerdict } from "../gate-policy.js";
 import type { ChangeSetDocument } from "../change-set.js";
 import type { GateLedgerPort } from "../op/gate.js";
 import type { PrPolicyReport } from "../pr-loop.js";
+import type { PrForge } from "../pr-forge.js";
+import { type ReviewRisk } from "../op/activities/review-agent.js";
 /** `ci.policy` as read at base. */
 export interface PrLoopPolicy {
     /** Absent when the declaration at base sets none. */
@@ -56,7 +61,38 @@ export interface PrPolicyInput {
     head: string;
     /** The change-set document the gate binds. Its `entries` are every change the plan proposes. */
     changeSet: ChangeSetDocument;
+    /** What the pull request's review note says (#4326). Absent only when the caller did not look. */
+    review?: PolicyReview;
+}
+/**
+ * The review agent's finding as a policy reads it, `input.review`. The risk is
+ * the model's, so a policy treats it as one signal beside the change set, never
+ * as a verdict. `head` is the commit the review read; a policy that cares
+ * whether the review is current compares it with `input.head`.
+ */
+export interface PolicyReview {
+    /** Whether a review note written by the run's own token was found on the pull request. */
+    found: boolean;
+    /** The risk the review named, or `unknown` when none was found, the command failed or the review gave none. */
+    risk: ReviewRisk | "unknown";
+    /** The commit the review read, or null when none was found. */
+    head: string | null;
+    /** Why nothing was found, for the log. Absent when a review was. */
+    reason?: string;
 }
+/**
+ * The users the run's own token acts as on GitHub and Forgejo. Only a note one
+ * of them wrote counts as the review: a pull request's author can post a
+ * comment that starts with the marker, and cannot post as these.
+ */
+export declare const REVIEW_NOTE_AUTHORS: readonly string[];
+/**
+ * The review of pull request `pr`, read from the sticky note the review job
+ * posted (`postReviewNote`, ../op/activities/review-agent.ts). A forge that
+ * cannot be read, a pull request that is not known and a note nobody trusted
+ * all give `found: false`, which a policy sees as `risk: "unknown"`.
+ */
+export declare function policyReviewOf(forge: PrForge | undefined, pr: number | null): Promise<PolicyReview>;
 /** Run the policy over `input`. Undefined when the base sets no policy. */
 export declare function runPrPolicy(read: PrLoopPolicy, input: PrPolicyInput, exec?: GatePolicyExec): GatePolicyVerdict | undefined;
 /** The verdict as the report keeps it. */

package/dist/components/pr-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-policy.d.ts","sourceRoot":"","sources":["../../src/components/pr-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,wGAAwG;IACxG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CActE;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,SAAS,EAAE,iBAAiB,CAAC;CAC9B;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAW1H;AAED,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAWvF;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,cAAc,CAAC;IACrB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,MAAM,EAAE,OAAO,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4CAA4C;AAC5C,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;CAAE,GAC3E;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE7H;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2CpG;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/L"}
+{"version":3,"file":"pr-policy.d.ts","sourceRoot":"","sources":["../../src/components/pr-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEzG,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,wGAAwG;IACxG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CActE;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,SAAS,EAAE,iBAAiB,CAAC;IAC7B,kGAAkG;IAClG,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,0FAA0F;IAC1F,KAAK,EAAE,OAAO,CAAC;IACf,+GAA+G;IAC/G,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAgE,CAAC;AAElH;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAczG;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAW1H;AAED,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAWvF;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,cAAc,CAAC;IACrB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,MAAM,EAAE,OAAO,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4CAA4C;AAC5C,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;CAAE,GAC3E;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE7H;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2CpG;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/L"}

