@intentius/chant 0.124.14 → 0.124.15

package/dist/discovery/fold-import.js

@@ -18,6 +18,7 @@ import { collectCompositeOrigins, collectParamDependencies, collectTagOrigins, s
 import { getInterpolationFields, getProvenance, setPathProvenance, setProvenance } from "../provenance.js";
 import { foldProvenanceOfEntities } from "../fold-provenance.js";
 import { collectEntities } from "./collect.js";
+import { hostCompositeName, markHostCompositeInstance } from "./host-composite.js";
 import { intrinsicCallFoldsEagerly, intrinsicTagFolds } from "../lexicon.js";
 /**
  * chant #1063 — the package specifier a lexicon NAME (`"aws"`, `"gitlab"`)
@@ -2265,52 +2266,6 @@ async function interpretCompositeFactory(factory, args, ctx, call) {
         return undefined;
     }
 }
-/**
- * chant#3598 — a host composite instance's own marker. Non-enumerable and
- * symbol-keyed, like provenance, so nothing that serializes or compares the
- * exports sees it. It carries the composite's name, which the members object
- * otherwise has no record of once it is returned.
- */
-const HOST_COMPOSITE_INSTANCE = Symbol.for("chant.fold.hostCompositeInstance");
-/**
- * Mark `members` as the instance a host's composite produced, and return it
- * unchanged.
- *
- * chant#3608 — every declarable member, and every member of a nested host
- * instance, is also stamped with the composite, the way `expandComposite`
- * stamps a chant instance's members. A destructured member is never expanded,
- * so this is the only record it has that a composite wrote it, and without
- * it a path the fold did not attribute reads as authored and so `direct`.
- * `setProvenance` keeps the first writer, and a nested instance was marked
- * when its own call returned, so a member keeps its innermost composite.
- */
-function markHostCompositeInstance(members, compositeName) {
-    if (Object.isExtensible(members) && !Object.prototype.hasOwnProperty.call(members, HOST_COMPOSITE_INSTANCE)) {
-        Object.defineProperty(members, HOST_COMPOSITE_INSTANCE, {
-            value: compositeName,
-            enumerable: false,
-            configurable: true,
-        });
-    }
-    stampHostCompositeMembers(members, compositeName);
-    return members;
-}
-/** Stamp `composite` on each declarable member of a host instance, descending into nested host instances. */
-function stampHostCompositeMembers(members, compositeName) {
-    for (const member of Object.values(members)) {
-        if (isDeclarable(member))
-            setProvenance(member, { composite: compositeName });
-        else if (hostCompositeName(member) !== undefined)
-            stampHostCompositeMembers(member, compositeName);
-    }
-}
-/** The composite name a host composite instance was marked with, or `undefined` for any other value. */
-function hostCompositeName(value) {
-    if (!isIndexableObject(value))
-        return undefined;
-    const name = value[HOST_COMPOSITE_INSTANCE];
-    return typeof name === "string" ? name : undefined;
-}
 /** Evaluate an admissible factory body's statements in order, binding each `const`, and return the `return` expression's value. */
 async function interpretFactoryBody(fn, ctx, bind) {
     if (!ts.isBlock(fn.body))
@@ -4036,7 +3991,7 @@ export async function foldProject(files, intrinsics = [], options = {}) {
         const attempt = attempts.get(file);
         return {
             file,
-            exports: attempt?.ok === true ? expandHostCompositeExports(Object.fromEntries(attempt.exportedValues)) : {},
+            exports: attempt?.ok === true ? Object.fromEntries(attempt.exportedValues) : {},
         };
     }));
     const out = new Map();
@@ -4103,66 +4058,6 @@ function foldProvenanceByFile(modules) {
     }
     return out;
 }
-/**
- * chant#3598 — a file's exports with every host composite instance replaced by
- * its members, for {@link foldProvenanceByFile} only.
- *
- * A host's registration form (chant#2442) returns the members object the
- * factory built, not a chant `CompositeInstance`, because wrapping it would run
- * chant's member validation against the host's own entities. `collectEntities`
- * expands only chant's instances, so an instance exported whole
- * (`export const store = Store({...})`) contributed no entity and therefore no
- * record, while a destructured member, a plain declarable export, did.
- *
- * The members are named and stamped the way `expandComposite` names and stamps
- * a chant instance: `${exportName}${Member}`, with a whole-entity `composite`
- * origin under the paths the fold already attributed. That origin is written
- * before `collectEntities` adds its `authored` one, and the first writer wins,
- * so a path the fold did not attribute is `unknown` rather than `direct`.
- *
- * Only a top-level export is expanded. A host instance nested in another
- * composite's body or placed in an array does not fold today, so its file is
- * `run` and has no record to give.
- *
- * The exports a caller receives in the verdict are the originals.
- */
-function expandHostCompositeExports(exports) {
-    const out = {};
-    for (const [name, value] of Object.entries(exports)) {
-        if (hostCompositeName(value) === undefined) {
-            out[name] = value;
-            continue;
-        }
-        expandHostCompositeInstance(name, value, name, out);
-    }
-    return out;
-}
-/**
- * chant#3608 — one host instance's members into `out`, a nested host instance
- * expanded in place under its member's name (`siteMainBucket`), as
- * `expandComposite` expands a nested chant instance. Every member belongs to
- * the top-level `instance`; its composite is the innermost one, which
- * {@link markHostCompositeInstance} already stamped, so the whole-entity
- * origin names that composite too.
- */
-function expandHostCompositeInstance(prefix, members, instance, out) {
-    const compositeName = hostCompositeName(members);
-    for (const [memberName, member] of Object.entries(members)) {
-        if (memberName.length === 0)
-            continue;
-        const fullName = `${prefix}${memberName[0].toUpperCase()}${memberName.slice(1)}`;
-        if (hostCompositeName(member) !== undefined) {
-            expandHostCompositeInstance(fullName, member, instance, out);
-            continue;
-        }
-        if (!isDeclarable(member))
-            continue;
-        setProvenance(member, { composite: compositeName, compositeInstance: instance });
-        const composite = getProvenance(member)?.composite ?? compositeName;
-        setPathProvenance(member, "", { kind: "composite", composite, instance });
-        out[fullName] = member;
-    }
-}
 /** The deepest directory every one of `files` sits under. */
 function commonDirectory(files) {
     const split = files.map((file) => dirname(resolvePath(file)).split(sep));

