@intentius/chant 0.80.0 → 0.81.0

package/dist/workspace/member-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-commands.d.ts","sourceRoot":"","sources":["../../src/workspace/member-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE9E,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAEjE,OAAO,EAAwC,KAAK,aAAa,EAAyB,MAAM,cAAc,CAAC;AAC/G,OAAO,EAAe,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEzD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEjE,wFAAwF;AACxF,MAAM,WAAW,OAAO;IACtB,+DAA+D;IAC/D,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,iFAAiF;IACjF,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,iCAAiC;AACjC,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,SAAS;IACxB,2GAA2G;IAC3G,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,kGAAkG;IAClG,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,mDAAmD;IACnD,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED,2DAA2D;AAC3D,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAUD;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,SAAS,CAI3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,SAA6B,GAAG,SAAS,CAW5G;AAED,MAAM,WAAW,WAAW;IAC1B,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,wGAAwG;IACxG,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,uGAAuG;IACvG,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB;AAED,0JAA0J;AAC1J,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,UAAU,CAoFpG;AAID,yFAAyF;AACzF,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,MAAM,CAMnG;AAED,gDAAgD;AAChD,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,EAAE,CAuBzF;AAED,yHAAyH;AACzH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGrF;AAID,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC9C,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IACrB,4FAA4F;IAC5F,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qGAAqG;IACrG,IAAI,EAAE,YAAY,GAAG,YAAY,CAAC;CACnC;AAyBD,mGAAmG;AACnG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAmBnK;AAkCD,mHAAmH;AACnH,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAK3F;AAWD,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAYrD;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAQlD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAQ3E;AAwCD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAEzK;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA+EnG"}

package/dist/workspace/member-handles.d.ts

@@ -0,0 +1,54 @@
+/**
+ * A chant member's outputs and parameters, read from its source without
+ * running it (#2539, #2524 D6).
+ *
+ * `chant workspace check` resolves member links in source and never runs
+ * member code, so it can't build a member to learn its outputs. This reader
+ * parses the member's TypeScript files and picks out the two handles a join
+ * uses, the way the graph IR names them (`exports` and `imports`):
+ *
+ * - an output is the name passed to `output(ref, "Name")`, or the binding of
+ *   `export const name = stackOutput(ref)`;
+ * - a parameter is the binding of `export const name = new Parameter(...)`.
+ *
+ * Only calls whose function is imported from `@intentius/chant` or a chant
+ * lexicon count. An output name must be a string literal, or a `const` in the
+ * same file that is one. Any other name can't be read without running the
+ * code, so it is a gap: the member's list of outputs is then incomplete, and a
+ * link to a name the reader didn't find is unresolved rather than missing.
+ *
+ * The reader loads the TypeScript parser and nothing else from the project.
+ */
+import { type Declaration, type ResolvedGroup } from "./declaration.js";
+import type { KindRegistry } from "./kinds.js";
+import { type MemberHandles } from "./links.js";
+import { type WorkspaceTree } from "./tree.js";
+/** One output or parameter found in source. */
+export interface SourceHandle {
+    name: string;
+    /** Tree-relative file and 1-based line, for messages. */
+    file: string;
+    line: number;
+}
+export interface SourceHandles {
+    outputs: SourceHandle[];
+    /** Parameters: the names a consumer reads from outside. */
+    inputs: SourceHandle[];
+    /** Why the list of outputs may be incomplete, one line each. Empty when it is complete. */
+    gaps: string[];
+}
+/**
+ * Read a chant member's outputs and parameters from the source under `dir`
+ * (tree-relative, `""` for the root), leaving out the `exclude`d directories.
+ * Runs no member code.
+ */
+export declare function readSourceHandles(tree: WorkspaceTree, dir: string, exclude?: ReadonlySet<string>): SourceHandles;
+/**
+ * Every member's handles, read in source for `chant workspace check`. A
+ * `chant` member's outputs and parameters are parsed from its TypeScript
+ * without running it; other kinds expose what the kind and the entry list.
+ * A member whose directory is missing or whose kind is unknown is left out,
+ * so links to it are unresolved.
+ */
+export declare function sourceMemberHandles(declaration: Declaration, tree: WorkspaceTree, groups: readonly ResolvedGroup[], kinds: KindRegistry): Map<string, MemberHandles>;
+//# sourceMappingURL=member-handles.d.ts.map

