dorfl 0.14.1 → 0.14.3

package/dist/advance-ci-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"advance-ci-template.d.ts","sourceRoot":"","sources":["../src/advance-ci-template.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,yDAAyD;AACzD,MAAM,WAAW,wBAAwB;IACxC,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC3C,kEAAkE;IAClE,EAAE,EAAE,OAAO,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CA2BtE;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,IAAI,EAAE,MAAM,GACV,2BAA2B,CA2F7B"}
+{"version":3,"file":"advance-ci-template.d.ts","sourceRoot":"","sources":["../src/advance-ci-template.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,yDAAyD;AACzD,MAAM,WAAW,wBAAwB;IACxC,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC3C,kEAAkE;IAClE,EAAE,EAAE,OAAO,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CA2BtE;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,IAAI,EAAE,MAAM,GACV,2BAA2B,CAmG7B"}

package/dist/advance-ci-template.js

@@ -62,13 +62,19 @@ export function validateAdvanceCiTemplate(text) {
         '+ `cwd.repo.specs[]` pools), so a ready ungated SPEC becomes one auto-task ' +
         'matrix leg alongside the eligible-task legs ' +
         '(`ci-propose-matrix-must-enumerate-sliceable-prds-not-only-slices`).');
-    require('propose-one-advance-per-item', /dorfl advance "?\$\{\{\s*matrix\./.test(text), 'each matrix leg must run one `dorfl advance <matrix item>` ' +
-        '(one PR per item).');
+    require('propose-one-advance-per-item', /WORK_ITEM:\s*\$\{\{\s*matrix\.item\s*\}\}[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"/.test(text), 'each matrix leg must run one `dorfl advance <matrix item>` ' +
+        '(one PR per item), reading the item from the step env (`WORK_ITEM`).');
+    // The item id is a slug that may be hand-written, so it must reach the shell
+    // as DATA through `env:`, never as `${{ }}` text spliced into the `run:` script
+    // (GitHub Actions script injection).
+    require('matrix-item-not-spliced-into-run', !/dorfl advance "?\$\{\{/.test(text), 'the matrix item must NOT be interpolated into the `run:` script as ' +
+        '`${{ matrix.item }}` (script injection): pass it through the step `env:` ' +
+        'as `WORK_ITEM` and quote it as `"${WORK_ITEM}"`.');
     // The matrix leg must carry `--propose` so the integration mode is TIED to the
     // matrix shape (it cannot desync from the dispatch `integrationMode` input nor
     // fall back to a repo config default of `merge`). Scoped to the `advance-propose`
     // job so it is the LEG that carries it, not merely the file somewhere.
-    require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--propose\b/.test(text), 'each `propose` matrix leg must pass `--propose` so the integration mode is ' +
+    require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--propose\b/.test(text), 'each `propose` matrix leg must pass `--propose` so the integration mode is ' +
         'TIED to the matrix shape (a leg can never merge to main / desync from the ' +
         'dispatch mode).');
     // --- merge ⇒ a MATRIX per item (parallel build/gate/review, serialised land) -
@@ -84,7 +90,7 @@ export function validateAdvanceCiTemplate(text) {
     // scoped to the `advance-merge:` job so the `--merge` flag is TIED to its leg
     // (cannot desync from the dispatch `integrationMode` input nor fall back to a
     // repo config default of `propose`).
-    require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--merge\b/.test(text), 'each `merge` matrix leg must pass `--merge` so the integration mode is ' +
+    require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--merge\b/.test(text), 'each `merge` matrix leg must pass `--merge` so the integration mode is ' +
         'TIED to the matrix shape (a leg can never propose-only / desync from the ' +
         'dispatch mode).');
     // The merge fan-out is the SAFETY-FLOOR shape: no `concurrency:` group on the

package/dist/advance-ci-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"advance-ci-template.js","sourceRoot":"","sources":["../src/advance-ci-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAE,YAAY,EAAC,MAAM,SAAS,CAAC;AACjD,OAAO,EAAC,OAAO,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAC,aAAa,EAAC,MAAM,UAAU,CAAC;AA6DvC;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAiB;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,UAAU,GAAG;QAClB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,CAAC;QAC1E,OAAO,CACN,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,2BAA2B,CAC3B;KACD,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,yEAAyE;IACzE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,QAAiB;IACtD,OAAO,YAAY,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,IAAY;IAEZ,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC,CAAC;IAEF,+EAA+E;IAC/E,OAAO,CAAC,cAAc,EAAE,iCAAiC,CAAC,IAAI,CAC7D,IAAI,CACJ,EAAE,yDAAyD,CAAC,CAAC;IAC9D,OAAO,CAAC,6BAA6B,EAAE,mDAAmD,CAAC,IAAI,CAC9F,IAAI,CACJ,EAAE,yEAAyE,CAAC,CAAC;IAE9E,gFAAgF;IAChF,OAAO,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,IAAI,CAC3D,IAAI,CACJ,EAAE,gEAAgE,CAAC,CAAC;IACrE,OAAO,CAAC,6BAA6B,EAAE,mBAAmB,CAAC,IAAI,CAC9D,IAAI,CACJ,EAAE,oEAAoE;QACtE,wBAAwB,CAAC,CAAC;IAC3B,gEAAgE;IAChE,yEAAyE;IACzE,mEAAmE;IACnE,6EAA6E;IAC7E,mFAAmF;IACnF,gEAAgE;IAChE,OAAO,CAAC,mCAAmC,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1E,aAAa,CAAC,IAAI,CACjB,IAAI,CACJ,EAAE,uEAAuE;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,8CAA8C;QAC9C,sEAAsE,CAAC,CAAC;IACzE,OAAO,CAAC,8BAA8B,EAAE,mCAAmC,CAAC,IAAI,CAC/E,IAAI,CACJ,EAAE,6DAA6D;QAC/D,oBAAoB,CAAC,CAAC;IACvB,+EAA+E;IAC/E,+EAA+E;IAC/E,kFAAkF;IAClF,uEAAuE;IACvE,OAAO,CAAC,kCAAkC,EAAE,8EAA8E,CAAC,IAAI,CAC9H,IAAI,CACJ,EAAE,6EAA6E;QAC/E,4EAA4E;QAC5E,iBAAiB,CAAC,CAAC;IAEpB,gFAAgF;IAChF,6EAA6E;IAC7E,qFAAqF;IACrF,yEAAyE;IACzE,8EAA8E;IAC9E,+EAA+E;IAC/E,OAAO,CAAC,cAAc,EAAE,mDAAmD,CAAC,IAAI,CAC/E,IAAI,CACJ,EAAE,0EAA0E;QAC5E,uEAAuE;QACvE,yCAAyC,CAAC,CAAC;IAC5C,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,qCAAqC;IACrC,OAAO,CAAC,8BAA8B,EAAE,0EAA0E,CAAC,IAAI,CACtH,IAAI,CACJ,EAAE,yEAAyE;QAC3E,2EAA2E;QAC3E,iBAAiB,CAAC,CAAC;IACpB,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,OAAO,CAAC,sCAAsC,EAAE,CAAC,2CAA2C,CAAC,IAAI,CAChG,IAAI,CACJ,EAAE,yEAAyE;QAC3E,6EAA6E;QAC7E,uEAAuE;QACvE,QAAQ,CAAC,CAAC;IAEX,gFAAgF;IAChF,OAAO,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,IAAI,CACvD,IAAI,CACJ,EAAE,yDAAyD,CAAC,CAAC;IAE9D,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"advance-ci-template.js","sourceRoot":"","sources":["../src/advance-ci-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAE,YAAY,EAAC,MAAM,SAAS,CAAC;AACjD,OAAO,EAAC,OAAO,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAC,aAAa,EAAC,MAAM,UAAU,CAAC;AA6DvC;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAiB;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,UAAU,GAAG;QAClB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,CAAC;QAC1E,OAAO,CACN,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,2BAA2B,CAC3B;KACD,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,yEAAyE;IACzE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,QAAiB;IACtD,OAAO,YAAY,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,IAAY;IAEZ,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC,CAAC;IAEF,+EAA+E;IAC/E,OAAO,CAAC,cAAc,EAAE,iCAAiC,CAAC,IAAI,CAC7D,IAAI,CACJ,EAAE,yDAAyD,CAAC,CAAC;IAC9D,OAAO,CAAC,6BAA6B,EAAE,mDAAmD,CAAC,IAAI,CAC9F,IAAI,CACJ,EAAE,yEAAyE,CAAC,CAAC;IAE9E,gFAAgF;IAChF,OAAO,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,IAAI,CAC3D,IAAI,CACJ,EAAE,gEAAgE,CAAC,CAAC;IACrE,OAAO,CAAC,6BAA6B,EAAE,mBAAmB,CAAC,IAAI,CAC9D,IAAI,CACJ,EAAE,oEAAoE;QACtE,wBAAwB,CAAC,CAAC;IAC3B,gEAAgE;IAChE,yEAAyE;IACzE,mEAAmE;IACnE,6EAA6E;IAC7E,mFAAmF;IACnF,gEAAgE;IAChE,OAAO,CAAC,mCAAmC,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1E,aAAa,CAAC,IAAI,CACjB,IAAI,CACJ,EAAE,uEAAuE;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,8CAA8C;QAC9C,sEAAsE,CAAC,CAAC;IACzE,OAAO,CAAC,8BAA8B,EAAE,kFAAkF,CAAC,IAAI,CAC9H,IAAI,CACJ,EAAE,6DAA6D;QAC/D,sEAAsE,CAAC,CAAC;IACzE,6EAA6E;IAC7E,gFAAgF;IAChF,qCAAqC;IACrC,OAAO,CAAC,kCAAkC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CACzE,IAAI,CACJ,EAAE,qEAAqE;QACvE,2EAA2E;QAC3E,kDAAkD,CAAC,CAAC;IACrD,+EAA+E;IAC/E,+EAA+E;IAC/E,kFAAkF;IAClF,uEAAuE;IACvE,OAAO,CAAC,kCAAkC,EAAE,0EAA0E,CAAC,IAAI,CAC1H,IAAI,CACJ,EAAE,6EAA6E;QAC/E,4EAA4E;QAC5E,iBAAiB,CAAC,CAAC;IAEpB,gFAAgF;IAChF,6EAA6E;IAC7E,qFAAqF;IACrF,yEAAyE;IACzE,8EAA8E;IAC9E,+EAA+E;IAC/E,OAAO,CAAC,cAAc,EAAE,mDAAmD,CAAC,IAAI,CAC/E,IAAI,CACJ,EAAE,0EAA0E;QAC5E,uEAAuE;QACvE,yCAAyC,CAAC,CAAC;IAC5C,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,qCAAqC;IACrC,OAAO,CAAC,8BAA8B,EAAE,sEAAsE,CAAC,IAAI,CAClH,IAAI,CACJ,EAAE,yEAAyE;QAC3E,2EAA2E;QAC3E,iBAAiB,CAAC,CAAC;IACpB,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,OAAO,CAAC,sCAAsC,EAAE,CAAC,2CAA2C,CAAC,IAAI,CAChG,IAAI,CACJ,EAAE,yEAAyE;QAC3E,6EAA6E;QAC7E,uEAAuE;QACvE,QAAQ,CAAC,CAAC;IAEX,gFAAgF;IAChF,OAAO,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,IAAI,CACvD,IAAI,CACJ,EAAE,yDAAyD,CAAC,CAAC;IAE9D,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}