package/dist/discovery/host-composite.d.ts

@@ -0,0 +1,35 @@
+import { type Declarable } from "../declarable.js";
+/**
+ * Mark `members` as the instance a host's composite produced, and return it
+ * unchanged.
+ *
+ * chant#3608 — every declarable member, and every member of a nested host
+ * instance, is also stamped with the composite, the way `expandComposite`
+ * stamps a chant instance's members. A destructured member is never expanded,
+ * so this is the only record it has that a composite wrote it, and without
+ * it a path the fold did not attribute reads as authored and so `direct`.
+ * `setProvenance` keeps the first writer, and a nested instance was marked
+ * when its own call returned, so a member keeps its innermost composite.
+ */
+export declare function markHostCompositeInstance(members: Record<string, unknown>, compositeName: string): Record<string, unknown>;
+/** The composite name a host composite instance was marked with, or `undefined` for any other value. */
+export declare function hostCompositeName(value: unknown): string | undefined;
+/**
+ * chant#3598, chant#3612 — a host composite instance's members as entities,
+ * for `collectEntities`.
+ *
+ * `collectEntities` is the one place `build()` and `foldProject` turn exports
+ * into entities, so expanding here is what makes the two report the same set:
+ * `export const archive = Archive({...})` gives `archiveBucket` to both.
+ *
+ * The members are named and stamped the way `expandComposite` names and stamps
+ * a chant instance: `${exportName}${Member}`, a nested host instance expanded
+ * in place under its member's name (`siteMainBucket`), with a whole-entity
+ * `composite` origin under the paths the fold already attributed. That origin
+ * is written before `collectEntities` adds its own record, and the first
+ * writer wins, so a path the fold did not attribute is `unknown` rather than
+ * `direct`. Every member belongs to the top-level `instance`; its composite is
+ * the innermost one, which {@link markHostCompositeInstance} already stamped.
+ */
+export declare function expandHostComposite(prefix: string, members: Record<string, unknown>, instance?: string): Array<[string, Declarable]>;
+//# sourceMappingURL=host-composite.d.ts.map

