team 0.1.1 → 0.2.0

package/dist/file/sections/seats.js

@@ -0,0 +1,161 @@
+import { CLIS } from "../../clis.js";
+import { insideProject, insideTrust, normalize } from "../paths.js";
+import { hasVersionToken } from "../signature.js";
+import { valueOf } from "./section.js";
+import { MODES } from "./workspace.js";
+export const seats = {
+    name: 'seats',
+    owner: false,
+    after: ['trust', 'budgets'],
+    validate(entry, ctx) {
+        const trust = valueOf(ctx, 'trust');
+        const accounts = valueOf(ctx, 'budgets').declared;
+        return readSeats(entry, ctx.check, trust, ctx.root.line, ctx.broken, accounts);
+    },
+    schema: {
+        type: 'array',
+        minItems: 1,
+        items: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                role: { type: 'string', minLength: 1 },
+                name: { type: 'string', pattern: '^[A-Za-z0-9][A-Za-z0-9._-]*$' },
+                cli: { enum: CLIS },
+                vendor: { type: 'string', minLength: 1 },
+                account: { type: 'string' },
+                model: { type: 'string', minLength: 1 },
+                version: { type: 'string', $comment: 'quoted: unquoted, YAML reads 4.10 as the number 4.1' },
+                display: { type: 'string', $comment: 'defaults to "model version"; must contain the version as a token of its own' },
+                launch: { type: 'string', minLength: 1 },
+                cwd: { type: 'string', $comment: 'relative to the project, or a trust path' },
+                label: { type: 'string' },
+                mode: { enum: MODES },
+                parked: { type: 'boolean' },
+                stopped: { type: 'boolean' },
+                count: { type: 'integer', minimum: 1 },
+            },
+            required: ['role', 'name', 'cli', 'vendor', 'model', 'version', 'launch'],
+            $comment: 'account must name a key of budgets.accounts; label defaults to the model and version; a seat with count is neither lead',
+        },
+    },
+};
+// `broken` collects the names of seats left out for their own problems, so that a reference to
+// one is not reported a second time. `accounts` is the names the file's budgets declare: a seat
+// that names an `account:` must name one of these, or it would silently spend nothing budgeted.
+function readSeats(entry, check, trust, topLine, broken, accounts) {
+    if (!entry) {
+        check.fail(topLine, 'seats is required: at least the coordinator\'s and the operator\'s seat');
+        return [];
+    }
+    if (entry.value.kind !== 'seq' || !entry.value.items.length) {
+        check.fail(entry.value.line, 'seats must be a list with at least one seat');
+        return [];
+    }
+    const seats = [];
+    for (const item of entry.value.items) {
+        const fields = check.fields(item, 'a seat', [
+            'role', 'name', 'cli', 'vendor', 'account', 'model', 'version', 'display', 'launch', 'cwd', 'label', 'mode',
+            'parked', 'stopped', 'count',
+        ]);
+        if (item.kind !== 'map')
+            continue;
+        const line = item.line;
+        const role = check.required(fields.get('role'), 'a seat\'s role', line);
+        const name = check.required(fields.get('name'), 'a seat\'s name', line);
+        const at = name ? `seat "${name}"` : 'a seat';
+        if (name && !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) {
+            check.fail(fields.get('name')?.line ?? line, `${at}: the name takes letters, digits, ".", "_" and "-"`);
+        }
+        if (!fields.get('cli'))
+            check.fail(line, `${at}: cli is required`);
+        const cli = check.oneOf(fields.get('cli'), `${at}: cli`, CLIS);
+        const vendor = check.required(fields.get('vendor'), `${at}: vendor`, line);
+        // The account whose budget the seat spends, when the vendor's name is not it (§ 3b). Optional:
+        // absent, the seat spends its vendor, and the fingerprint of every file written so far is
+        // unchanged. Named, it must be one of the budgets' accounts: a typo would take the seat out of
+        // every budget with no warning at all.
