dorfl 0.14.2 → 0.15.0

package/dist/intake-trigger-template.js

@@ -7,9 +7,12 @@
  * `advance-lifecycle-template.ts` / `advance-ci-template.ts` (the package depends on
  * NO YAML lib, so the checks are presence/shape assertions over the raw text). It
  * ALSO carries the PURE intake-flags DERIVATION ({@link deriveIntakeFlags}) —
- * CI's merge-vs-propose POLICY, the load-bearing testable logic the workflow
- * encodes at runtime. The DOCUMENT mode is the resolved `intakeIntegration`
- * (operator/config); author-trust drives ONLY the `--origin-trust` stamp +
+ * CI's merge-vs-propose POLICY. Since the CI split (task
+ * `ci-split-generate-workflows`) the workflow no longer derives it in a shell
+ * step: the called `dorfl-item.yml` lock job derives the same rule from trusted
+ * inputs (`ci-phase-intake.ts`: the event's author association, `dorfl.json`
+ * at the base). The DOCUMENT mode is the resolved `intakeIntegration`
+ * (operator/config); author-trust drives ONLY the origin-trust stamp +
  * placement, never the mode.
  *
  * SCOPE FENCE (spec Out-of-Scope): the issue→artifact TRANSFORM engine is
@@ -22,8 +25,10 @@
  * RESOLVED design decisions in the task):
  *
  *   - TRIGGERS: `issues` opened, `issue_comment` created, and a label
- *     (`dorfl:intake`). It invokes `intake <N>` (EXPLICIT, four-outcome
- *     dispatch) — never a bare slug.
+ *     (`dorfl:intake`). Its one job calls `dorfl-item.yml` with
+ *     `item: issue:<N>` (lock, agent, apply; decision 10 of ADR
+ *     `ci-agent-job-holds-no-write-token`), which runs `intake <N>` (EXPLICIT,
+ *     four-outcome dispatch) — never a bare slug.
  *   - EVENT→`IntakeEventKind` MAPPING (Decision 2: no edit-detection): only a
  *     CREATED `issue_comment` (and an opened issue / the label) drives
  *     (re-)evaluation; an EDITED comment is NOT a trigger (the ID-based
@@ -58,16 +63,18 @@
  *     overlapping ticks on the SAME issue; the `processing` lock / claim CAS is the
  *     real cross-run serialiser.
  *   - The running CI job NEVER edits `.github/workflows/**` (US #9): it requests NO
- *     `workflows` permission and cannot rewrite its own triggers. It needs
+ *     `workflows` permission and cannot rewrite its own triggers. It grants
  *     `contents: write` + `pull-requests: write` (emit/propose the artifact) +
- *     `issues: write` (post the clarifying/review comment back).
+ *     `issues: write` (post the clarifying/review comment back) + `actions` and
+ *     `checks: read` (the apply job tells a timed-out agent job from a
+ *     cancelled one), which the called workflow's jobs narrow per job.
  *
  * The structural validator is the dependency-free counterpart of "the workflow
  * parses + carries the right discipline" the task's acceptance criteria require;
  * the test generates this artifact under `--fake` and asserts every invariant.
  */
 import { brand } from './brand.js';
-import { providerSecretsWithBlock } from './install-ci-core.js';
+import { ITEM_WORKFLOW_CALLER_PERMISSIONS, itemCallSecrets, } from './dorfl-item-template.js';
 /** The capability id (the registry key + the emitted workflow file stem). */
 export const INTAKE_TRIGGER_CAPABILITY_ID = 'intake';
 /** The wizard-facing label for the issue-intake capability. */
@@ -99,9 +106,10 @@ export const TRUSTED_AUTHOR_ASSOCIATIONS = [
  * DERIVE the per-outcome file-emit modes + the origin-trust stamp — CI's intake
  * POLICY (ADR `untrusted-origin-carries-via-stamp-not-forced-staging`; spec
  * `intake-integration-knob-and-specs-land-in-proposed-rename` US #1/#2). This is
- * the load-bearing pure logic the workflow encodes at runtime (it reads the
- * resolved `intakeIntegration ?? integration` via `dorfl config --json` for the
- * MODE, and `author_association` off the event payload for the STAMP):
+ * the load-bearing pure rule the intake lock job applies at runtime (it reads
+ * the resolved `intakeIntegration ?? integration` from `dorfl.json` at the base
+ * for the MODE, and `author_association` off the event payload for the STAMP;
+ * `ci-phase-intake.ts`):
  *
  *   - **DOCUMENT mode (spec = task)** — the resolved `intakeIntegration` value, a
  *     SINGLE mode applied to BOTH the spec and task document: `merge` ⇒
@@ -162,27 +170,22 @@ export function isAuthorTrusted(authorAssociation) {
 // ─── The workflow generator ──────────────────────────────────────────────────
 /**
  * Generate the intake-trigger workflow YAML. Deterministic: the same config
- * produces byte-identical output. The workflow is a FIXED shell (ADR §6: all
- * policy is env/config, so the artifact carries no config-derived policy beyond
- * the env-block scaffolding) — `config` is accepted for parity with the
- * `CapabilityEmitter` seam and future per-config wiring, but the intake-trigger
- * shape itself is config-independent.
+ * produces byte-identical output.
  *
- * The per-outcome FLAGS are DERIVED AT RUNTIME by a `bash` step that mirrors
- * {@link deriveIntakeFlags}: it reads the resolved `intakeIntegration ??
- * integration` via `dorfl config --json` to set the (config-derived) DOCUMENT
- * mode `--merge-spec`/`--propose-spec` + `--merge-task`/`--propose-task` (a SINGLE
- * mode applied to both), and the event's `author_association` to set ONLY the
- * `--origin-trust` STAMP (which carries the placement + build-PR consequence). The
- * autonomy gates (`autoBuild`/`autoTask`) are NOT read for the document mode (they
- * mean only "may an agent act autonomously"). The same rule that
- * {@link deriveIntakeFlags} unit-tests is what the workflow executes — they cannot
- * desync because the test asserts the SHELL derivation matches the function.
+ * THE SPLIT (spec `ci-agent-job-without-write-token`, decision 10 of ADR
+ * `ci-agent-job-holds-no-write-token`; task `ci-split-generate-workflows`): the
+ * one job CALLS the per-item workflow `dorfl-item.yml` with
+ * `item: issue:<N>`, under this workflow's per-issue concurrency group. Its lock
+ * job (write token, no agent) takes the `processing` label and DERIVES the
+ * intake policy itself: the origin-trust stamp from this run's event
+ * (`comment.author_association`, else `issue.author_association`; a called
+ * workflow sees its caller's event) and the document mode from
+ * `intakeIntegration ?? integration` in `dorfl.json` at the base, the same rule
+ * {@link deriveIntakeFlags} states. The decision agent runs in the agent job
+ * (read-only token), and the apply job (write token, no agent) posts the
+ * comment or integrates the document.