package/dist/discovery/host-composite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-composite.d.ts","sourceRoot":"","sources":["../../src/discovery/host-composite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAoB9D;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,aAAa,EAAE,MAAM,GACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAUD,wGAAwG;AACxG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,GAAE,MAAe,GACxB,KAAK,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAiB7B"}

package/dist/discovery/host-composite.js

@@ -0,0 +1,93 @@
+import { isDeclarable } from "../declarable.js";
+import { getProvenance, setPathProvenance, setProvenance } from "../provenance.js";
+/**
+ * chant#3598 — a host composite instance's own marker. Non-enumerable and
+ * symbol-keyed, like provenance, so nothing that serializes or compares the
+ * exports sees it. It carries the composite's name, which the members object
+ * otherwise has no record of once it is returned.
+ *
+ * Only the fold path sets it: a host's registration form (chant#2442) returns
+ * the members object the factory built, not a chant `CompositeInstance`, and
+ * chant knows the object came from a composite only because the fold resolved
+ * the call. A file that runs instead has no such knowledge.
+ */
+const HOST_COMPOSITE_INSTANCE = Symbol.for("chant.fold.hostCompositeInstance");
+function isPlainIndexable(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Mark `members` as the instance a host's composite produced, and return it
+ * unchanged.
+ *
+ * chant#3608 — every declarable member, and every member of a nested host
+ * instance, is also stamped with the composite, the way `expandComposite`
+ * stamps a chant instance's members. A destructured member is never expanded,
+ * so this is the only record it has that a composite wrote it, and without
+ * it a path the fold did not attribute reads as authored and so `direct`.
+ * `setProvenance` keeps the first writer, and a nested instance was marked
+ * when its own call returned, so a member keeps its innermost composite.
+ */
+export function markHostCompositeInstance(members, compositeName) {
+    if (Object.isExtensible(members) && !Object.prototype.hasOwnProperty.call(members, HOST_COMPOSITE_INSTANCE)) {
+        Object.defineProperty(members, HOST_COMPOSITE_INSTANCE, {
+            value: compositeName,
+            enumerable: false,
+            configurable: true,
+        });
+    }
+    stampHostCompositeMembers(members, compositeName);
+    return members;
+}
+/** Stamp `composite` on each declarable member of a host instance, descending into nested host instances. */
+function stampHostCompositeMembers(members, compositeName) {
+    for (const member of Object.values(members)) {
+        if (isDeclarable(member))
+            setProvenance(member, { composite: compositeName });
+        else if (hostCompositeName(member) !== undefined)
+            stampHostCompositeMembers(member, compositeName);
+    }
+}
+/** The composite name a host composite instance was marked with, or `undefined` for any other value. */
+export function hostCompositeName(value) {
+    if (!isPlainIndexable(value))
+        return undefined;
+    const name = value[HOST_COMPOSITE_INSTANCE];
+    return typeof name === "string" ? name : undefined;
+}
+/**
+ * chant#3598, chant#3612 — a host composite instance's members as entities,
+ * for `collectEntities`.
+ *
+ * `collectEntities` is the one place `build()` and `foldProject` turn exports
+ * into entities, so expanding here is what makes the two report the same set:
+ * `export const archive = Archive({...})` gives `archiveBucket` to both.
+ *
+ * The members are named and stamped the way `expandComposite` names and stamps
+ * a chant instance: `${exportName}${Member}`, a nested host instance expanded
+ * in place under its member's name (`siteMainBucket`), with a whole-entity
+ * `composite` origin under the paths the fold already attributed. That origin
+ * is written before `collectEntities` adds its own record, and the first
+ * writer wins, so a path the fold did not attribute is `unknown` rather than
+ * `direct`. Every member belongs to the top-level `instance`; its composite is
+ * the innermost one, which {@link markHostCompositeInstance} already stamped.
+ */
+export function expandHostComposite(prefix, members, instance = prefix) {
+    const out = [];
+    const compositeName = hostCompositeName(members);
+    for (const [memberName, member] of Object.entries(members)) {
+        if (memberName.length === 0)
+            continue;
+        const fullName = `${prefix}${memberName[0].toUpperCase()}${memberName.slice(1)}`;
+        if (hostCompositeName(member) !== undefined) {
+            out.push(...expandHostComposite(fullName, member, instance));
+            continue;
+        }
+        if (!isDeclarable(member))
+            continue;
+        setProvenance(member, { composite: compositeName, compositeInstance: instance });
+        const composite = getProvenance(member)?.composite ?? compositeName;
+        setPathProvenance(member, "", { kind: "composite", composite, instance });
+        out.push([fullName, member]);
+    }
+    return out;
+}

