@intentius/chant 0.124.13 → 0.124.15

package/dist/lsp/lexicon-providers.js

@@ -0,0 +1,163 @@
+/**
+ * Generic lexicon-based LSP completion and hover providers.
+ *
+ * Provides LexiconIndex for looking up resources/properties by class name,
+ * and helper functions that implement the common completion/hover patterns
+ * shared across lexicons.
+ */
+// ── LexiconIndex ───────────────────────────────────────────────────
+/**
+ * Indexed access to lexicon entries for LSP features.
+ */
+export class LexiconIndex {
+    constructor(entries) {
+        this.entries = entries;
+    }
+    /** All resource class names with their backing type names. */
+    getResourceNames() {
+        const results = [];
+        for (const [name, entry] of Object.entries(this.entries)) {
+            if (entry.kind === "resource") {
+                results.push({ className: name, resourceType: entry.resourceType });
+            }
+        }
+        return results;
+    }
+    /** Property names available on a given resource class. */
+    getPropertyNames(className) {
+        const entry = this.entries[className];
+        if (!entry || entry.kind !== "resource")
+            return [];
+        const props = [];
+        if (entry.propertyConstraints) {
+            props.push(...Object.keys(entry.propertyConstraints));
+        }
+        if (entry.createOnly) {
+            for (const p of entry.createOnly) {
+                if (!props.includes(p))
+                    props.push(p);
+            }
+        }
+        if (entry.writeOnly) {
+            for (const p of entry.writeOnly) {
+                if (!props.includes(p))
+                    props.push(p);
+            }
+        }
+        return props;
+    }
+    /** Look up a single entry by class name. */
+    getEntry(name) {
+        return this.entries[name];
+    }
+}
+// ── Completion helper ──────────────────────────────────────────────
+/**
+ * Provide completions from a lexicon index.
+ *
+ * Handles two contexts:
+ * - After `new ` — suggests resource class names
+ * - Inside constructor props — suggests property names
+ *
+ * @param importSource - Human-readable source label for documentation
+ *   (e.g. "AWS CloudFormation resource")
+ */
+export function lexiconCompletions(ctx, index, importSource) {
+    const { linePrefix, wordAtCursor } = ctx;
+    // After `new ` — suggest resource class names
+    if (/\bnew\s+\w*$/.test(linePrefix)) {
+        const resources = index.getResourceNames();
+        const prefix = wordAtCursor?.toLowerCase();
+        const filtered = prefix
+            ? resources.filter((r) => r.className.toLowerCase().startsWith(prefix))
+            : resources;
+        // Deterministic ordering (the raw index order is arbitrary).
+        const sorted = [...filtered].sort((a, b) => a.className.localeCompare(b.className));
+        // When the user has typed a prefix, the set is already narrowed — return
+        // every match so a common resource never gets truncated out of a short
+        // prefix on a large lexicon (e.g. StorageBucket for "S" on gcp/aws, #600).
+        // Only cap the unfiltered `new ` dump, to bound the payload.
+        const items = prefix ? sorted : sorted.slice(0, 100);