  */
 export function generateIntakeWorkflow(config) {
-    // `intake <N>` runs the prompt→verdict decision (the agent), so it needs the
-    // provider secret(s) forwarded to `$GITHUB_ENV` by the setup action.
-    const setupWith = providerSecretsWithBlock(config);
     return `\
 # dorfl — the ISSUE INTAKE trigger in CI (capability D: consider incoming
 # issues → task/spec, PLUS insertion point E: surface the review verdict into the
@@ -197,6 +200,14 @@ export function generateIntakeWorkflow(config) {
 # findings as questions back into THIS issue thread via the issue-comment seam (insertion
 # point E) — REUSED, not a new review mechanism.
 #
+# THE SPLIT (ADR ci-agent-job-holds-no-write-token): ANY GitHub user can write
+# the issue text the decision agent reads, so the agent never shares a job with
+# a write token. The one job below calls dorfl-item.yml with
+# \`item: issue:<N>\`: a LOCK job (write token, no agent: takes the \`processing\`
+# label), an AGENT job (read-only token, no persisted credential: runs the
+# decision) and an APPLY job (write token, no agent: validates the agent's
+# handoff as hostile, then comments or integrates the document).
+#
 # TRIGGERS (capability D): an OPENED issue, a CREATED issue comment, and the
 # \`${INTAKE_TRIGGER_LABEL}\` label. A CREATED comment is the (re-)evaluation
 # trigger; an EDITED comment is deliberately NOT a trigger (the ID-based
@@ -206,31 +217,29 @@ export function generateIntakeWorkflow(config) {
 # re-evaluation (a fresh id the watermark catches). There is NO edit-detection /
 # \`updated_at\` / body-hash tracking.
 #
-# THE DOCUMENT MODE is \`intakeIntegration\`; AUTHOR-TRUST → PLACEMENT + the STAMP:
-# the intake DOCUMENT merge-vs-propose mode is the resolved \`intakeIntegration ??
-# integration\` (an operator/config choice, a SINGLE value applied to BOTH the task
-# and spec document), DECOUPLED from the autonomy gates (spec
-# intake-integration-knob-and-specs-land-in-proposed-rename; ADR
-# untrusted-origin-carries-via-stamp-not-forced-staging). \`autoBuild\`/\`autoTask\`
-# no longer decide the document mode (they mean only "may an agent act
-# autonomously"). Because ANYBODY can file an issue, WHO authored it still matters —
-# but author-trust drives only (1) the \`--origin-trust\` STAMP on the emitted
-# document and (2), via that stamp read by \`intake\`'s dispatch, which PLACEMENT
-# default the document lands in. So an untrusted author's task DOCUMENT MERGES to
-# \`main\` just like a trusted one when \`intakeIntegration\` is \`merge\`; the
-# untrusted safety is the CARRIED stamp (it forces the later BUILD to a code PR)
-# plus the placement default, not a forced document PR. "Merge everything" is
-# \`intakeIntegration: merge\` (or \`integration: merge\`), independent of the gates
-# AND of who filed the issue — so a repo can have autonomy AND merged documents.
+# THE DOCUMENT MODE is \`intakeIntegration\`; AUTHOR-TRUST → PLACEMENT + the STAMP.
+# Both are derived by the item's LOCK job from trusted inputs, never from the
+# agent: the document merge-vs-propose mode is the resolved
+# \`intakeIntegration ?? integration\` in dorfl.json at the base (an
+# operator/config choice, a SINGLE value applied to BOTH the task and spec
+# document, DECOUPLED from the autonomy gates; spec
+# intake-integration-knob-and-specs-land-in-proposed-rename), and the
+# origin-trust stamp comes from THIS run's event: an author outside
+# OWNER/MEMBER/COLLABORATOR (\`comment.author_association\`, else
+# \`issue.author_association\`) is untrusted (ADR
+# untrusted-origin-carries-via-stamp-not-forced-staging). Author-trust drives
+# only (1) the \`originTrust\` STAMP on the emitted document and (2), via that
+# stamp, which PLACEMENT default the document lands in; the untrusted safety is
+# the CARRIED stamp (it forces the later BUILD to a code PR) plus the placement
+# default, not a forced document PR.
 #
 # CI runs IN-PLACE (the CI container IS the isolation): NO --isolated/--remote/
 # registry (laptop-only affordances). The PER-ISSUE concurrency group below
 # serialises overlapping ticks on the SAME issue; the \`processing\` lock / claim
 # CAS is the real cross-run serialiser.
 #
-# SAFETY (US #9): the running job is FORBIDDEN from editing the workflows tree
-# under .github. It requests NO \`workflows\` permission, so it can never rewrite
-# its own triggers.
+# SAFETY (US #9): no job requests a \`workflows\` permission, so none can
+# rewrite its own triggers.
 
 name: intake
 
@@ -253,39 +262,14 @@ on:
 # triggers landing close together must not run intake on one issue twice at once).
 # The \`processing\` lock / claim CAS is the real cross-run serialiser; this just
 # avoids redundant concurrent ticks. Keyed by the issue number so DIFFERENT issues
-# still run in parallel.
+# still run in parallel. One intake run carries exactly one issue, so no
+# parallelism slot applies here.
 concurrency:
   group: intake-\${{ github.event.issue.number }}
   cancel-in-progress: false
 
-# NO \`workflows\` permission: the running job can NEVER edit the workflows tree
-# under .github (US #9). \`contents: write\` + \`pull-requests: write\` emit/propose
-# the artifact; \`issues: write\` posts the clarifying/review comment back into the
-# thread (insertion point E). It never rewrites its triggers.
-permissions:
-  contents: write
-  pull-requests: write
-  issues: write
-
-# ── The intake DOCUMENT mode is resolved FROM CONFIG, not carried here ───────
-# CI is NOT a special policy surface (ADR ci-config-policy-and-gate-family §5):
-# it runs the SAME engine config, resolved through flag > env > per-repo > global
-# > default. The SAME dorfl.json the laptop uses applies here. This workflow emits
-# NO DORFL_AUTO_BUILD / DORFL_AUTO_TASK line (ADR
-# untrusted-origin-carries-via-stamp-not-forced-staging: hardcoding them here made
-# the env layer OUTRANK the committed dorfl.json — the shadowing bug). So the env
-# layer carries NO config default; the policy step below READS the resolved intake
-# DOCUMENT mode \`intakeIntegration ?? integration\` via \`dorfl config --json\` (the
-# mechanism \`advance\` already uses), so your committed dorfl.json wins (then the
-# global config, then the built-in default \`propose\`). To land intake documents on
-# main, set \`intakeIntegration: merge\` (or \`integration: merge\`) in dorfl.json
-# (applies everywhere) — NOT by re-running install-ci (ADR §6: install-ci is
-# one-time). The autonomy gates \`autoBuild\`/\`autoTask\` are DECOUPLED from the
-# document mode (spec intake-integration-knob-and-specs-land-in-proposed-rename):
-# they gate autonomy only and are NOT read here. \`intake\` itself is GATE-FREE (the
-# explicit invocation is its own authorization); CI READS only the resolved
-# \`intakeIntegration\`/\`integration\` to DERIVE the merge-vs-propose document flags
-# below (the merge-vs-propose POLICY).
