@intentius/chant 0.124.12 → 0.124.14

package/dist/workspace/chant-migrations/chud-lexicon-exit-ship-inputs.js

@@ -0,0 +1,180 @@
+/**
+ * `chud-lexicon-exit-ship-inputs` (#2811): the release Op asks the ship-skip
+ * point with the inputs the point declares.
+ *
+ * The release Op `chud-lexicon-exit` (0.92.0) wrote asks `ship-skip` with no
+ * inputs, so the point's table can only give its default row. This migration
+ * makes the Op compute the point's `release.*` inputs when it loads, from the
+ * diff between the commit the `fly` site serves (the last release in its
+ * ledger) and HEAD, and pass the ones the point declares to `decide`:
+ *
+ * - `first_release`: no release in the ledger;
+ * - `new_migrations`: `.sql` files added or changed under the app's
+ *   migrations folder;
+ * - `files_changed`: paths changed;
+ * - `app_changed`: a path under the app member;
+ * - `work_changed`: a path under the directory a declared work kind keeps its
+ *   items in (chud's `contracts_changed`);
+ * - `units`: work item files added or changed.
+ *
+ * A first release, or one whose serving commit this clone lacks, counts every
+ * file on HEAD, as chud's release plan did. The inputs are not part of the
+ * release plan, which keeps the answer and its decider, so a retry of a
+ * shipped commit plans the same digest.
+ *
+ * The plan is empty unless the member's release Op is the one
+ * `chud-lexicon-exit` wrote and still asks `ship-skip` with no inputs. A
+ * release Op the project changed so that an anchor is gone is a conflict.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join, posix } from "node:path";
+import { CHUD_LEXICON_EXIT } from "./chud-lexicon-exit.js";
+export const CHUD_LEXICON_EXIT_SHIP_INPUTS = "chud-lexicon-exit-ship-inputs";
+const DESCRIPTION = "have the release Op ask ship-skip with the inputs the point declares, from the diff since the serving release (#2811)";
+/** The call chud-lexicon-exit wrote: no inputs. */
+const ASKED_BARE = 'const shipSkip = decide("ship-skip", { id: "shipSkip" });';
+function readText(dir, path) {
+    const abs = join(dir, path);
+    return existsSync(abs) ? readFileSync(abs, "utf-8") : undefined;
+}
+/**
+ * Where each declared work kind keeps its items, read from the kind file's
+ * text: a kind with a `work` block, its `location.dir` and `location.match`.
+ */
+export function workItemsOf(dir, decl) {
+    const out = [];
+    const kinds = [...(decl?.records ?? []), ...(decl?.members ?? []).flatMap((m) => (m.records ?? []).map((r) => ({ kind: r.kind && m.dir ? posix.join(m.dir, r.kind) : undefined })))];
+    for (const { kind } of kinds) {
+        if (!kind)
+            continue;
+        const text = readText(dir, kind);
+        if (!text || !/\bwork:\s*\{/.test(text))
+            continue;
+        const loc = /location:\s*\{\s*dir:\s*("(?:[^"\\]|\\.)*"),\s*match:\s*("(?:[^"\\]|\\.)*")/.exec(text);
+        if (!loc)
+            continue;
+        try {
+            out.push({ dir: posix.normalize(posix.join(posix.dirname(kind), JSON.parse(loc[1]))), match: JSON.parse(loc[2]) });
+        }
+        catch {
+            continue;
+        }
+    }
+    return out;
+}
+/** The code that computes the inputs and asks the point with them, in place of {@link ASKED_BARE}. */
+export function askedWithInputs(rootRel, appDir, work) {
+    return `/** The workspace root, which the diff names paths from. */
+const root = fileURLToPath(new URL(${JSON.stringify(rootRel === "." ? "./" : `${rootRel}/`)}, import.meta.url));
+/** The app member and the work items, from the workspace root. */
+const APP = ${JSON.stringify(appDir)};
+const WORK: Array<{ dir: string; match: string }> = ${JSON.stringify(work)};
+
+/**
+ * The ship-skip point's inputs: what this release would change since the
+ * commit the site serves, the last release in the ledger. A first release
+ * (or one whose serving commit this clone lacks) counts every file on HEAD.