+        return items.map((r) => ({
+            label: r.className,
+            insertText: r.className,
+            kind: "resource",
+            detail: r.resourceType,
+            documentation: `${importSource}: ${r.resourceType}`,
+        }));
+    }
+    // Inside constructor props — look for `new ClassName({` pattern
+    if (!ctx.content)
+        return [];
+    const constructorMatch = ctx.content.slice(0, ctx.content.split("\n").slice(0, ctx.position.line + 1).join("\n").length)
+        .match(/\bnew\s+(\w+)\s*\(\s*(?:["'][^"']*["']\s*,\s*)?{[^}]*$/s);
+    if (constructorMatch) {
+        const className = constructorMatch[1];
+        const entry = index.getEntry(className);
+        const props = index.getPropertyNames(className);
+        if (props.length > 0) {
+            const inferred = new Set(entry?.inferredDeprecations ?? []);
+            const deprecatedSet = new Set((entry?.deprecatedProperties ?? []).filter((p) => !inferred.has(p)));
+            const filtered = wordAtCursor
+                ? props.filter((p) => p.toLowerCase().startsWith(wordAtCursor.toLowerCase()))
+                : props;
+            return filtered.map((p) => ({
+                label: p,
+                insertText: p,
+                kind: "property",
+                detail: `Property of ${className}`,
+                ...(deprecatedSet.has(p) && { deprecated: true }),
+            }));
+        }
+    }
+    return [];
+}
+// ── Hover helper ───────────────────────────────────────────────────
+/**
+ * Provide hover information from a lexicon index.
+ *
+ * @param formatHover - Lexicon-specific hover content formatter.
+ *   If not provided, uses a generic format.
+ */
+export function lexiconHover(ctx, index, formatHover) {
+    const { word } = ctx;
+    if (!word)
+        return undefined;
+    const entry = index.getEntry(word);
+    if (!entry)
+        return undefined;
+    if (formatHover) {
+        return formatHover(word, entry);
+    }
+    // Default hover format for resource entries
+    if (entry.kind === "resource") {
+        return defaultResourceHover(word, entry);
+    }
+    return undefined;
+}
+function defaultResourceHover(className, entry) {
+    const lines = [];
+    lines.push(`**${className}**`);
+    lines.push("");
+    lines.push(`Resource type: \`${entry.resourceType}\``);
+    if (entry.attrs && Object.keys(entry.attrs).length > 0) {
+        lines.push("");
+        lines.push("**Attributes:**");
+        for (const [key, value] of Object.entries(entry.attrs)) {
+            lines.push(`- \`${key}\` → \`${value}\``);
+        }
+    }
+    if (entry.primaryIdentifier && entry.primaryIdentifier.length > 0) {
+        lines.push("");
+        lines.push(`**Primary identifier:** ${entry.primaryIdentifier.map((p) => `\`${p}\``).join(", ")}`);
+    }
+    if (entry.createOnly && entry.createOnly.length > 0) {
+        lines.push("");
+        lines.push(`**Create-only:** ${entry.createOnly.map((p) => `\`${p}\``).join(", ")}`);
+    }
+    if (entry.writeOnly && entry.writeOnly.length > 0) {
+        lines.push("");
+        lines.push(`**Write-only:** ${entry.writeOnly.map((p) => `\`${p}\``).join(", ")}`);
+    }
+    return { contents: lines.join("\n") };
+}