package/dist/components/pr-policy.js

@@ -20,10 +20,14 @@
  *   no longer applies under the approvals of the merges it carries.
  * - error: the policy did not run or gave no readable answer. pr-apply
  *   applies nothing.
+ *
+ * A policy also reads `input.review` (#4326): the risk the pull request's
+ * review note names, when the review agent posted one ({@link policyReviewOf}).
  */
 import { readDeclaration, WorkspaceReadError } from "../workspace/declaration.js";
 import { locateWorkspace } from "../workspace/which-chant.js";
 import { checkGatePolicy, DEFAULT_POLICY_PATH, exportGatePolicy, } from "../gate-policy.js";
+import { parseReviewResult, REVIEW_MARKER_PREFIX } from "../op/activities/review-agent.js";
 /** Whether the working tree's declaration names a `ci.policy`. */
 function checkoutNamesPolicy(cwd) {
     try {
@@ -55,6 +59,38 @@ export function prLoopPolicyAt(cwd, base) {
         return missing ? { base } : { base, note: `ci.policy: the declaration at ${base.slice(0, 12)} could not be read (${why}); this checkout names no policy, so none runs` };
     }
 }
+/**
+ * The users the run's own token acts as on GitHub and Forgejo. Only a note one
+ * of them wrote counts as the review: a pull request's author can post a
+ * comment that starts with the marker, and cannot post as these.
+ */
+export const REVIEW_NOTE_AUTHORS = ["github-actions[bot]", "gitea-actions", "forgejo-actions"];
+/**
+ * The review of pull request `pr`, read from the sticky note the review job
+ * posted (`postReviewNote`, ../op/activities/review-agent.ts). A forge that
+ * cannot be read, a pull request that is not known and a note nobody trusted
+ * all give `found: false`, which a policy sees as `risk: "unknown"`.
+ */
+export async function policyReviewOf(forge, pr) {
+    const none = (reason) => ({ found: false, risk: "unknown", head: null, reason });
+    if (!forge)
+        return none("no forge client, so no pull request note was read");
+    if (pr === null)
+        return none("no pull request to read a review from");
+    let note;
+    try {
+        note = await forge.findComment(pr, REVIEW_MARKER_PREFIX, { author: REVIEW_NOTE_AUTHORS });
+    }
+    catch (err) {
+        return none(`could not read the notes of #${pr}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!note)
+        return none(`#${pr} has no review note written by the run's token`);
+    const result = parseReviewResult(note.body);
+    if (!result)
+        return none(`the review note on #${pr} names no head and risk`);
+    return { found: true, risk: result.risk, head: result.head };
+}
 /** Run the policy over `input`. Undefined when the base sets no policy. */
 export function runPrPolicy(read, input, exec) {
     if (!read.settings || !read.tree)

package/dist/components/pr-run.d.ts

@@ -77,6 +77,7 @@ import type { PrApplyRecord } from "./fan-out-record.js";
 import type { CapabilityRegistry } from "./capability.js";
 import type { RunProgressEvent } from "./run-progress.js";
 import type { RunEventSink } from "../run-event-stream.js";
+import type { PrMigrationFile } from "../pr-migrations.js";
 export interface PrPlanSetOptions {
     /** Every component in the project, not the selection: a planned member's dependency outside it is read too (#4104). */
     components: DriverComponent[];
@@ -337,6 +338,8 @@ export interface PrReportInput {
     waves?: PrWave[];
     /** The rounds the apply planned after an upstream applied (#3999). */
     rounds?: PrRound[];
+    /** Plan stage (#4407): the new migration files, classified. */
+    migrations?: PrMigrationFile[];
 }
 /** The report a stage writes. */
 export declare function prReport(input: PrReportInput): PrReport;