package/dist/advance-lifecycle-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"advance-lifecycle-template.d.ts","sourceRoot":"","sources":["../src/advance-lifecycle-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAG3D,6EAA6E;AAC7E,eAAO,MAAM,+BAA+B,sBAAsB,CAAC;AAEnE,oEAAoE;AACpE,eAAO,MAAM,kCAAkC,uJACsG,CAAC;AAEtJ,8EAA8E;AAC9E,eAAO,MAAM,+BAA+B,oCACV,CAAC;AAEnC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gCAAgC,CAC/C,MAAM,EAAE,gBAAgB,GACtB,MAAM,CA6aR;AAED,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACvC,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,8DAA8D;AAC9D,MAAM,WAAW,0BAA0B;IAC1C,kEAAkE;IAClE,EAAE,EAAE,OAAO,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,uBAAuB,EAAE,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC/C,IAAI,EAAE,MAAM,GACV,0BAA0B,CAsU5B"}
+{"version":3,"file":"advance-lifecycle-template.d.ts","sourceRoot":"","sources":["../src/advance-lifecycle-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAGH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAG3D,6EAA6E;AAC7E,eAAO,MAAM,+BAA+B,sBAAsB,CAAC;AAEnE,oEAAoE;AACpE,eAAO,MAAM,kCAAkC,uJACsG,CAAC;AAEtJ,8EAA8E;AAC9E,eAAO,MAAM,+BAA+B,oCACV,CAAC;AAEnC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gCAAgC,CAC/C,MAAM,EAAE,gBAAgB,GACtB,MAAM,CAsdR;AAED,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACvC,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,8DAA8D;AAC9D,MAAM,WAAW,0BAA0B;IAC1C,kEAAkE;IAClE,EAAE,EAAE,OAAO,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,uBAAuB,EAAE,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC/C,IAAI,EAAE,MAAM,GACV,0BAA0B,CAmV5B"}

package/dist/advance-lifecycle-template.js

@@ -59,6 +59,7 @@
  * parses + carries the right discipline" the task's acceptance criteria require;
  * the test generates this artifact under `--fake` and asserts every invariant.
  */
+import { ACTION_PINS, pinnedUses } from './install-ci-action-pins.js';
 import { providerSecretsWithBlock } from './install-ci-core.js';
 /** The capability id (the registry key + the emitted workflow file stem). */
 export const ADVANCE_LIFECYCLE_CAPABILITY_ID = 'advance-lifecycle';
@@ -286,7 +287,7 @@ jobs:
       # re-run, no baked-in YAML number.
       githubTimeout: \${{ steps.timeout.outputs.githubTimeout }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: ${pinnedUses(ACTION_PINS.checkout)}
         with:
           fetch-depth: 0
       - uses: ./.github/actions/dorfl-setup
@@ -296,13 +297,26 @@ jobs:
         # surfaceBlockers), so an override that does not reach this job produces an
         # empty matrix and is silently inert. \`if:\` + the inner \`[ -n ... ]\` guard
         # keep schedule/push (and a blank dispatch field) exporting NOTHING — an
-        # empty DORFL_* would make env-config coercion throw.
+        # empty DORFL_* would make env-config coercion throw. The inputs reach the
+        # shell through \`env:\` as DATA, never as \`\${{ }}\` text spliced into the
+        # script (GitHub's script-injection guidance), and the \`case\` guard stops a
+        # value from appending its own lines to $GITHUB_ENV. Both only matter if an
+        # input ever stops being a fixed \`type: choice\`; for the choices below the
+        # step writes exactly what it always did.
         if: \${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
+          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
+          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
+          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
         run: |
-          [ -n "\${{ github.event.inputs.autoBuild }}" ] && echo "DORFL_AUTO_BUILD=\${{ github.event.inputs.autoBuild }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.autoTask }}" ] && echo "DORFL_AUTO_TASK=\${{ github.event.inputs.autoTask }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.observationTriage }}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${{ github.event.inputs.observationTriage }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.surfaceBlockers }}" ] && echo "DORFL_SURFACE_BLOCKERS=\${{ github.event.inputs.surfaceBlockers }}" >> "$GITHUB_ENV"
+          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
+            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
+          esac
+          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
           true
       - id: scan
         # Enumerate eligible items as namespaced ids, one matrix leg per id. CI
@@ -383,7 +397,7 @@ jobs:
       matrix:
         item: \${{ fromJson(needs.enumerate.outputs.items) }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: ${pinnedUses(ACTION_PINS.checkout)}
         with:
           fetch-depth: 0
       - uses: ./.github/actions/dorfl-setup${setupWith}
@@ -392,11 +406,19 @@ jobs:
         # DORFL_* ONLY on a workflow_dispatch with a non-blank input, so the
         # one-shot override also reaches the \`advance\` leg that builds the item.
         if: \${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
+          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
+          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
+          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
         run: |
-          [ -n "\${{ github.event.inputs.autoBuild }}" ] && echo "DORFL_AUTO_BUILD=\${{ github.event.inputs.autoBuild }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.autoTask }}" ] && echo "DORFL_AUTO_TASK=\${{ github.event.inputs.autoTask }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.observationTriage }}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${{ github.event.inputs.observationTriage }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.surfaceBlockers }}" ] && echo "DORFL_SURFACE_BLOCKERS=\${{ github.event.inputs.surfaceBlockers }}" >> "$GITHUB_ENV"
+          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
+            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
+          esac
+          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
           true
       - name: advance one item in-place (propose ⇒ opens a PR)
         # In-place in this checkout (no --isolated/--remote): the CI container IS
@@ -411,13 +433,19 @@ jobs:
         # works zero-config; the job's \`pull-requests: write\` scopes that token.
         env:
           GH_TOKEN: \${{ secrets.DORFL_GH_TOKEN || secrets.GITHUB_TOKEN }}
+          # The item id is a slug read from work/ (frontmatter \`slug:\` or the
+          # file name). dorfl sanitises the slugs it mints, but a hand-written
+          # one is only checked when \`advance\` resolves it, so it reaches the
+          # shell as DATA through env, never as \`\${{ matrix.item }}\` text
+          # spliced into the script.
+          WORK_ITEM: \${{ matrix.item }}
         # \`--watch\` streams the build agent's high-signal turns (assistant text,
         # tool calls, finish) into THIS job log live, so the run shows the agent
         # working instead of freezing after "Start work". A read-only observer (no
         # outcome/gate/git effect). It fits because each matrix leg names ONE item
         # (one pi session to tail) — the merge job is now a per-item matrix too
         # (see below) and streams the same way.
-        run: dorfl advance "\${{ matrix.item }}" --propose --watch --arbiter origin
+        run: dorfl advance "\${WORK_ITEM}" --propose --watch --arbiter origin
 