package/dist/lsp/types.js

@@ -0,0 +1,5 @@
+/**
+ * Simplified LSP types for lexicon plugin contributions.
+ * No dependency on vscode-languageserver — just plain interfaces.
+ */
+export {};

package/dist/managed-fields.js

@@ -0,0 +1,293 @@
+/**
+ * Kubernetes-object-shape utilities shared by every lexicon whose live model
+ * is a Kubernetes API object — the k8s lexicon itself (chant #1076) and GCP's
+ * Config Connector custom resources (chant #1087).
+ *
+ * A Config Connector custom resource *is* a Kubernetes object: it carries the
+ * same envelope (`status`, `metadata.{uid,resourceVersion,generation,
+ * creationTimestamp,managedFields,selfLink}`), the same SSA `fieldsV1`
+ * encoding for `metadata.managedFields`, and some CNRM kinds even embed
+ * genuinely k8s-shaped substructures (Cloud Run's `RunService` wraps a
+ * Knative pod spec with `containers`/`env`/`ports`, keyed the same way a
+ * Deployment's are). None of that is specific to chant's k8s *lexicon* — it
+ * is a fact about the Kubernetes API that any reader of a Kubernetes-shaped
+ * object needs, regardless of which lexicon is doing the reading.
+ *
+ * This module lives in core rather than in the k8s lexicon for the same
+ * reason `./kubectl-context.ts`'s `resolveClusterTarget` does (chant #1100):
+ * GCP's observation needs it too, without taking a dependency on the k8s
+ * lexicon package. Nothing here is keyed by chant's own k8s entityType
+ * catalog (`K8s::Apps::Deployment`, …) or by any lexicon's service-default
+ * table — that stays lexicon-specific, layered on top of what's here
+ * (`lexicons/k8s/src/deep-observe-hooks.ts`'s `K8S_SERVICE_DEFAULTS`,
+ * `lexicons/gcp/src/deep-observe.ts`'s CNRM-specific annotation noise).
+ */
+// ── The generic Kubernetes object envelope ──────────────────────────────────
+/**
+ * Paths every Kubernetes API object carries regardless of kind, matched on
+ * the exact index-erased pattern (there is exactly one `status`, one
+ * `metadata.managedFields`, per object — no per-type variation the way AWS's
+ * `Arn`/`RoleId` repeat at every nesting depth).
+ *
+ * - `status` — the whole subtree is server-computed; no declarative source
+ *   (chant's k8s manifests, chant's Config Connector CRs) ever authors it.
+ * - `metadata.uid`/`resourceVersion`/`generation`/`creationTimestamp` — minted
+ *   and incremented by the API server, never authored.
+ * - `metadata.managedFields` — the bookkeeping the ownership walk below reads
+ *   to decide everything else. Left in the tree it would report as permanent
+ *   drift (a timestamp changes on every write) and would recurse into the
+ *   encoded `fieldsV1` structure as if it were ordinary properties.
+ * - `metadata.selfLink` — deprecated API-server bookkeeping some clusters
+ *   still echo; never a declared field.
+ */
+export const K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS = new Set([
+    "status",
+    "metadata.uid",
+    "metadata.resourceVersion",
+    "metadata.generation",
+    "metadata.creationTimestamp",
+    "metadata.managedFields",
+    "metadata.selfLink",
+]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Stable JSON with sorted keys — the fallback ordering key for a set-like array without a natural identity field. */
+function canonicalJson(value) {
+    return (JSON.stringify(value, (_k, v) => v && typeof v === "object" && !Array.isArray(v)
+        ? Object.fromEntries(Object.entries(v).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)))
+        : v) ?? "");
+}
+/** The final segment of an index-erased pattern (`spec.template.spec.containers[].env[].name` → `name`'s *container*, i.e. `env`). */
+function lastSegment(pattern) {
+    const withoutIndex = pattern.replace(/\[\]$/, "");
+    const dot = withoutIndex.lastIndexOf(".");
+    return dot === -1 ? withoutIndex : withoutIndex.slice(dot + 1);
+}
+/**
+ * Kubernetes' own well-known list-map-key conventions for the substructures
+ * that recur across kinds and across lexicons: containers/initContainers/
+ * ephemeralContainers and `env`/`volumes` keyed by `name` — the same field
+ * Kubernetes' strategic-merge-patch and SSA's `list-map-keys` key on for
+ * these lists — and container ports keyed by `containerPort`+`protocol`,
+ * Service ports keyed by `port`+`protocol` (Kubernetes' own SSA
+ * `list-map-keys` for each). Both port shapes are handled under one `ports`
+ * branch by checking which field is present.
+ *
+ * Entity-type-agnostic on purpose: whether an array named `containers`
+ * belongs to a `K8s::Apps::Deployment` or to a GCP `RunService`'s embedded
+ * pod spec, the identity Kubernetes assigns each element is the same.
+ */
+export function k8sListMapOrderKey(element) {
+    const name = lastSegment(element.pattern);
+    const el = element.element;
+    if (name === "containers" || name === "initContainers" || name === "ephemeralContainers") {
+        return isRecord(el) && typeof el.name === "string" ? el.name : canonicalJson(el);
+    }
+    if (name === "env" || name === "volumes") {