package/dist/components/pr-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-run.d.ts","sourceRoot":"","sources":["../../src/components/pr-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAA2C,KAAK,iBAAiB,EAA2C,MAAM,eAAe,CAAC;AACzI,OAAO,EAAgB,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAML,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,MAAM,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAC;AAElB,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAmB,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,gBAAgB;IAC/B,uHAAuH;IACvH,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,qFAAqF;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,0FAA0F;IAC1F,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,yGAAyG;IACzG,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED,mEAAmE;AACnE,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACxB,oFAAoF;IACpF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;CACjB;AAWD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAuG7E;AA0BD;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC5C,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,GAAG,SAAS,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAQnE;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAOvD;AAED,uDAAuD;AACvD,wBAAsB,YAAY,CAChC,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAI5G;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAIxG;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6FAA6F;IAC7F,GAAG,EAAE,SAAS,CAAC;IACf,yGAAyG;IACzG,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC/C,qEAAqE;IACrE,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IACpF,4FAA4F;IAC5F,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KAAK,IAAI,CAAC;IAC3G,8GAA8G;IAC9G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACtH;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,UAAU,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,kFAAkF;IAClF,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,0EAA0E;IAC1E,GAAG,EAAE,eAAe,CAAC;IACrB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAmBD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA4FhF;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAqDvH;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,yGAAyG;IACzG,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,yGAAyG;IACzG,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,iDAAiD;IACjD,MAAM,EAAE,aAAa,CAAC;IACtB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,QAAQ,GAChB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,+CAA+C;IAC/C,IAAI,EAAE,UAAU,CAAC;IACjB,mGAAmG;IACnG,GAAG,EAAE,SAAS,CAAC;IACf,wDAAwD;IACxD,KAAK,EAAE,SAAS,CAAC;CAClB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+B7E;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,SAAS,MAAM,EAAO,GAAG,UAAU,CASvI;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,GAAE,SAAS,QAAQ,EAAO,GAAG,MAAM,EAAE,CAgBzI;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,GAAG,EAAE,SAAS,CAAC;IACf,QAAQ,EAAE,UAAU,CAAC;IACrB,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAED,iCAAiC;AACjC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,QAAQ,CAkCvD"}
+{"version":3,"file":"pr-run.d.ts","sourceRoot":"","sources":["../../src/components/pr-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAA2C,KAAK,iBAAiB,EAA2C,MAAM,eAAe,CAAC;AACzI,OAAO,EAAgB,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAML,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,MAAM,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAC;AAElB,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAmB,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,gBAAgB;IAC/B,uHAAuH;IACvH,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,qFAAqF;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,0FAA0F;IAC1F,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,yGAAyG;IACzG,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED,mEAAmE;AACnE,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACxB,oFAAoF;IACpF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;CACjB;AAWD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAuG7E;AA0BD;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC5C,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,MAAM,GAAG,SAAS,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAQnE;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAOvD;AAED,uDAAuD;AACvD,wBAAsB,YAAY,CAChC,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAI5G;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAIxG;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6FAA6F;IAC7F,GAAG,EAAE,SAAS,CAAC;IACf,yGAAyG;IACzG,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC/C,qEAAqE;IACrE,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IACpF,4FAA4F;IAC5F,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KAAK,IAAI,CAAC;IAC3G,8GAA8G;IAC9G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACtH;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,UAAU,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,kFAAkF;IAClF,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,0EAA0E;IAC1E,GAAG,EAAE,eAAe,CAAC;IACrB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAmBD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA4FhF;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAqDvH;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,yGAAyG;IACzG,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,yGAAyG;IACzG,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,iDAAiD;IACjD,MAAM,EAAE,aAAa,CAAC;IACtB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,QAAQ,GAChB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,+CAA+C;IAC/C,IAAI,EAAE,UAAU,CAAC;IACjB,mGAAmG;IACnG,GAAG,EAAE,SAAS,CAAC;IACf,wDAAwD;IACxD,KAAK,EAAE,SAAS,CAAC;CAClB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+B7E;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,SAAS,MAAM,EAAO,GAAG,UAAU,CASvI;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,GAAE,SAAS,QAAQ,EAAO,GAAG,MAAM,EAAE,CAgBzI;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,GAAG,EAAE,SAAS,CAAC;IACf,QAAQ,EAAE,UAAU,CAAC;IACrB,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,iCAAiC;AACjC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,QAAQ,CAmCvD"}

package/dist/components/pr-run.js

@@ -604,6 +604,7 @@ export function prReport(input) {
         ...(input.set.deployedOutputs ? { deployedOutputs: input.set.deployedOutputs } : {}),
         ...(input.set.plannedOutputs ? { plannedOutputs: input.set.plannedOutputs } : {}),
         ...(input.rounds && input.rounds.length > 0 ? { rounds: input.rounds } : {}),
+        ...(input.migrations && input.migrations.length > 0 ? { migrations: input.migrations } : {}),
         approval: input.approval,
         ...(input.waveGate ? { waveGate: input.waveGate } : {}),
         ...(input.waveGate && input.waves?.length ? { waves: [...input.waves].sort((a, b) => a.wave - b.wave) } : {}),

package/dist/components/starter-plugin.d.ts

@@ -37,6 +37,7 @@ import { type CapabilityPlugin } from "./capability-plugin.js";
 export declare const STARTER_VERB_FAMILIES: {
     readonly build: readonly ["docker-build", "zip-package", "jvm-build"];
     readonly sbom: readonly ["generate-sbom"];
+    readonly publish: readonly ["publish-image", "publish-artifact"];
     readonly supplyChainSecurity: readonly ["sign", "attest-provenance", "verify"];
     readonly supplyChainPolicy: readonly ["scan-vulnerabilities", "vuln-gate"];
     readonly waitVerify: readonly ["wait-cluster-healthy", "wait-endpoint", "health-gate"];