   # ── MERGE: a MATRIX of independent jobs (parallel build/gate/review, serialised land) ──
   # SPEC \`land-time-reverify-and-parallel-merge-ceiling\` (stories 4 + 6): each item
@@ -448,7 +476,7 @@ jobs:
       matrix:
         item: \${{ fromJson(needs.enumerate.outputs.items) }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: ${pinnedUses(ACTION_PINS.checkout)}
         with:
           fetch-depth: 0
       - uses: ./.github/actions/dorfl-setup${setupWith}
@@ -458,11 +486,19 @@ jobs:
         # merge job re-scans the pool inside \`advance -n\`, so it needs the override
         # too for the lifecycle/task pools to reflect it.
         if: \${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
+          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
+          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
+          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
         run: |
-          [ -n "\${{ github.event.inputs.autoBuild }}" ] && echo "DORFL_AUTO_BUILD=\${{ github.event.inputs.autoBuild }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.autoTask }}" ] && echo "DORFL_AUTO_TASK=\${{ github.event.inputs.autoTask }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.observationTriage }}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${{ github.event.inputs.observationTriage }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.surfaceBlockers }}" ] && echo "DORFL_SURFACE_BLOCKERS=\${{ github.event.inputs.surfaceBlockers }}" >> "$GITHUB_ENV"
+          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
+            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
+          esac
+          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
           true
       - name: advance one item in-place (merge ⇒ rebase + CAS land on main)
         # In-place (no --isolated/--remote). \`--merge\` ties the integration mode
@@ -473,10 +509,16 @@ jobs:
         # \`GH_TOKEN\` from the env.
         env:
           GH_TOKEN: \${{ secrets.DORFL_GH_TOKEN || secrets.GITHUB_TOKEN }}
+          # The item id is a slug read from work/ (frontmatter \`slug:\` or the
+          # file name). dorfl sanitises the slugs it mints, but a hand-written
+          # one is only checked when \`advance\` resolves it, so it reaches the
+          # shell as DATA through env, never as \`\${{ matrix.item }}\` text
+          # spliced into the script.
+          WORK_ITEM: \${{ matrix.item }}
         # \`--watch\` streams the build agent's high-signal turns into THIS job
         # log live; each leg names ONE item, so it fits the same way it does on
         # the propose legs.
-        run: dorfl advance "\${{ matrix.item }}" --merge --watch --arbiter origin
+        run: dorfl advance "\${WORK_ITEM}" --merge --watch --arbiter origin
 
   # ── REAP merged remote work/* branches (capability F, the hygiene sweep) ─────
   # PRESERVED from the seed (NOT a separate gc-sweep workflow): the provider-
@@ -498,7 +540,7 @@ jobs:
     if: \${{ (github.event.inputs.sweepMergedBranches || 'true') == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: ${pinnedUses(ACTION_PINS.checkout)}
         with:
           fetch-depth: 0
       - uses: ./.github/actions/dorfl-setup
@@ -555,9 +597,15 @@ export function validateAdvanceLifecycleWorkflow(text) {
     require('propose-matrix', /strategy:\s*[\s\S]*?matrix:/.test(text), '`propose` mode must emit a MATRIX of jobs (`strategy.matrix`).');
     require('propose-enumerates-via-scan', /dorfl scan --json/.test(text), 'the matrix items must be ENUMERATED via the eligible-pool scan ' +
         '(`dorfl scan --json`).');
-    require('propose-one-advance-per-item', /dorfl advance "?\$\{\{\s*matrix\./.test(text), 'each matrix leg must run one `dorfl advance <matrix item>` ' +
-        '(one PR per item).');
-    require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--propose\b/.test(text), 'each `propose` matrix leg must pass `--propose` so the integration mode is ' +
+    require('propose-one-advance-per-item', /WORK_ITEM:\s*\$\{\{\s*matrix\.item\s*\}\}[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"/.test(text), 'each matrix leg must run one `dorfl advance <matrix item>` ' +
+        '(one PR per item), reading the item from the step env (`WORK_ITEM`).');
+    // The item id is a slug that may be hand-written (only minted slugs are
+    // sanitised), so it must reach the shell as DATA through `env:`, never as `${{ }}` text
+    // spliced into the `run:` script (GitHub Actions script injection).
+    require('matrix-item-not-spliced-into-run', !/dorfl advance "?\$\{\{/.test(operative), 'the matrix item must NOT be interpolated into the `run:` script as ' +
+        '`${{ matrix.item }}` (script injection): pass it through the step `env:` ' +
+        'as `WORK_ITEM` and quote it as `"${WORK_ITEM}"`.');
+    require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--propose\b/.test(text), 'each `propose` matrix leg must pass `--propose` so the integration mode is ' +
         'TIED to the matrix shape (a leg can never merge to main / desync from the ' +
         'dispatch mode).');
     // --- merge ⇒ a MATRIX per item (parallel build/gate/review, serialised land) -
@@ -567,7 +615,7 @@ export function validateAdvanceLifecycleWorkflow(text) {
     require('merge-matrix', /advance-merge:[\s\S]*?strategy:\s*[\s\S]*?matrix:/.test(text), 'the `merge` job must use a MATRIX (parallel build/gate/review per item; ' +
         "the land tail is serialised by the engine's `mergeRetries` CAS-retry " +
         "loop, not by the workflow's job shape).");
-    require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--merge\b/.test(text), 'each `merge` matrix leg must pass `--merge` so the integration mode is ' +
+    require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--merge\b/.test(text), 'each `merge` matrix leg must pass `--merge` so the integration mode is ' +
         'TIED to the matrix shape (a leg can never propose-only / desync from the ' +
         'dispatch mode).');
     // No host-specific cross-job serialiser on the merge job: a GitHub Actions
@@ -616,8 +664,13 @@ export function validateAdvanceLifecycleWorkflow(text) {
         ['observationTriage', 'DORFL_OBSERVATION_TRIAGE'],
         ['surfaceBlockers', 'DORFL_SURFACE_BLOCKERS'],
     ]) {
-        // The override is a guarded shell write: `[ -n <input> ] && echo <ENV>=<input> >> $GITHUB_ENV`.
-        const guardedWrite = new RegExp(`\\[ -n "\\$\\{\\{ github\\.event\\.inputs\\.${input} \\}\\}" \\][\\s\\S]*?${envVar}=`);
+        // The override is a guarded shell write of a step-env copy of the input:
+        // `env: DISPATCH_<X>: ${{ inputs.<x> }}` then
+        // `[ -n "${DISPATCH_<X>}" ] && echo "<ENV>=${DISPATCH_<X>}" >> $GITHUB_ENV`.
+        // The input never appears as `${{ }}` text inside the `run:` script.
+        const dispatchVar = envVar.replace(/^DORFL_/, 'DISPATCH_');
+        const guardedWrite = new RegExp(`${dispatchVar}:\\s*\\$\\{\\{ github\\.event\\.inputs\\.${input} \\}\\}` +
+            `[\\s\\S]*?\\[ -n "\\$\\{${dispatchVar}\\}" \\] && echo "${envVar}=\\$\\{${dispatchVar}\\}"`);
         require(`dispatch-${input}-guarded-write`, guardedWrite.test(text), `the \`${input}\` override must be a blank-guarded write of \`${envVar}\` ` +
             'to `$GITHUB_ENV` (blank dispatch input / schedule / push emit nothing).');
     }