+        return isRecord(el) && typeof el.name === "string" ? el.name : canonicalJson(el);
+    }
+    if (name === "ports") {
+        if (isRecord(el)) {
+            const protocol = typeof el.protocol === "string" ? el.protocol : "TCP";
+            // Zero-padded so the sort key orders numerically, not lexicographically
+            // ("443" would otherwise sort before "80") — cosmetic, since either
+            // order canonicalizes the two sides identically, but a stable,
+            // human-sensible order is free to have here.
+            if (typeof el.containerPort === "number")
+                return `${String(el.containerPort).padStart(5, "0")}/${protocol}`;
+            if (typeof el.port === "number")
+                return `${String(el.port).padStart(5, "0")}/${protocol}`;
+        }
+        return canonicalJson(el);
+    }
+    return undefined;
+}
+function sameJson(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+function findKeyedIndex(array, keyFields) {
+    return array.findIndex((el) => isRecord(el) && Object.entries(keyFields).every(([k, v]) => sameJson(el[k], v)));
+}
+function findValueIndex(array, value) {
+    return array.findIndex((el) => sameJson(el, value));
+}
+function joinField(parent, name) {
+    return parent ? `${parent}.${name}` : name;
+}
+function joinIndex(parent, index) {
+    return `${parent}[${index}]`;
+}
+/**
+ * Walk one manager's `fieldsV1` tree in lockstep with the live object and the
+ * declared props, threading the *live* dot-path (chant's own path syntax —
+ * no leading dot, real array indices) as it goes. `owned` collects every path
+ * this manager's entry reaches on the live tree; `contested` collects the
+ * subset where the declared tree also has a value at the equivalent
+ * position, resolved by the same key/value match rather than by index.
+ *
+ * Only `f:`/`i:`/`v:`/`k:`/`.` are understood — the same five forms
+ * `@intentius/chant-k8s-client`'s `managed-fields.ts`'s `renderSegment`
+ * renders — and an unrecognized prefix is skipped, consistent with that
+ * module's own behavior, rather than guessed at.
+ */
+function walkOwnership(fieldsNode, liveNode, declaredNode, path, owned, contested, 
+/** Records path → manager as it walks (#1189); omitted by callers that only need the sets. */
+owners, manager) {
+    if (fieldsNode === null || typeof fieldsNode !== "object" || Array.isArray(fieldsNode))
+        return;
+    for (const [key, child] of Object.entries(fieldsNode)) {
+        if (key === ".") {
+            if (path !== "") {
+                owned.add(path);
+                if (declaredNode !== undefined)
+                    contested.add(path);
+                if (owners && manager)
+                    owners.set(path, manager);
+            }
+            continue;
+        }
+        if (key.startsWith("f:")) {
+            const name = key.slice(2);
+            if (!isRecord(liveNode) || !(name in liveNode))
+                continue;
+            const childLive = liveNode[name];
+            const childDeclared = isRecord(declaredNode) ? declaredNode[name] : undefined;
+            const childPath = joinField(path, name);
+            owned.add(childPath);
+            if (childDeclared !== undefined)
+                contested.add(childPath);
+            if (owners && manager)
+                owners.set(childPath, manager);
+            walkOwnership(child, childLive, childDeclared, childPath, owned, contested, owners, manager);
+            continue;
+        }
+        if (key.startsWith("i:")) {
+            const idx = Number(key.slice(2));
+            if (!Array.isArray(liveNode) || !Number.isInteger(idx) || idx < 0 || idx >= liveNode.length)
+                continue;
+            const childLive = liveNode[idx];
+            const childDeclared = Array.isArray(declaredNode) ? declaredNode[idx] : undefined;
+            const childPath = joinIndex(path, idx);
+            owned.add(childPath);
+            if (childDeclared !== undefined)
+                contested.add(childPath);
+            if (owners && manager)
+                owners.set(childPath, manager);
+            walkOwnership(child, childLive, childDeclared, childPath, owned, contested, owners, manager);
+            continue;
+        }
+        if (key.startsWith("v:") || key.startsWith("k:")) {
+            if (!Array.isArray(liveNode))
+                continue;
+            let decoded;
+            try {
+                decoded = JSON.parse(key.slice(2));
+            }
+            catch {
+                continue; // not decodable JSON — skip rather than mangle, like renderSegment.
+            }
+            const liveIdx = key.startsWith("v:")
+                ? findValueIndex(liveNode, decoded)
+                : isRecord(decoded)
+                    ? findKeyedIndex(liveNode, decoded)
+                    : -1;
+            if (liveIdx === -1)
+                continue;
+            let childDeclared;
+            if (Array.isArray(declaredNode)) {
+                const declaredIdx = key.startsWith("v:")