+# Nothing at workflow level: the calling job grants what dorfl-item.yml needs.
+permissions: {}
 
 jobs:
   intake:
@@ -293,124 +277,15 @@ jobs:
     # comment on a PR also fires \`issue_comment\`; skip those — there is no issue to
     # intake). \`pull_request\` is absent on a real issue comment.
     if: \${{ github.event.issue.number && !github.event.issue.pull_request }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-      - uses: ./.github/actions/dorfl-setup${setupWith}
-
-      - name: derive the intake DOCUMENT mode (intakeIntegration) + the origin-trust stamp (author-trust)
-        id: policy
-        # The intake POLICY, executed at runtime — the SAME rule
-        # \`deriveIntakeFlags\` unit-tests (they cannot desync; the test asserts this
-        # shell matches the function). The DOCUMENT mode is the resolved
-        # \`intakeIntegration ?? integration\` (operator/config), DECOUPLED from the
-        # autonomy gates; author-trust drives ONLY the stamp + placement (ADR
-        # untrusted-origin-carries-via-stamp-not-forced-staging; spec
-        # intake-integration-knob-and-specs-land-in-proposed-rename):
-        #   * DOCUMENT mode (spec = task) — config-derived: --merge-* iff the
-        #            resolved intakeIntegration is merge, else --propose-*. A SINGLE
-        #            value applied to BOTH the spec and task document. autoBuild/
-        #            autoTask are NOT read (they gate autonomy only).
-        #   * ORIGIN-TRUST stamp — the ONLY thing author-trust drives: --origin-trust
-        #            untrusted iff the author is not OWNER/MEMBER/COLLABORATOR, which
-        #            \`intake\`'s dispatch reads to select the untrusted PLACEMENT
-        #            default and to force the later BUILD to a code PR.
-        # author_association comes from the COMMENT on an \`issue_comment\` event,
-        # else the ISSUE on an \`issues\` event — read straight off the payload, no
-        # extra API call.
-        env:
-          AUTHOR_ASSOCIATION: \${{ github.event.comment.author_association || github.event.issue.author_association }}
-        run: |
-          set -euo pipefail
-
-          # Read the RESOLVED intake DOCUMENT mode from the committed config via
-          # \`dorfl config --json\` (the mechanism \`advance\` already uses), NOT a
-          # hardcoded DORFL_* env (ADR
-          # untrusted-origin-carries-via-stamp-not-forced-staging: an env default
-          # would OUTRANK dorfl.json — the shadowing bug). In-place, so the
-          # resolution chain reads THIS repo's dorfl.json exactly like the laptop.
-          # \`intakeIntegration\` is OPTIONAL (unset ⇒ falls back to \`integration\`),
-          # so read \`.intakeIntegration // .integration\` in ONE jq expression — the
-          # shell twin of the \`intakeIntegration ?? integration\` the CLI applies.
-          # The autonomy gates (autoBuild/autoTask) are DECOUPLED from the document
-          # mode (spec intake-integration-knob-and-specs-land-in-proposed-rename):
-          # they gate autonomy only and are NOT read here.
-          config_json="$(dorfl config --json)"
-          intake_integration="$(echo "\${config_json}" | jq -r '.intakeIntegration // .integration')"
-
-          # DOCUMENT mode: config-derived from the single \`intakeIntegration ??
-          # integration\` value, applied to BOTH the spec and task document (US #1
-          # chose one intake knob, not a per-type split). merge ⇒ --merge-*,
-          # else --propose-*. Author-trust does NOT bite the mode (ADR
-          # untrusted-origin-carries-via-stamp-not-forced-staging): an untrusted
-          # author's DOCUMENT merges just like a trusted one; the untrusted safety
-          # is the stamp + placement below, not a document PR.
-          if [ "\${intake_integration}" = "merge" ]; then
-            spec_flag="--merge-spec"
-            task_flag="--merge-task"
-          else
-            spec_flag="--propose-spec"
-            task_flag="--propose-task"
-          fi
-
-          # Author-trust: TRUSTED iff OWNER/MEMBER/COLLABORATOR (admin / write-
-          # collaborator — the whole signal). Anything else (incl. empty) is
-          # UNTRUSTED. It drives ONLY the origin-trust stamp below (NOT the modes).
-          trusted="false"
-          case "\${AUTHOR_ASSOCIATION:-}" in
-            OWNER|MEMBER|COLLABORATOR) trusted="true" ;;
-          esac
-
-          # ORIGIN-TRUST stamp — the SOLE thing author-trust drives on the wire
-          # (task untrusted-origin-forces-build-propose). \`intake\` STAMPS this
-          # onto the emitted spec/task frontmatter (origin: issue + originTrust:
-          # <value>); its dispatch reads the stamp to (1) select the untrusted-side
-          # PLACEMENT default (\`untrusted*LandIn\`) and (2) force the later BUILD of
-          # an untrusted task to a code PR. It does NOT re-resolve trust (that is
-          # CI's policy, passed IN). The stamp SURVIVES the merge boundary so a
-          # later auto-task/auto-build of an untrusted-origin artifact still forces
-          # a human becomes-code checkpoint (the laundering gap is closed).
-          if [ "\${trusted}" = "true" ]; then
-            origin_trust_flag="--origin-trust=trusted"
-          else
-            origin_trust_flag="--origin-trust=untrusted"
-          fi
-
-          echo "spec_flag=\${spec_flag}" >> "\$GITHUB_OUTPUT"
-          echo "task_flag=\${task_flag}" >> "\$GITHUB_OUTPUT"
-          echo "origin_trust_flag=\${origin_trust_flag}" >> "\$GITHUB_OUTPUT"
-          echo "intake policy: intakeIntegration='\${intake_integration}' author_association='\${AUTHOR_ASSOCIATION:-}' trusted=\${trusted} → \${spec_flag} \${task_flag} \${origin_trust_flag}"
-
-      - name: intake the issue (four-outcome dispatch; surfaces the review verdict into the thread)
-        # In-place in this checkout (no --isolated/--remote): the CI container IS
-        # the isolation. EXPLICIT \`intake <N>\`, never a bare slug. The per-outcome
-        # flags carry the (intakeIntegration-derived) document modes + the
-        # origin-trust stamp derived above (author-trust drives only the stamp +
-        # placement, not the document merge-vs-propose; the autonomy gates drive
-        # neither). \`intake\` runs the
-        # lone-task review/edit loop and posts its findings as questions back into
-        # THIS issue thread (insertion point E) through the issue-comment seam —
-        # CI surfaces E by invoking intake; it adds no new review mechanism.
-        #
-        # Every value reaches the shell through \`env:\` as DATA and is read back as a
-        # quoted variable, never as \`\${{ }}\` text spliced into the script
-        # (GitHub's script-injection guidance). The issue number is an integer and
-        # the policy outputs are fixed flags today; routing them through env anyway
-        # keeps "no \`\${{ }}\` inside \`run:\`" a rule with no exceptions.