package/dist/discovery/index.d.ts

@@ -70,6 +70,15 @@ export interface DiscoveryOptions {
      * at all, rather than a looser fallback.
      */
     lexicons?: readonly string[];
+    /**
+     * chant#3612 — package specifiers to follow a bare import into, verbatim,
+     * alongside whatever {@link lexicons} names. The same allowlist
+     * `FoldProjectOptions.lexiconPackages` gives `foldProject` (chant#2438), so
+     * a build over a host of its own folds the files `foldProject` folds. A
+     * chant project never needs it: its packages are `lexicons`. Only
+     * meaningful when {@link fold} is set. Default: none.
+     */
+    lexiconPackages?: readonly string[];
     /**
      * chant #1045 Phase 2 — opt-in: whatever would otherwise reach the
      * in-process `importModule` step (every file, when {@link fold} isn't set;

package/dist/discovery/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/discovery/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AA8D1D;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,8DAA8D;IAC9D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,qDAAqD;IACrD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mDAAmD;IACnD,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB;;;OAGG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+SjG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/discovery/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AA8D1D;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7B;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEpC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,8DAA8D;IAC9D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,qDAAqD;IACrD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mDAAmD;IACnD,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB;;;OAGG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+SjG"}

package/dist/discovery/index.js

@@ -134,7 +134,7 @@ export async function discover(path, options) {
             "project code and the second exists to invoke it. Pass one.");
     }
     const foldSession = options?.fold
-        ? createFoldSession(options.intrinsics, buildParamValuesMap, options.lexicons, options.sandbox === true, [], options.executing === true, files)
+        ? createFoldSession(options.intrinsics, buildParamValuesMap, options.lexicons, options.sandbox === true, options.lexiconPackages ?? [], options.executing === true, files)
         : undefined;
     if (options?.fold) {
         for (const file of files) {

package/dist/gate-decision.d.ts

@@ -18,8 +18,9 @@
  *
  * A gate the declaration at base names under `identity.gates` counts only a
  * sealed approval from its class: {@link identityGateAdmissionAt} reads that
- * rule from a bare clone at base and judges by `admitApprover`, the function
- * chant's `gateAdmission` judges by (#3862); pass its `refuses` to
+ * rule from a bare clone at base, with the principal classes the pinned
+ * packages supply read as data (#3888), and judges by `admitApprover`, the
+ * function chant's `gateAdmission` judges by (#3862); pass its `refuses` to
  * {@link decideGateApproval}.
  *
  * With `spend` (#3784), an approval a wave already applied under is spent and
@@ -27,8 +28,9 @@
  * the lines of `_gates/<op>/applied.jsonl` ({@link parseAppliedGateLines}).
  *
  * The module reads the ledger lines and the review it is handed; reading
- * them is the caller's. It imports no TypeScript, esbuild, zod, lint, fold or
- * codegen module, and none of chant's git ledger code, which
+ * them is the caller's. It imports no TypeScript, esbuild, zod, ajv, lint,
+ * fold or codegen module, no package's code, and none of chant's git ledger
+ * code, which
  * `gate-decision-bundle.test.ts` holds it to. Its rules are chant's own:
  * `./lifecycle/gate-ledger-select.ts` is what `evaluateGate` decides by, and
  * `gate-decision.test.ts` decides the same ledgers both ways.
@@ -90,15 +92,24 @@ export interface IdentityGateAdmission {
  * class, the role grants in `.chant/trust.json` at base put the approver in
  * it. Both judge with the same function ({@link admitApprover}).
  *
- * The classes are the four core ones, then `classes`, the domain classes the
- * caller read from the pinned packages (`./workspace-principals`), in pin
- * order. This reader loads no package. A gate whose class is in neither
- * refuses every approval, and when the declaration at base pins anything the
- * reason says the pins were not read, since one of them may supply it.
+ * The classes are the four core ones, then the domain classes the
+ * declaration's pins supply, in pin order (#3888), read as chant reads them:
+ * a path pin's `./workspace-principals` file at `base`, and a package pin's
+ * from the package installed under `packages` (default `repo`) at the
+ * pinned version. A bare clone has no `node_modules`, so a caller that reads
+ * one passes the directory its packages are installed under. Only data is
+ * read; no package is imported. `classes`, when given, stands for every
+ * domain class instead and no pin is read.
+ *
+ * When a pin can't be read (its package is not installed, or not at the
+ * pinned version), a gate whose class it could change (a domain class, or
+ * `human`) refuses every approval and says which pins were not read; a gate
+ * naming `agent`, `runner` or `service`, or no class, is judged as usual.
  * Throws when the declaration at base cannot be parsed.
  */
 export declare function identityGateAdmissionAt(repo: string, base: string, gate: string, opts?: {
     classes?: readonly ClassGrant[];
+    packages?: string;
 }): IdentityGateAdmission | null;
 /** What a pull request's review says about a wave, under `pr-review`. */
 export interface ReviewApproval {