+ */
+async function shipSkipInputs(): Promise<Record<string, boolean | number>> {
+  const git = (...args: string[]) => execFileSync("git", args, { cwd: root, encoding: "utf-8" });
+  const lines = (text: string) => text.split("\\n").filter(Boolean);
+  const { records } = await readReleaseLedger(ENV, { cwd: fileURLToPath(new URL("../", import.meta.url)) });
+  const serving = records.at(-1)?.gitSha;
+  let known = false;
+  if (serving) {
+    try {
+      git("cat-file", "-e", \`\${serving}^{commit}\`);
+      known = true;
+    } catch {
+      known = false;
+    }
+  }
+  const all = known ? lines(git("diff", "--name-only", "--relative", serving!, "HEAD")) : lines(git("ls-tree", "-r", "--name-only", "HEAD"));
+  const added = known ? lines(git("diff", "--name-only", "--relative", "--diff-filter=AM", serving!, "HEAD")) : all;
+  const under = (dir: string, path: string) => dir === "." || path.startsWith(\`\${dir}/\`);
+  const migrations = posix.join(APP, params.appMigrations.default);
+  const workItems = added.filter((p) => WORK.some((w) => posix.dirname(p) === posix.normalize(w.dir) && new RegExp(w.match).test(posix.basename(p))));
+  return {
+    "release.first_release": !serving,
+    "release.new_migrations": added.filter((p) => under(migrations, p) && p.endsWith(".sql")).length,
+    "release.files_changed": all.length,
+    "release.app_changed": all.some((p) => under(APP, p)),
+    "release.work_changed": all.some((p) => WORK.some((w) => under(posix.normalize(w.dir), p))),
+    "release.units": workItems.length,
+  };
+}
+
+/** Only the inputs the point declares: a point that declares fewer is asked with those. */
+const declared = new Set(Object.keys(shipSkipPoint.inputs));
+const inputs = Object.fromEntries(Object.entries(await shipSkipInputs()).filter(([name]) => declared.has(name)));
+const shipSkip = decide("ship-skip", { id: "shipSkip", inputs });`;
+}
+/** Each edit: the text chud-lexicon-exit wrote, and what it becomes. A \`find\` may be a pattern, for text that differs between the exit's versions. */
+function edits(rootRel, appDir, work) {
+    return [
+        { find: ASKED_BARE, replace: askedWithInputs(rootRel, appDir, work), what: "the ship-skip decide step" },
+        { find: 'import { readFileSync } from "node:fs";\n', replace: 'import { readFileSync } from "node:fs";\nimport { posix } from "node:path";\n', what: "the node:fs import" },
+        {
+            find: 'import { parsePoints, quorumOf } from "@intentius/chant/workspace/points";\n',
+            replace: 'import { parsePoints, quorumOf } from "@intentius/chant/workspace/points";\nimport { readReleaseLedger } from "@intentius/chant/lifecycle/release-ledger";\n',
+            what: "the workspace/points import",
+        },
+        {
+            // 0.92.0 named the systemone lexicon's decide; later exits name chant's.
+            find: /( \*   workspace root, through (?:the systemone lexicon's|chant's) `decide` activity), and\n \*   writes the release plan:/,
+            replace: "$1, with\n *   the inputs it declares, computed from the diff between the commit the\n *   `fly` site serves (the last release in its ledger) and HEAD: whether\n *   this is the first release, how many migrations would fire, how many files\n *   changed, whether the app or the work items changed, and how many work\n *   items did (on a first release, every file on HEAD counts). It\n *   writes the release plan:",
+            what: "the release Op's comment on Plan",
+            // The comment is prose: a project that reworded it keeps its words.