+        const account = check.text(fields.get('account'), `${at}: account`);
+        if (account !== undefined && !accounts.has(account)) {
+            check.fail(fields.get('account')?.line ?? line, `${at}: account "${account}" is not in budgets.accounts`);
+        }
+        const model = check.required(fields.get('model'), `${at}: model`, line);
+        const version = readVersion(fields.get('version'), at, line, check);
+        const launch = check.required(fields.get('launch'), `${at}: launch`, line);
+        const display = check.text(fields.get('display'), `${at}: display`) ?? (model && version ? `${model} ${version}` : undefined);
+        if (display && version && fields.get('display') && !hasVersionToken(display, version)) {
+            check.fail(fields.get('display')?.line ?? line, `${at}: display must contain the version "${version}" as a token of its own`);
+        }
+        const cwd = readCwd(fields.get('cwd'), at, trust, check);
+        const mode = check.oneOf(fields.get('mode'), `${at}: mode`, MODES);
+        const parked = check.flag(fields.get('parked'), `${at}: parked`);
+        const stopped = check.flag(fields.get('stopped'), `${at}: stopped`);
+        const count = check.whole(fields.get('count'), `${at}: count`, 1) ?? 1;
+        const label = check.text(fields.get('label'), `${at}: label`);
+        // Left out, the herdr title is the model and version. A written label wins, so a file that
+        // already names one keeps the title, and the fingerprint, it had.
+        if (!role || !name || !cli || !vendor || !model || !version || !launch || !display) {
+            if (name)
+                broken.add(name);
+            continue;
+        }
+        for (let instance = 1; instance <= count; instance++) {
+            const suffix = instance === 1 ? '' : `-${instance}`;
+            seats.push({
+                role, cli, vendor, model, version, display, launch, cwd, parked, stopped, line,
+                name: name + suffix,
+                label: (label ?? defaultLabel(model, version)) + suffix,
+                declared: name,
+                count,
+                instance,
+                ...(account ? { account } : {}),
+                ...(mode ? { mode } : {}),
+            });
+        }
+    }
+    reportCollisions(seats, 'name', check);
+    return seats;
+}
+export function defaultLabel(model, version) {
+    return `${model} ${version}`.toLowerCase();
+}
+function readVersion(entry, at, line, check) {
+    if (!entry) {
+        check.fail(line, `${at}: version is required`);
+        return undefined;
+    }
+    const node = entry.value;
+    if (node.kind === 'scalar' && typeof node.value === 'string' && node.value !== '')
+        return node.value;
+    if (node.kind === 'scalar' && typeof node.value === 'number') {
+        check.fail(node.line, `${at}: version must be quoted ("${node.raw}"): unquoted, YAML reads it as a number and 4.10 becomes 4.1`);
+    }
+    else
+        check.fail(node.line, `${at}: version must be quoted text`);
+    return undefined;
+}
+function readCwd(entry, at, trust, check) {
+    const cwd = check.text(entry, `${at}: cwd`);
+    if (cwd === undefined || !entry)
+        return '.';
+    if (cwd.startsWith('/') || cwd.startsWith('~') || /^[A-Za-z]:[\\/]/.test(cwd)) {
+        check.fail(entry.value.line, `${at}: cwd must be relative to the project, never absolute and never "~"`);
+        return '.';
+    }
+    const path = normalize(cwd);
+    if (!insideProject(path) && !insideTrust(path, trust)) {
+        check.fail(entry.value.line, `${at}: cwd "${cwd}" is outside the project and matches no trust path`);
+    }
+    return path;
+}
+function reportCollisions(seats, field, check) {
+    const seen = new Map();
+    for (const seat of seats) {
+        const first = seen.get(seat[field]);
+        if (!first)
+            seen.set(seat[field], seat);
+        else if (first.line !== seat.line || first.instance === seat.instance) {
+            check.fail(seat.line, `two seats have the ${field} "${seat[field]}" (the other is on line ${first.line}${first.count > 1 || seat.count > 1 ? ', after count is expanded' : ''})`);
+        }
+    }
+}

