@intentius/chant-lexicon-sql 0.124.54 → 0.124.55

package/dist/exit-codes.d.ts

@@ -0,0 +1,69 @@
+/**
+ * SQL engine outcomes mapped onto chant's exit-code table (#4553, `CHANT_EXIT`
+ * in `@intentius/chant/exit-codes`), for the versioned migration engine chant
+ * runs through the sql capability (sql-yodeler, `yodel`).
+ *
+ * sql-yodeler from sql-yodeler#288 on exits by chant's table, so its codes
+ * pass through. An older yodel has its own table, where 3 means anything
+ * outstanding (lint errors included) and 4 every refusal; {@link yodelExitOf}
+ * reads one of those with the command it came from.
+ *
+ * | Engine outcome | Table |
+ * |---|---|
+ * | applied, nothing pending, stood down at plan time | `done` |
+ * | a wave plan that moved (`WavePlanMoved`), an approval of another digest | `moved` |
+ * | a policy rule denies the plan and no override counts | `denied` |
+ * | another apply holds the history lock | `held` |
+ * | a newer commit on the branch applies the same environment (stand-down) | `superseded` |
+ * | an apply stopped at its gate, pending migrations under `yodel status`, a migration the required environment has not applied, a change that needs an Op the engine does not run, a manual step | `waiting` |
+ * | drift found by `yodel drift` | `drift` |
+ * | a checksum mismatch, a fork, an out-of-order migration, an applied migration gone from the directory, reader and writer one identity, a write run with the reader, lint errors | `failed` |
+ */
+import { type ChantExitCode } from "@intentius/chant/exit-codes";
+/** An outcome of the versioned migration engine, by name. */
+export type SqlEngineOutcome = "applied" | "unchanged" | "plan-moved" | "approval-moved" | "policy-denied" | "lock-held" | "stood-down" | "gated" | "pending" | "promotion-unmet" | "needs-op" | "manual-step" | "drift" | "checksum-mismatch" | "fork" | "out-of-order" | "directory" | "shared-identity" | "reader-write" | "lint-errors" | "failed";
+/**
+ * The table's code for an engine outcome. A refusal no approval fixes is
+ * `failed`; one a person can clear (a gate, an unmet promotion) is `waiting`.
+ */
+export declare function sqlExitOf(outcome: SqlEngineOutcome): ChantExitCode;
+/** Whether `outcome` is a plan that moved since its approval. */
+export declare function sqlPlanMoved(outcome: SqlEngineOutcome): boolean;
+/** yodel's own exit table before sql-yodeler#288 (its `src/exit.ts` up to 0.10). */
+export declare const YODEL_LEGACY_EXIT: {
+    readonly ok: 0;
+    readonly error: 1;
+    /** Something yodel will not do itself; drift, for `yodel drift`. */
+    readonly needsOp: 2;
+    /** Something outstanding: a gate, pending migrations, lint errors. */
+    readonly outstanding: 3;
+    /** Refused, nothing done: every refusal, policy denials and unmet promotions included. */
+    readonly refused: 4;
+    readonly locked: 5;
+};
+/** A `yodel` exit status and the command it came from. */
+export interface YodelExitSource {
+    code: number | null | undefined;
+    /** The yodel verb (`apply`, `status`, `lint`, `drift`, ...). */
+    command?: string;
+    /** The yodel predates sql-yodeler#288 and exits by {@link YODEL_LEGACY_EXIT}. */
+    legacy?: boolean;
+}
+/**
+ * The table's code for a `yodel` exit status. A yodel on chant's table passes
+ * through (a code outside the table is `failed`). A legacy yodel's codes are
+ * read by meaning:
+ *
+ * | legacy yodel | Table |
+ * |---|---|
+ * | 0 | `done` |
+ * | 2 from `yodel drift` | `drift` |
+ * | 2 from any other verb, a change that needs an Op or a manual step | `waiting` |
+ * | 3 from `yodel lint` | `failed` (sql-yodeler#285 ruling C) |
+ * | 3 from any other verb | `waiting` |
+ * | 4, any refusal | `failed`: the legacy code does not tell a policy denial or an unmet promotion apart |
+ * | 5 | `held` |
+ * | 1, anything else | `failed` |
+ */
+export declare function yodelExitOf(source: YodelExitSource): ChantExitCode;
+//# sourceMappingURL=exit-codes.d.ts.map