+            optional: true,
+        },
+    ];
+}
+function planShipInputs(ctx) {
+    const { dir } = ctx;
+    let decl = null;
+    try {
+        decl = JSON.parse(readText(dir, "chant.workspace.json") ?? "null");
+    }
+    catch {
+        decl = null;
+    }
+    const candidates = (decl?.members ?? []).filter((m) => m.kind === "chant" && m.dir).map((m) => posix.normalize(m.dir));
+    if (!candidates.includes("delivery"))
+        candidates.push("delivery");
+    const appDir = decl?.members?.find((m) => m.name === "app")?.dir ?? "app";
+    const work = workItemsOf(dir, decl);
+    const changes = [];
+    const conflicts = [];
+    for (const d of candidates) {
+        const path = posix.join(d, "ops/release.op.ts");
+        const text = readText(dir, path);
+        if (text === undefined || !text.includes(`its migration ${CHUD_LEXICON_EXIT}`) || !text.includes("flyRelease("))
+            continue;
+        if (!text.includes(ASKED_BARE))
+            continue;
+        let next = text;
+        const missing = [];
+        for (const e of edits(posix.relative(posix.join(d, "ops"), ".") || ".", posix.normalize(appDir), work)) {
+            const hit = typeof e.find === "string" ? next.includes(e.find) : e.find.test(next);
+            if (!hit) {
+                if (!e.optional)
+                    missing.push(e.what);
+                continue;
+            }
+            next = typeof e.find === "string" ? next.replace(e.find, () => e.replace) : next.replace(e.find, e.replace);
+        }
+        if (missing.length > 0) {
+            conflicts.push({ path, reason: `cannot find ${missing.join("; ")}. Pass ship-skip its inputs by hand, then run the upgrade again` });
+            continue;
+        }
+        changes.push({ path, action: "write", why: "ship-skip is asked with the inputs the point declares, from the diff since the serving release", data: Buffer.from(next) });
+    }
+    if (changes.length === 0 && conflicts.length === 0)
+        return null;
+    return { id: CHUD_LEXICON_EXIT_SHIP_INPUTS, description: DESCRIPTION, changes, notMoved: [], conflicts };
+}
+export const chudLexiconExitShipInputs = {
+    id: CHUD_LEXICON_EXIT_SHIP_INPUTS,
+    description: DESCRIPTION,
+    plan: planShipInputs,
+};

package/dist/workspace/chant-migrations/chud-lexicon-exit-ship-policy.js

@@ -0,0 +1,99 @@
+/**
+ * `chud-lexicon-exit-ship-policy` (#2810): let a person pass the ship gate
+ * in a repo `chud-lexicon-exit` migrated.
+ *
+ * `chud-lexicon-exit` (0.92.0) kept chud's decisions/ship-skip.cedar.ts,
+ * which permits an agent when the ship-skip table said yes and permits no
+ * person. Cedar denies what nothing permits, so it decided `deny` on a
+ * person's approval too, and only `log-only` let one through. This migration
+ * adds a permit for `Chant::Human` under the same floor, which still forbids
+ * an agent unless the table said yes. At `enforce`, Cedar then decides
+ * `allow` for a person and `deny` for an agent.
+ *
+ * The plan is empty unless the policy is the one `chud-lexicon-exit` left
+ * (it reads the decide step's `shipSkipBy`), and once the permit is there. A
+ * policy the project changed so that an anchor is gone is a conflict.