package/dist/file/sections/section.d.ts

@@ -0,0 +1,32 @@
+import type { YamlEntry, YamlNode } from '../../yaml.ts';
+import type { Check, Fields } from '../check.ts';
+/** What a section reads and writes while the file is validated. */
+export interface Ctx {
+    /** Every problem and warning, and the field helpers that report them. */
+    check: Check;
+    /** The whole file, for errors that belong to the file itself rather than one section. */
+    root: YamlNode;
+    /** The file's own fields, by top-level key. */
+    top: Fields;
+    /** The names of seats left out for their own problems, shared with the sections that name seats. */
+    broken: Set<string>;
+    /** Each section's value, set once the section has run. */
+    values: Map<string, unknown>;
+}
+/** A section's value, once every section it names in `after` has run. */
+export declare function valueOf<T>(ctx: Ctx, name: string): T;
+/** A JSON Schema fragment for one section, assembled into the file's schema by the generator. */
+export type JsonSchema = Record<string, unknown>;
+/** One top-level section of the team file, read and checked on its own. */
+export interface Section {
+    /** The top-level key; `watch.checks` names a line inside `watch`, not a key of its own. */
+    name: string;
+    /** True when only the owner changes it: `team approve` fingerprints exactly these, in list order. */
+    owner: boolean;
+    /** The sections whose value this one reads; the validator runs it once those have run. */
+    after: readonly string[];
+    /** The code from `validate.ts`, moved as it was: reads its entry, reports, returns its value. */
+    validate(entry: YamlEntry | undefined, ctx: Ctx): unknown;
+    /** The JSON Schema fragment for this section. */
+    schema: JsonSchema;
+}

package/dist/file/sections/section.js

@@ -0,0 +1,7 @@
+/** A section's value, once every section it names in `after` has run. */
+export function valueOf(ctx, name) {
+    const value = ctx.values.get(name);
+    if (value === undefined)
+        throw new Error(`section "${name}" has not run before its reader; name it in "after"`);
+    return value;
+}

package/dist/file/sections/session.d.ts

@@ -0,0 +1,2 @@
+import type { Section } from './section.ts';
+export declare const session: Section;

package/dist/file/sections/session.js

@@ -0,0 +1,16 @@
+import { valueOf } from "./section.js";
+export const session = {
+    name: 'session',
+    owner: true,
+    after: ['project'],
+    validate(entry, ctx) {
+        const project = valueOf(ctx, 'project');
+        const session = ctx.check.text(entry, 'session') ?? project;
+        if (session === 'default') {
+            ctx.check.fail(ctx.top.get('session')?.line ?? ctx.top.get('project')?.line ?? 1, 'session can\'t be "default", herdr\'s own session: give the team a session of its own');
+        }
+        return session;
+    },
+    // The team's own herdr session, defaulting to the project's name — never `default`, herdr's own.
+    schema: { type: 'string', not: { const: 'default' } },
+};

package/dist/file/sections/tools.d.ts

@@ -0,0 +1,2 @@
+import type { Section } from './section.ts';
+export declare const tools: Section;

package/dist/file/sections/tools.js

@@ -0,0 +1,43 @@
+export const tools = {
+    name: 'tools',
+    owner: true,
+    after: [],
+    validate(entry, ctx) {
+        return readTools(entry, ctx.check);
+    },
+    schema: {
+        type: 'object',
+        additionalProperties: {
+            type: 'object',
+            properties: { kind: { type: 'string', minLength: 1 } },
+            required: ['kind'],
+            additionalProperties: { type: 'string' },
+        },
+        $comment: 'a tool is a name, then its kind and where it is; every field but the kind is text',
+    },
+};
+function readTools(entry, check) {
+    const tools = {};
+    if (!entry)
+        return tools;
+    if (entry.value.kind !== 'map') {
+        check.fail(entry.value.line, 'tools must be a map: a name, then its kind and where it is');
+        return tools;
+    }
+    for (const tool of entry.value.entries) {
+        const fields = {};
+        if (tool.value.kind !== 'map') {
+            check.fail(tool.value.line, `tools.${tool.key} must be a map with a kind`);
+            continue;
+        }
+        for (const field of tool.value.entries) {
+            const value = check.text(field, `tools.${tool.key}.${field.key}`);
+            if (value !== undefined)
+                fields[field.key] = value;
+        }
+        if (!('kind' in fields))
+            check.fail(tool.line, `tools.${tool.key} needs a kind`);
+        tools[tool.key] = fields;
+    }
+    return tools;
+}