package/dist/workspace/member-handles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-handles.d.ts","sourceRoot":"","sources":["../../src/workspace/member-handles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAY,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAe,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAIlE,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,2DAA2D;IAC3D,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,2FAA2F;IAC3F,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AA8HD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,WAAW,CAAC,MAAM,CAAa,GAAG,aAAa,CAa3H;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,WAAW,EACxB,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,KAAK,EAAE,YAAY,GAClB,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAyB5B"}

package/dist/workspace/member-pipeline.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Per-member CI pipelines (#2542; #2524 D19, ws-041 and ws-042).
+ *
+ * When `chant build --components --generate` or `chant run --generate` runs
+ * for a project inside a workspace member, the generator is told which
+ * member it is generating for ({@link PipelineMember}). The generated
+ * pipeline is then filtered to the member's paths, its jobs run in the
+ * member's directory, and its file is named after the member so two members
+ * never write the same file.
+ *
+ * Forges read CI files from fixed paths at the repository root, outside any
+ * member's directory. The member whose command generates such a file owns
+ * it (ws-042), and records it in its list of generated files. That list
+ * belongs in the member's `generated` entry in `chant.workspace.json` once
+ * #2541 lands. Until then it is `.chant/generated.json` in the member's
+ * directory ({@link GENERATED_RECORD_FILE}), which `WSP081` reads to allow
+ * one declarer per file (./checks/pipelines.ts).
+ *
+ * The command handlers import this module only after `findWorkspaceRoot`
+ * has found a declaration, so a project outside any workspace never loads it.
+ */
+import type { PipelineMember } from "../lexicon.js";
+import type { WorkspaceRootSearch } from "../project-root.js";
+import { type Declaration, type Member } from "./declaration.js";
+/**
+ * TODO(#2541): the interim home of a member's generated-file list, relative
+ * to the member's directory. #2541 moves the list into the member's entry in
+ * the declaration, and this file goes away.
+ */
+export declare const GENERATED_RECORD_FILE = ".chant/generated.json";
+/** One generated file a member owns. */
+export interface GeneratedFileEntry {
+    /** The file, relative to the repository root, with `/` separators. */
+    path: string;
+    /** The command that regenerates it, run in the member's directory. */
+    command: string;
+    /** The environment the pipeline deploys, for a component pipeline. */
+    env?: string;
+}
+export interface GeneratedRecord {
+    schema: 1;
+    files: GeneratedFileEntry[];
+}
+/** The member a project belongs to, and where it sits. */
+export interface MemberContext {
+    declaration: Declaration;
+    member: Member;
+    /** Absolute path of the workspace root. */
+    workspaceRoot: string;
+    /** Absolute path of the repository root: the git top, or the workspace root outside git. */
+    repoRoot: string;
+    /** Absolute path of the member's directory. */
+    memberRoot: string;
+    /** What the generators read: name, repository-relative directory and exclusions. */
+    pipeline: PipelineMember;
+}
+/**
+ * The member that owns `projectDir`, given the declaration `findWorkspaceRoot`
+ * found. Undefined when no member owns it: the directory sits in an example
+ * group's match, or outside every member of a workspace with no root member.
+ * Throws `WorkspaceReadError` when the declaration can't be read.
+ */
+export declare function resolveMemberContext(projectDir: string, found: WorkspaceRootSearch): MemberContext | undefined;