package/dist/gate-decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-decision.d.ts","sourceRoot":"","sources":["../src/gate-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AASH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAQzG,OAAO,EAA+B,KAAK,UAAU,EAA0B,MAAM,gCAAgC,CAAC;AACtH,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAcrD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/C;AAwBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAErE;AAED,0HAA0H;AAC1H,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAmBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAG1E;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,YAAY,CAAC;IAC1B,+HAA+H;IAC/H,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAAC;CACtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CAAO,GAC7C,qBAAqB,GAAG,IAAI,CAiB9B;AAID,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7F;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAmBnH;AAID,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,sIAAsI;IACtI,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iHAAiH;IACjH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5D,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;CAAE,GAC1E;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,wHAAwH;IACxH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,yGAAyG;IACzG,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,iFAAiF;IACjF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,yDAAyD;IACzD,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,wHAAwH;IACxH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAIN;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,oBAAoB,CA6CjF"}
+{"version":3,"file":"gate-decision.d.ts","sourceRoot":"","sources":["../src/gate-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAWH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAQzG,OAAO,EAA+B,KAAK,UAAU,EAA+C,MAAM,gCAAgC,CAAC;AAE3I,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAcrD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/C;AAwBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAErE;AAED,0HAA0H;AAC1H,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAmBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAG1E;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,YAAY,CAAC;IAC1B,+HAA+H;IAC/H,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAAC;CACtD;AAoDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,qBAAqB,GAAG,IAAI,CAc9B;AAID,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7F;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAmBnH;AAID,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,sIAAsI;IACtI,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iHAAiH;IACjH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5D,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;CAAE,GAC1E;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,wHAAwH;IACxH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,yGAAyG;IACzG,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,iFAAiF;IACjF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,yDAAyD;IACzD,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,wHAAwH;IACxH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAIN;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,oBAAoB,CA6CjF"}