package/dist/file/sections/trust.d.ts

@@ -0,0 +1,2 @@
+import type { Section } from './section.ts';
+export declare const trust: Section;

package/dist/file/sections/trust.js

@@ -0,0 +1,20 @@
+import { trustProblem } from "../paths.js";
+export const trust = {
+    name: 'trust',
+    owner: true,
+    after: [],
+    validate(entry, ctx) {
+        const trustItems = ctx.check.list(entry, 'trust');
+        for (const item of trustItems) {
+            const problem = trustProblem(item.value);
+            if (problem)
+                ctx.check.fail(item.line, `trust: "${item.value}" ${problem}`);
+        }
+        return trustItems.map((item) => item.value);
+    },
+    schema: {
+        type: 'array',
+        items: { type: 'string', minLength: 1 },
+        $comment: 'paths outside the project the seats may still work in, as the validator reads them',
+    },
+};

package/dist/file/sections/units.d.ts

@@ -0,0 +1,16 @@
+import type { JsonSchema } from './section.ts';
+export declare const DURATION: {
+    s: number;
+    m: number;
+    h: number;
+};
+export declare const PERCENT: {
+    '%': number;
+};
+export declare const SIZE: {
+    MB: number;
+    GB: number;
+    TB: number;
+};
+/** The schema of a measure, its unit tables deciding the pattern the text must fit. */
+export declare function measureSchema(units: Record<string, number>): JsonSchema;

package/dist/file/sections/units.js

@@ -0,0 +1,8 @@
+export const DURATION = { s: 1, m: 60, h: 3600 };
+export const PERCENT = { '%': 1 };
+export const SIZE = { MB: 1e6, GB: 1e9, TB: 1e12 };
+/** The schema of a measure, its unit tables deciding the pattern the text must fit. */
+export function measureSchema(units) {
+    const unit = Object.keys(units).join('|');
+    return { type: 'string', pattern: `^[0-9]+(?:\\.[0-9]+)?(${unit})$` };
+}

package/dist/file/sections/visibility.d.ts

@@ -0,0 +1,2 @@
+import type { Section } from './section.ts';
+export declare const visibility: Section;

package/dist/file/sections/visibility.js

@@ -0,0 +1,12 @@
+import { valueOf } from "./section.js";
+export const visibility = {
+    name: 'visibility',
+    owner: true,
+    after: ['identity'],
+    validate(entry, ctx) {
+        const identity = valueOf(ctx, 'identity');
+        return ctx.check.oneOf(entry, 'visibility', ['public', 'private'])
+            ?? (identity.forbiddenPublic.length ? 'public' : 'private');
+    },
+    schema: { enum: ['public', 'private'] },
+};

package/dist/file/sections/watch-checks.d.ts

@@ -0,0 +1,9 @@
+import type { Section } from './section.ts';
+/**
+ * Not a top-level key: the line inside `watch` that turns a check off. It stands in the list
+ * because the owner-only sections are generated from it, and its digest is its own — turning a
+ * check off reads as `watch.checks` changed, never as a threshold change too. The checks
+ * themselves are read by `watch`, so this section validates nothing: it is a name in the list,
+ * and a fragment that lives inside the watch one.
+ */
+export declare const watchChecks: Section;