+/** The directory a forge's generated files go in for a member, relative to the repository root, or undefined for a forge chant doesn't know. */
+export declare function memberPipelineDir(provider: string): string | undefined;
+/**
+ * The default path of a member's component pipeline for one environment,
+ * relative to the repository root: `chant-<member>-<env>.yml` in the forge's
+ * workflow directory, or `.gitlab/ci/chant-<member>-<env>.gitlab-ci.yml`.
+ */
+export declare function memberPipelineFile(provider: string, member: string, env: string): string | undefined;
+/** A repository-relative path for an absolute one. */
+export declare function repoRelative(ctx: MemberContext, absolute: string): string;
+/** Read a member's generated-file record, or an empty one. */
+export declare function readGeneratedRecord(memberRoot: string): GeneratedRecord;
+/**
+ * Add or replace entries in a member's generated-file record, keyed by path,
+ * and write it back sorted, so regenerating the same files leaves it
+ * byte-identical.
+ */
+export declare function recordGeneratedFiles(memberRoot: string, entries: GeneratedFileEntry[]): string;
+/** Quote one argument for a recorded command line when it needs it. */
+export declare function shellArg(arg: string): string;
+/** The first line of a member's generated pipeline, naming the command that regenerates it. */
+export declare function generatedHeader(command: string): string;
+/** What `chant build --components --generate` needs to write a member's pipeline. */
+export interface MemberComponentPlan {
+    ctx: MemberContext;
+    /** Passed to the generator as `options.member`. */
+    member: PipelineMember;
+    /** The pipeline file, relative to the repository root. */
+    file: string;
+    /** The pipeline file's absolute path. */
+    target: string;
+    /** The command that regenerates it, run in the member's directory. */
+    command: string;
+    env: string;
+}
+export interface ComponentPlanInput {
+    projectDir: string;
+    found: WorkspaceRootSearch;
+    lexicon: string;
+    /** `--env`, or undefined for the generator's default. */
+    env?: string;
+    promoteTo?: string;
+    /** `--output`, relative to the current directory. */
+    output?: string;
+    params?: string[];
+    paramsFile?: string;
+}
+/**
+ * Plan a member's component pipeline: which member, which file and which
+ * command. Undefined when the project belongs to no member. Throws with a
+ * readable message when there is no default file for the forge and no
+ * `--output`.
+ */
+export declare function planMemberComponentPipeline(input: ComponentPlanInput): MemberComponentPlan | undefined;
+/** Write a member's pipeline with its header and record it as the member's generated file. */
+export declare function writeMemberComponentPipeline(plan: MemberComponentPlan, yaml: string): void;
+/** What `chant run --generate` needs to write a member's Op pipelines. */
+export interface MemberOpPlan {
+    ctx: MemberContext;
+    member: PipelineMember;
+    /** Absolute directory the files are written to. */
+    outDir: string;
+    command: string;
+}
+/** Plan a member's Op pipelines. Undefined when the directory belongs to no member. */
+export declare function planMemberOpPipelines(input: {
+    projectDir: string;
+    found: WorkspaceRootSearch;
+    provider: string;
+    output?: string;
+    specFile?: string;
+}): MemberOpPlan | undefined;
+/** Write a member's Op pipeline files with their header and record them. Returns the paths written, relative to the current directory. */
+export declare function writeMemberOpPipelines(plan: MemberOpPlan, files: {
+    name: string;
+    yaml: string;
+}[]): string[];
+/** A message for an error from planning: a declaration error with its file and line, or the error's own message. */
+export declare function describeError(err: unknown): string;
+//# sourceMappingURL=member-pipeline.d.ts.map

