@intentius/chant 0.124.13 → 0.124.15

package/dist/op/gate-name.js

@@ -0,0 +1,86 @@
+/**
+ * The gate step's name field, and the one-version bridge for the key it used
+ * to carry (chant #2202).
+ *
+ * A gate is a fact on the gate ledger, not a channel: since #2119 nothing is
+ * running and nothing is signalled, so the field that names a gate is called
+ * `gate` — the same word `chant approve <op> <gate>` takes on the command
+ * line. It was called `signalName` through 0.58.0.
+ *
+ * `signalName` is still read, on `GateStep`, on the component `Gate` step and
+ * on the composites' gate options, and a build that sees only the old key
+ * warns once. It goes away in 0.60.0: delete this module's
+ * {@link DEPRECATED_GATE_KEY_WARNING}, {@link usesDeprecatedGateKey}, the
+ * `signalName` branch of {@link gateName}, the optional `signalName` fields
+ * that call it, and the schema's `oneOf` once that release is out, leaving
+ * `gate` as the only key.
+ */
+/**
+ * The op name a `chant components fan-out` gate is recorded under (#2420).
+ *
+ * A fan-out is a command rather than an authored `*.op.ts`, so `chant approve`
+ * has nothing to discover for this name and must not report that as a problem.
+ * It lives here, next to the other thing that decides what a gate is called,
+ * so both the command that records the pending fact and the command that
+ * answers it read one constant instead of agreeing by hand.
+ */
+export const FAN_OUT_GATE_OP = "fan-out";
+/**
+ * The op name a `chant workspace upgrade` gate is recorded under (#2550). The
+ * gate is the scope (`.` for a plain project), and it binds the digest of the
+ * upgrade's patch. Like a fan-out, the upgrade is a command with no `*.op.ts`
+ * behind it, so `chant approve` must not warn that it found none.
+ */
+export const WORKSPACE_UPGRADE_GATE_OP = "workspace-upgrade";
+/**
+ * The op name the override gate records denials and overrides under (#3760):
+ * `_gates/policy-override.jsonl`, gate the subject a policy denied. Like a
+ * fan-out it has no `*.op.ts`, and an override is a person's, never a model's.
+ */
+export const OVERRIDE_GATE_OP = "policy-override";
+/**
+ * The pull-request loop records its gate under `pr-<number>`, or
+ * `pr-<number>-<member>` in a workspace member (`prOp` in `pr-loop.ts`), and
+ * no `*.op.ts` stands behind that name either.
+ */
+const PR_GATE_OP = /^pr-\d+(?:-[a-z0-9][a-z0-9-]*)?$/;
+/**
+ * Whether gates recorded under this op name are never resolved over MCP or ACP
+ * (chant#3485, chant#3513). These are the gate-only names MCP cannot discover:
+ * `fan-out`, `workspace-upgrade`, `policy-override` (#3760) and the
+ * pull-request gate `pr-<number>`. With
+ * no Op config to read `neverOverMcp` from, the pending record carries it.
+ */
+export function isNeverOverMcpGateOp(op) {
+    return op === FAN_OUT_GATE_OP || op === WORKSPACE_UPGRADE_GATE_OP || op === OVERRIDE_GATE_OP || PR_GATE_OP.test(op);
+}
+/**
+ * The gate's name, from whichever key carries it. One place reads the old key,
+ * so removing the bridge is a one-file edit rather than a sweep.
+ */
+export function gateName(step) {
+    return step.gate ?? step.signalName ?? "";
+}
+/** True when a step names its gate only with the deprecated key. */
+export function usesDeprecatedGateKey(step) {
+    return step.gate === undefined && typeof step.signalName === "string";
+}
+/** What a build prints once when it finds a gate step still using the old key. */
+export const DEPRECATED_GATE_KEY_WARNING = 'Gate steps still using "signalName": the key is now "gate" (chant #2202). ' +
+    '"signalName" is accepted through 0.59.0 and removed in 0.60.0.';
+/**
+ * True when any gate step in an Op's phases (main or `onFailure`, at any
+ * nesting depth inside an `effect()`) names itself only with the deprecated
+ * key. `chant build` calls this to warn once per build.