package/dist/exit-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-codes.d.ts","sourceRoot":"","sources":["../src/exit-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE7E,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,gBAAgB,GAChB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,iBAAiB,GACjB,UAAU,GACV,aAAa,GACb,OAAO,GACP,mBAAmB,GACnB,MAAM,GACN,cAAc,GACd,WAAW,GACX,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,QAAQ,CAAC;AA0Bb;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAElE;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAE/D;AAED,oFAAoF;AACpF,eAAO,MAAM,iBAAiB;;;IAG5B,oEAAoE;;IAEpE,sEAAsE;;IAEtE,0FAA0F;;;CAGlF,CAAC;AAEX,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,aAAa,CAiBlE"}

package/dist/exit-codes.js

@@ -0,0 +1,105 @@
+/**
+ * SQL engine outcomes mapped onto chant's exit-code table (#4553, `CHANT_EXIT`
+ * in `@intentius/chant/exit-codes`), for the versioned migration engine chant
+ * runs through the sql capability (sql-yodeler, `yodel`).
+ *
+ * sql-yodeler from sql-yodeler#288 on exits by chant's table, so its codes
+ * pass through. An older yodel has its own table, where 3 means anything
+ * outstanding (lint errors included) and 4 every refusal; {@link yodelExitOf}
+ * reads one of those with the command it came from.
+ *
+ * | Engine outcome | Table |
+ * |---|---|
+ * | applied, nothing pending, stood down at plan time | `done` |
+ * | a wave plan that moved (`WavePlanMoved`), an approval of another digest | `moved` |
+ * | a policy rule denies the plan and no override counts | `denied` |
+ * | another apply holds the history lock | `held` |
+ * | a newer commit on the branch applies the same environment (stand-down) | `superseded` |
+ * | an apply stopped at its gate, pending migrations under `yodel status`, a migration the required environment has not applied, a change that needs an Op the engine does not run, a manual step | `waiting` |
+ * | drift found by `yodel drift` | `drift` |
+ * | a checksum mismatch, a fork, an out-of-order migration, an applied migration gone from the directory, reader and writer one identity, a write run with the reader, lint errors | `failed` |
+ */
+import { CHANT_EXIT } from "@intentius/chant/exit-codes";
+const OUTCOME_EXIT = {
+    applied: CHANT_EXIT.done,
+    unchanged: CHANT_EXIT.done,
+    "plan-moved": CHANT_EXIT.moved,
+    "approval-moved": CHANT_EXIT.moved,
+    "policy-denied": CHANT_EXIT.denied,
+    "lock-held": CHANT_EXIT.held,
+    "stood-down": CHANT_EXIT.superseded,
+    gated: CHANT_EXIT.waiting,
+    pending: CHANT_EXIT.waiting,
+    "promotion-unmet": CHANT_EXIT.waiting,
+    "needs-op": CHANT_EXIT.waiting,
+    "manual-step": CHANT_EXIT.waiting,
+    drift: CHANT_EXIT.drift,
+    "checksum-mismatch": CHANT_EXIT.failed,
+    fork: CHANT_EXIT.failed,
+    "out-of-order": CHANT_EXIT.failed,
+    directory: CHANT_EXIT.failed,
+    "shared-identity": CHANT_EXIT.failed,
+    "reader-write": CHANT_EXIT.failed,
+    "lint-errors": CHANT_EXIT.failed,
+    failed: CHANT_EXIT.failed,
+};
+/**
+ * The table's code for an engine outcome. A refusal no approval fixes is
+ * `failed`; one a person can clear (a gate, an unmet promotion) is `waiting`.
+ */
+export function sqlExitOf(outcome) {
+    return OUTCOME_EXIT[outcome];
+}
+/** Whether `outcome` is a plan that moved since its approval. */
+export function sqlPlanMoved(outcome) {
+    return sqlExitOf(outcome) === CHANT_EXIT.moved;
+}
+/** yodel's own exit table before sql-yodeler#288 (its `src/exit.ts` up to 0.10). */
+export const YODEL_LEGACY_EXIT = {
+    ok: 0,
+    error: 1,
+    /** Something yodel will not do itself; drift, for `yodel drift`. */
+    needsOp: 2,
+    /** Something outstanding: a gate, pending migrations, lint errors. */
+    outstanding: 3,
+    /** Refused, nothing done: every refusal, policy denials and unmet promotions included. */
+    refused: 4,
+    locked: 5,
+};
+/**
+ * The table's code for a `yodel` exit status. A yodel on chant's table passes
+ * through (a code outside the table is `failed`). A legacy yodel's codes are
+ * read by meaning:
+ *
+ * | legacy yodel | Table |
+ * |---|---|
+ * | 0 | `done` |
+ * | 2 from `yodel drift` | `drift` |
+ * | 2 from any other verb, a change that needs an Op or a manual step | `waiting` |
+ * | 3 from `yodel lint` | `failed` (sql-yodeler#285 ruling C) |
+ * | 3 from any other verb | `waiting` |
+ * | 4, any refusal | `failed`: the legacy code does not tell a policy denial or an unmet promotion apart |
+ * | 5 | `held` |
+ * | 1, anything else | `failed` |
+ */
+export function yodelExitOf(source) {
+    const { code, command, legacy } = source;
+    if (code === 0)
+        return CHANT_EXIT.done;
+    if (!legacy) {
+        for (const value of Object.values(CHANT_EXIT))
+            if (value === code)
+                return value;
+        return CHANT_EXIT.failed;
+    }
+    switch (code) {
+        case YODEL_LEGACY_EXIT.needsOp:
+            return command === "drift" ? CHANT_EXIT.drift : CHANT_EXIT.waiting;
+        case YODEL_LEGACY_EXIT.outstanding:
+            return command === "lint" ? CHANT_EXIT.failed : CHANT_EXIT.waiting;
+        case YODEL_LEGACY_EXIT.locked:
+            return CHANT_EXIT.held;
+        default:
+            return CHANT_EXIT.failed;
+    }
+}