package/dist/workspace/member-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-pipeline.d.ts","sourceRoot":"","sources":["../../src/workspace/member-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAA+E,KAAK,WAAW,EAAE,KAAK,MAAM,EAAE,MAAM,eAAe,CAAC;AAG3I;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D,wCAAwC;AACxC,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CAAC,CAAC;IACV,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAqBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,aAAa,GAAG,SAAS,CA0B9G;AAUD,gJAAgJ;AAChJ,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIpG;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAKvE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAS9F;AAED,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,aAAa,CAAC;IACnB,mDAAmD;IACnD,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAKD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,GAAG,SAAS,CA8BtG;AAED,8FAA8F;AAC9F,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI1F;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,uFAAuF;AACvF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,YAAY,GAAG,SAAS,CAsB3B;AAED,0IAA0I;AAC1I,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,MAAM,EAAE,CAY5G;AAED,oHAAoH;AACpH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAGlD"}

package/dist/workspace/member-run.d.ts

@@ -0,0 +1,67 @@
+/**
+ * `chant workspace member-run` (#2537): the one process a toolchain runs for
+ * `chant workspace build|lint|audit|graph`.
+ *
+ * `member-commands.ts` groups the members by the chant each one resolves
+ * (#2524 D3, "one process per toolchain identity") and spawns that chant's
+ * `workspace member-run` once per group. The request arrives as JSON on
+ * stdin: the level-0 command line for each member, and the member's
+ * directory. This process runs them one after another, in-process, from
+ * inside each directory, so every member gets what `chant <verb> .` would
+ * print there. It answers on stdout with one {@link PROTOCOL_PREFIX} line per
+ * member, after a header line naming the protocol and this chant's version.
+ *
+ * A chant older than this command has no header to print. The caller sees
+ * that and falls back to one level-0 process per member.
+ *
+ * Internal: not listed in `chant --help`, and the protocol may change with
+ * the caller, which is always a chant of the same or a newer release.
+ */
+import type { CommandContext } from "../cli/registry.js";
+/** Marks the lines of this protocol on stdout; anything else there is stray output. */
+export declare const PROTOCOL_PREFIX = "@@chant-member-run@@ ";
+export declare const MEMBER_RUN_PROTOCOL = 1;
+export interface MemberRunRequest {
+    protocol: number;
+    units: MemberRunUnit[];
+}
+export interface MemberRunUnit {
+    /** Echoed back on the answer line. */
+    id: string;
+    /** The member's directory, absolute. The command runs from inside it. */
+    dir: string;
+    /** The level-0 command line, such as `["lint", ".", "--format", "sarif"]`. */
+    argv: string[];
+    /**
+     * Directories (relative to `dir`) to leave out of discovery. Set for member
+     * `.`, whose project is the root minus every other member. Kept in the
+     * protocol for a member-run from before #2527, which applied it itself;
+     * from #2527 on, discovery reads the same set from the declaration.
+     */
+    exclude?: string[];
+}
+export type MemberRunLine = {
+    type: "header";
+    protocol: number;
+    chant: string;
+} | {
+    type: "result";
+    id: string;
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Run `fn` with stdout, stderr and `process.exit` captured. Commands print
+ * through `console`, which writes through the stream's `write` at call time,
+ * so replacing `write` catches everything they print.
+ */
+export declare function captureRun(fn: () => Promise<number>): Promise<{
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}>;
+/** Run each unit of `request` in turn, answering on stdout. */
+export declare function runMemberUnits(request: MemberRunRequest, run: (argv: string[]) => Promise<number>): Promise<number>;
+export declare function runWorkspaceMemberRun(_ctx: CommandContext, run: (argv: string[]) => Promise<number>): Promise<number>;
+//# sourceMappingURL=member-run.d.ts.map

package/dist/workspace/member-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-run.d.ts","sourceRoot":"","sources":["../../src/workspace/member-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD,uFAAuF;AACvF,eAAO,MAAM,eAAe,0BAA0B,CAAC;AACvD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAWrF;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiCzH;AAYD,+DAA+D;AAC/D,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBzH;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAa3H"}