+ */
+export function opUsesDeprecatedGateKey(config) {
+    const inStep = (step) => {
+        if (step.kind === "gate")
+            return usesDeprecatedGateKey(step);
+        if (step.kind === "effect")
+            return step.steps.some(inStep);
+        return false;
+    };
+    const inPhases = (phases) => (phases ?? []).some((p) => p.steps.some(inStep));
+    return inPhases(config.phases) || inPhases(config.onFailure);
+}

package/dist/op/gate-plan-context.js

@@ -0,0 +1,167 @@
+/**
+ * The plan summary a gate's policy reads (#3182).
+ *
+ * A gate's Cedar request used to carry `planDigest` and whatever the Op put
+ * in `approval.context` by hand, so a rule like "deny an agent a plan that
+ * deletes a database" needed every Op to compute and pass the plan's deletes
+ * itself. A gate whose `plan` names the step that planned the change now gets
+ * `context.plan` from that step's change-set document (#3181), with no code in
+ * the Op:
+ *
+ * - `terraformPlan` returns `changeSet`, one member's part;
+ * - `lifecyclePlanChangeSet` and `readChangeSetPart` return `part`;
+ * - `composeChangeSet` returns `document`, the whole run's change set.
+ *
+ * {@link gatePlanSummary} is the summary, shaped for Cedar: flat counts
+ * (`no-op` is not a Cedar identifier), sets of names, and no nulls or floats.
+ * The cedar lexicon's `GATE_CEDAR_SCHEMA` declares it as `Chant::PlanSummary`,
+ * and its policy pack is written against it.
+ *
+ * The summary rides on the pending fact with the rest of the resolved context,
+ * so `chant approve` evaluates the policy against the plan the run produced.
+ * It comes from the same step result as the digest the gate binds, and a new
+ * plan is a new digest, so an approval never stands on a summary of another
+ * plan.
+ *
+ * Imports types only, so the module bundles without TypeScript (#3421).
+ */
+/** The `approval.context` key the summary lands under. An authored context may not use it. */
+export const GATE_PLAN_CONTEXT_KEY = "plan";
+/** How many addresses each address set carries before it is cut and {@link GatePlanSummary.truncated} is set. */
+export const GATE_PLAN_ADDRESS_LIMIT = 500;
+/** The attributes that hold a resource's tags or labels, read in this order. */
+const TAG_ATTRIBUTES = ["tags", "tags_all", "labels"];
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function isMember(v) {
+    return isObject(v) && typeof v.member === "string";
+}
+function isPart(v) {
+    return isObject(v) && isMember(v.member) && Array.isArray(v.entries);
+}
+function isDocument(v) {
+    return isObject(v) && Array.isArray(v.members) && v.members.every(isMember) && Array.isArray(v.entries);
+}
+/** The members and entries a step result carries, when it carries a change set. */
+export function changeSetOfResult(result) {
+    if (isDocument(result))
+        return result;
+    if (isPart(result))
+        return { members: [result.member], entries: result.entries };
+    if (!isObject(result))
+        return undefined;
+    if (isDocument(result.document))
+        return result.document;
+    for (const key of ["changeSet", "part"]) {
+        const part = result[key];
+        if (isPart(part))
+            return { members: [part.member], entries: part.entries };
+    }
+    return undefined;
+}
+const CHANGES = new Set(["create", "update", "replace", "delete"]);
+function tagKeysOf(entry) {
+    let keys;
+    for (const name of TAG_ATTRIBUTES) {
+        const attr = entry.attributes.find((a) => a.path === name);
+        if (!attr)
+            continue;
+        keys ?? (keys = new Set());
+        if (isObject(attr.after))
+            for (const k of Object.keys(attr.after))
+                keys.add(k);
+    }
+    return keys ? [...keys] : undefined;
+}
+function isTagOnlyUpdate(entry) {
+    return (entry.action === "update" &&