+ */
+import { posix } from "node:path";
+import { applyEdits, readText } from "./chud-lexicon-exit.js";
+export const CHUD_LEXICON_EXIT_SHIP_POLICY = "chud-lexicon-exit-ship-policy";
+const DESCRIPTION = "let a person pass the ship gate: the Cedar policy chud-lexicon-exit kept permits no person (#2810)";
+/** The policy `chud-lexicon-exit` left: chud's, reading the decide step's answer and decider. */
+function isExitPolicy(text) {
+    return text.includes('context.shipSkipBy == "table"') && text.includes("agentSkipsOnTableYes") && !/export const personApproves\b/.test(text);
+}
+export const SHIP_POLICY_EDITS = [
+    {
+        find: `import { DenyByDefaultSet, Policy, gatePolicy, GATE_AGENT_TYPE, PASS_GATE_ACTION } from "@intentius/chant-lexicon-cedar";`,
+        replace: `import { DenyByDefaultSet, Policy, gatePolicy, GATE_AGENT_TYPE, GATE_HUMAN_TYPE, PASS_GATE_ACTION } from "@intentius/chant-lexicon-cedar";`,
+        required: "the import from @intentius/chant-lexicon-cedar",
+        unless: /GATE_HUMAN_TYPE/,
+    },
+    {
+        find: "const agent = GATE_AGENT_TYPE as never;\n",
+        replace: "const person = GATE_HUMAN_TYPE as never;\nconst agent = GATE_AGENT_TYPE as never;\n",
+        required: "the `agent` principal type",
+        unless: /const person = GATE_HUMAN_TYPE/,
+    },
+    {
+        find: "export const agentSkipsOnTableYes = new Policy({",
+        replace: `/** A person may pass the gate: it is where a person approves the release. */
+export const personApproves = new Policy({
+  effect: "permit",
+  principal: { is: person },
+  action: { eq: passGate },
+  annotations: { id: "a-person-approves" },
+});
+
+export const agentSkipsOnTableYes = new Policy({`,
+        required: "the agentSkipsOnTableYes policy",
+    },
+    {
+        find: "  policies: [agentSkipsOnTableYes],\n",
+        replace: "  policies: [personApproves, agentSkipsOnTableYes],\n",
+        required: "the DenyByDefaultSet's `policies`",
+    },
+    {
+        find: " * The rule: an agent may pass the gate only when the decision table said yes.\n",
+        replace: " * The rule: a person may always pass the gate, and an agent only when the\n * decision table said yes.\n",
+    },
+    {
+        find: " * every release until someone adds a row, so by default a person always\n * approves.\n",
+        replace: " * every release until someone adds a row, so by default a person always\n * approves. In `enforce` mode Cedar decides `allow` on a person's approval\n * and `deny` on an agent's.\n",
+    },
+];
+function planShipPolicy(ctx) {
+    const { dir } = ctx;
+    let decl = null;
+    try {
+        decl = JSON.parse(readText(dir, "chant.workspace.json") ?? "null");
+    }
+    catch {
+        decl = null;
+    }
+    const candidates = (decl?.members ?? []).filter((m) => m.kind === "chant" && m.dir).map((m) => posix.normalize(m.dir));
+    if (!candidates.includes("delivery"))
+        candidates.push("delivery");
+    const changes = [];
+    const conflicts = [];
+    for (const d of candidates) {
+        const path = posix.join(d, "decisions/ship-skip.cedar.ts");
+        const text = readText(dir, path);
+        if (text === undefined || !isExitPolicy(text))
+            continue;
+        const edited = applyEdits(text, SHIP_POLICY_EDITS);
+        if (edited.missing.length > 0) {
+            conflicts.push({ path, reason: `cannot find ${edited.missing.join("; ")}. Add a permit for Chant::Human by hand, then run the upgrade again` });
+            continue;
+        }
+        changes.push({ path, action: "write", why: "a person may pass the ship gate; an agent only when the table said yes", data: Buffer.from(edited.text) });
+    }
+    if (changes.length === 0 && conflicts.length === 0)
+        return null;
+    return { id: CHUD_LEXICON_EXIT_SHIP_POLICY, description: DESCRIPTION, changes, notMoved: [], conflicts };
+}
+export const chudLexiconExitShipPolicy = {
+    id: CHUD_LEXICON_EXIT_SHIP_POLICY,
+    description: DESCRIPTION,
+    plan: planShipPolicy,
+};