package/dist/workspace/reason-codes.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The workspace read contract's closed list of reason codes (#2536, #2524
+ * D15, ws-017, ws-020).
+ *
+ * Every code a `chant workspace` read prints is here: the error that stops a
+ * read, the reason an unreadable member, group, ledger or record is listed
+ * with, and the lineage lock findings of `check`. Each command's own list
+ * (`WORKSPACE_ERROR_CODES`, `MEMBER_REASON_CODES`, `STATUS_REASON_CODES`,
+ * `RECORD_REASON_CODES` and the rest) is a subset of this one, which the
+ * compiler checks through `satisfies`. `reason-codes.test.ts` checks that the
+ * output schemas and the source emit nothing outside it.
+ *
+ * The list is closed: a reader may switch on a code, and a new code is a
+ * contract change. Within contract version 1, before the floor release, codes
+ * may still be added; after it, a new code means a new contract version.
+ *
+ * `chant workspace check` also reports `WSP` ids. Those are the declaration
+ * check catalog (`checks.ts`), a separate closed list, and a finding whose
+ * cause is one of the codes here carries that code too.
+ */
+/** The version of the read contract this chant writes: the declaration format, the output schemas and these codes. */
+export declare const READ_CONTRACT_VERSION = 1;
+/** The first chant release that writes contract version 1. A reader that needs the contract refuses an older chant. */
+export declare const READ_CONTRACT_FLOOR = "0.81.0";
+/** Each code and what it means. The key order is the order the docs list them in. */
+export declare const REASONS: {
+    readonly "declaration-missing": "No chant.workspace.json or .jsonc between the directory and the git root.";
+    readonly "declaration-ambiguous": "Both chant.workspace.json and chant.workspace.jsonc exist.";
+    readonly "declaration-unparseable": "The declaration is not valid JSON, or not valid JSONC for .jsonc.";
+    readonly "declaration-invalid": "The declaration does not match its schema, repeats a name, or --member names no entry.";
+    readonly "placement-invalid": "A member or group match breaks a placement rule.";
+    readonly "reader-too-old": "The declaration's minReader is newer than the chant reading it.";
+    readonly "root-chant-required": "The declaration pins a chant version other than the reader's, and that chant is not installed at the workspace root.";
+    readonly "not-a-git-repository": "--at, or a ledger read, needs a git repository and there is none.";
+    readonly "revision-unknown": "--at names no commit.";
+    readonly "environment-invalid": "An environment name that can't name a ledger directory.";
+    readonly "dir-missing": "The member's directory does not exist.";
+    readonly "unknown-kind": "No built-in kind or pinned package supplies the member's kind.";
+    readonly "kind-probe-failed": "The member's directory is not what its kind reads.";
+    readonly "no-matches": "An example group matches no directory holding a chant project.";
+    readonly "kind-not-run": "The member's kind is one the per-member commands don't run, such as other.";
+    readonly "command-failed": "The member's own command exited with a failure.";
+    readonly "output-unreadable": "The member's command printed something that isn't the document asked for.";
+    readonly "ir-version-unsupported": "The member's IR has a version this chant can't read.";
+    readonly "ledger-unreadable": "Reading the ledger failed, so nothing from it is listed.";
+    readonly "ledger-malformed": "Some lines of the ledger aren't release records; the rest are listed.";
+    readonly "record-unparseable": "No front matter, a YAML error, or a value outside the JSON subset of YAML.";
+    readonly "record-schema-invalid": "The front matter does not match the kind's schema.";
+    readonly "record-id-duplicate": "Another record earlier in path order has the same id.";
+    readonly "record-supersedes-unknown": "A supersedes link names an id no record has.";
+    readonly "record-supersedes-conflict": "A second closed record supersedes a record another one already superseded.";
+    readonly "kind-unreadable": "The record kind file is missing or could not be imported.";
+    readonly "kind-invalid": "The record kind file exports no recordKind, or its shape is wrong.";
+    readonly "schema-unreadable": "The schema file the record kind names is missing or is not JSON.";
+    readonly "schema-id-mismatch": "The schema's $id differs from the id the record kind names.";
+    readonly "schema-invalid": "The record schema itself does not compile.";
+    readonly "location-missing": "The records directory does not exist, in the tree or at the revision.";
+    readonly "lock-invalid": "The lineage lock can't be read.";
+    readonly "manual-step-open": "A scope in the lineage lock has an open manual step.";
+};
+export type ReasonCode = keyof typeof REASONS;
+/** Every code, in the order of {@link REASONS}. */
+export declare const REASON_CODES: ReasonCode[];
+export declare function isReasonCode(value: unknown): value is ReasonCode;
+//# sourceMappingURL=reason-codes.d.ts.map

package/dist/workspace/reason-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reason-codes.d.ts","sourceRoot":"","sources":["../../src/workspace/reason-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,sHAAsH;AACtH,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,uHAAuH;AACvH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,qFAAqF;AACrF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CV,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,OAAO,CAAC;AAE9C,mDAAmD;AACnD,eAAO,MAAM,YAAY,EAA2B,UAAU,EAAE,CAAC;AAEjE,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE"}