+        entry.attributes.length > 0 &&
+        entry.attributes.every((a) => TAG_ATTRIBUTES.includes(a.path)));
+}
+const sorted = (s) => [...s].sort();
+/** The plan summary of a change set's members and entries. */
+export function gatePlanSummary(changeSet) {
+    const count = { create: 0, update: 0, replace: 0, delete: 0, read: 0, "no-op": 0, forget: 0 };
+    const typesBy = { create: new Set(), update: new Set(), replace: new Set(), delete: new Set() };
+    const types = new Set();
+    const membersChanged = new Set();
+    const regions = new Set();
+    const scopes = new Set();
+    const lexicons = new Set();
+    const deleted = [];
+    const replaced = [];
+    let taggedCreates = 0;
+    let untaggedCreates = 0;
+    let createTagKeys;
+    let tagOnly = true;
+    for (const e of changeSet.entries) {
+        if (e.action in count)
+            count[e.action]++;
+        if (!CHANGES.has(e.action))
+            continue;
+        const action = e.action;
+        typesBy[action].add(e.type);
+        types.add(e.type);
+        membersChanged.add(e.member);
+        lexicons.add(e.lexicon);
+        if (e.region)
+            regions.add(e.region);
+        if (e.scope)
+            scopes.add(e.scope);
+        if (action === "delete")
+            deleted.push(e.address);
+        if (action === "replace")
+            replaced.push(e.address);
+        if (!isTagOnlyUpdate(e))
+            tagOnly = false;
+        if (action === "create") {
+            const keys = tagKeysOf(e);
+            if (keys === undefined) {
+                untaggedCreates++;
+            }
+            else {
+                taggedCreates++;
+                createTagKeys = createTagKeys === undefined ? new Set(keys) : new Set(keys.filter((k) => createTagKeys.has(k)));
+            }
+        }
+    }
+    const failedMembers = new Set(changeSet.members.filter((m) => m.status === "failed").map((m) => m.member));
+    const changes = count.create + count.update + count.replace + count.delete;
+    const cap = (list) => [...new Set(list)].sort().slice(0, GATE_PLAN_ADDRESS_LIMIT);
+    const truncated = new Set(deleted).size > GATE_PLAN_ADDRESS_LIMIT || new Set(replaced).size > GATE_PLAN_ADDRESS_LIMIT;
+    return {
+        members: sorted(new Set(changeSet.members.map((m) => m.member))),
+        membersChanged: sorted(membersChanged),
+        failedMembers: sorted(failedMembers),
+        failed: failedMembers.size,
+        holes: changeSet.members.reduce((n, m) => n + (Array.isArray(m.holes) ? m.holes.length : 0), 0),
+        entries: changeSet.entries.length,
+        changes,
+        creates: count.create,
+        updates: count.update,
+        replaces: count.replace,
+        deletes: count.delete,
+        reads: count.read,
+        noOps: count["no-op"],
+        forgets: count.forget,
+        types: sorted(types),
+        createdTypes: sorted(typesBy.create),
+        updatedTypes: sorted(typesBy.update),
+        replacedTypes: sorted(typesBy.replace),
+        deletedTypes: sorted(typesBy.delete),
+        deleted: cap(deleted),
+        replaced: cap(replaced),
+        regions: sorted(regions),
+        scopes: sorted(scopes),
+        lexicons: sorted(lexicons),
+        taggedCreates,
+        untaggedCreates,
+        createTagKeys: createTagKeys ? sorted(createTagKeys) : [],
+        tagOnly: changes > 0 && tagOnly,
+        truncated,
+    };
+}
+/** The summary of a step result, when the result carries a change set. */
+export function gatePlanSummaryOfResult(result) {
+    const changeSet = changeSetOfResult(result);
+    return changeSet ? gatePlanSummary(changeSet) : undefined;
+}

package/dist/op/gate-point-run.js

@@ -0,0 +1,67 @@
+/**
+ * Reaching a gate that asks a declared decision point (#3170). The shape of
+ * the declaration is in `./gate-point.ts`.