package/dist/index.d.ts

@@ -6,4 +6,8 @@ export { database, table, view, dictionary, user, role, policy, quota, settingsP
 export { schema, index, sequence, type, domain, extension, func, procedure, aggregate, trigger, eventTrigger, operator, operatorClass, operatorFamily, foreignTable, textSearchConfiguration, textSearchDictionary, statistics, foreignDataWrapper, foreignServer, publication, collation, cast } from "./postgres/entities.js";
 export { diffStatements, renderStatements, type DiffStatementsOptions, type ManualStep, type MigrationStep, type OpStep, type SchemaStatements, type StatementChange, type StatementStep, type StepObject, } from "./migration-statements.js";
 export { readSqlFile, sqlFileDeclarations, sqlFileEntities, sqlFileOf, SqlFileError, type SqlFileObject, type SqlFileOptions, type SqlFileSource, } from "./sql-files.js";
+export { sqlExitOf, sqlPlanMoved, yodelExitOf, YODEL_LEGACY_EXIT, type SqlEngineOutcome, type YodelExitSource } from "./exit-codes.js";
+export { sqlCapabilityPlugin, sqlMigrateCapability, sqlApplyCapability, createSqlMigrateCapability, createSqlApplyCapability, SqlPlanMovedError, YodelRunError, SQL_VERB_FAMILIES, type SqlMigrateStepInput, type SqlMigrateStepOutput, type SqlMigrateArtifact, type SqlApplyStepInput, type SqlApplyStepOutput, } from "./capability-plugin.js";
+export { sqlDefaultLockGrain, sqlLockGrainRefusal, type SqlLockGrainKind } from "./lock-grain.js";
+export { YODEL_COMMANDS, YODEL_OPTIONAL_FLAGS, runAllowedYodel, allowedYodelArgv, type YodelRunner, type YodelRun } from "./yodel-run.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAM3D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAMtI,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,UAAU,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAI7T,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,MAAM,EACX,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,UAAU,GAChB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,YAAY,EACZ,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAM3D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAMtI,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,UAAU,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAI7T,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,MAAM,EACX,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,UAAU,GAChB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,YAAY,EACZ,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAOpI,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -22,3 +22,15 @@ export { diffStatements, renderStatements, } from "./migration-statements.js";
 // Plain `.sql` files as a schema source (#3646): DDL read into the declarations
 // the tagged templates make; also at `@intentius/chant-lexicon-sql/sql-files`.
 export { readSqlFile, sqlFileDeclarations, sqlFileEntities, sqlFileOf, SqlFileError, } from "./sql-files.js";
+// SQL engine and yodel outcomes on chant's exit-code table (#4570); also at
+// `@intentius/chant-lexicon-sql/exit-codes`.
+export { sqlExitOf, sqlPlanMoved, yodelExitOf, YODEL_LEGACY_EXIT } from "./exit-codes.js";
+// The `sql-migrate` and `sql-apply` capabilities (#4569), contributed to core's
+// capability-plugin seam: core loads `sqlCapabilityPlugin` when a project's
+// chant.config lists this lexicon, so op waves and pr-plan plan and apply a
+// SQL member through chant. sql-yodeler's engine runs by a fixed argv list
+// (`YODEL_COMMANDS`).
+export { sqlCapabilityPlugin, sqlMigrateCapability, sqlApplyCapability, createSqlMigrateCapability, createSqlApplyCapability, SqlPlanMovedError, YodelRunError, SQL_VERB_FAMILIES, } from "./capability-plugin.js";
+// The lock grain of a SQL member (#4571): target, with resource refused by name.
+export { sqlDefaultLockGrain, sqlLockGrainRefusal } from "./lock-grain.js";
+export { YODEL_COMMANDS, YODEL_OPTIONAL_FLAGS, runAllowedYodel, allowedYodelArgv } from "./yodel-run.js";