package/dist/file/sections/watch-checks.js

@@ -0,0 +1,14 @@
+/**
+ * Not a top-level key: the line inside `watch` that turns a check off. It stands in the list
+ * because the owner-only sections are generated from it, and its digest is its own — turning a
+ * check off reads as `watch.checks` changed, never as a threshold change too. The checks
+ * themselves are read by `watch`, so this section validates nothing: it is a name in the list,
+ * and a fragment that lives inside the watch one.
+ */
+export const watchChecks = {
+    name: 'watch.checks',
+    owner: true,
+    after: [],
+    validate: () => undefined,
+    schema: { $comment: 'inside watch: the checks property of the watch fragment' },
+};

package/dist/file/sections/watch.d.ts

@@ -0,0 +1,14 @@
+import type { TeamFile } from '../types.ts';
+import type { Section } from './section.ts';
+/** What the watch section hands the rest of the file: its value, and whether the old marks key was set. */
+export interface Watched {
+    watch: TeamFile['watch'];
+    /** `watch.quota_marks` was written: `budgets.marks` warns that it replaces it. */
+    legacyMarks: boolean;
+}
+export declare const watch: Section;
+/**
+ * The watch values a file that sets none runs with — and, since the section is the owner's, the
+ * values a file runs with until the owner approves what it sets instead.
+ */
+export declare function defaultWatch(): TeamFile['watch'];

package/dist/file/sections/watch.js

@@ -0,0 +1,111 @@
+import { ALWAYS_ON, CHECK_NAMES } from "../../watch/check.js";
+import { measureSchema, DURATION } from "./units.js";
+export const watch = {
+    name: 'watch',
+    owner: true,
+    after: [],
+    validate(entry, ctx) {
+        return readWatch(entry, ctx.check);
+    },
+    schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+            interval: measureSchema(DURATION),
+            idle_first: measureSchema(DURATION),
+            idle_repeat: measureSchema(DURATION),
+            team_idle: measureSchema(DURATION),
+            nudge_wait: measureSchema(DURATION),
+            unsent_after: measureSchema(DURATION),
+            quota_marks: {
+                type: 'array',
+                items: { type: 'number', exclusiveMinimum: 0, maximum: 100 },
+                deprecated: true,
+                $comment: 'now budgets.marks, and still read',
+            },
+            checks: {
+                type: 'object',
+                propertyNames: { enum: CHECK_NAMES.filter((name) => !ALWAYS_ON.includes(name)) },
+                additionalProperties: { const: 'off' },
+                $comment: 'the four that always run (attention, missing, model-drift, approval) are refused here too',
+            },
+        },
+    },
+};
+/**
+ * The watch values a file that sets none runs with — and, since the section is the owner's, the
+ * values a file runs with until the owner approves what it sets instead.
+ */
+export function defaultWatch() {
+    return {
+        interval: 120,
+        idleFirst: 600,
+        idleRepeat: 1200,