package/dist/workspace/records-cli.d.ts

@@ -1,6 +1,7 @@
 /**
- * `chant workspace records --kind <path> [--current] [--at <rev>] [--json]`,
- * the first-test slice of the records query (#2546, #2536).
+ * `chant workspace records --kind <path> [--current] [--at <rev>] [--base <rev>]
+ * [--require attested] [--json]`, the first-test slice of the records query
+ * (#2546, #2536), with each record's provenance level (#2547).
  *
  * It reads every record the kind file locates and prints them, with reason
  * codes for any that are invalid. An invalid record never fails the command:
@@ -12,17 +13,37 @@
  */
 import type { CommandContext } from "../cli/registry.js";
 import { type ReadErrorCode, type RecordEntry } from "./records.js";
+import { type ProvenanceLevel } from "./trust/attestor.js";
+import { type BaseSource, type RecordProvenance } from "./trust/provenance.js";
 /** The version of the `records` output this chant writes. */
 export declare const RECORDS_CONTRACT_VERSION = 1;
 /** `$id` of the JSON Schema for the `--json` output, shipped beside this file. */
 export declare const RECORDS_OUTPUT_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/records/v1/records.schema.json";
+/** Exit code when the read worked and a record falls below `--require`. */
+export declare const EXIT_BELOW_REQUIRED = 2;
 export interface RecordsQuery {
     kind: string;
     current?: boolean;
     at?: string;
+    /** The revision the trust policy is read at (#2547). Defaults to the target branch tip. */
+    base?: string;
     /** Where `kind` is resolved from and the repository is found. */
     cwd: string;
 }
+/** A record as the output carries it: the entry plus its provenance (#2547). */
+export type RecordView = RecordEntry & {
+    provenance: RecordProvenance;
+};
+/** Where provenance was judged from (#2547). */
+export interface TrustView {
+    /** The full commit id the policy was read at, or null when there is no base. */
+    base: string | null;
+    baseFrom: BaseSource | null;
+    /** Whether a signers file exists at base. False means every record is `unattested`. */
+    active: boolean;
+    signersPath: string;
+    problems: string[];
+}
 /** The `records` output: a result, or a failure with one error code. */
 export type RecordsDocument = {
     $schema: string;
@@ -34,7 +55,8 @@ export type RecordsDocument = {
     };
     at: string | null;
     current: boolean;
-    records: RecordEntry[];
+    trust: TrustView;
+    records: RecordView[];
     summary: {
         total: number;
         valid: number;
@@ -52,6 +74,8 @@ export type RecordsDocument = {
 /** Run the query and build the document `--json` prints. Never throws a {@link RecordReadError}. */
 export declare function queryRecords(query: RecordsQuery): Promise<RecordsDocument>;
 export declare function runWorkspaceRecords(ctx: CommandContext): Promise<number>;
-/** `chant workspace <anything else>`: only `records` exists so far. */
+/** Records whose provenance falls below `required`. Only `attested` can be required. */
+export declare function belowRequired(records: RecordView[], required: ProvenanceLevel): RecordView[];
+/** `chant workspace <anything else>`. */
 export declare function runWorkspaceUnknown(ctx: CommandContext): Promise<number>;
 //# sourceMappingURL=records-cli.d.ts.map

package/dist/workspace/records-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"records-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/records-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAgD,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAE/G,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,gFAAgF,CAAC;AAItH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wEAAwE;AACxE,MAAM,MAAM,eAAe,GACvB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAChF,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE3F,oGAAoG;AACpG,wBAAsB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CA8BhF;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAe9E;AAmBD,uEAAuE;AACvE,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAS9E"}
+{"version":3,"file":"records-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/records-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAgD,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAC/G,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAA+C,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEzH,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,gFAAgF,CAAC;AAItH,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG;IAAE,UAAU,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAExE,gDAAgD;AAChD,MAAM,WAAW,SAAS;IACxB,gFAAgF;IAChF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,uFAAuF;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wEAAwE;AACxE,MAAM,MAAM,eAAe,GACvB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAChF,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE3F,oGAAoG;AACpG,wBAAsB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CA4ChF;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAmC9E;AAUD,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,eAAe,GAAG,UAAU,EAAE,CAE5F;AAoBD,yCAAyC;AACzC,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAS9E"}