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "1c5c80cc89bf89d0e69689cc3bed3bc3a1220b8805edfaf5ad5c41ac44fa051c",
+    "manifest.json": "1fde954d33c814b24fa348430a4727deee6a4e503c95c56a4db27e45e1edb016",
     "meta.json": "2a75a38ea0fb186f27a59d6b8401d7af0809db5e471769f0259f7c1a4292b858",
     "types/index.d.ts": "0286ebb367773e84c76818b0f69cb14cff8328fd2f8c65ed87563c8d5815458c",
     "rules/postgres-templates.ts": "cbbe8b3c3531300ef5f17d596bf9403343d9fde019961436b6af0cdc66e4064a",
@@ -80,5 +80,5 @@
     "rules/sqlpg125.ts": "cc7411c57c525613dc720ba00e986bbc4e5a84b8b0bcfa7a6ce0d058f039f025",
     "rules/sqlpg126.ts": "d57b82a5842273876510131d67bf4418cbd61eff821e245edebc644dafd502bb"
   },
-  "composite": "9c591c97c31e3e6d029ba0138be4f1b960b1cffc50e41fd9de201b60af44fc83"
+  "composite": "108fefe2f3370008e48604e44a74f1e5a4d767b8fbc72d33fa55616e6e67c15f"
 }

package/dist/lock-grain.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The lock grain of a SQL member (#4571, on #4552's hooks).
+ *
+ * A SQL member's grain is `target`: one environment's history. Two applies
+ * of one environment are kept apart by the environment's own lock, which
+ * sql-yodeler takes for every apply (a KeeperMap row on ClickHouse, a
+ * session advisory lock on Postgres), and by chant's target lock on the
+ * environment. `sql-apply` sends a whole build in creation order, so it
+ * holds the environment too.
+ *
+ * `resource` is refused by name, as it is on Terraform and stock Pulumi: a
+ * migration chain applies in order, and a row per object would let two
+ * applies of one chain interleave. Neither kind answers `lockRows`. `repo`
+ * is the pipeline's, and any member may take it.
+ *
+ * sql-yodeler's rendered apply jobs set `APPLY_LOCK` (`YODEL_LOCK_WAIT`,
+ * `YODEL_STAND_DOWN`, src/ci/render.ts:323) for the engine's lock wait and
+ * its stand-down; dropping it for these hooks is sql-yodeler#293's.
+ */
+import type { LockGrain } from "@intentius/chant/lifecycle/lock-rows";
+/** The capability kinds this lexicon gives a grain to. */
+export type SqlLockGrainKind = "sql-migrate" | "sql-apply";
+/** The grain a SQL member takes when `ci.lockGrain` sets none: always `target`. */
+export declare function sqlDefaultLockGrain(): LockGrain;
+/** Why a SQL member cannot take `grain`, naming the engine; undefined for `target` and `repo`. */
+export declare function sqlLockGrainRefusal(kind: SqlLockGrainKind, grain: LockGrain): string | undefined;
+//# sourceMappingURL=lock-grain.d.ts.map

package/dist/lock-grain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-grain.d.ts","sourceRoot":"","sources":["../src/lock-grain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAEtE,0DAA0D;AAC1D,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,WAAW,CAAC;AAE3D,mFAAmF;AACnF,wBAAgB,mBAAmB,IAAI,SAAS,CAE/C;AAED,kGAAkG;AAClG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAMhG"}

package/dist/lock-grain.js

@@ -0,0 +1,13 @@
+/** The grain a SQL member takes when `ci.lockGrain` sets none: always `target`. */
+export function sqlDefaultLockGrain() {
+    return "target";
+}
+/** Why a SQL member cannot take `grain`, naming the engine; undefined for `target` and `repo`. */
+export function sqlLockGrainRefusal(kind, grain) {
+    if (grain !== "resource")
+        return undefined;
+    if (kind === "sql-migrate") {
+        return "SQL Yodeler applies an environment's migrations in chain order under the environment's own lock (a KeeperMap row on ClickHouse, a session advisory lock on Postgres), so nothing in it is per resource (ci.lockGrain: target)";
+    }
+    return "the sql lexicon's applier sends a whole build in creation order, since its objects depend on each other, so nothing in it is per resource (ci.lockGrain: target)";
+}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "sql",
-  "version": "0.124.54",
+  "version": "0.124.55",
   "chantVersion": ">=0.1.0",
   "namespace": "SQL",
   "intrinsics": [],