+ *
+ * The run asks the point with the gate's own `gate.*` inputs (those the point
+ * declares) and the authored ones, through the `decide` activity's path
+ * (`./activities/decide.ts`), so the chain, the model's threshold, the reuse
+ * of an answer the same inputs already have and the escalation to people are
+ * the decide activity's. Then:
+ *
+ * - The question is open (escalated to people, or a model's proposal waiting
+ *   for a person): the run records a pending fact on the gate ledger that
+ *   cites the question, as a plain gate records one, and ends `waiting` on
+ *   the question. A person answers it with `chant workspace points answer
+ *   <id>` (or through hud), and the next run, or the local operator's next
+ *   round, asks again and finds the answer.
+ * - It is answered with an answer the gate passes on (`pass`, default yes):
+ *   the run appends a resolution to the gate ledger that cites the answer
+ *   record, once per answer and plan, and walks through.
+ * - It is answered otherwise: the gate step fails, naming the record. `points
+ *   retract` takes the answer back and asks people again.
+ *
+ * `chant approve` does not pass such a gate: only the point's answer does.
+ * The answer record names the gate in its `constrains` (`gate:<op>/<gate>`)
+ * and, when the point declares them, in its `gate.*` inputs.
+ */
+import { defaultGatePointStore, gatePointInputs } from "./gate-point.js";
+import { isPointWait } from "./steward-points.js";
+// The decision itself bundles without the workspace (#3816): `@intentius/chant/point-decision`.
+export { evaluatePointGate, pointGateResumable, } from "../point-decision.js";
+/**
+ * The real asker: the workspace that holds `cwd`. It reads the point's
+ * declared inputs from `points`, adds the `gate.*` ones the point declares,
+ * and asks through the decide activity. A point with no model decider is
+ * asked with no backends, so the run needs no `decide.backends`. A question
+ * goes where the gate's `point.store` says, and to the ledger in a CI job
+ * when it says nothing (`defaultGatePointStore`, #3815).
+ */
+export function workspaceGatePointAsker(cwd) {
+    return {
+        async ask(request) {
+            const { workspacePoints } = await import("../workspace/points-cli.js");
+            const doc = await workspacePoints({ cwd });
+            if ("error" in doc)
+                throw new Error(`decision point ${request.point}: ${doc.error.code}: ${doc.error.message}`);
+            const point = doc.points.find((p) => p.name === request.point);
+            if (!point) {
+                const bad = doc.sources.find((s) => s.reason);
+                throw new Error(`gate "${request.facts.name}" asks decision point ${request.point}, and no points file declares it${bad ? ` (${bad.kind}: ${bad.reason.message})` : ""}`);
+            }
+            const inputs = gatePointInputs(request.point, point.inputs.map((i) => i.name), request.facts, request.inputs);
+            const { runDecide } = await import("./activities/decide.js");
+            const asksModel = point.deciders.some((d) => d.kind === "model");
+            try {
+                const store = request.store ?? defaultGatePointStore();
+                const r = await runDecide({ point: request.point, inputs, subject: request.subject, cwd, ...(store ? { store } : {}), ...(asksModel ? {} : { backends: {} }) });
+                return { id: r.id, point: request.point, path: r.path, state: r.state, answer: r.answer, decider: r.decider, answeredBy: r.answeredBy, subject: request.subject, steward: null };
+            }
+            catch (err) {
+                if (!isPointWait(err))
+                    throw err;
+                const q = err.question;
+                return { id: q.id, point: q.point, path: q.path, state: q.state, answer: null, decider: "quorum", answeredBy: [], subject: q.subject, steward: q.steward };
+            }
+        },
+    };
+}

package/dist/op/gate-point.js

@@ -0,0 +1,111 @@
+/**
+ * A gate that asks a declared decision point (#3170): the declaration's
+ * shape. What a run does when it reaches one is in `./gate-point-run.ts`.
+ *
+ * A plain gate is a pair of facts on the gate ledger: the run records a
+ * pending fact, and `chant approve` records the resolution. A gate that names
+ * a point asks it instead, the way the `decide` activity does (#2740): the
+ * point's deciders (a table, a model, people) and its quorum decide, the
+ * answer is an answer record in the workspace, and an open question is
+ * answered with `chant workspace points answer` or through hud. The run then
+ * passes the gate on that answer and writes the resolution itself, citing the
+ * record. So the gate ledger and the workspace's decision history both show
+ * the approval, and each names the other.