-        env:
-          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
-          ISSUE_NUMBER: \${{ github.event.issue.number }}
-          SPEC_FLAG: \${{ steps.policy.outputs.spec_flag }}
-          TASK_FLAG: \${{ steps.policy.outputs.task_flag }}
-          ORIGIN_TRUST_FLAG: \${{ steps.policy.outputs.origin_trust_flag }}
-        run: |
-          dorfl intake "\${ISSUE_NUMBER}" \\
-            "\${SPEC_FLAG}" \\
-            "\${TASK_FLAG}" \\
-            "\${ORIGIN_TRUST_FLAG}" \\
-            --arbiter origin
+    # The union of what dorfl-item.yml's jobs request (a called workflow can
+    # only narrow this): the lock and apply jobs write (the \`processing\` label,
+    # the comment back into the thread = insertion point E, the document PR or
+    # merge); apply reads the agent job's check runs (a timeout vs a cancel).
+    permissions:
+${ITEM_WORKFLOW_CALLER_PERMISSIONS}
+    uses: ./.github/workflows/dorfl-item.yml
+    with:
+      item: issue:\${{ github.event.issue.number }}${itemCallSecrets(config, false)}
 `;
 }
 /**
@@ -435,114 +310,52 @@ export function validateIntakeWorkflow(text) {
         .split('\n')
         .filter((line) => !/^\s*#/.test(line))
         .join('\n');
-    // --- INVOKES `intake <N>` (explicit, four-outcome dispatch), never bare ------
-    require('invokes-intake', /dorfl intake\b/.test(operative), 'must invoke `dorfl intake <N>` (the four-outcome dispatch engine CI ' +
-        'schedules).');
-    // The issue number rides the explicit positional — never a bare slug, and the
-    // number comes from the event payload (the issue under intake).
-    require('intake-explicit-issue-number', /ISSUE_NUMBER:\s*\$\{\{\s*github\.event\.issue\.number\s*\}\}[\s\S]*?dorfl intake "\$\{ISSUE_NUMBER\}"/.test(operative), 'the intake invocation must pass the explicit issue NUMBER ' +
-        '(`github.event.issue.number`, via the step env as `ISSUE_NUMBER`), never a bare slug.');
-    // No `${{ }}` spliced into the intake `run:` script (script injection): the
-    // number and the policy flags reach the shell through the step `env:`.
-    require('intake-args-not-spliced-into-run', !/dorfl intake "?\$\{\{/.test(operative) &&
-        !/"\$\{\{\s*steps\.policy\.outputs\./.test(operative), 'the intake invocation must NOT interpolate `${{ github.event.issue.number }}` ' +
-        'or `${{ steps.policy.outputs.* }}` into its `run:` script: pass them through ' +
-        'the step `env:` and quote the variables.');
-    // CI owns ONLY the trigger/policy/delivery — it must NOT invoke a build/task
-    // verb (that is the build/task tick), nor re-implement the transform.
-    require('no-build-verbs', !/dorfl (?:do|advance)\b/.test(operative), 'the intake workflow must invoke ONLY `intake` (+ derive the policy), not a ' +
-        'build/task verb — CI owns the trigger + merge policy, not the transform.');
+    // --- CALLS the per-item workflow with `item: issue:<N>` (decision 10) -------
+    require('calls-item-workflow', /\n {4}uses: \.\/\.github\/workflows\/dorfl-item\.yml\n/.test(operative), 'the intake job must call the per-item workflow ' +
+        '(`uses: ./.github/workflows/dorfl-item.yml`: lock, agent, apply).');
+    // The issue number rides the explicit `issue:<N>` item id from the event
+    // payload (the issue under intake) — never a bare slug.
+    require('intake-explicit-issue-number', /\n {6}item: issue:\$\{\{ github\.event\.issue\.number \}\}\n/.test(operative), 'the item must be the explicit `issue:<N>` id ' +
+        '(`item: issue:${{ github.event.issue.number }}`).');
+    // No agent verb runs in THIS workflow: the decision agent runs in the called
+    // workflow's agent job (read-only token).
+    require('no-agent-verbs', !/dorfl (?:do|advance|intake|run)\b/.test(operative), 'the intake workflow must run no dorfl verb itself: `intake` runs in the ' +
+        "called workflow's lock, agent and apply jobs.");
+    // The caller grants the union of what the called jobs request.
+    require('caller-grants-item-scopes', /\n {4}permissions:\n {6}contents: write\n {6}issues: write\n {6}pull-requests: write\n {6}actions: read\n {6}checks: read\n/.test(operative), 'the calling job must grant every scope a job of dorfl-item.yml requests ' +
+        '(`contents`, `issues`, `pull-requests: write`; `actions`, `checks: read`).');
+    require('workflow-permissions-empty', /^permissions: \{\}$/m.test(text), 'the workflow must grant nothing at workflow level (`permissions: {}`).');
+    require('secrets-explicit', !/secrets:\s*inherit\b/.test(operative), 'secrets reach the called workflow explicitly, never `secrets: inherit`.');
+    require('no-pr-identity-token', !/DORFL_GH_TOKEN/.test(operative), 'intake keeps the built-in token for its writes (no DORFL_GH_TOKEN is ' +
+        'passed to the called workflow).');
     // --- TRIGGERS: issues opened + issue_comment created + the label ------------
     require('trigger-issues-opened', /\bissues:\s*[\s\S]*?types:\s*[\s\S]*?-\s*opened\b/.test(text), 'must trigger on an OPENED issue (`on.issues.types: [opened]`).');
     require('trigger-issue-comment-created', /\bissue_comment:\s*[\s\S]*?types:\s*[\s\S]*?-\s*created\b/.test(text), 'must trigger on a CREATED issue comment ' +
         '(`on.issue_comment.types: [created]`) — the (re-)evaluation trigger.');
     require('trigger-label', /\bissues:\s*[\s\S]*?types:\s*[\s\S]*?-\s*labeled\b/.test(text), 'must trigger on a label (`on.issues.types: [labeled]`).');
+    // A comment on a PR also fires `issue_comment`: there is no issue to intake.