+        teamIdle: 600,
+        nudgeWait: 600,
+        unsentAfter: 60,
+        quotaMarks: [50, 75, 90],
+        checks: [],
+    };
+}
+function readWatch(entry, check) {
+    const fields = check.fields(entry?.value, 'watch', [
+        'interval', 'idle_first', 'idle_repeat', 'team_idle', 'nudge_wait', 'unsent_after', 'quota_marks', 'checks',
+    ]);
+    const time = (name, fallback) => check.measure(fields.get(name), `watch.${name}`, DURATION, '120s or 10m') ?? fallback;
+    const base = defaultWatch();
+    let quotaMarks = base.quotaMarks;
+    const marks = fields.get('quota_marks');
+    if (marks) {
+        const node = marks.value;
+        const numbers = node.kind === 'seq' ? node.items.map((item) => (item.kind === 'scalar' ? item.value : null)) : null;
+        if (numbers && numbers.every((n) => typeof n === 'number' && n > 0 && n <= 100))
+            quotaMarks = numbers;
+        else
+            check.fail(node.line, 'watch.quota_marks must be a list of percentages, such as [50, 75, 90]');
+        check.warnings.push({ line: node.line, message: 'watch.quota_marks is now budgets.marks, and is still read' });
+    }
+    return {
+        legacyMarks: Boolean(marks),
+        watch: {
+            interval: time('interval', base.interval),
+            idleFirst: time('idle_first', base.idleFirst),
+            idleRepeat: time('idle_repeat', base.idleRepeat),
+            teamIdle: time('team_idle', base.teamIdle),
+            nudgeWait: time('nudge_wait', base.nudgeWait),
+            unsentAfter: time('unsent_after', base.unsentAfter),
+            quotaMarks,
+            checks: readChecks(fields.get('checks'), check),
+        },
+    };
+}
+// The checks a file turns off: a map of check name to `off`. A name that doesn't exist is refused
+// with its line, and so is one of the four that always run (RFC 0002 § 4.2) — the schema refuses
+// them, and `team approve` validates before it fingerprints, so neither can approve them either.
+function readChecks(entry, check) {
+    const off = [];
+    if (!entry)
+        return off;
+    const node = entry.value;
+    if (node.kind !== 'map') {
+        if (!(node.kind === 'scalar' && node.value === null)) {
+            check.fail(node.line, 'watch.checks must be a map: a check named, and set off');
+        }
+        return off;
+    }
+    for (const item of node.entries) {
+        if (!CHECK_NAMES.includes(item.key)) {
+            check.fail(item.line, `unknown check "${item.key}" in watch.checks: the checks are ${CHECK_NAMES.join(', ')}`);
+            continue;
+        }
+        if (ALWAYS_ON.includes(item.key)) {
+            check.fail(item.line, `watch.checks can't turn off ${item.key}: ${ALWAYS_ON.join(', ')} always run`);
+            continue;
+        }
+        if (item.value.kind === 'scalar' && item.value.value === 'off')
+            off.push(item.key);
+        else
+            check.fail(item.line, `watch.checks.${item.key} must be off: the only setting is off`);
+    }
+    return off;
+}