+ *
+ * This module imports nothing at run time, so the `gate` builder can check a
+ * declaration without loading the ledger or the workspace.
+ */
+/**
+ * Where a gate's question goes when its `point` names no `store` (#3815): the
+ * ledger in a CI job, whose checkout is thrown away when the job ends, so the
+ * question outlives it; otherwise undefined, and `points ask`'s own rule
+ * holds (the ledger in a steward's turn, the tree otherwise). A CI job is one
+ * whose environment sets `CI`, as GitHub Actions and GitLab CI do.
+ */
+export function defaultGatePointStore(env = process.env) {
+    const ci = env.CI?.trim().toLowerCase();
+    return ci && ci !== "false" && ci !== "0" ? "ledger" : undefined;
+}
+/** The answers a gate passes on when it names none: a noul point's yes. */
+export const DEFAULT_GATE_POINT_PASS = [true];
+/** A gate's `point` as a {@link GatePoint}, or undefined for a plain gate. */
+export function gatePointOf(point) {
+    if (point === undefined)
+        return undefined;
+    return typeof point === "string" ? { name: point } : point;
+}
+const POINT_NAME = /^[a-z][a-z0-9-]*$/;
+/** What is wrong with a gate's `point`, empty when nothing is. `withApproval` is whether the gate also declares `approval`. */
+export function gatePointProblems(point, withApproval = false) {
+    const problems = [];
+    if (withApproval)
+        problems.push("a gate that asks a decision point takes its quorum from the point: give `approval` or `point`, not both");
+    const p = typeof point === "string" ? { name: point } : point;
+    if (p === null || typeof p !== "object" || Array.isArray(p))
+        return [...problems, "`point` is a decision point's name or { name, inputs?, pass?, store? }"];
+    const { name, inputs, pass, store, ...rest } = p;
+    if (typeof name !== "string" || !POINT_NAME.test(name))
+        problems.push("`point.name` is a decision point's name: lower case letters, digits and hyphens, starting with a letter");
+    if (inputs !== undefined && (inputs === null || typeof inputs !== "object" || Array.isArray(inputs)))
+        problems.push("`point.inputs` is an object of input name to value");
+    if (inputs && typeof inputs === "object") {
+        const own = Object.keys(inputs).filter((k) => k in GATE_POINT_INPUTS);
+        if (own.length > 0)
+            problems.push(`\`point.inputs\` gives ${own.join(", ")}, which the gate passes itself`);
+    }
+    if (pass !== undefined && (!Array.isArray(pass) || pass.length === 0 || pass.some((a) => typeof a !== "string" && typeof a !== "boolean"))) {
+        problems.push("`point.pass` is a non-empty list of the answers that pass the gate");
+    }
+    if (store !== undefined && store !== "tree" && store !== "ledger")
+        problems.push("`point.store` is tree or ledger: where the question is held");
+    const extra = Object.keys(rest);
+    if (extra.length > 0)
+        problems.push(`\`point\` takes name, inputs, pass and store, not ${extra.join(", ")}`);
+    return problems;
+}
+/** The `gate.*` inputs a gate passes to its point, each from a {@link GatePointFacts} field. */
+export const GATE_POINT_INPUTS = {
+    "gate.component": "component",
+    "gate.name": "name",
+    "gate.env": "env",
+    "gate.planDigest": "planDigest",
+};
+/**
+ * The inputs a gate asks its point with: the `gate.*` inputs the point
+ * declares, from `facts`, and the authored ones. A gate that binds a plan
+ * asks a point that declares `gate.planDigest`, so each plan is its own
+ * question and an answer for one plan never passes another: it throws
+ * otherwise, naming the input to declare.