+    require('skips-pull-request-comments', /if: \$\{\{ github\.event\.issue\.number && !github\.event\.issue\.pull_request \}\}/.test(operative), 'the intake job must skip a comment on a pull request (no issue to intake).');
     // --- Decision 2: a CREATED comment triggers; an EDITED comment does NOT ------
-    // The `issue_comment` trigger must NOT list `edited` (no edit-detection); and
-    // there must be no `updated_at`/body-hash edit-tracking wiring.
     require('no-comment-edited-trigger', !/issue_comment:\s*[\s\S]*?types:\s*[\s\S]*?-\s*edited\b/.test(text), 'the `issue_comment` trigger must NOT include `edited` (Decision 2: no ' +
         'edit-detection; a CREATED comment is the (re-)evaluation trigger).');
     require('no-edit-tracking', !/updated_at|body-hash|bodyHash/.test(operative), 'must NOT implement `updated_at` / body-hash edit-tracking (Decision 2).');
-    // The "post a NEW comment to signal an edit" CONVENTION must be documented in
-    // the workflow so a human knows how to re-trigger after editing a comment.
     require('documents-new-comment-convention', /post a NEW comment/i.test(text), 'must DOCUMENT the "post a new comment to signal an edit" convention ' +
         '(Decision 2) so a human knows how to drive re-evaluation.');
-    // --- AUTHOR-TRUST → per-outcome flags (Decision 1) --------------------------
-    // The workflow must READ author_association off the event payload (no extra API).
-    require('reads-author-association', /author_association/.test(text), 'must read `author_association` off the event payload to compose author-' +
-        'trust into the merge-vs-propose policy (Decision 1; no extra API call).');
-    // Trust = OWNER/MEMBER/COLLABORATOR (the whole signal).
-    require('trust-owner-member-collaborator', /OWNER\|MEMBER\|COLLABORATOR|OWNER[\s\S]{0,40}MEMBER[\s\S]{0,40}COLLABORATOR/.test(text), 'author-trust must be OWNER/MEMBER/COLLABORATOR (admin / write-collaborator ' +
-        '— the whole signal; Decision 1).');
-    // The DOCUMENT mode is intakeIntegration-DERIVED (spec
-    // intake-integration-knob-and-specs-land-in-proposed-rename; the autonomy gates
-    // no longer bite it): the derivation must be able to emit both task modes
-    // (merge iff the resolved intakeIntegration is merge, else propose).
-    require('derives-propose-task', /--propose-task\b/.test(operative), 'the policy derivation must be able to emit `--propose-task` (the ' +
-        'intakeIntegration-propose path).');
-    require('derives-merge-task', /--merge-task\b/.test(operative), 'the policy derivation must be able to emit `--merge-task` (the ' +
-        'intakeIntegration-merge path; a task DOCUMENT merges regardless of the ' +
-        'autonomy gates or author-trust).');
-    // --merge-spec is emitted when the resolved intakeIntegration is merge (the
-    // SAME single value as the task; the gates do not bite it).
-    require('derives-merge-spec', /--merge-spec\b/.test(operative), 'the policy derivation must be able to emit `--merge-spec` (the ' +
-        'intakeIntegration-merge path).');
-    require('derives-propose-spec', /--propose-spec\b/.test(operative), 'the policy derivation must be able to emit `--propose-spec` (the ' +
-        'intakeIntegration-propose path).');
-    // ORIGIN-TRUST stamp (task untrusted-origin-forces-build-propose): the shell
-    // must derive `--origin-trust <trusted|untrusted>` from the author-trust case
-    // (independent of the document mode) and pass it to `intake` so the emitted
-    // artifact is stamped (the stamp is the SOLE thing author-trust drives).
-    require('derives-origin-trust-untrusted', /--origin-trust=untrusted\b/.test(operative), 'the policy derivation must emit `--origin-trust=untrusted` for a non-trusted ' +
-        'author (so the emitted artifact is stamped untrusted; task ' +
-        'untrusted-origin-forces-build-propose).');
-    require('derives-origin-trust-trusted', /--origin-trust=trusted\b/.test(operative), 'the policy derivation must emit `--origin-trust=trusted` for a trusted author.');
-    require('passes-origin-trust-to-intake', /steps\.policy\.outputs\.origin_trust_flag/.test(operative), 'the intake invocation must pass the derived `--origin-trust` flag (the ' +
-        'stamp must reach `dorfl intake`).');
-    // The derivation must read the RESOLVED intake DOCUMENT mode via `dorfl config
-    // --json` (the mechanism `advance` uses), NOT a hardcoded DORFL_* env (ADR
-    // untrusted-origin-carries-via-stamp-not-forced-staging — the shadowing bug).
-    require('reads-config-json', /dorfl config --json/.test(operative), 'the policy derivation must read the resolved config via ' +
-        '`dorfl config --json` (as `advance` does), so a committed `dorfl.json` ' +
-        'mode is honored in CI (not shadowed by a hardcoded env).');
-    // The DOCUMENT mode is the resolved `intakeIntegration ?? integration` (spec
-    // intake-integration-knob-and-specs-land-in-proposed-rename): the derivation
-    // must read `.intakeIntegration` with a `.integration` FALLBACK (the shell twin
-    // of `intakeIntegration ?? integration`), NOT the autonomy gates. Pin BOTH the
-    // key and the fallback so a regression to a gate-derived mode is caught.
-    require('reads-intake-integration', /\.intakeIntegration\b/.test(operative), 'the policy derivation must read the resolved `intakeIntegration` mode (jq ' +
-        '`.intakeIntegration` off `dorfl config --json`) for the document mode.');
-    require('intake-integration-falls-back-to-integration', /\.intakeIntegration\s*\/\/\s*\.integration/.test(operative), 'the policy derivation must fall back to `.integration` when ' +
-        '`intakeIntegration` is unset (jq `.intakeIntegration // .integration`, the ' +
-        'shell twin of `intakeIntegration ?? integration`).');
-    // The DOCUMENT mode must NOT be derived from the autonomy gates (spec
-    // intake-integration-knob-and-specs-land-in-proposed-rename: autoBuild/autoTask
-    // gate autonomy ONLY, never the document PR-mode). The mode branch must not read
-    // `.autoBuild` / `.autoTask` off the config json.
-    require('mode-not-gate-derived', !/\.auto(?:Build|Task)\b/.test(operative), 'the intake DOCUMENT mode must be derived from `intakeIntegration ?? ' +
-        'integration`, NOT the autonomy gates — the derivation must not read ' +
-        '`.autoBuild` / `.autoTask` (they gate autonomy only; spec ' +
-        'intake-integration-knob-and-specs-land-in-proposed-rename).');
-    // ANTI-REGRESSION (ADR untrusted-origin-carries-via-stamp-not-forced-staging;
-    // spec US #12): the workflow must NOT emit a `DORFL_AUTO_BUILD:` /
-    // `DORFL_AUTO_TASK:` env ASSIGNMENT. The env layer OUTRANKS per-repo config, so
-    // a hardcoded default here SHADOWS the committed `dorfl.json` gates (the bug this
-    // task fixes). Mirrors `advance-lifecycle-template.ts`'s `no-gate-env-auto-build`
-    // / `no-gate-env-auto-task`. Checked over the OPERATIVE (non-comment) lines so
-    // the header comment that NAMES these keys is not a false positive.