+                    ? findValueIndex(declaredNode, decoded)
+                    : isRecord(decoded)
+                        ? findKeyedIndex(declaredNode, decoded)
+                        : -1;
+                childDeclared = declaredIdx === -1 ? undefined : declaredNode[declaredIdx];
+            }
+            const childLive = liveNode[liveIdx];
+            const childPath = joinIndex(path, liveIdx);
+            owned.add(childPath);
+            if (childDeclared !== undefined)
+                contested.add(childPath);
+            if (owners && manager)
+                owners.set(childPath, manager);
+            walkOwnership(child, childLive, childDeclared, childPath, owned, contested, owners, manager);
+            continue;
+        }
+        // An unrecognized prefix (a future fieldsV1 encoding) — skip.
+    }
+}
+/**
+ * Build the three ownership sets for one live object. `entries` is
+ * `metadata.managedFields`, already decoded (`@intentius/chant-k8s-client`'s
+ * `managedFieldsOf` for the k8s lexicon; a plain `JSON.parse` of `kubectl get
+ * -o json` for gcp); `isChantManager` classifies each entry's manager name
+ * — matched on the `chant`/`chant:<stack>` family per chant #1075, but the
+ * matcher itself is supplied by the caller rather than fixed here, because
+ * what counts as "chant" is not the same fact on every lexicon's apply path
+ * (see gcp's `deep-observe.ts` module doc for why that matters there).
+ *
+ * Subresource entries (`status`, `scale`) are excluded: a controller writing
+ * a Deployment's `status` is not competing for the spec chant declared, the
+ * same reasoning `@intentius/chant-k8s-client`'s `fieldsOwnedBy` default
+ * already encodes.
+ */
+export function buildOwnershipSets(entries, liveRoot, declaredRoot, isChantManager) {
+    const chantOwned = new Set();
+    const foreignOwned = new Set();
+    const foreignContested = new Set();
+    const owners = new Map();
+    for (const entry of entries) {
+        if (typeof entry.manager !== "string" || entry.manager.length === 0)
+            continue;
+        if (entry.subresource !== undefined)
+            continue;
+        if (isChantManager(entry.manager)) {
+            // Chant-owned paths are always diffable, regardless of who else is
+            // involved — "contested" only matters for a *foreign* owner.
+            walkOwnership(entry.fieldsV1, liveRoot, declaredRoot, "", chantOwned, new Set(), owners, entry.manager);
+        }
+        else {
+            walkOwnership(entry.fieldsV1, liveRoot, declaredRoot, "", foreignOwned, foreignContested, owners, entry.manager);
+        }
+    }
+    return { chantOwned, foreignOwned, foreignContested, owners };
+}
+/**
+ * Well-known metadata the control plane writes on an object regardless of
+ * who applied it — matched on the exact index-erased pattern, like
+ * {@link K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS}, but gated by the caller on
+ * `side === "live" && counterpart === "absent"` so a manifest that *does*
+ * declare one of these (a hand-pinned `change-cause`, say) is still compared.
+ *
+ * This list is the noise valve that replaced the managed-fields prune
+ * (chant #1191). Until then a foreign-owned, undeclared path was dropped
+ * before the diff ever saw it, which silenced `kubectl label deploy web
+ * team=platform` — the exact console-edit class the `undeclared` drift kind
+ * exists for. Now a foreign-owned path nobody declared is reported as
+ * `undeclared` (with its owner named, #1189) unless the accepted baseline
+ * already carries it — and what remains to subtract statically is only the
+ * handful of annotations and labels Kubernetes' own controllers stamp on
+ * every object of a kind. Widening this set is additive; each entry must be
+ * something *no* human writes out of band.
+ *
+ * - `kubectl.kubernetes.io/last-applied-configuration` — client-side apply's
+ *   bookkeeping, a JSON copy of whatever was last applied.
+ * - `deployment.kubernetes.io/revision` (+ `revision-history`,
+ *   `desired-replicas`, `max-replicas`) — the Deployment controller's
+ *   rollout counters, written to Deployments and their ReplicaSets.
+ * - `pod-template-hash` / `controller-revision-hash` /
+ *   `statefulset.kubernetes.io/pod-name` — the selector labels the
+ *   ReplicaSet, DaemonSet and StatefulSet controllers add to what they own.
+ */
+export const K8S_SYSTEM_METADATA_PRUNE_PATTERNS = new Set([
+    "metadata.annotations.kubectl.kubernetes.io/last-applied-configuration",
+    "metadata.annotations.deployment.kubernetes.io/revision",
+    "metadata.annotations.deployment.kubernetes.io/revision-history",
+    "metadata.annotations.deployment.kubernetes.io/desired-replicas",
+    "metadata.annotations.deployment.kubernetes.io/max-replicas",
+    "metadata.labels.pod-template-hash",
+    "metadata.labels.controller-revision-hash",
+    "metadata.labels.statefulset.kubernetes.io/pod-name",
+    "spec.template.metadata.labels.pod-template-hash",
+    "spec.template.metadata.labels.controller-revision-hash",
+]);