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAgB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AA0B5E,eAAO,MAAM,SAAS,EAAE,aA+SvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAgB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AA2B5E,eAAO,MAAM,SAAS,EAAE,aAuTvB,CAAC"}

package/dist/plugin.js

@@ -30,6 +30,7 @@ import { looksLikePostgres } from "./migrate/from-postgres/detect.js";
 import { sqlWorkspaceOutputs } from "./workspace-outputs.js";
 import { CDC_TEMPLATE, DEFAULT_TEMPLATE, EVENTS_TEMPLATE, POSTGRES_EVENTS_TEMPLATE, POSTGRES_TEMPLATE, POSTGRES_TENANT_TEMPLATE } from "./init-templates.js";
 import { compositeCatalog } from "./composites/catalog.js";
+import { sqlCiServices, sqlCiSetup } from "./ci-setup.js";
 export const sqlPlugin = {
     name: "sql",
     serializer: sqlSerializer,
@@ -38,6 +39,13 @@ export const sqlPlugin = {
     emulator: [CLICKHOUSE_EMULATOR, POSTGRES_EMULATOR],
     /** chant's marker is a trailer on the object's comment (#3208, ./clickhouse/ownership.ts). */
     ownershipChannel: SQL_OWNERSHIP_CHANNEL,
+    // #4572: the setup lines for the pull request pipeline's default image, and the replay server per dialect.
+    ciSetup(ctx) {
+        return sqlCiSetup(ctx);
+    },
+    ciServices(ctx) {
+        return sqlCiServices(ctx);
+    },
     async generate(options) {
         const { generate, writeGeneratedFiles } = await import("./codegen/generate.js");
         writeGeneratedFiles(await generate(options));

package/dist/postgres/testing/migration.d.ts

@@ -18,6 +18,8 @@ export declare class ApprovingLedger {
         appended: import("@intentius/chant/point-decision").PendingGateRecord[];
         resolved: import("@intentius/chant/point-decision").GateResolutionRecord[];
         applied: import("@intentius/chant/gate-decision").AppliedGateRecord[];
+        finished: import("@intentius/chant/lifecycle/gate-applied").FinishedGateRecord[];
+        attachments: Map<string, string>;
         checkpoints: Map<string, string>;
     };
     approveLast(): void;

package/dist/postgres/testing/migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/postgres/testing/migration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAoD,KAAK,UAAU,EAAE,KAAK,cAAc,EAAiB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE9J,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAEpF,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,qBAAqB,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAO/F;AAED,gFAAgF;AAChF,wBAAsB,cAAc,CAAC,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAItJ;AAED,uIAAuI;AACvI,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,WAAW,CAAiB;IACpC,IAAI;;;;;MAA0B;IAE9B,WAAW,IAAI,IAAI;CAcpB;AAED,2CAA2C;AAC3C,eAAO,MAAM,UAAU,GAAI,GAAG,WAAW,EAAE,MAAM,MAAM,KAAG,OAAyF,CAAC"}
+{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/postgres/testing/migration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAoD,KAAK,UAAU,EAAE,KAAK,cAAc,EAAiB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE9J,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAEpF,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,qBAAqB,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAO/F;AAED,gFAAgF;AAChF,wBAAsB,cAAc,CAAC,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAItJ;AAED,uIAAuI;AACvI,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,WAAW,CAAiB;IACpC,IAAI;;;;;;;MAA0B;IAE9B,WAAW,IAAI,IAAI;CAcpB;AAED,2CAA2C;AAC3C,eAAO,MAAM,UAAU,GAAI,GAAG,WAAW,EAAE,MAAM,MAAM,KAAG,OAAyF,CAAC"}