+    // --- The policy is derived in the lock job, from trusted inputs --------------
+    // The document mode and the origin-trust stamp are derived by the called
+    // workflow's LOCK job (`ci-phase-intake.ts`), never by the agent: this
+    // workflow must not derive them itself any more, nor carry a gate env.
     require('no-gate-env-auto-build', !/DORFL_AUTO_BUILD\s*:/.test(operative), 'the workflow must NOT emit a `DORFL_AUTO_BUILD:` env assignment (env ' +
-        'carries no defaults; the gate is resolved from per-repo config / built-in ' +
-        'default — else the env SHADOWS the committed dorfl.json).');
+        'carries no defaults — else the env SHADOWS the committed dorfl.json).');
     require('no-gate-env-auto-task', !/DORFL_AUTO_TASK\s*:/.test(operative), 'the workflow must NOT emit a `DORFL_AUTO_TASK:` env assignment (env ' +
-        'carries no defaults; the gate is resolved from per-repo config / built-in ' +
-        'default — else the env SHADOWS the committed dorfl.json).');
+        'carries no defaults — else the env SHADOWS the committed dorfl.json).');
+    require('documents-policy-derivation', /OWNER\/MEMBER\/COLLABORATOR/.test(text) &&
+        /intakeIntegration \?\? integration/.test(text), "must DOCUMENT where the policy comes from: the lock job's origin trust " +
+        '(OWNER/MEMBER/COLLABORATOR, from the event) and document mode ' +
+        '(`intakeIntegration ?? integration`, from dorfl.json at the base).');
     // --- Insertion point E: the issue-thread review surface ---------------------
-    // E is REUSED via `intake` (which runs the lone-task review and posts to the
-    // thread). The workflow must request `issues: write` so that comment can land.
-    require('issues-write-permission', /\bissues:\s*write\b/.test(operative), 'must request `issues: write` so the review verdict / clarifying question ' +
+    require('issues-write-permission', /\bissues:\s*write\b/.test(operative), 'must grant `issues: write` so the review verdict / clarifying question ' +
         'can be posted back into the issue thread (insertion point E).');
-    // It must NOT route the review verdict through the PR-comment seam — E posts to
-    // the ISSUE (postIssueComment by number), NOT the PR (postPRComment by url).
     require('no-pr-comment-seam', !/postPRComment\b/.test(operative), 'insertion point E posts to the ISSUE thread (postIssueComment by number), ' +
         'NOT the PR seam `postPRComment` (by url) — do not use the PR seam.');
     // --- CI runs IN-PLACE: no isolation machinery ------------------------------
@@ -555,10 +368,12 @@ export function validateIntakeWorkflow(text) {
     // --- US #9: NO `workflows` permission; cannot self-edit triggers ------------
     require('no-workflows-permission', !/\bworkflows:\s*write\b/.test(text), 'the running job must request NO `workflows` permission (US #9: it can ' +
         'never edit `.github/workflows/**` / rewrite its own triggers).');
-    require('never-edits-dot-github-workflows', !/\.github\/workflows\//.test(operative), 'no emitted job step may touch `.github/workflows/**` (US #9).');
-    // --- Wires the SHARED composite setup action -------------------------------
-    require('uses-shared-setup-action', /uses:\s*\.\/\.github\/actions\/dorfl-setup\b/.test(text), 'the job must wire the shared composite setup action ' +
-        '(`./.github/actions/dorfl-setup`, emitted by the core task).');
+    // Calling a reusable workflow (`uses: ./.github/workflows/...`) is not a
+    // step touching the tree; anything else naming it is.
+    require('never-edits-dot-github-workflows', !/\.github\/workflows\//.test(operative
+        .split('\n')
+        .filter((line) => !/^\s*uses: \.\/\.github\/workflows\//.test(line))
+        .join('\n')), 'no emitted job step may touch `.github/workflows/**` (US #9).');
     return { ok: problems.length === 0, problems };
 }
 //# sourceMappingURL=intake-trigger-template.js.map

package/dist/intake-trigger-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"intake-trigger-template.js","sourceRoot":"","sources":["../src/intake-trigger-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAC,KAAK,EAAC,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAC,wBAAwB,EAAC,MAAM,sBAAsB,CAAC;AAE9D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,QAAQ,CAAC;AAErD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,+BAA+B,GAC3C,8IAA8I,CAAC;AAEhJ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,KAAK,CAAC,IAAI,SAAS,CAAC;AAE3D,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IAC1C,OAAO;IACP,QAAQ;IACR,cAAc;CACL,CAAC;AAsDX;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAGjC;IACA,MAAM,EAAC,iBAAiB,EAAE,aAAa,EAAC,GAAG,OAAO,CAAC;IACnD,oFAAoF;IACpF,gFAAgF;IAChF,iFAAiF;IACjF,8EAA8E;IAC9E,iFAAiF;IACjF,6EAA6E;IAC7E,MAAM,IAAI,GAAwB,iBAAiB,CAAC;IACpD,MAAM,IAAI,GAAwB,iBAAiB,CAAC;IACpD,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