package/dist/mcp/types.js

@@ -0,0 +1,4 @@
+/**
+ * MCP contribution types for lexicon plugins.
+ */
+export {};

package/dist/notify-verify.js

@@ -73,4 +73,3 @@ export function verifyWebhook(input) {
         return { ok: false, reason: "the body is not JSON" };
     }
 }
-//# sourceMappingURL=notify-verify.js.map

package/dist/notify.js

@@ -304,4 +304,3 @@ export async function sendNotify(config, event, options = {}) {
         await deliver("teams", config.teams, () => json((options.render?.teams ?? teamsMessage)(event)));
     return out;
 }
-//# sourceMappingURL=notify.js.map

package/dist/notify.schema.json

@@ -0,0 +1,72 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://intentius.io/chant/schemas/notify/v1/notify.schema.json",
+  "title": "chant.notify/v1",
+  "description": "The event a notify webhook receives (#3761): a wave or environment waits for an approval, a run was refused or failed, or drift was found. Sent by chant's Op waves and by products built on chant (terragucci, SQL Yodeler) through @intentius/chant/notify, signed with HMAC-SHA256 over <timestamp>.<body>. Readers ignore fields they do not know; a field is only ever added within a version.",
+  "type": "object",
+  "required": ["schema", "id", "event", "at", "source", "project", "summary", "targets"],
+  "properties": {
+    "schema": { "const": "chant.notify/v1" },
+    "id": { "type": "string", "minLength": 1, "description": "The same for every send of one event about one digest (else drift fingerprint, else commit), so a receiver can drop a repeat; random when there is none. The delivery header carries it too." },
+    "event": { "enum": ["waiting", "refused", "failed", "drift"] },
+    "at": { "type": "string", "description": "When it was sent, ISO 8601 UTC." },
+    "source": { "type": "string", "minLength": 1, "description": "The product that sent it: chant, terragucci, sql-yodeler." },
+    "project": { "type": "string", "description": "What the run belongs to: the repository, or a name the product gives." },
+    "summary": { "type": "string", "description": "One line a person can read." },
+    "wave": {
+      "type": "object",
+      "required": ["number"],
+      "properties": {
+        "number": { "type": "integer", "minimum": 1 },
+        "name": { "type": "string" },
+        "gate": { "type": "string", "description": "The gate the wave waits on." }
+      }
+    },
+    "environment": { "type": "string" },
+    "targets": { "type": "array", "items": { "type": "string" }, "description": "What the event concerns: a wave's roots or runs, an environment's pending migrations. For refused and failed, the ones refused or failed when the product knows them." },
+    "digest": { "type": "string", "description": "The plan digest an approval binds." },
+    "approve": {
+      "type": "object",
+      "description": "On waiting: how a person approves it.",
+      "required": ["command"],
+      "properties": {
+        "command": { "type": "string", "description": "The command to run, as the product prints it." },
+        "chant": { "type": "string", "description": "chant's own command for the same approval, when the product's differs." },
+        "review": {
+          "type": "object",
+          "description": "Under pr-review: the pull request whose approving review would approve it.",
+          "required": ["pr", "url"],
+          "properties": { "pr": { "type": "integer" }, "url": { "type": "string" } }
+        }
+      }
+    },
+    "status": { "type": "string", "description": "The product's own word for the outcome." },
+    "reason": { "type": "string", "description": "On refused and failed: why." },
+    "exitCode": { "type": "integer" },
+    "drift": {
+      "type": "object",
+      "required": ["changed"],
+      "properties": {
+        "changed": { "type": "array", "items": { "type": "string" } },
+        "missing": { "type": "array", "items": { "type": "string" } },
+        "failed": { "type": "array", "items": { "type": "string" }, "description": "What could not be checked." },
+        "fingerprint": { "type": "string", "description": "The same drift has the same fingerprint, run after run." }
+      }
+    },
+    "run": {
+      "type": "object",
+      "properties": {
+        "url": { "type": "string", "description": "The CI run's page (GitHub, Forgejo) or job's page (GitLab)." },
+        "forge": { "enum": ["github", "gitlab", "forgejo"] },
+        "repository": { "type": "string" },
+        "commit": { "type": "string" },
+        "pr": { "type": "integer" }
+      }
+    },
+    "reportUrl": { "type": "string" },
+    "detail": { "type": "object", "description": "The product's own record of the outcome, carried whole (terragucci.outcome/v1)." }
+  },
+  "allOf": [
+    { "if": { "required": ["event"], "properties": { "event": { "const": "drift" } } }, "then": { "required": ["drift"], "properties": { "drift": { "type": "object" } } } }
+  ]
+}