+ */
+export function gatePointInputs(point, declared, facts, authored = {}) {
+    if (facts.planDigest !== null && !declared.includes("gate.planDigest")) {
+        throw new Error(`gate "${facts.name}" binds a plan and asks decision point ${point}, which does not declare the input gate.planDigest: ` +
+            `declare it in the points file, so each plan is its own question and an answer for one plan never passes another`);
+    }
+    const inputs = {};
+    for (const [input, field] of Object.entries(GATE_POINT_INPUTS)) {
+        if (declared.includes(input) && facts[field] !== null)
+            inputs[input] = facts[field];
+    }
+    return { ...authored, ...inputs };
+}
+/**
+ * What an answer record's `constrains` names a gate by: `gate:<op>/<gate>`,
+ * with `@<env>` when the run names an environment. It is how the record
+ * names the gate ledger entry that cites it.
+ */
+export function gateSubject(op, gate, env) {
+    return `gate:${op}/${gate}${env ? `@${env}` : ""}`;
+}
+/** The gate a {@link gateSubject} names, or undefined for a subject that names none (#3835). */
+export function parseGateSubject(subject) {
+    if (!subject || !subject.startsWith("gate:"))
+        return undefined;
+    const rest = subject.slice("gate:".length);
+    const at = rest.lastIndexOf("@");
+    const named = at > 0 ? rest.slice(0, at) : rest;
+    const slash = named.indexOf("/");
+    if (slash <= 0 || slash === named.length - 1)
+        return undefined;
+    return { op: named.slice(0, slash), gate: named.slice(slash + 1), ...(at > 0 ? { env: rest.slice(at + 1) } : {}) };
+}

package/dist/op/gate-resume-plan.js

@@ -0,0 +1,155 @@
+/**
+ * What a resume would start again, decided from the ledger alone (#3858).
+ *
+ * `chant run resume` starts again the CI job behind a gate an approval now
+ * answers (`./gate-resume.ts`). A product that resumes in its own job, such
+ * as terragucci's GitHub and Forgejo resume job, which applies the waves
+ * itself from wave 1 with a read-only token, needs the same decision without
+ * the forge call. {@link planGateResumes} makes it, per gate:
+ *
+ * - A standing pending fact (the newest per gate and environment, not
+ *   expired) is resumable when an approval answers it, or when the decision
+ *   point it cites has an answer the gate passes on. One whose answering
+ *   approval a wave already applied under (`approvals.spend`,
+ *   `_gates/<op>/applied.jsonl`, #3784) is `spent`: that apply ran, so there
+ *   is nothing to resume, and a resumed run would only wait again.
+ * - An apply that stopped: the newest applied line of a gate carries a run
+ *   locator (`resume`), no `finished` line says how it ended, and no pending
+ *   fact of the gate is newer. It is resumable once the run that applied is
+ *   gone, which only the forge can say: the caller checks that
+ *   (`resumeGateRun` does, and `chant run resume --dry-run` asks it without
+ *   starting anything). The resumed wave applies the rest under the same
+ *   approval.
+ *
+ * Pure: no git, no forge, no clock, no Ajv. It imports the run locator's
+ * check, the ledger's selection rules and `pointGateResumable`, all of which
+ * bundle on their own, so a product can bundle
+ * `@intentius/chant/op/gate-resume-plan` (`gate-resume-plan-bundle.test.ts`).