,mFAAmF;IACnF,iFAAiF;IACjF,8EAA8E;IAC9E,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,WAAW,GAA4B,aAAa;QACzD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,WAAW,CAAC;IACf,OAAO,EAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC9B,iBAAqC;IAErC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAQ,2BAAiD,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC9D,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO;;;;;;;;;;;;;;;MAeF,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAoGmB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiHrD,CAAC;AACF,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC,CAAC;IAEF,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,iFAAiF;IACjF,wEAAwE;IACxE,MAAM,SAAS,GAAG,IAAI;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,gFAAgF;IAChF,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,CAC9C,SAAS,CACT,EAAE,sEAAsE;QACxE,aAAa,CAAC,CAAC;IAChB,8EAA8E;IAC9E,gEAAgE;IAChE,OAAO,CAAC,8BAA8B,EAAE,uGAAuG,CAAC,IAAI,CACnJ,SAAS,CACT,EAAE,4DAA4D;QAC9D,uFAAuF,CAAC,CAAC;IAC1F,4EAA4E;IAC5E,uEAAuE;IACvE,OAAO,CAAC,kCAAkC,EAAE,CAAC,uBAAuB,CAAC,IAAI,CACxE,SAAS,CACT;QACA,CAAC,oCAAoC,CAAC,IAAI,CACzC,SAAS,CACT,EAAE,gFAAgF;QACnF,+EAA+E;QAC/E,0CAA0C,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,sEAAsE;IACtE,OAAO,CAAC,gBAAgB,EAAE,CAAC,wBAAwB,CAAC,IAAI,CACvD,SAAS,CACT,EAAE,6EAA6E;QAC/E,0EAA0E,CAAC,CAAC;IAE7E,+EAA+E;IAC/E,OAAO,CAAC,uBAAuB,EAAE,mDAAmD,CAAC,IAAI,CACxF,IAAI,CACJ,EAAE,gEAAgE,CAAC,CAAC;IACrE,OAAO,CAAC,+BAA+B,EAAE,2DAA2D,CAAC,IAAI,CACxG,IAAI,CACJ,EAAE,0CAA0C;QAC5C,sEAAsE,CAAC,CAAC;IACzE,OAAO,CAAC,eAAe,EAAE,oDAAoD,CAAC,IAAI,CACjF,IAAI,CACJ,EAAE,yDAAyD,CAAC,CAAC;IAE9D,gFAAgF;IAChF,8EAA8E;IAC9E,gEAAgE;IAChE,OAAO,CAAC,2BAA2B,EAAE,CAAC,wDAAwD,CAAC,IAAI,CAClG,IAAI,CACJ,EAAE,wEAAwE;QAC1E,oEAAoE,CAAC,CAAC;IACvE,OAAO,CAAC,kBAAkB,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAChE,SAAS,CACT,EAAE,yEAAyE,CAAC,CAAC;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,OAAO,CAAC,kCAAkC,EAAE,qBAAqB,CAAC,IAAI,CACrE,IAAI,CACJ,EAAE,sEAAsE;QACxE,2DAA2D,CAAC,CAAC;IAE9D,+EAA+E;IAC/E,kFAAkF;IAClF,OAAO,CAAC,0BAA0B,EAAE,oBAAoB,CAAC,IAAI,CAC5D,IAAI,CACJ,EAAE,yEAAyE;QAC3E,yEAAyE,CAAC,CAAC;IAC5E,wDAAwD;IACxD,OAAO,CAAC,iCAAiC,EAAE,6EAA6E,CAAC,IAAI,CAC5H,IAAI,CACJ,EAAE,6EAA6E;QAC/E,kCAAkC,CAAC,CAAC;IACrC,uDAAuD;IACvD,gFAAgF;IAChF,0EAA0E;IAC1E,qEAAqE;IACrE,OAAO,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,IAAI,CACtD,SAAS,CACT,EAAE,mEAAmE;QACrE,kCAAkC,CAAC,CAAC;IACrC,OAAO,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,IAAI,CAClD,SAAS,CACT,EAAE,iEAAiE;QACnE,yEAAyE;QACzE,kCAAkC,CAAC,CAAC;IACrC,4EAA4E;IAC5E,4DAA4D;IAC5D,OAAO,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,IAAI,CAClD,SAAS,CACT,EAAE,iEAAiE;QACnE,gCAAgC,CAAC,CAAC;IACnC,OAAO,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,IAAI,CACtD,SAAS,CACT,EAAE,mEAAmE;QACrE,kCAAkC,CAAC,CAAC;IACrC,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,OAAO,CAAC,gCAAgC,EAAE,4BAA4B,CAAC,IAAI,CAC1E,SAAS,CACT,EAAE,+EAA+E;QACjF,6DAA6D;QAC7D,yCAAyC,CAAC,CAAC;IAC5C,OAAO,CAAC,8BAA8B,EAAE,0BAA0B,CAAC,IAAI,CACtE,SAAS,CACT,EAAE,gFAAgF,CAAC,CAAC;IACrF,OAAO,CAAC,+BAA+B,EAAE,2CAA2C,CAAC,IAAI,CACxF,SAAS,CACT,EAAE,yEAAyE;QAC3E,mCAAmC,CAAC,CAAC;IACtC,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,CACtD,SAAS,CACT,EAAE,0DAA0D;QAC5D,yEAAyE;QACzE,0DAA0D,CAAC,CAAC;IAC7D,6EAA6E;IAC7E,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,yEAAyE;IACzE,OAAO,CAAC,0BAA0B,EAAE,uBAAuB,CAAC,IAAI,CAC/D,SAAS,CACT,EAAE,4EAA4E;QAC9E,wEAAwE,CAAC,CAAC;IAC3E,OAAO,CAAC,8CAA8C,EAAE,4CAA4C,CAAC,IAAI,CACxG,SAAS,CACT,EAAE,8DAA8D;QAChE,6EAA6E;QAC7E,oDAAoD,CAAC,CAAC;IACvD,sEAAsE;IACtE,gFAAgF;IAChF,iFAAiF;IACjF,kDAAkD;IAClD,OAAO,CAAC,uBAAuB,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAC9D,SAAS,CACT,EAAE,sEAAsE;QACxE,sEAAsE;QACtE,4DAA4D;QAC5D,6DAA6D,CAAC,CAAC;IAChE,8EAA8E;IAC9E,mEAAmE;IACnE,gFAAgF;IAChF,kFAAkF;IAClF,kFAAkF;IAClF,+EAA+E;IAC/E,oEAAoE;IACpE,OAAO,CAAC,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAC7D,SAAS,CACT,EAAE,uEAAuE;QACzE,4EAA4E;QAC5E,2DAA2D,CAAC,CAAC;IAC9D,OAAO,CAAC,uBAAuB,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAC3D,SAAS,CACT,EAAE,sEAAsE;QACxE,4EAA4E;QAC5E,2DAA2D,CAAC,CAAC;IAE9D,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,OAAO,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,IAAI,CAC5D,SAAS,CACT,EAAE,2EAA2E;QAC7E,+DAA+D,CAAC,CAAC;IAClE,gFAAgF;IAChF,6EAA6E;IAC7E,OAAO,CAAC,oBAAoB,EAAE,CAAC,iBAAiB,CAAC,IAAI,CACpD,SAAS,CACT,EAAE,4EAA4E;QAC9E,oEAAoE,CAAC,CAAC;IAEvE,8EAA8E;IAC9E,OAAO,CAAC,kBAAkB,EAAE,CAAC,cAAc,CAAC,IAAI,CAC/C,SAAS,CACT,EAAE,0EAA0E,CAAC,CAAC;IAC/E,OAAO,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAClD,SAAS,CACT,EAAE,gEAAgE,CAAC,CAAC;IAErE,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,IAAI,CAClE,IAAI,CACJ,EAAE,yEAAyE,CAAC,CAAC;IAC9E,OAAO,CAAC,uBAAuB,EAAE,iEAAiE,CAAC,IAAI,CACtG,IAAI,CACJ,EAAE,yEAAyE;QAC3E,yCAAyC,CAAC,CAAC;IAE5C,+EAA+E;IAC/E,OAAO,CAAC,yBAAyB,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAChE,IAAI,CACJ,EAAE,wEAAwE;QAC1E,gEAAgE,CAAC,CAAC;IACnE,OAAO,CAAC,kCAAkC,EAAE,CAAC,uBAAuB,CAAC,IAAI,CACxE,SAAS,CACT,EAAE,+DAA+D,CAAC,CAAC;IAEpE,8EAA8E;IAC9E,OAAO,CAAC,0BAA0B,EAAE,8CAA8C,CAAC,IAAI,CACtF,IAAI,CACJ,EAAE,sDAAsD;QACxD,8DAA8D,CAAC,CAAC;IAEjE,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"intake-trigger-template.js","sourceRoot":"","sources":["../src/intake-trigger-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,EAAC,KAAK,EAAC,MAAM,YAAY,CAAC;AAEjC,OAAO,EACN,gCAAgC,EAChC,eAAe,GACf,MAAM,0BAA0B,CAAC;AAElC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,QAAQ,CAAC;AAErD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,+BAA+B,GAC3C,8IAA8I,CAAC;AAEhJ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,KAAK,CAAC,IAAI,SAAS,CAAC;AAE3D,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IAC1C,OAAO;IACP,QAAQ;IACR,cAAc;CACL,CAAC;AAsDX;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAGjC;IACA,MAAM,EAAC,iBAAiB,EAAE,aAAa,EAAC,GAAG,OAAO,CAAC;IACnD,oFAAoF;IACpF,gFAAgF;IAChF,iFAAiF;IACjF,8EAA8E;IAC9E,iFAAiF;IACjF,6EAA6E;IAC7E,MAAM,IAAI,GAAwB,iBAAiB,CAAC;IACpD,MAAM,IAAI,GAAwB,iBAAiB,CAAC;IACpD,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,mFAAmF;IACnF,iFAAiF;IACjF,8EAA8E;IAC9E,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,WAAW,GAA4B,aAAa;QACzD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,WAAW,CAAC;IACf,OAAO,EAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC9B,iBAAqC;IAErC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAQ,2BAAiD,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC9D,OAAO;;;;;;;;;;;;;;;;;;;;;;;MAuBF,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyExB,gCAAgC;;;qDAGmB,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC;CAClF,CAAC;AACF,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC,CAAC;IAEF,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,iFAAiF;IACjF,wEAAwE;IACxE,MAAM,SAAS,GAAG,IAAI;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,+EAA+E;IAC/E,OAAO,CAAC,qBAAqB,EAAE,wDAAwD,CAAC,IAAI,CAC3F,SAAS,CACT,EAAE,iDAAiD;QACnD,mEAAmE,CAAC,CAAC;IACtE,yEAAyE;IACzE,wDAAwD;IACxD,OAAO,CAAC,8BAA8B,EAAE,8DAA8D,CAAC,IAAI,CAC1G,SAAS,CACT,EAAE,+CAA+C;QACjD,mDAAmD,CAAC,CAAC;IACtD,6EAA6E;IAC7E,0CAA0C;IAC1C,OAAO,CAAC,gBAAgB,EAAE,CAAC,mCAAmC,CAAC,IAAI,CAClE,SAAS,CACT,EAAE,0EAA0E;QAC5E,+CAA+C,CAAC,CAAC;IAClD,+DAA+D;IAC/D,OAAO,CAAC,2BAA2B,EAAE,6HAA6H,CAAC,IAAI,CACtK,SAAS,CACT,EAAE,0EAA0E;QAC5E,4EAA4E,CAAC,CAAC;IAC/E,OAAO,CAAC,4BAA4B,EAAE,sBAAsB,CAAC,IAAI,CAChE,IAAI,CACJ,EAAE,wEAAwE,CAAC,CAAC;IAC7E,OAAO,CAAC,kBAAkB,EAAE,CAAC,sBAAsB,CAAC,IAAI,CACvD,SAAS,CACT,EAAE,yEAAyE,CAAC,CAAC;IAC9E,OAAO,CAAC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,IAAI,CACrD,SAAS,CACT,EAAE,uEAAuE;QACzE,iCAAiC,CAAC,CAAC;IAEpC,+EAA+E;IAC/E,OAAO,CAAC,uBAAuB,EAAE,mDAAmD,CAAC,IAAI,CACxF,IAAI,CACJ,EAAE,gEAAgE,CAAC,CAAC;IACrE,OAAO,CAAC,+BAA+B,EAAE,2DAA2D,CAAC,IAAI,CACxG,IAAI,CACJ,EAAE,0CAA0C;QAC5C,sEAAsE,CAAC,CAAC;IACzE,OAAO,CAAC,eAAe,EAAE,oDAAoD,CAAC,IAAI,CACjF,IAAI,CACJ,EAAE,yDAAyD,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,OAAO,CAAC,6BAA6B,EAAE,qFAAqF,CAAC,IAAI,CAChI,SAAS,CACT,EAAE,4EAA4E,CAAC,CAAC;IAEjF,gFAAgF;IAChF,OAAO,CAAC,2BAA2B,EAAE,CAAC,wDAAwD,CAAC,IAAI,CAClG,IAAI,CACJ,EAAE,wEAAwE;QAC1E,oEAAoE,CAAC,CAAC;IACvE,OAAO,CAAC,kBAAkB,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAChE,SAAS,CACT,EAAE,yEAAyE,CAAC,CAAC;IAC9E,OAAO,CAAC,kCAAkC,EAAE,qBAAqB,CAAC,IAAI,CACrE,IAAI,CACJ,EAAE,sEAAsE;QACxE,2DAA2D,CAAC,CAAC;IAE9D,gFAAgF;IAChF,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,OAAO,CAAC,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAC7D,SAAS,CACT,EAAE,uEAAuE;QACzE,uEAAuE,CAAC,CAAC;IAC1E,OAAO,CAAC,uBAAuB,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAC3D,SAAS,CACT,EAAE,sEAAsE;QACxE,uEAAuE,CAAC,CAAC;IAC1E,OAAO,CAAC,6BAA6B,EAAE,6BAA6B,CAAC,IAAI,CACxE,IAAI,CACJ;QACA,oCAAoC,CAAC,IAAI,CACxC,IAAI,CACJ,EAAE,yEAAyE;QAC5E,gEAAgE;QAChE,oEAAoE,CAAC,CAAC;IAEvE,+EAA+E;IAC/E,OAAO,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,IAAI,CAC5D,SAAS,CACT,EAAE,yEAAyE;QAC3E,+DAA+D,CAAC,CAAC;IAClE,OAAO,CAAC,oBAAoB,EAAE,CAAC,iBAAiB,CAAC,IAAI,CACpD,SAAS,CACT,EAAE,4EAA4E;QAC9E,oEAAoE,CAAC,CAAC;IAEvE,8EAA8E;IAC9E,OAAO,CAAC,kBAAkB,EAAE,CAAC,cAAc,CAAC,IAAI,CAC/C,SAAS,CACT,EAAE,0EAA0E,CAAC,CAAC;IAC/E,OAAO,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAClD,SAAS,CACT,EAAE,gEAAgE,CAAC,CAAC;IAErE,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,IAAI,CAClE,IAAI,CACJ,EAAE,yEAAyE,CAAC,CAAC;IAC9E,OAAO,CAAC,uBAAuB,EAAE,iEAAiE,CAAC,IAAI,CACtG,IAAI,CACJ,EAAE,yEAAyE;QAC3E,yCAAyC,CAAC,CAAC;IAE5C,+EAA+E;IAC/E,OAAO,CAAC,yBAAyB,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAChE,IAAI,CACJ,EAAE,wEAAwE;QAC1E,gEAAgE,CAAC,CAAC;IACnE,yEAAyE;IACzE,sDAAsD;IACtD,OAAO,CAAC,kCAAkC,EAAE,CAAC,uBAAuB,CAAC,IAAI,CACxE,SAAS;SACP,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACnE,IAAI,CAAC,IAAI,CAAC,CACZ,EAAE,+DAA+D,CAAC,CAAC;IAEpE,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}