package/dist/advance-lifecycle-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"advance-lifecycle-template.js","sourceRoot":"","sources":["../src/advance-lifecycle-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAGH,OAAO,EAAC,wBAAwB,EAAC,MAAM,sBAAsB,CAAC;AAE9D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,+BAA+B,GAAG,mBAAmB,CAAC;AAEnE,oEAAoE;AACpE,MAAM,CAAC,MAAM,kCAAkC,GAC9C,oJAAoJ,CAAC;AAEtJ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAC3C,iCAAiC,CAAC;AAEnC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gCAAgC,CAC/C,MAAwB;IAExB,wEAAwE;IACxE,8EAA8E;IAC9E,gFAAgF;IAChF,oEAAoE;IACpE,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAkSc,MAAM,CAAC,WAAW;;;;;;;6CAOK,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBA0DhC,MAAM,CAAC,WAAW;;;;;;;6CAOK,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4DrD,CAAC;AACF,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC/C,IAAY;IAEZ,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC,CAAC;IAEF,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,iFAAiF;IACjF,+EAA+E;IAC/E,MAAM,SAAS,GAAG,IAAI;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,CAChD,IAAI,CACJ,EAAE,2EAA2E,CAAC,CAAC;IAChF,OAAO,CAAC,kBAAkB,EAAE,CAAC,YAAY,CAAC,IAAI,CAC7C,SAAS,CACT,EAAE,6EAA6E;QAC/E,2CAA2C,CAAC,CAAC;IAE9C,gFAAgF;IAChF,OAAO,CAAC,cAAc,EAAE,iCAAiC,CAAC,IAAI,CAC7D,IAAI,CACJ,EAAE,yDAAyD,CAAC,CAAC;IAC9D,OAAO,CAAC,2BAA2B,EAAE,sBAAsB,CAAC,IAAI,CAC/D,IAAI,CACJ,EAAE,8DAA8D,CAAC,CAAC;IACnE,OAAO,CAAC,iCAAiC,EAAE,2DAA2D,CAAC,IAAI,CAC1G,IAAI,CACJ,EAAE,gEAAgE,CAAC,CAAC;IACrE,+EAA+E;IAC/E,8EAA8E;IAC9E,kEAAkE;IAClE,OAAO,CAAC,6BAA6B,EAAE,mDAAmD,CAAC,IAAI,CAC9F,IAAI,CACJ,EAAE,2EAA2E;QAC7E,4BAA4B,CAAC,CAAC;IAE/B,+EAA+E;IAC/E,OAAO,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QACjE,wCAAwC,CAAC,IAAI,CAC5C,IAAI,CACJ,EAAE,0EAA0E;QAC7E,kCAAkC,CAAC,CAAC;IAErC,+EAA+E;IAC/E,OAAO,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,IAAI,CAC3D,IAAI,CACJ,EAAE,gEAAgE,CAAC,CAAC;IACrE,OAAO,CAAC,6BAA6B,EAAE,mBAAmB,CAAC,IAAI,CAC9D,IAAI,CACJ,EAAE,iEAAiE;QACnE,wBAAwB,CAAC,CAAC;IAC3B,OAAO,CAAC,8BAA8B,EAAE,mCAAmC,CAAC,IAAI,CAC/E,IAAI,CACJ,EAAE,6DAA6D;QAC/D,oBAAoB,CAAC,CAAC;IACvB,OAAO,CAAC,kCAAkC,EAAE,8EAA8E,CAAC,IAAI,CAC9H,IAAI,CACJ,EAAE,6EAA6E;QAC/E,4EAA4E;QAC5E,iBAAiB,CAAC,CAAC;IAEpB,gFAAgF;IAChF,6EAA6E;IAC7E,mEAAmE;IACnE,yEAAyE;IACzE,OAAO,CAAC,cAAc,EAAE,mDAAmD,CAAC,IAAI,CAC/E,IAAI,CACJ,EAAE,0EAA0E;QAC5E,uEAAuE;QACvE,yCAAyC,CAAC,CAAC;IAC5C,OAAO,CAAC,8BAA8B,EAAE,0EAA0E,CAAC,IAAI,CACtH,IAAI,CACJ,EAAE,yEAAyE;QAC3E,2EAA2E;QAC3E,iBAAiB,CAAC,CAAC;IACpB,2EAA2E;IAC3E,+EAA+E;IAC/E,qEAAqE;IACrE,OAAO,CAAC,sCAAsC,EAAE,CAAC,2CAA2C,CAAC,IAAI,CAChG,IAAI,CACJ,EAAE,yEAAyE;QAC3E,6EAA6E;QAC7E,6EAA6E,CAAC,CAAC;IAEhF,wEAAwE;IACxE,+EAA+E;IAC/E,iFAAiF;IACjF,gFAAgF;IAChF,+DAA+D;IAC/D,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,gFAAgF;IAChF,gEAAgE;IAChE,OAAO,CAAC,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAC7D,SAAS,CACT,EAAE,mEAAmE;QACrE,0FAA0F,CAAC,CAAC;IAC7F,OAAO,CAAC,uBAAuB,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAC3D,SAAS,CACT,EAAE,kEAAkE;QACpE,0FAA0F,CAAC,CAAC;IAC7F,OAAO,CAAC,gCAAgC,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAC7E,SAAS,CACT,EAAE,gEAAgE;QAClE,yFAAyF,CAAC,CAAC;IAC5F,OAAO,CAAC,8BAA8B,EAAE,CAAC,4BAA4B,CAAC,IAAI,CACzE,SAAS,CACT,EAAE,8DAA8D;QAChE,yFAAyF,CAAC,CAAC;IAC5F,+EAA+E;IAC/E,gFAAgF;IAChF,oEAAoE;IACpE,gFAAgF;IAChF,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,6EAA6E;IAC7E,KAAK,MAAM,KAAK,IAAI;QACnB,WAAW;QACX,UAAU;QACV,mBAAmB;QACnB,iBAAiB;KACjB,EAAE,CAAC;QACH,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,IAAI,MAAM,CAC5C,mDAAmD,KAAK,GAAG,CAC3D,CAAC,IAAI,CACL,IAAI,CACJ,EAAE,4CAA4C,KAAK,yBAAyB,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI;QAC7B,CAAC,WAAW,EAAE,kBAAkB,CAAC;QACjC,CAAC,UAAU,EAAE,iBAAiB,CAAC;QAC/B,CAAC,mBAAmB,EAAE,0BAA0B,CAAC;QACjD,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;KACpC,EAAE,CAAC;QACZ,gGAAgG;QAChG,MAAM,YAAY,GAAG,IAAI,MAAM,CAC9B,+CAA+C,KAAK,yBAAyB,MAAM,GAAG,CACtF,CAAC;QACF,OAAO,CAAC,YAAY,KAAK,gBAAgB,EAAE,YAAY,CAAC,IAAI,CAC3D,IAAI,CACJ,EAAE,SAAS,KAAK,kDAAkD,MAAM,KAAK;YAC7E,yEAAyE,CAAC,CAAC;IAC7E,CAAC;IACD,8EAA8E;IAC9E,iFAAiF;IACjF,OAAO,CAAC,iCAAiC,EAAE,6DAA6D,CAAC,IAAI,CAC5G,IAAI,CACJ,EAAE,8EAA8E;QAChF,sEAAsE;QACtE,2DAA2D,CAAC,CAAC;IAC9D,+EAA+E;IAC/E,wCAAwC;IACxC,OAAO,CAAC,gCAAgC,EAAE,iEAAiE,CAAC,IAAI,CAC/G,IAAI,CACJ,EAAE,sEAAsE;QACxE,6DAA6D,CAAC,CAAC;IAEhE,gFAAgF;IAChF,OAAO,CAAC,sBAAsB,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC;QACtE,CAAC,aAAa,CAAC,IAAI,CAClB,SAAS,CACT,EAAE,yEAAyE;QAC5E,iEAAiE,CAAC,CAAC;IAEpE,+EAA+E;IAC/E,OAAO,CAAC,0BAA0B,EAAE,uBAAuB,CAAC,IAAI,CAC/D,IAAI,CACJ,EAAE,wEAAwE;QAC1E,0BAA0B,CAAC,CAAC;IAC7B,OAAO,CAAC,8BAA8B,EAAE,8BAA8B,CAAC,IAAI,CAC1E,IAAI,CACJ,EAAE,mEAAmE;QACrE,gCAAgC,CAAC,CAAC;IACnC,OAAO,CAAC,2BAA2B,EAAE,sBAAsB,CAAC,IAAI,CAC/D,IAAI,CACJ,EAAE,2EAA2E;QAC7E,YAAY,CAAC,CAAC;IACf,gCAAgC;IAChC,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,8EAA8E;IAC9E,8EAA8E;IAC9E,2CAA2C;IAC3C,OAAO,CAAC,8BAA8B,EAAE,wDAAwD,CAAC,IAAI,CACpG,IAAI,CACJ,EAAE,6DAA6D;QAC/D,8EAA8E;QAC9E,oEAAoE,CAAC,CAAC;IACvE,OAAO,CAAC,4BAA4B,EAAE,8CAA8C,CAAC,IAAI,CACxF,IAAI,CACJ,EAAE,sEAAsE;QACxE,2EAA2E;QAC3E,gEAAgE,CAAC,CAAC;IAEnE,8EAA8E;IAC9E,OAAO,CAAC,kBAAkB,EAAE,CAAC,cAAc,CAAC,IAAI,CAC/C,SAAS,CACT,EAAE,0EAA0E,CAAC,CAAC;IAC/E,