package/dist/file/sections/workspace.d.ts

@@ -0,0 +1,4 @@
+import type { Mode } from '../types.ts';
+import type { Section } from './section.ts';
+export declare const MODES: Mode[];
+export declare const workspace: Section;

package/dist/file/sections/workspace.js

@@ -0,0 +1,77 @@
+import { insideTrust, normalize } from "../paths.js";
+import { valueOf } from "./section.js";
+export const MODES = ['worktree', 'shared'];
+export const workspace = {
+    name: 'workspace',
+    owner: true,
+    after: ['seats', 'project', 'trust'],
+    validate(entry, ctx) {
+        const project = valueOf(ctx, 'project');
+        const trust = valueOf(ctx, 'trust');
+        const seats = valueOf(ctx, 'seats');
+        return readWorkspace(entry, ctx.check, project, trust, seats, ctx.root.line);
+    },
+    schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+            mode: { enum: MODES },
+            path: { type: 'string', pattern: '(^|/)\\{task\\}$' },
+            branch: { type: 'string' },
+            base: { type: 'string' },
+            setup: { type: 'array', items: { type: 'string' } },
+            remove: { enum: ['on-merge', 'manual'] },
+            protected: { type: 'array', items: { type: 'string' } },
+            limit: { type: 'integer', minimum: 1 },
+        },
+        $comment: 'path ends with the segment {task} under a fixed folder of its own, inside a trust pattern; branch defaults to {task}, base and path are required when a seat works in worktrees — the validator checks what a pattern cannot say',
+    },
+};
+function readWorkspace(entry, check, project, trust, seats, topLine) {
+    const fields = check.fields(entry?.value, 'workspace', ['mode', 'path', 'branch', 'base', 'setup', 'remove', 'protected', 'limit']);
+    const mode = check.oneOf(fields.get('mode'), 'workspace.mode', MODES) ?? 'worktree';
+    const usesWorktrees = seats.some((seat) => (seat.mode ?? mode) === 'worktree');
+    const line = entry?.line ?? topLine;
+    const path = check.text(fields.get('path'), 'workspace.path') ?? null;
+    const base = check.text(fields.get('base'), 'workspace.base') ?? null;
+    if (usesWorktrees && !base)
+        check.fail(line, 'workspace.base is required when a seat works in worktrees');
+    if (usesWorktrees && !path)
+        check.fail(line, 'workspace.path is required when a seat works in worktrees');
+    if (path) {
+        const at = fields.get('path')?.value.line ?? line;
+        const problem = worktreePathProblem(path, project, trust);
+        if (problem)
+            check.fail(at, `workspace.path ${problem}`);
+    }
+    const protectedPaths = fields.get('protected') ? check.list(fields.get('protected'), 'workspace.protected').map((item) => item.value) : ['.'];
+    return {
+        mode,
+        path,
+        branch: check.text(fields.get('branch'), 'workspace.branch') ?? '{task}',
+        base,
+        setup: check.list(fields.get('setup'), 'workspace.setup').map((item) => item.value),
+        remove: check.oneOf(fields.get('remove'), 'workspace.remove', ['on-merge', 'manual']) ?? 'on-merge',
+        protected: protectedPaths,
+        limit: check.whole(fields.get('limit'), 'workspace.limit', 1) ?? 8,
+    };
+}
+// A worktree goes under a fixed folder of its own, and inside a trust path.
+function worktreePathProblem(path, project, trust) {
+    if (path.startsWith('/') || path.startsWith('~'))
+        return 'must be relative to the project';
+    const segments = path.split('/').filter((segment) => segment && segment !== '.');
+    const last = segments[segments.length - 1];
+    if (last !== '{task}')
+        return 'must end with the segment {task}';
+    if (segments.slice(0, -1).some((segment) => segment.includes('{task}')))
+        return 'takes {task} only as its last segment';
+    const folder = segments.slice(0, -1).map((segment) => segment.replaceAll('{repo}', project || 'project'));
+    if (folder.every((segment) => segment === '..')) {
+        return 'needs a fixed folder of its own before {task}: this one puts worktrees straight into the project or one of its parents';
+    }
+    const sample = normalize([...folder, 'task'].join('/'));
+    if (!insideTrust(sample, trust))
+        return 'matches no trust pattern';
+    return null;
+}

package/dist/file/types.d.ts

@@ -24,11 +24,17 @@ export type Seat = {
     name: string;
     cli: string;
     vendor: string;
+    /**
+     * The account whose budget this seat spends, when one vendor has two (RFC 0003 § 3b). Absent
+     * means the vendor is the account; a seat that names one spends it instead of the vendor.
+     */
+    account?: string;
     model: string;
     version: string;
     display: string;
     launch: string;
     cwd: string;
+    /** Herdr workspace title. Omitted in the file, it is `<model> <version>` in lowercase. */
     label: string;
     mode: Mode;
     parked: boolean;

package/dist/file/validate.d.ts

@@ -1,13 +1,5 @@
-import type { TeamFile, ValidateResult } from './types.ts';
+import type { ValidateResult } from './types.ts';
+export { defaultLabel } from './sections/seats.ts';
+export { defaultWatch } from './sections/watch.ts';
+export { defaultBudgets } from './sections/budgets.ts';
 export declare function validateTeamFile(text: string): ValidateResult;
-/**
- * The watch values a file that sets none runs with — and, since the section is the owner's, the
- * values a file runs with until the owner approves what it sets instead.
- */
-export declare function defaultWatch(): TeamFile['watch'];
-/**
- * The budget values a file that sets none runs with — and, since the section is the owner's, the
- * values a file runs with until the owner approves what it sets instead. No accounts: nothing is
- * budgeted until the owner names one.
- */
-export declare function defaultBudgets(): TeamFile['budgets'];