package/dist/gate-decision.js

@@ -18,8 +18,9 @@
  *
  * A gate the declaration at base names under `identity.gates` counts only a
  * sealed approval from its class: {@link identityGateAdmissionAt} reads that
- * rule from a bare clone at base and judges by `admitApprover`, the function
- * chant's `gateAdmission` judges by (#3862); pass its `refuses` to
+ * rule from a bare clone at base, with the principal classes the pinned
+ * packages supply read as data (#3888), and judges by `admitApprover`, the
+ * function chant's `gateAdmission` judges by (#3862); pass its `refuses` to
  * {@link decideGateApproval}.
  *
  * With `spend` (#3784), an approval a wave already applied under is spent and
@@ -27,13 +28,16 @@
  * the lines of `_gates/<op>/applied.jsonl` ({@link parseAppliedGateLines}).
  *
  * The module reads the ledger lines and the review it is handed; reading
- * them is the caller's. It imports no TypeScript, esbuild, zod, lint, fold or
- * codegen module, and none of chant's git ledger code, which
+ * them is the caller's. It imports no TypeScript, esbuild, zod, ajv, lint,
+ * fold or codegen module, no package's code, and none of chant's git ledger
+ * code, which
  * `gate-decision-bundle.test.ts` holds it to. Its rules are chant's own:
  * `./lifecycle/gate-ledger-select.ts` is what `evaluateGate` decides by, and
  * `gate-decision.test.ts` decides the same ledgers both ways.
  */
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join, posix } from "node:path";
 import { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, } from "./lifecycle/gate-ledger-select.js";
 import { samePlanDigest } from "./lifecycle/plan-digest.js";
 import { isApprovalSpent } from "./lifecycle/gate-applied.js";
@@ -41,6 +45,7 @@ import { gateSealRefusal } from "./workspace/trust/gate-seal.js";
 import { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, trustConfigProblems, } from "./workspace/trust/trust-files.js";
 import { parseJsonText } from "./workspace/jsonc.js";
 import { CORE_CLASSES, admitApprover } from "./workspace/identity-gate-rule.js";
+import { diskFiles, findInstalledPackage, mergePinClasses, parseClassDataByHand, readClassFiles } from "./workspace/class-data.js";
 export { GATE_APPROVAL_SOURCES } from "./op/op-waves.js";
 export { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, latestResolutionSince, } from "./lifecycle/gate-ledger-select.js";
 export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, sshKeyFingerprint, verifySshSignatureWith, } from "./workspace/trust/gate-seal.js";
@@ -141,6 +146,49 @@ export function identityGatesAt(repo, base) {
     const declaration = declarationAt(repo, base);
     return declaration === null ? [] : identityGatesOf(declaration.value);
 }
+/**
+ * Read the classes each pin supplies, as chant's `gateAdmission(cwd, gate,
+ * base)` reads them: a path pin's `./workspace-principals` file from `base`
+ * itself, so a change can't remap a class by editing its own copy of the
+ * plugin; a package pin's from the package installed under `packages` (its
+ * `node_modules` or a parent's), which must be at the pinned version. Reads
+ * data only and imports no package.
+ */
+function pinnedClassesAt(repo, base, pins, packages) {
+    const reads = [];
+    const unread = [];
+    (Array.isArray(pins) ? pins : []).forEach((raw, i) => {
+        const pin = (raw !== null && typeof raw === "object" ? raw : {});
+        if (typeof pin.path === "string" && pin.path) {
+            const dir = posix.normalize(pin.path);
+            const files = (path) => showAt(repo, base, dir === "." ? path : posix.join(dir, path));
+            reads.push({ pin: i, source: pin.path, read: readClassFiles(files, pin.path, parseClassDataByHand) });
+            return;
+        }
+        if (typeof pin.package !== "string" || !pin.package)
+            return;
+        const dir = findInstalledPackage(pin.package, packages);
+        if (!dir) {
+            unread.push(`${pin.package} is not installed under ${packages}`);