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,OAAO,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAClD,SAAS,CACT,EAAE,gEAAgE,CAAC,CAAC;IAErE,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,IAAI,CAClE,IAAI,CACJ,EAAE,yEAAyE,CAAC,CAAC;IAE9E,+EAA+E;IAC/E,OAAO,CAAC,yBAAyB,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAChE,IAAI,CACJ,EAAE,wEAAwE;QAC1E,gEAAgE,CAAC,CAAC;IACnE,OAAO,CAAC,kCAAkC,EAAE,CAAC,uBAAuB,CAAC,IAAI,CACxE,SAAS,CACT,EAAE,+DAA+D,CAAC,CAAC;IAEpE,8EAA8E;IAC9E,OAAO,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7D,OAAO,CAAC,IAAI,CACX,IAAI,CACJ,EAAE,sEAAsE;QACzE,oCAAoC,CAAC,CAAC;IAEvC,6EAA6E;IAC7E,yEAAyE;IACzE,oEAAoE;IACpE,+EAA+E;IAC/E,2EAA2E;IAC3E,6EAA6E;IAC7E,OAAO,CAAC,mCAAmC,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1E,aAAa,CAAC,IAAI,CACjB,IAAI,CACJ,EAAE,uEAAuE;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,uDAAuD;QACvD,sEAAsE,CAAC,CAAC;IAEzE,+EAA+E;IAC/E,2EAA2E;IAC3E,qEAAqE;IACrE,gFAAgF;IAChF,gFAAgF;IAChF,uEAAuE;IACvE,+EAA+E;IAC/E,+EAA+E;IAC/E,4DAA4D;IAC5D,OAAO,CAAC,oCAAoC,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1E,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QACpC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;QACrC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,8BAA8B,CAAC,IAAI,CAClC,IAAI,CACJ,EAAE,4EAA4E;QAC/E,4DAA4D;QAC5D,gEAAgE;QAChE,6EAA6E;QAC7E,8DAA8D;QAC9D,4EAA4E;QAC5E,yBAAyB;QACzB,mDAAmD,CAAC,CAAC;IAEtD,+EAA+E;IAC/E,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,sDAAsD;IACtD,OAAO,CAAC,uCAAuC,EAAE,kDAAkD,CAAC,IAAI,CACvG,IAAI,CACJ,EAAE,0EAA0E;QAC5E,qCAAqC;QACrC,sDAAsD,CAAC,CAAC;IACzD,OAAO,CAAC,mCAAmC,EAAE,qBAAqB,CAAC,IAAI,CACtE,IAAI,CACJ,EAAE,yDAAyD;QAC3D,gEAAgE;QAChE,4DAA4D,CAAC,CAAC;IAC/D,OAAO,CAAC,2CAA2C,EAAE,mDAAmD,CAAC,IAAI,CAC5G,IAAI,CACJ,EAAE,sDAAsD;QACxD,sEAAsE;QACtE,sDAAsD,CAAC,CAAC;IACzD,OAAO,CAAC,qCAAqC,EAAE,iHAAiH,CAAC,IAAI,CACpK,IAAI,CACJ,EAAE,2DAA2D;QAC7D,0EAA0E;QAC1E,mEAAmE,CAAC,CAAC;IACtE,OAAO,CAAC,mCAAmC,EAAE,+GAA+G,CAAC,IAAI,CAChK,IAAI,CACJ,EAAE,yDAAyD;QAC3D,0EAA0E;QAC1E,4CAA4C,CAAC,CAAC;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,kEAAkE;IAClE,OAAO,CAAC,6BAA6B,EAAE,CAAC,iEAAiE,CAAC,IAAI,CAC7G,IAAI,CACJ,EAAE,gEAAgE;QAClE,mEAAmE;QACnE,+CAA+C,CAAC,CAAC;IAElD,8EAA8E;IAC9E,OAAO,CAAC,0BAA0B,EAAE,8CAA8C,CAAC,IAAI,CACtF,IAAI,CACJ,EAAE,wDAAwD;QAC1D,8DAA8D,CAAC,CAAC;IAEjE,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"advance-lifecycle-template.js","sourceRoot":"","sources":["../src/advance-lifecycle-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EAAC,WAAW,EAAE,UAAU,EAAC,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAC,wBAAwB,EAAC,MAAM,sBAAsB,CAAC;AAE9D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,+BAA+B,GAAG,mBAAmB,CAAC;AAEnE,oEAAoE;AACpE,MAAM,CAAC,MAAM,kCAAkC,GAC9C,oJAAoJ,CAAC;AAEtJ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAC3C,iCAAiC,CAAC;AAEnC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gCAAgC,CAC/C,MAAwB;IAExB,wEAAwE;IACxE,8EAA8E;IAC9E,gFAAgF;IAChF,oEAAoE;IACpE,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAqMQ,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBA0G1B,MAAM,CAAC,WAAW;;;;gBAIxB,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC;;;6CAGH,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAwEhC,MAAM,CAAC,WAAW;;;;gBAIxB,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC;;;6CAGH,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA6DtC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC;;;;;;;;;;;;;CAa/C,CAAC;AACF,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC/C,IAAY;IAEZ,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC,CAAC;IAEF,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,iFAAiF;IACjF,+EAA+E;IAC/E,MAAM,SAAS,GAAG,IAAI;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,CAChD,IAAI,CACJ,EAAE,2EAA2E,CAAC,CAAC;IAChF,OAAO,CAAC,kBAAkB,EAAE,CAAC,YAAY,CAAC,IAAI,CAC7C,SAAS,CACT,EAAE,6EAA6E;QAC/E,2CAA2C,CAAC,CAAC;IAE9C,gFAAgF;IAChF,OAAO,CAAC,cAAc,EAAE,iCAAiC,CAAC,IAAI,CAC7D,IAAI,CACJ,EAAE,yDAAyD,CAAC,CAAC;IAC9D,OAAO,CAAC,2BAA2B,EAAE,sBAAsB,CAAC,IAAI,CAC/D,IAAI,CACJ,EAAE,8DAA8D,CAAC,CAAC;IACnE,OAAO,CAAC,iCAAiC,EAAE,2DAA2D,CAAC,IAAI,CAC1G,IAAI,CACJ,EAAE,gEAAgE,CAAC,CAAC;IACrE,+EAA+E;IAC/E,8EAA8E;IAC9E,kEAAkE;IAClE,OAAO,CAAC,6BAA6B,EAAE,mDAAmD,CAAC,IAAI,CAC9F,IAAI,CACJ,EAAE,2EAA2E;QAC7E,4BAA4B,CAAC,CAAC;IAE/B,+EAA+E;IAC/E,OAAO,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QACjE,wCAAwC,CAAC,IAAI,CAC5C,IAAI,CACJ,EAAE,0EAA0E;QAC7E,kCAAkC,CAAC,CAAC;IAErC,+EAA+E;IAC/E,OAAO,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,IAAI,CAC3D,IAAI,CACJ,EAAE,gEAAgE,CAAC,CAAC;IACrE,OAAO,CAAC,6BAA6B,EAAE,mBAAmB,CAAC,IAAI,CAC9D,IAAI,CACJ,EAAE,iEAAiE;QACnE,wBAAwB,CAAC,CAAC;IAC3B,OAAO,CAAC,8BAA8B,EAAE,kFAAkF,CAAC,IAAI,CAC9H,IAAI,CACJ,EAAE,6DAA6D;QAC/D,sEAAsE,CAAC,CAAC;IACzE,wEAAwE;IACxE,wFAAwF;IACxF,oEAAoE;IACpE,OAAO,CAAC,kCAAkC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CACzE,SAAS,CACT,EAAE,qEAAqE;QACvE,2EAA2E;QAC3E,kDAAkD,CAAC,CAAC;IACrD,OAAO,CAAC,kCAAkC,EAAE,0EAA0E,CAAC,IAAI,CAC1H,IAAI,CACJ,EAAE,6EAA6E;QAC/E,4EAA4E;QAC5E,iBAAiB,CAAC,CAAC;IAEpB,gFAAgF;IAChF,6EAA6E;IAC7E,mEAAmE;IACnE,yEAAyE;IACzE,OAAO,CAAC,cAAc,EAAE,mDAAmD,CAAC,IAAI,CAC/E,IAAI,CACJ,EAAE,0EAA0E;QAC5E,uEAAuE;QACvE,yCAAyC,CAAC,CAAC;IAC5C,OAAO,CAAC,8BAA8B,EAAE,sEAAsE,CAAC,IAAI,CAClH,IAAI,CACJ,EAAE,yEAAyE;QAC3E,2EAA2E;QAC3E,iBAAiB,CAAC,CAAC;IACpB,2EAA2E;IAC3E,+EAA+E;IAC/E,qEAAqE;IACrE,OAAO,CAAC,sCAAsC,EAAE,CAAC,2CAA2C,CAAC,IAAI,CAChG,IAAI,CACJ,EAAE,yEAAyE;QAC3E,6EAA6E;QAC7E,6EAA6E,CAAC,CAAC;IAEhF,wEAAwE;IACxE,+EAA+E;IAC/E,iFAAiF;IACjF,gFAAgF;IAChF,+DAA+D;IAC/D,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,gFAAgF;IAChF,gEAAgE;IAChE,OAAO,CAAC,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAC7D,SAAS,CACT,EAAE,mEAAmE;QACrE,0FAA0F,CAAC,CAAC;IAC7F,OAAO,CAAC,uBAAuB,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAC3D,SAAS,CACT,EAAE,kEAAkE;QACpE,0FAA0F,CAAC,CAAC;IAC7F,OAAO,CAAC,gCAAgC,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAC7E,SAAS,CACT,EAAE,gEAAgE;QAClE,yFAAyF,CAAC,CAAC;IAC5F,OAAO,CAAC,8BAA8B,EAAE,CAAC,4BAA4B,CAAC,IAAI,CACzE,SAAS,CACT,EAAE,8DAA8D;QAChE,yFAAyF,CAAC,CAAC;IAC5F,+EAA+E;IAC/E,gFAAgF;IAChF,oEAAoE;IACpE,gFAAgF;IAChF,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,6EAA6E;IAC7E,KAAK,MAAM,KAAK,IAAI;QACnB,WAAW;QACX,UAAU;QACV,mBAAmB;QACnB,iBAAiB;KACjB,EAAE,CAAC;QACH,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,IAAI,MAAM,CAC5C,mDAAmD,KAAK,GAAG,CAC3D,CAAC,IAAI,CACL,IAAI,CACJ,EAAE,4CAA4C,KAAK,yBAAyB,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI;QAC7B,CAAC,WAAW,EAAE,kBAAkB,CAAC;QACjC,CAAC,UAAU,EAAE,iBAAiB,CAAC;QAC/B,CAAC,mBAAmB,EAAE,0BAA0B,CAAC;QACjD,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;KACpC,EAAE,CAAC;QACZ,yEAAyE;QACzE,8CAA8C;QAC9C,6EAA6E;QAC7E,qEAAqE;QACrE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,IAAI,MAAM,CAC9B,GAAG,WAAW,4CAA4C,KAAK,SAAS;YACvE,2BAA2B,WAAW,qBAAqB,MAAM,UAAU,WAAW,MAAM,CAC7F,CAAC;QACF,OAAO,CAAC,YAAY,KAAK,gBAAgB,EAAE,YAAY,CAAC,IAAI,CAC3D,IAAI,CACJ,EAAE,SAAS,KAAK,kDAAkD,MAAM,KAAK;YAC7E,yEAAyE,CAAC,CAAC;IAC7E,CAAC;IACD,8EAA8E;IAC9E,iFAAiF;IACjF,OAAO,CAAC,iCAAiC,EAAE,6DAA6D,CAAC,IAAI,CAC5G,IAAI,CACJ,EAAE,8EAA8E;QAChF,sEAAsE;QACtE,2DAA2D,CAAC,CAAC;IAC9D,+EAA+E;IAC/E,wCAAwC;IACxC,OAAO,CAAC,gCAAgC,EAAE,iEAAiE,CAAC,IAAI,CAC/G,IAAI,CACJ,EAAE,sEAAsE;QACxE,6DAA6D,CAAC,CAAC;IAEhE,gFAAgF;IAChF,OAAO,CAAC,sBAAsB,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC;QACtE,CAAC,aAAa,CAAC,IAAI,CAClB,SAAS,CACT,EAAE,yEAAyE;QAC5E,iEAAiE,CAAC,CAAC;IAEpE,+EAA+E;IAC/E,OAAO,CAAC,0BAA0B,EAAE,uBAAuB,CAAC,IAAI,CAC/D,IAAI,CACJ,EAAE,wEAAwE;QAC1E,0BAA0B,CAAC,CAAC;IAC7B,OAAO,CAAC,8BAA8B,EAAE,8BAA8B,CAAC,IAAI,CAC1E,IAAI,CACJ,EAAE,mEAAmE;QACrE,gCAAgC,CAAC,CAAC;IACnC,OAAO,CAAC,2BAA2B,EAAE,sBAAsB,CAAC,IAAI,CAC/D,IAAI,CACJ,EAAE,2EAA2E;QAC7E,YAAY,CAAC,CAAC;IACf,gCAAgC;IAChC,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,8EAA8E;IAC9E,8EAA8E;IAC9E,2CAA2C;IAC3C,OAAO,CAAC,8BAA8B,EAAE,wDAAwD,CAAC,IAAI,CACpG,IAAI,CACJ,EAAE,6DAA6D;QAC/D,8EAA8E;QAC9E,oEAAoE,CAAC,CAAC;IACvE,OAAO,CAAC,4BAA4B,EAAE,8CAA8C,CAAC,IAAI,CACxF,IAAI,CACJ,EAAE,sEAAsE;QACxE,2EAA2E;QAC3E,gEAAgE,CAAC,CAAC;IAEnE,8EAA8E;IAC9E,OAAO,CAAC,kBAAkB,EAAE,CAAC,cAAc,CAAC,IAAI,CAC/C,SAAS,CACT,EAAE,0EAA0E,CAAC,CAAC;IAC/E,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,OAAO,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAClD,SAAS,CACT,EAAE,gEAAgE,CAAC,CAAC;IAErE,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,IAAI,CAClE,IAAI,CACJ,EAAE,yEAAyE,CAAC,CAAC;IAE9E,+EAA+E;IAC/E,OAAO,CAAC,yBAAyB,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAChE,IAAI,CACJ,EAAE,wEAAwE;QAC1E,gEAAgE,CAAC,CAAC;IACnE,OAAO,CAAC,kCAAkC,EAAE,CAAC,uBAAuB,CAAC,IAAI,CACxE,SAAS,CACT,EAAE,+DAA+D,CAAC,CAAC;IAEpE,8EAA8E;IAC9E,OAAO,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7D,OAAO,CAAC,IAAI,CACX,IAAI,CACJ,EAAE,sEAAsE;QACzE,oCAAoC,CAAC,CAAC;IAEvC,6EAA6E;IAC7E,yEAAyE;IACzE,oEAAoE;IACpE,+EAA+E;IAC/E,2EAA2E;IAC3E,6EAA6E;IAC7E,OAAO,CAAC,mCAAmC,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1E,aAAa,CAAC,IAAI,CACjB,IAAI,CACJ,EAAE,uEAAuE;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,uDAAuD;QACvD,sEAAsE,CAAC,CAAC;IAEzE,+EAA+E;IAC/E,2EAA2E;IAC3E,qEAAqE;IACrE,gFAAgF;IAChF,gFAAgF;IAChF,uEAAuE;IACvE,+EAA+E;IAC/E,+EAA+E;IAC/E,4DAA4D;IAC5D,OAAO,CAAC,oCAAoC,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1E,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QACpC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;QACrC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,8BAA8B,CAAC,IAAI,CAClC,IAAI,CACJ,EAAE,4EAA4E;QAC/E,4DAA4D;QAC5D,gEAAgE;QAChE,6EAA6E;QAC7E,8DAA8D;QAC9D,4EAA4E;QAC5E,yBAAyB;QACzB,mDAAmD,CAAC,CAAC;IAEtD,+EAA+E;IAC/E,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,sDAAsD;IACtD,OAAO,CAAC,uCAAuC,EAAE,kDAAkD,CAAC,IAAI,CACvG,IAAI,CACJ,EAAE,0EAA0E;QAC5E,qCAAqC;QACrC,sDAAsD,CAAC,CAAC;IACzD,OAAO,CAAC,mCAAmC,EAAE,qBAAqB,CAAC,IAAI,CACtE,IAAI,CACJ,EAAE,yDAAyD;QAC3D,gEAAgE;QAChE,4DAA4D,CAAC,CAAC;IAC/D,OAAO,CAAC,2CAA2C,EAAE,mDAAmD,CAAC,IAAI,CAC5G,IAAI,CACJ,EAAE,sDAAsD;QACxD,sEAAsE;QACtE,sDAAsD,CAAC,CAAC;IACzD,OAAO,CAAC,qCAAqC,EAAE,iHAAiH,CAAC,IAAI,CACpK,IAAI,CACJ,EAAE,2DAA2D;QAC7D,0EAA0E;QAC1E,mEAAmE,CAAC,CAAC;IACtE,OAAO,CAAC,mCAAmC,EAAE,+GAA+G,CAAC,IAAI,CAChK,IAAI,CACJ,EAAE,yDAAyD;QAC3D,0EAA0E;QAC1E,4CAA4C,CAAC,CAAC;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,kEAAkE;IAClE,OAAO,CAAC,6BAA6B,EAAE,CAAC,iEAAiE,CAAC,IAAI,CAC7G,IAAI,CACJ,EAAE,gEAAgE;QAClE,mEAAmE;QACnE,+CAA+C,CAAC,CAAC;IAElD,8EAA8E;IAC9E,OAAO,CAAC,0BAA0B,EAAE,8CAA8C,CAAC,IAAI,CACtF,IAAI,CACJ,EAAE,wDAAwD;QAC1D,8DAA8D,CAAC,CAAC;IAEjE,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}