package/dist/token-source.d.ts

@@ -21,6 +21,22 @@
  * - `entra`: `az account get-access-token` for Azure Database for PostgreSQL.
  * - `command`: any command that prints a password on its standard output.
  *
+ * In a CI job that traded its OIDC token through chant's `ci.identity`
+ * (`@intentius/chant/ci-identity`, #4296, #4572), the cloud sources mint
+ * from what the trade left instead, with no cloud command line in the
+ * image ({@link tradedToken}):
+ *
+ * - `rds-iam` presigns the token with the traded AWS keys
+ *   (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`),
+ *   through chant's SigV4 signer, as `aws rds generate-db-auth-token` does.
+ * - `cloud-sql-iam` is the traded Google access token
+ *   (`GOOGLE_OAUTH_ACCESS_TOKEN`), which Cloud SQL's IAM sign-in takes.
+ * - `entra` is `AZURE_DATABASE_ACCESS_TOKEN`, which the trade sets with
+ *   `ci.identity.cloud.azure.database`. The ARM token it always sets is
+ *   for another scope, so without `database` `entra` still runs `az`.
+ *
+ * Outside CI none of these variables is set and the command lines run.
+ *
  * A token is reused until most of its lifetime has passed and minted again
  * after, so a long apply, whose ClickHouse requests each carry the password
  * and whose Postgres connections each authenticate when opened, never sends
@@ -67,6 +83,18 @@ export interface CredentialSource {
     /** Forget the cached token, so the next `get()` mints again. */
     invalidate(): void;
 }
+/** The variable chant's trade sets to an Azure Database for PostgreSQL token (`AZURE_DATABASE_TOKEN_ENV` in `@intentius/chant/ci-identity`, #4572). */
+export declare const AZURE_DATABASE_TOKEN_ENV = "AZURE_DATABASE_ACCESS_TOKEN";
+/**
+ * The token a cloud source takes from chant's traded identity (#4572), when
+ * the job's environment holds it; undefined otherwise, and for `command`.
+ * Pure but for `now`, for tests.
+ */
+export declare function tradedToken(config: TokenSourceConfig, input: {
+    url: string;
+    user?: string;
+    env: Record<string, string | undefined>;
+}, now?: Date): string | undefined;
 /** The program a source runs. Pure, for tests. */
 export declare function tokenCommand(config: TokenSourceConfig, input: {
     url: string;

package/dist/token-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-source.d.ts","sourceRoot":"","sources":["../src/token-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,yDAAyD;AACzD,eAAO,MAAM,iBAAiB;;IAG1B,kGAAkG;;IAElG,kFAAkF;;;;IAKlF,gEAAgE;;;;IAKhE,gEAAgE;;;;IAKhE,yGAAyG;;IAEzG,+DAA+D;;6BAGjE,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,gEAAgE;AAChE,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAAkD,CAAC;AAY/G,+GAA+G;AAC/G,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED,sEAAsE;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAU/G,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,gEAAgE;IAChE,UAAU,IAAI,IAAI,CAAC;CACpB;AAED,kDAAkD;AAClD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,GAC7E,SAAS,MAAM,EAAE,CA0BnB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GACA,gBAAgB,CAoClB"}
+{"version":3,"file":"token-source.d.ts","sourceRoot":"","sources":["../src/token-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,yDAAyD;AACzD,eAAO,MAAM,iBAAiB;;IAG1B,kGAAkG;;IAElG,kFAAkF;;;;IAKlF,gEAAgE;;;;IAKhE,gEAAgE;;;;IAKhE,yGAAyG;;IAEzG,+DAA+D;;6BAGjE,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,gEAAgE;AAChE,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAAkD,CAAC;AAY/G,+GAA+G;AAC/G,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED,sEAAsE;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAU/G,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,gEAAgE;IAChE,UAAU,IAAI,IAAI,CAAC;CACpB;AAED,uJAAuJ;AACvJ,eAAO,MAAM,wBAAwB,gCAAgC,CAAC;AAOtE;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,EAC9E,GAAG,GAAE,IAAiB,GACrB,MAAM,GAAG,SAAS,CA+BpB;AAED,kDAAkD;AAClD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,GAC7E,SAAS,MAAM,EAAE,CA0BnB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GACA,gBAAgB,CA0ClB"}