+            return;
+        }
+        let installed;
+        try {
+            installed = JSON.parse(readFileSync(join(dir, "package.json"), "utf-8")).version;
+        }
+        catch {
+            installed = undefined;
+        }
+        if (typeof pin.version === "string" && pin.version && installed !== pin.version) {
+            unread.push(`${pin.package} is pinned at ${pin.version}, and ${String(installed ?? "an unknown version")} is installed under ${packages}`);
+            return;
+        }
+        reads.push({ pin: i, source: pin.package, read: readClassFiles(diskFiles(dir), pin.package, parseClassDataByHand) });
+    });
+    return { classes: mergePinClasses(reads).classes, unread };
+}
+/** The core classes whose members no domain class can change: every one but `human`, which is the principals in no other class. */
+const PIN_FREE = new Set(CORE_CLASSES.filter((c) => c.role !== null).map((c) => c.name));
 /**
  * The `identity.gates` rule for `gate` at `base`, or null when the
  * declaration there names none: what chant's `gateAdmission(cwd, gate, base)`
@@ -149,11 +197,19 @@ export function identityGatesAt(repo, base) {
  * class, the role grants in `.chant/trust.json` at base put the approver in
  * it. Both judge with the same function ({@link admitApprover}).
  *
- * The classes are the four core ones, then `classes`, the domain classes the
- * caller read from the pinned packages (`./workspace-principals`), in pin
- * order. This reader loads no package. A gate whose class is in neither
- * refuses every approval, and when the declaration at base pins anything the
- * reason says the pins were not read, since one of them may supply it.
+ * The classes are the four core ones, then the domain classes the
+ * declaration's pins supply, in pin order (#3888), read as chant reads them:
+ * a path pin's `./workspace-principals` file at `base`, and a package pin's
+ * from the package installed under `packages` (default `repo`) at the
+ * pinned version. A bare clone has no `node_modules`, so a caller that reads
+ * one passes the directory its packages are installed under. Only data is
+ * read; no package is imported. `classes`, when given, stands for every
+ * domain class instead and no pin is read.
+ *
+ * When a pin can't be read (its package is not installed, or not at the
+ * pinned version), a gate whose class it could change (a domain class, or
+ * `human`) refuses every approval and says which pins were not read; a gate
+ * naming `agent`, `runner` or `service`, or no class, is judged as usual.
  * Throws when the declaration at base cannot be parsed.
  */
 export function identityGateAdmissionAt(repo, base, gate, opts = {}) {
@@ -163,16 +219,13 @@ export function identityGateAdmissionAt(repo, base, gate, opts = {}) {
         return null;
     const { signers, roles } = trustAt(repo, base);
     const pins = declaration.value.pins;
-    const rule = {
-        gate,
-        class: requirement.class,
-        signers,
-        roles,
-        classes: [...CORE_CLASSES, ...(opts.classes ?? [])],
-        ...(Array.isArray(pins) && pins.length > 0
-            ? { unknownClass: `is not a core class, and this reader does not load the classes the pinned packages in ${declaration.file} at base supply` }
-            : {}),
-    };
+    const pinned = opts.classes ? { classes: opts.classes, unread: [] } : pinnedClassesAt(repo, base, pins, opts.packages ?? repo);
+    const want = requirement.class;
+    if (want !== null && !PIN_FREE.has(want) && pinned.unread.length > 0) {
+        const reason = `identity.gates.${gate} names the class ${want}, and the pins in ${declaration.file} at base could not all be read, so no approval can show it is in that class: ${pinned.unread.join("; ")}`;
+        return { requirement, refuses: () => reason };
+    }
+    const rule = { gate, class: want, signers, roles, classes: [...CORE_CLASSES, ...pinned.classes] };
     return { requirement, refuses: (a) => admitApprover(rule, a) };
 }
 /**