package/dist/cli.js

@@ -581,8 +581,8 @@ export function formatSyncReport(result, dryRun) {
  * it prints the error to stderr and exits 1 (the task-only commands never act on
  * a spec). An OMITTED slug (`start`/`complete`/`prompt` infer it from the branch)
  * passes through untouched. (The legacy ''prd:'' prefix is a DEAD namespace token
- * after the hard cutover — it is neither special-cased nor rejected here; a
- * ''prd:<slug>'' arg resolves as a bare literal task slug.)
+ * after the hard cutover: it is not special-cased here; a ''prd:<slug>'' arg
+ * is refused by the shared safe-slug check, since `:` is not a slug character.)
  *
  * `do` is the ONE command that spans both namespaces; it consumes the full
  * `resolveSlug` (with the cross-namespace collision check) in the `do-in-place`

package/dist/close-job-template.d.ts

@@ -46,7 +46,7 @@ export declare const CLOSE_JOB_WORKFLOW_PATH = "workflows/close-job.yml";
  * and future per-config wiring, but the close-job shape itself is
  * config-independent.
  */
-export declare function generateCloseJobWorkflow(_config: ResolvedCIConfig): string;
+export declare function generateCloseJobWorkflow(config: ResolvedCIConfig): string;
 /** A single structural problem found in the generated workflow. */
 export interface CloseJobProblem {
     /** A short, stable id for the violated invariant (for tests/assertions). */

package/dist/close-job-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"close-job-template.d.ts","sourceRoot":"","sources":["../src/close-job-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAE3D,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,2EACkC,CAAC;AAE1E,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAuE1E;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC/B,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,EAAE,EAAE,OAAO,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAuFzE"}
+{"version":3,"file":"close-job-template.d.ts","sourceRoot":"","sources":["../src/close-job-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAG3D,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,2EACkC,CAAC;AAE1E,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAmFzE;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC/B,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,EAAE,EAAE,OAAO,CAAC;IACZ,iDAAiD;IACjD,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAuFzE"}

package/dist/close-job-template.js

@@ -32,6 +32,8 @@
  * parses + carries the right discipline" the task's acceptance criteria require;
  * the test generates this artifact under `--fake` and asserts every invariant.
  */
+import { ACTION_PINS, pinnedUses } from './install-ci-action-pins.js';
+import { shouldDropCheckoutCredentials } from './install-ci-core.js';
 /** The capability id (the registry key + the emitted workflow file stem). */
 export const CLOSE_JOB_CAPABILITY_ID = 'close-job';
 /** The wizard-facing label for the close-job capability. */
@@ -45,7 +47,19 @@ export const CLOSE_JOB_WORKFLOW_PATH = 'workflows/close-job.yml';
  * and future per-config wiring, but the close-job shape itself is
  * config-independent.
  */
-export function generateCloseJobWorkflow(_config) {
+export function generateCloseJobWorkflow(config) {
+    // `persist-credentials: false` ONLY on a repo KNOWN to be public (see
+    // {@link shouldDropCheckoutCredentials}): this job has `contents: read`, so
+    // the persisted token can only ever read, and on a public repo reads need
+    // no token. Unknown / private / internal ⇒ today's checkout, unchanged.
+    const checkoutCredentials = shouldDropCheckoutCredentials(config)
+        ? `
+          # Public repository: every git read works without a token, and this
+          # job cannot push, so do not leave the token in .git/config for later
+          # steps (the setup action, including any project-setup hook, and
+          # close-merged-issues) to read.
+          persist-credentials: false`
+        : '';
     return `\
 # dorfl — the ISSUE CLOSE-JOB in CI (capability E, spec runner-in-ci).
 # EMITTED by \`dorfl install-ci\`; the human commits it. DO NOT hand-edit a
@@ -103,9 +117,9 @@ jobs:
   close-merged-issues:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: ${pinnedUses(ACTION_PINS.checkout)}
         with:
-          fetch-depth: 0
+          fetch-depth: 0${checkoutCredentials}
       - uses: ./.github/actions/dorfl-setup
       - name: close issues whose work has landed on main
         # In-place in this checkout (no --isolated/--remote): the CI container IS

package/dist/close-job-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"close-job-template.js","sourceRoot":"","sources":["../src/close-job-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAEnD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,0BAA0B,GACtC,wEAAwE,CAAC;AAE1E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAyB;IACjE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqEP,CAAC;AACF,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACpD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC,CAAC;IAEF,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,wEAAwE;IACxE,MAAM,SAAS,GAAG,IAAI;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB,EAAE,gEAAgE,CAAC,IAAI,CACjG,IAAI,CACJ,EAAE,4EAA4E;QAC9E,0EAA0E,CAAC,CAAC;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,OAAO,CAAC,0BAA0B,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAC1D,SAAS,CACT,EAAE,4EAA4E;QAC9E,2DAA2D,CAAC,CAAC;IAC9D,+EAA+E;IAC/E,qDAAqD;IACrD,OAAO,CAAC,iBAAiB,EAAE,CAAC,iCAAiC,CAAC,IAAI,CACjE,SAAS,CACT,EAAE,6EAA6E,CAAC,CAAC;IAClF,OAAO,CAAC,6BAA6B,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAC/D,IAAI,CACJ,EAAE,0EAA0E;QAC5E,+CAA+C,CAAC,CAAC;IAElD,+EAA+E;IAC/E,6EAA6E;IAC7E,8DAA8D;IAC9D,OAAO,CAAC,6BAA6B,EAAE,6BAA6B,CAAC,IAAI,CACxE,SAAS,CACT,EAAE,qEAAqE;QACvE,qDAAqD,CAAC,CAAC;IACxD,+EAA+E;IAC/E,+DAA+D;IAC/D,OAAO,CAAC,0BAA0B,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAC3D,SAAS,CACT,EAAE,sEAAsE;QACxE,uDAAuD,CAAC,CAAC;IAC1D,2EAA2E;IAC3E,OAAO,CAAC,gBAAgB,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAC9D,SAAS,CACT,EAAE,yEAAyE;QAC3E,qDAAqD,CAAC,CAAC;IAExD,8EAA8E;IAC9E,OAAO,CAAC,kBAAkB,EAAE,CAAC,cAAc,CAAC,IAAI,CAC/C,SAAS,CACT,EAAE,0EAA0E,CAAC,CAAC;IAC/E,OAAO,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC,IAAI,CAC3C,SAAS,CACT,EAAE,gEAAgE,CAAC,CAAC;IAErE,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,IAAI,CAClE,IAAI,CACJ,EAAE,+EAA+E,CAAC,CAAC;IAEpF,+EAA+E;IAC/E,OAAO,CAAC,yBAAyB,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAChE,IAAI,CACJ,EAAE,wEAAwE;QAC1E,gEAAgE,CAAC,CAAC;IACnE,OAAO,CAAC,kCAAkC,EAAE,CAAC,uBAAuB,CAAC,IAAI,CACxE,SAAS,CACT,EAAE,+DAA+D,CAAC,CAAC;IACpE,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,OAAO,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,IAAI,CAC5D,SAAS,CACT,EAAE,8EAA8E,CAAC,CAAC;IAEnF,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"close-job-template.js","sourceRoot":"","sources":["../src/close-job-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAC,WAAW,EAAE,UAAU,EAAC,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAC,6BAA6B,EAAC,MAAM,sBAAsB,CAAC;AAEnE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAEnD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,0BAA0B,GACtC,wEAAwE,CAAC;AAE1E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAwB;IAChE,sEAAsE;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,MAAM,CAAC;QAChE,CAAC,CAAC;;;;;qCAKiC;QACnC,CAAC,CAAC,EAAE,CAAC;IACN,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAyDQ,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC;;0BAEtB,mBAAmB;;;;;;;;;;CAU5C,CAAC;AACF,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACpD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC,CAAC;IAEF,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,wEAAwE;IACxE,MAAM,SAAS,GAAG,IAAI;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB,EAAE,gEAAgE,CAAC,IAAI,CACjG,IAAI,CACJ,EAAE,4EAA4E;QAC9E,0EAA0E,CAAC,CAAC;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,OAAO,CAAC,0BAA0B,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAC1D,SAAS,CACT,EAAE,4EAA4E;QAC9E,2DAA2D,CAAC,CAAC;IAC9D,+EAA+E;IAC/E,qDAAqD;IACrD,OAAO,CAAC,iBAAiB,EAAE,CAAC,iCAAiC,CAAC,IAAI,CACjE,SAAS,CACT,EAAE,6EAA6E,CAAC,CAAC;IAClF,OAAO,CAAC,6BAA6B,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAC/D,IAAI,CACJ,EAAE,0EAA0E;QAC5E,+CAA+C,CAAC,CAAC;IAElD,+EAA+E;IAC/E,6EAA6E;IAC7E,8DAA8D;IAC9D,OAAO,CAAC,6BAA6B,EAAE,6BAA6B,CAAC,IAAI,CACxE,SAAS,CACT,EAAE,qEAAqE;QACvE,qDAAqD,CAAC,CAAC;IACxD,+EAA+E;IAC/E,+DAA+D;IAC/D,OAAO,CAAC,0BAA0B,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAC3D,SAAS,CACT,EAAE,sEAAsE;QACxE,uDAAuD,CAAC,CAAC;IAC1D,2EAA2E;IAC3E,OAAO,CAAC,gBAAgB,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAC9D,SAAS,CACT,EAAE,yEAAyE;QAC3E,qDAAqD,CAAC,CAAC;IAExD,8EAA8E;IAC9E,OAAO,CAAC,kBAAkB,EAAE,CAAC,cAAc,CAAC,IAAI,CAC/C,SAAS,CACT,EAAE,0EAA0E,CAAC,CAAC;IAC/E,OAAO,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC,IAAI,CAC3C,SAAS,CACT,EAAE,gEAAgE,CAAC,CAAC;IAErE,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,IAAI,CAClE,IAAI,CACJ,EAAE,+EAA+E,CAAC,CAAC;IAEpF,+EAA+E;IAC/E,OAAO,CAAC,yBAAyB,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAChE,IAAI,CACJ,EAAE,wEAAwE;QAC1E,gEAAgE,CAAC,CAAC;IACnE,OAAO,CAAC,kCAAkC,EAAE,CAAC,uBAAuB,CAAC,IAAI,CACxE,SAAS,CACT,EAAE,+DAA+D,CAAC,CAAC;IACpE,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,OAAO,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,IAAI,CAC5D,SAAS,CACT,EAAE,8EAA8E,CAAC,CAAC;IAEnF,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}