+ */
+import { isPendingGateExpired, latestResolutionForPlan } from "../lifecycle/gate-ledger-select.js";
+import { finishedApply, isApprovalSpent } from "../lifecycle/gate-applied.js";
+import { samePlanDigest } from "../lifecycle/plan-digest.js";
+import { pointGateResumable } from "../point-decision.js";
+import { isGateRunLocator } from "./gate-run-locator.js";
+const time = (iso) => new Date(iso).getTime();
+/** The newest pending fact per gate and environment: the facts a run still waits on. */
+export function standingGateFacts(pending, gate) {
+    const newest = new Map();
+    for (const p of pending) {
+        if (gate !== undefined && p.gate !== gate)
+            continue;
+        const key = `${p.gate}\u0000${p.environment ?? ""}`;
+        const prior = newest.get(key);
+        if (!prior || time(p.timestamp) >= time(prior.timestamp))
+            newest.set(key, p);
+    }
+    return [...newest.values()];
+}
+/** The newest approval of the fact's plan since the fact, when it has no approval block. */
+const defaultAnswering = (resolutions, standing) => {
+    if (standing.approval)
+        return undefined;
+    const mine = resolutions.filter((r) => standing.environment === undefined || r.environment === standing.environment);
+    return latestResolutionForPlan(mine, standing.gate, standing.timestamp, standing.planDigest).resolution;
+};
+/** The applied line that spent an approval of `gate` and `digest` made at `approvedAt`, if one did. */
+function spentBy(applied, gate, digest, approval) {
+    if (digest === undefined)
+        return undefined;
+    const probe = { gate, planDigest: digest, timestamp: approval.timestamp, ...(approval.review ? { review: { pr: approval.review.pr, head: approval.review.head } } : {}) };
+    if (!isApprovalSpent(applied, probe))
+        return undefined;
+    return applied.find((a) => isApprovalSpent([a], probe));
+}
+/** Decide, for each standing pending fact and each stopped apply of an op, whether a resume would start its job again and why. */
+export function planGateResumes(input) {
+    const applied = input.applied ?? [];
+    const finished = input.finished ?? [];
+    const answering = input.answering ?? defaultAnswering;
+    const out = [];
+    const standing = standingGateFacts(input.pending, input.gate).filter((p) => !isPendingGateExpired(p, input.now));
+    for (const p of standing) {
+        const base = {
+            source: "pending",
+            op: p.op || input.op,
+            gate: p.gate,
+            ...(p.environment !== undefined ? { environment: p.environment } : {}),
+            ...(p.planDigest !== undefined ? { planDigest: p.planDigest } : {}),
+            ...(isGateRunLocator(p.resume) ? { run: p.resume } : {}),
+            pending: p,
+        };
+        if (p.answer) {
+            const check = pointGateResumable(p, input.questions?.get(p.answer.id));
+            if (!check.resumable) {
+                out.push({ ...base, resumable: false, reason: "not-approved", message: check.message });
+                continue;
+            }
+            // The resolution a wave recorded when it went through on this answer, if one did, is what an apply spends.
+            const cited = input.resolutions.filter((r) => r.gate === p.gate && r.answer?.id === p.answer.id && samePlanDigest(r.planDigest, p.planDigest));
+            const used = cited.map((r) => ({ r, by: spentBy(applied, p.gate, p.planDigest, r) })).find((x) => x.by);
+            if (used?.by) {
+                out.push({ ...base, resumable: false, reason: "spent", approvedBy: check.answeredBy, approvedAt: used.r.timestamp, message: spentMessage(used.by), spent: spentOf(used.by) });
+                continue;
+            }
+            out.push({ ...base, resumable: true, reason: "answered", approvedBy: check.answeredBy, ...(check.answeredOn ? { approvedAt: check.answeredOn } : {}), message: `question ${p.answer.id} has an answer the gate passes on` });
+            continue;
+        }
+        const answer = answering(input.resolutions, p, input.pending);
+        if (!answer) {
+            out.push({ ...base, resumable: false, reason: "not-approved", message: p.approval && !input.answering ? "its gate has an approval block, which needs chant's tally (pass answering)" : "no approval answers it yet" });
+            continue;
+        }
+        const by = spentBy(applied, p.gate, p.planDigest, answer);
+        if (by) {
+            out.push({ ...base, resumable: false, reason: "spent", approvedBy: answer.resolvedBy, approvedAt: answer.timestamp, message: spentMessage(by), spent: spentOf(by) });
+            continue;
+        }
+        out.push({ ...base, resumable: true, reason: "approved", approvedBy: answer.resolvedBy, approvedAt: answer.timestamp, message: `approved by ${answer.resolvedBy} at ${answer.timestamp}` });
+    }
+    for (const line of stoppedApplies(applied, finished, input.pending, input.gate)) {
+        out.push({
+            source: "stopped",
+            op: line.op || input.op,
+            gate: line.gate,
+            planDigest: line.planDigest,
+            resumable: true,
+            reason: "stopped",
+            approvedBy: line.approvedBy,
+            approvedAt: line.approvedAt,
+            run: line.resume,
+            stopped: { appliedAt: line.timestamp, approvedAt: line.approvedAt, kind: line.kind, ...(line.wave ? { wave: line.wave } : {}) },
+            message: `the apply of ${line.planDigest} under the approval by ${line.approvedBy || "?"} began at ${line.timestamp} and never recorded how it ended; it resumes once run ${line.resume.run} is gone`,
+        });
+    }
+    return out;
+}
+const spentOf = (a) => ({ appliedAt: a.timestamp, approvedAt: a.approvedAt, ...(a.wave ? { wave: a.wave } : {}) });
+const spentMessage = (a) => `the approval that answers it is spent: ${a.wave ? `wave ${a.wave.number} (${a.wave.name})` : "a wave"} applied under it at ${a.timestamp}`;
+/**
+ * Per gate, the apply that may have stopped: the gate's newest applied line,
+ * or the line that names the same approval and carries a run locator, with
+ * no finished line for it and no pending fact of the gate since.