package/dist/workspace/records.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../src/workspace/records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAIpD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,4IAWtB,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,gBAAgB,2KAiBnB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,aAAa;gBAAnB,IAAI,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAMD,oDAAoD;AACpD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;kBAoCzB,CAAC;AAEL,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAmBD,kFAAkF;AAClF,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiCzG;AAID,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAExG;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAgB1D;AA0BD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,sFAAsF;IACtF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAChF;AAsBD,oEAAoE;AACpE,wBAAsB,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgFnH"}
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../src/workspace/records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAIpD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,4IAWU,CAAC;AAC3C,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,gBAAgB,2KAiBa,CAAC;AAC3C,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,aAAa;gBAAnB,IAAI,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAMD,oDAAoD;AACpD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;kBAoCzB,CAAC;AAEL,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAmBD,kFAAkF;AAClF,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiCzG;AAID,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAExG;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAgB1D;AA0BD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,sFAAsF;IACtF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAChF;AAsBD,oEAAoE;AACpE,wBAAsB,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgFnH"}

package/dist/workspace/root-refusal.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `chant build` and `chant lint` at the root of a declared workspace (#2537,
+ * #2524 D0 and D12, ws-023).
+ *
+ * Once `chant.workspace.json` declares members, their directories leave the
+ * root project. A top-level `chant build` there would quietly build less than
+ * it did before the file existed, so both commands refuse with `WSP000` and
+ * point to `chant workspace build` and `chant workspace lint`. `--root-only`,
+ * or `rootOnly: true` in the root's `chant.config`, lets them run on the root
+ * project alone, with the member directories and example-group matches left
+ * out of discovery.
+ *
+ * `main.ts` decides with `findWorkspaceRoot` and `findProjectRoot`, which only
+ * test whether files exist, and imports this module only when the command's
+ * project is a declared root. A project with no declaration never loads it.
+ */
+/** The code a refusal carries. `WSP` ids name workspace findings (#2524 D16); `000` is the refusal itself. */
+export declare const ROOT_REFUSAL_CODE = "WSP000";
+export interface RootGuardInput {
+    verb: "build" | "lint";
+    /** The command's target, absolute. */
+    target: string;
+    /** The directory holding the declaration, absolute. */
+    workspaceDir: string;
+    /** `--root-only` on the command line, or `rootOnly: true` in the root's chant.config. */
+    rootOnly: boolean;
+}
+export type RootGuardResult = 
+/** The target belongs to a member or an example group, so it is not the root project; nothing changes. */
+{
+    action: "not-root";
+}
+/** The command runs on the root project with these directories (relative to the root) left out. */
+ | {
+    action: "root-only";
+    excluded: string[];
+}
+/** The command stops; `message` says why and what to run instead. */
+ | {
+    action: "refuse";
+    message: string;
+};
+/** Decide what a root `build` or `lint` does. Pure apart from reading the declaration. */
+export declare function decideRootCommand(input: RootGuardInput): RootGuardResult;
+/**
+ * Apply {@link decideRootCommand}: print the refusal and return 1, or return
+ * undefined so the command goes on. A root-only run needs nothing set up:
+ * every discovery walk under a declaration already leaves the member
+ * directories and group matches out (#2527, `workspaceMemberDirs` in
+ * `../discovery/walk.ts`), and `excluded` names the same directories.
+ */
+export declare function guardRootCommand(input: RootGuardInput): number | undefined;
+//# sourceMappingURL=root-refusal.d.ts.map

package/dist/workspace/root-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-refusal.d.ts","sourceRoot":"","sources":["../../src/workspace/root-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,8GAA8G;AAC9G,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,eAAe;AACzB,0GAA0G;AACxG;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE;AACxB,mGAAmG;GACjG;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE;AAC7C,qEAAqE;GACnE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAoCxE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAO1E"}