package/dist/install-ci-action-pins.d.ts

@@ -0,0 +1,98 @@
+/**
+ * The ONE table of third-party GitHub Actions that `dorfl install-ci` emits,
+ * each pinned to a full 40-character commit SHA, plus the regeneration rule that
+ * keeps a consumer repository's own pins.
+ *
+ * WHY SHAS. A tag such as `@v5` can be moved by whoever controls the action's
+ * repository, so a compromised or careless release reaches every job that uses
+ * it, including dorfl's jobs that hold `contents: write` and a provider API key.
+ * A commit SHA cannot move. This is GitHub's own hardening guidance ("Using
+ * third-party actions", Security hardening for GitHub Actions).
+ *
+ * THE FORMAT. Every reference is emitted as `owner/repo@<40-hex-sha> # vX.Y.Z`,
+ * the exact shape Dependabot writes and rewrites, so a consumer that enables
+ * Dependabot's `github-actions` ecosystem (with `/.github/actions/*` in
+ * `directories` for the composite action) gets reviewable bump PRs.
+ *
+ * HOW EACH SHA WAS RESOLVED (2026-09-26). For each tag:
+ *   1. `git ls-remote --tags https://github.com/<owner>/<repo>.git`, reading the
+ *      peeled `refs/tags/<tag>^{}` line when the tag is annotated (that line is
+ *      the COMMIT; the unpeeled line is the tag OBJECT and must never be used),
+ *      else the tag line itself for a lightweight tag;
+ *   2. cross-checked with `gh api repos/<owner>/<repo>/git/ref/tags/<tag>`
+ *      (object type) and `gh api repos/<owner>/<repo>/commits/<sha>` (the SHA is
+ *      a commit that exists in the repository).
+ *
+ *   actions/checkout v7.0.1: lightweight tag, `git/ref` type `commit`,
+ *     3d3c42e5aac5ba805825da76410c181273ba90b1 ("prep v7.0.1 release (#2531)").
+ *     The floating `v7` tag points at the same commit. v7 is the current major
+ *     and adds the fork-PR checkout block for `pull_request_target` /
+ *     `workflow_run` that v5 lacks; the inputs dorfl passes (`fetch-depth`,
+ *     `persist-credentials`) are unchanged.
+ *   actions/setup-node v7.0.0: lightweight tag, `git/ref` type `commit`,
+ *     820762786026740c76f36085b0efc47a31fe5020 ("Migrate to ESM and upgrade
+ *     dependencies (#1574)"). The floating `v7` tag points at the same commit.
+ *     `node-version` and `package-manager-cache` are still inputs (see the
+ *     comment on the setup-node step in `generateSetupAction`).
+ *   pnpm/action-setup v6.1.0: ANNOTATED tag. `git/ref` type `tag` with object
+ *     d9184bf108216479bc5a137cc391f4d7b14c870b (the tag object, NOT usable);
+ *     peeled `^{}` and `gh api .../git/tags/d9184bf...` both give the commit
+ *     ea17c68df8912ef543352723c149a84f56e3d413 ("feat: support pnpm v12
+ *     (#288)"). With no `version` input it still reads `packageManager` from
+ *     package.json, which is how dorfl's workspace mode uses it.
+ *
+ * To bump a pin: resolve the new tag the same way, update the entry, and record
+ * the resolution above. `install-ci-actions-pinned.test.ts` fails on any
+ * emitted `uses:` that is not a full SHA.
+ */
+/** One pinned third-party action. */
+export interface ActionPin {
+    /** `owner/repo`, or `owner/repo/path` for an action in a subdirectory. */
+    readonly action: string;
+    /** The full 40-character lowercase commit SHA (never a tag object). */
+    readonly sha: string;
+    /** The release tag the SHA was resolved from, for the trailing comment. */
+    readonly version: string;
+}
+/** Every third-party action dorfl's generators emit. */
+export declare const ACTION_PINS: {
+    readonly checkout: {
+        readonly action: "actions/checkout";
+        readonly sha: "3d3c42e5aac5ba805825da76410c181273ba90b1";
+        readonly version: "v7.0.1";
+    };
+    readonly setupNode: {
+        readonly action: "actions/setup-node";
+        readonly sha: "820762786026740c76f36085b0efc47a31fe5020";
+        readonly version: "v7.0.0";
+    };
+    readonly pnpmSetup: {
+        readonly action: "pnpm/action-setup";
+        readonly sha: "ea17c68df8912ef543352723c149a84f56e3d413";
+        readonly version: "v6.1.0";
+    };
+};
+/**
+ * The value to put after `uses: ` for a pinned action:
+ * `owner/repo@<sha> # vX.Y.Z` (the Dependabot format).
+ */
+export declare function pinnedUses(pin: ActionPin): string;
+/**
+ * Collect the SHA pins an existing file already carries, keyed by action
+ * (`owner/repo[/path]`). The value is the whole `uses:` value with its trailing
+ * comment, exactly as written. When the file pins the same action to several
+ * different SHAs, the one whose `# vX.Y.Z` comment is highest wins (ties: the
+ * first in the file), so a partial manual bump is never undone.
+ */
+export declare function existingPins(existing: string): Map<string, string>;
+/**
+ * Rewrite a freshly generated workflow / composite action so every `uses:` of an
+ * action that `existing` already pins to a full SHA keeps the consumer's
+ * reference and trailing comment. Matching is by action (`owner/repo`, plus the
+ * path for an action in a subdirectory), never by position. An existing TAG is
+ * not a pin: the generated reference (dorfl's SHA) stays. So the result never
+ * swaps a SHA for a tag. Only the value after `uses: ` changes; indentation and
+ * every other line are the generated ones.
+ */
+export declare function preserveExistingPins(generated: string, existing: string | undefined): string;
+//# sourceMappingURL=install-ci-action-pins.d.ts.map

package/dist/install-ci-action-pins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-ci-action-pins.d.ts","sourceRoot":"","sources":["../src/install-ci-action-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,qCAAqC;AACrC,MAAM,WAAW,SAAS;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,wDAAwD;AACxD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;CAgBsB,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAEjD;AA8CD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CACnC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC1B,MAAM,CAcR"}