package/dist/token-source.js

@@ -21,6 +21,22 @@
  * - `entra`: `az account get-access-token` for Azure Database for PostgreSQL.
  * - `command`: any command that prints a password on its standard output.
  *
+ * In a CI job that traded its OIDC token through chant's `ci.identity`
+ * (`@intentius/chant/ci-identity`, #4296, #4572), the cloud sources mint
+ * from what the trade left instead, with no cloud command line in the
+ * image ({@link tradedToken}):
+ *
+ * - `rds-iam` presigns the token with the traded AWS keys
+ *   (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`),
+ *   through chant's SigV4 signer, as `aws rds generate-db-auth-token` does.
+ * - `cloud-sql-iam` is the traded Google access token
+ *   (`GOOGLE_OAUTH_ACCESS_TOKEN`), which Cloud SQL's IAM sign-in takes.
+ * - `entra` is `AZURE_DATABASE_ACCESS_TOKEN`, which the trade sets with
+ *   `ci.identity.cloud.azure.database`. The ARM token it always sets is
+ *   for another scope, so without `database` `entra` still runs `az`.
+ *
+ * Outside CI none of these variables is set and the command lines run.
+ *
  * A token is reused until most of its lifetime has passed and minted again
  * after, so a long apply, whose ClickHouse requests each carry the password
  * and whose Postgres connections each authenticate when opened, never sends
@@ -28,6 +44,7 @@
  */
 import { execFile } from "node:child_process";
 import { z } from "zod";
+import { presignV4 } from "@intentius/chant/cloud-lister/sigv4";
 const ttl = z.number().int().positive().optional();
 /** The token sources a profile's `password` can name. */
 export const tokenSourceSchema = z.discriminatedUnion("token", [
@@ -81,6 +98,52 @@ const runCommand = (argv, env) => new Promise((resolve, reject) => {
             resolve(String(stdout));
     });
 });
+/** The variable chant's trade sets to an Azure Database for PostgreSQL token (`AZURE_DATABASE_TOKEN_ENV` in `@intentius/chant/ci-identity`, #4572). */
+export const AZURE_DATABASE_TOKEN_ENV = "AZURE_DATABASE_ACCESS_TOKEN";
+/** The region an `rds-iam` token is signed for: the config's, `AWS_REGION`, `AWS_DEFAULT_REGION`, else the RDS host name's. */
+function rdsRegion(config, hostname, env) {
+    return config.region ?? env.AWS_REGION ?? env.AWS_DEFAULT_REGION ?? /\.([a-z]{2}(?:-[a-z]+)+-\d+)\.rds\.amazonaws\.com$/.exec(hostname)?.[1];
+}
+/**
+ * The token a cloud source takes from chant's traded identity (#4572), when
+ * the job's environment holds it; undefined otherwise, and for `command`.
+ * Pure but for `now`, for tests.
+ */
+export function tradedToken(config, input, now = new Date()) {
+    const env = input.env;
+    switch (config.token) {
+        case "command":
+            return undefined;
+        case "cloud-sql-iam":
+            return env.GOOGLE_OAUTH_ACCESS_TOKEN || env.CLOUDSDK_AUTH_ACCESS_TOKEN || undefined;
+        case "entra":
+            return env[AZURE_DATABASE_TOKEN_ENV] || undefined;
+        case "rds-iam": {
+            const accessKeyId = env.AWS_ACCESS_KEY_ID;
+            const secretAccessKey = env.AWS_SECRET_ACCESS_KEY;
+            if (!accessKeyId || !secretAccessKey)
+                return undefined;
+            if (input.user === undefined)
+                throw new TokenSourceError("rds-iam mints a token for one database user; the profile names no user");
+            const url = new URL(input.url);
+            const region = rdsRegion(config, url.hostname, env);
+            if (region === undefined)
+                throw new TokenSourceError(`rds-iam signs its token for a region; set the token source's region or AWS_REGION for ${url.hostname}`);
+            const target = new URL(`https://${url.hostname}:${url.port || "5432"}/`);
+            target.searchParams.set("Action", "connect");
+            target.searchParams.set("DBUser", input.user);
+            const signed = presignV4({
+                url: target.toString(),
+                region,
+                service: "rds-db",
+                credentials: { accessKeyId, secretAccessKey, ...(env.AWS_SESSION_TOKEN ? { sessionToken: env.AWS_SESSION_TOKEN } : {}) },
+                seconds: DEFAULT_TTL_SECONDS["rds-iam"],
+                now,
+            });
+            return signed.replace(/^https:\/\//, "");
+        }
+    }
+}
 /** The program a source runs. Pure, for tests. */
 export function tokenCommand(config, input) {
     switch (config.token) {
@@ -94,7 +157,7 @@ export function tokenCommand(config, input) {
             const url = new URL(input.url);
             if (input.user === undefined)
                 throw new TokenSourceError("rds-iam mints a token for one database user; the profile names no user");
-            const region = config.region ?? input.env.AWS_REGION ?? input.env.AWS_DEFAULT_REGION ?? /\.([a-z]{2}(?:-[a-z]+)+-\d+)\.rds\.amazonaws\.com$/.exec(url.hostname)?.[1];
+            const region = rdsRegion(config, url.hostname, input.env);
             return [
                 "aws",
                 "rds",
@@ -122,6 +185,12 @@ export function credentialSource(config, input) {
     let cached;
     let pending;
     const mint = async () => {
+        // #4572: a CI job that traded its OIDC token through chant mints from what the trade left.
+        const traded = tradedToken(config, input, new Date(now()));
+        if (traded !== undefined) {
+            cached = { token: traded, until: now() + lifetimeMs };
+            return traded;
+        }
         const argv = tokenCommand(config, input);
         let out;
         try {