package/dist/lifecycle/gate-audit.d.ts

@@ -1,5 +1,7 @@
 import type { GateLedgerPort } from "../op/gate.js";
-export declare const GATE_AUDIT_KINDS: readonly ["approval-requested", "approved", "override-requested", "override-recorded", "revoked", "applied", "override-spent"];
+import type { LedgerReadPort } from "./ledger-port.js";
+import type { GateApprovalSource } from "../op/op-waves.js";
+export declare const GATE_AUDIT_KINDS: readonly ["approval-requested", "approved", "override-requested", "override-recorded", "revoked", "applied", "override-spent", "hook"];
 export type GateAuditKind = (typeof GATE_AUDIT_KINDS)[number];
 /** How an approval was authorised: a forge review, an ssh seal, or neither. A review wins; a review that is also sealed has `sealed: true` beside it. */
 export type GateAuditSeal = "sealed" | "review" | "unsigned";
@@ -63,7 +65,7 @@ export interface GateAuditSource {
     commit?: string;
     /** The commit that added the line, or for a revocation removed it, when the line came from history. */
     author?: GateLedgerCommit;
-    change: "added" | "removed" | "apply";
+    change: "added" | "removed" | "apply" | "decision";
 }
 export interface GateAuditEntry {
     /** `sha256:` over where the entry came from: the same sources give the same id. */
@@ -111,8 +113,27 @@ export interface GateAuditEntry {
         name: string;
         op?: string;
     };
+    /** Pending facts of a hold (#3886): the hook that holds the wave. */
+    heldBy?: {
+        hook: string;
+        moment: string;
+        target?: string;
+    };
+    /** Pending facts of an op wave (#3861): the approval mode the wave asked under. */
+    approvalMode?: GateApprovalSource;
     /** Overrides: the rules the denial named (from the denial line when there is one). */
     rules?: string[];
+    /** A hook entry: the hook's moment, name, run, how it came out, and why a moment was skipped (#3810). */
+    hook?: {
+        moment: string;
+        name: string;
+        target?: string;
+        outcome: "passed" | "failed" | "held" | "skipped";
+        exit: number;
+        reason?: string;
+    };
+    /** A hook entry: the applied entry of the same wave and digest, if the caller passed that apply in. */
+    applied?: string;
     /** A revoked entry: what was revoked. */
     subject?: "approval" | "override";
     /** An applied entry: the approval entry it ran under, if one is held. An override-spent entry: the override entry. */
@@ -128,6 +149,40 @@ export interface GateAuditGap {
     digest?: string;
     detail: string;
 }
+/**
+ * An op-wave decision record (`.chant/op-waves/<name>/wave-<k>.json`, written
+ * by `chant run wave`), as far as the audit reads it: the wave's gate and
+ * digest, and the `outcomes` of its hooks (#3804, #3811, #3847). Typed
+ * structurally so this file imports nothing from `../op/`.
+ */
+export interface WaveDecisionRecord {
+    wave: number;
+    name: string;
+    op: string;
+    gate: string;
+    digest?: string;
+    heldBy?: string[];
+    heldOn?: unknown;
+    outcomes?: ReadonlyArray<{
+        moment: string;
+        name: string;
+        target?: string;
+        exit: number;
+        outcome: string;
+        reason?: string;
+    }>;
+}
+/**
+ * A decision record the caller passes in. The record carries no time and no
+ * place, so `ref` (a file path, an artifact, a row) and `at` (when it was
+ * written) come from the caller. Give the parsed `record`, or its `text`.
+ */
+export interface GateAuditDecision {
+    ref: string;
+    at: string;
+    record?: unknown;
+    text?: string;
+}
 export interface GateAuditOptions {
     /** Whether a gate is an override gate. Default: op `policy-override`, or a gate named `override-...`. */
     isOverride?: (op: string, gate: string) => boolean;
@@ -143,6 +198,8 @@ export interface GateAuditOptions {
 export interface GateAuditInput extends GateAuditOptions {
     ledgers: readonly GateAuditLedger[];
     applies?: readonly GateAuditApply[];
+    /** Op-wave decision records: each hook outcome in them becomes a `hook` entry linked to the wave's approval and apply (#3810). */
+    decisions?: readonly GateAuditDecision[];
 }
 export declare const POLICY_OVERRIDE_OP = "policy-override";
 /** The default {@link GateAuditOptions.isOverride}. */
@@ -172,4 +229,14 @@ export declare function gateLedgerLinesFromLog(log: string): GateLedgerLine[];
  * history through {@link gateLedgerLinesFromLog} for that.
  */
 export declare function readGateAuditLedgers(port: Pick<GateLedgerPort, "read">, ops: readonly string[]): Promise<GateAuditLedger[]>;
+/**
+ * The thin reader for decision records kept on the ledger branch: every
+ * `.json` file directly under `dir` (such as a product's `_wave-decisions/<name>`),
+ * as input for {@link GateAuditInput.decisions}. A decision record holds no
+ * time, so `at` stamps them all: when the product collected them. Where the
+ * records live is the product's business; chant writes them to
+ * `.chant/op-waves/<name>/wave-<k>.json` in the job, and a product that
+ * collects them elsewhere passes them in directly.
+ */
+export declare function readGateAuditDecisions(port: Pick<LedgerReadPort, "read" | "list">, dir: string, at: string): Promise<GateAuditDecision[]>;
 //# sourceMappingURL=gate-audit.d.ts.map