package/dist/components/starter-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"starter-plugin.d.ts","sourceRoot":"","sources":["../../src/components/starter-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAsBH,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;aAChC,KAAK,YAAG,cAAc,EAAE,aAAa,EAAE,WAAW;aAIlD,IAAI,YAAG,eAAe;aACtB,mBAAmB,YAAG,MAAM,EAAE,mBAAmB,EAAE,QAAQ;aAC3D,iBAAiB,YAAG,sBAAsB,EAAE,WAAW;aAIvD,UAAU,YAAG,sBAAsB,EAAE,eAAe,EAAE,aAAa;aAGnE,OAAO,YAAG,eAAe;aACzB,WAAW,YAAG,OAAO;aAMrB,UAAU,YAAG,iBAAiB,EAAE,2BAA2B,EAAE,SAAS;CAC9D,CAAC;AA+BX;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,gBAUrC,CAAC"}
+{"version":3,"file":"starter-plugin.d.ts","sourceRoot":"","sources":["../../src/components/starter-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAwBH,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;aAChC,KAAK,YAAG,cAAc,EAAE,aAAa,EAAE,WAAW;aAIlD,IAAI,YAAG,eAAe;aAEtB,OAAO,YAAG,eAAe,EAAE,kBAAkB;aAC7C,mBAAmB,YAAG,MAAM,EAAE,mBAAmB,EAAE,QAAQ;aAC3D,iBAAiB,YAAG,sBAAsB,EAAE,WAAW;aAIvD,UAAU,YAAG,sBAAsB,EAAE,eAAe,EAAE,aAAa;aAGnE,OAAO,YAAG,eAAe;aACzB,WAAW,YAAG,OAAO;aAMrB,UAAU,YAAG,iBAAiB,EAAE,2BAA2B,EAAE,SAAS;CAC9D,CAAC;AAiCX;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,gBAUrC,CAAC"}

package/dist/components/starter-plugin.js

@@ -25,7 +25,7 @@
  *    from verb modules, so neither needed to change for this migration —
  *    the compatibility guarantee #559 asks for.
  */
-import { dockerBuildCapability, zipPackageCapability, jvmBuildCapability, generateSbomCapability, signCapability, attestProvenanceCapability, verifyCapability, scanVulnerabilitiesCapability, vulnGateCapability, waitClusterHealthyCapability, waitEndpointCapability, healthGateCapability, shellCapability, ensureSecretCapability, wranglerDeployCapability, wranglerVersionsPromoteCapability, r2SyncCapability, } from "./verbs/index.js";
+import { dockerBuildCapability, zipPackageCapability, jvmBuildCapability, generateSbomCapability, publishImageCapability, publishArtifactCapability, signCapability, attestProvenanceCapability, verifyCapability, scanVulnerabilitiesCapability, vulnGateCapability, waitClusterHealthyCapability, waitEndpointCapability, healthGateCapability, shellCapability, ensureSecretCapability, wranglerDeployCapability, wranglerVersionsPromoteCapability, r2SyncCapability, } from "./verbs/index.js";
 import { ownPackageVersion } from "./capability-plugin.js";
 /**
  * Every `kind` in the starter verb set, grouped by family, per epic #551 and
@@ -41,6 +41,8 @@ export const STARTER_VERB_FAMILIES = {
     // moved to the aws lexicon (#684) alongside the other AWS leaves; core's sbom
     // family keeps only the agnostic, artifact-type-keyed `generate-sbom`.
     sbom: ["generate-sbom"],
+    // `publish-image` is one agnostic verb (#3142, #3143); each cloud lexicon contributes its registry login as a backend (`CapabilityPlugin.registryBackends`).
+    publish: ["publish-image", "publish-artifact"],
     supplyChainSecurity: ["sign", "attest-provenance", "verify"],
     supplyChainPolicy: ["scan-vulnerabilities", "vuln-gate"],
     // Only the *agnostic* wait/verify verbs are in the starter set; the
@@ -71,6 +73,8 @@ function starterCapabilities() {
         zipPackageCapability,
         jvmBuildCapability,
         generateSbomCapability,
+        publishImageCapability,
+        publishArtifactCapability,
         signCapability,
         attestProvenanceCapability,
         verifyCapability,

package/dist/components/verbs/index.d.ts

@@ -38,6 +38,8 @@
  */
 export * from "./build-archive.js";
 export * from "./build.js";
+export * from "./publish-image.js";
+export * from "./publish-artifact.js";
 export * from "./bom-writer.js";
 export * from "./sbom-generator.js";
 export * from "./sbom.js";

package/dist/components/verbs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,QAAQ,CAAC;AACvB,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,OAAO,CAAC;AACtB,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,QAAQ,CAAC;AACvB,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,OAAO,CAAC;AACtB,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC"}