+ */
+function stoppedApplies(applied, finished, pending, gate) {
+    const newest = new Map();
+    for (const a of applied) {
+        if (gate !== undefined && a.gate !== gate)
+            continue;
+        const prior = newest.get(a.gate);
+        if (!prior || time(a.timestamp) >= time(prior.timestamp))
+            newest.set(a.gate, a);
+    }
+    const out = [];
+    for (const [g, last] of newest) {
+        const sameApply = applied.filter((a) => a.gate === g && samePlanDigest(a.planDigest, last.planDigest) && time(a.approvedAt) === time(last.approvedAt) && isGateRunLocator(a.resume));
+        const line = sameApply.reduce((n, a) => (!n || time(a.timestamp) >= time(n.timestamp) ? a : n), undefined);
+        if (!line)
+            continue;
+        if (sameApply.some((a) => finishedApply(finished, a)))
+            continue;
+        if (pending.some((p) => p.gate === g && time(p.timestamp) > time(line.timestamp)))
+            continue;
+        out.push(line);
+    }
+    return out;
+}

package/dist/op/gate-resume.js

@@ -0,0 +1,31 @@
+/**
+ * Resume the job that waits at a gate (#3683). The forge calls,
+ * {@link resumeGateRun} and {@link resumeTokenFromEnv}, live in
+ * `../gate-resume-run.ts`, which bundles without the workspace code (#3854),
+ * and are re-exported here so `@intentius/chant/op/gate-resume` keeps working.
+ * This module adds {@link resolutionAnswering}, which decides whether an
+ * approval answers a pending fact the way a run decides the gate, and so reads
+ * `./gate`'s quorum rules.
+ */
+import { latestResolutionForPlan } from "../lifecycle/gate-ledger.js";
+import { humanQuorumSince, tallyGateApprovals } from "./gate.js";
+export { isGateRunLocator, resolveGateRunLocator, resumeGateRun, resumeTokenFromEnv, } from "../gate-resume-run.js";
+/**
+ * The resolution that answers `standing`, read the way a run decides the gate
+ * (the plan, the environment, the quorum), or undefined. `pending` is the
+ * gate ledger's pending facts, which place the human quorum's anchor (#3206);
+ * without them it is `standing` itself. A workspace's
+ * `identity.gates` rule is not applied here: the resumed job applies it, and
+ * waits again when the approval does not count.
+ */
+export function resolutionAnswering(resolutions, standing, pending = [standing]) {
+    const env = standing.environment;
+    const mine = resolutions.filter((r) => env === undefined || r.environment === env);
+    if (standing.approval) {
+        const tally = tallyGateApprovals(mine, standing.gate, standing.timestamp, standing.planDigest, standing.approval, humanQuorumSince(pending, standing));
+        if (tally.permit)
+            return tally.permit;
+        return tally.counted.length >= tally.need ? tally.counted[tally.counted.length - 1] : undefined;
+    }
+    return latestResolutionForPlan(mine, standing.gate, standing.timestamp, standing.planDigest).resolution;
+}