package/dist/yodel-run.d.ts

@@ -0,0 +1,58 @@
+/** What one yodel run gave. Never thrown: a non-zero exit is a `code`. */
+export interface YodelRun {
+    /** The exit status; null when the process did not exit by itself or never started. */
+    code: number | null;
+    stdout: string;
+    stderr: string;
+    /** No yodel binary was found. */
+    missingBinary?: boolean;
+}
+/** Runs yodel with these arguments in `cwd`, with `env`. Injectable so tests need no binary. */
+export type YodelRunner = (args: string[], opts: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    dir?: string;
+}) => Promise<YodelRun>;
+/**
+ * The only yodel commands chant runs (ruling A on sql-yodeler#285). Each
+ * may be followed by `--dir <project>`, `--op <name>` and
+ * `--allow-out-of-order`, in that order ({@link YODEL_OPTIONAL_FLAGS}).
+ */
+export declare const YODEL_COMMANDS: readonly string[];
+/** The flags any of {@link YODEL_COMMANDS} may end with, in this order. */
+export declare const YODEL_OPTIONAL_FLAGS: readonly string[];
+/** The options every command takes. */
+export interface YodelCommonOptions {
+    /** The yodel project directory, passed as `--dir`. */
+    dir?: string;
+    /** The migrations Op, when more than one applies the environment. */
+    op?: string;
+    allowOutOfOrder?: boolean;
+}
+/** `yodel plan <env> --part <file>`, without the binary. */
+export declare function yodelPlanArgs(env: string, part: string, opts?: YodelCommonOptions): string[];
+/** `yodel apply <env> --wave-plan <file> --spec <spec>`, without the binary. */
+export declare function yodelWavePlanArgs(env: string, file: string, spec: string, opts?: YodelCommonOptions): string[];
+/** `yodel apply <env> --wave-apply <file> --spec <spec>`, without the binary. */
+export declare function yodelWaveApplyArgs(env: string, file: string, spec: string, opts?: YodelCommonOptions): string[];
+/** Whether `args` is one of {@link YODEL_COMMANDS} with an allowed tail. */
+export declare function allowedYodelArgv(args: readonly string[]): boolean;
+/** Whether `args` is the apply, the one command that writes. */
+export declare function isYodelApplyArgv(args: readonly string[]): boolean;
+/** Run `args` through `run`, refusing any argv off {@link YODEL_COMMANDS}. */
+export declare function runAllowedYodel(run: YodelRunner, args: string[], opts: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    dir?: string;
+}): Promise<YodelRun>;
+/** The variables that pick the writer (sql-yodeler `credentials.ts`). */
+export declare const YODEL_ROLE_VARIABLES: readonly string[];
+/** `env` with the writer taken out: what the planning commands run with. */
+export declare function readerEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * The yodel binary: the project's `node_modules/.bin/yodel`, else the
+ * working directory's, else `yodel` on PATH. Always a file named `yodel`.
+ */
+export declare function yodelBinary(cwd: string, dir?: string): string;
+export declare const defaultYodelRunner: YodelRunner;
+//# sourceMappingURL=yodel-run.d.ts.map

package/dist/yodel-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yodel-run.d.ts","sourceRoot":"","sources":["../src/yodel-run.ts"],"names":[],"mappings":"AA0CA,0EAA0E;AAC1E,MAAM,WAAW,QAAQ;IACvB,sFAAsF;IACtF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,gGAAgG;AAChG,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7H;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAI3C,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAA+D,CAAC;AAElH,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAMD,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,kBAAuB,GAAG,MAAM,EAAE,CAEhG;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,kBAAuB,GAAG,MAAM,EAAE,CAElH;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,kBAAuB,GAAG,MAAM,EAAE,CAEnH;AAoBD,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAOjE;AAED,gEAAgE;AAChE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEjE;AAED,8EAA8E;AAC9E,wBAAsB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAKtJ;AAED,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAwC,CAAC;AAK3F,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAOjF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED,eAAO,MAAM,kBAAkB,EAAE,WAQ7B,CAAC"}