@intentius/chant 0.124.14 → 0.124.16

package/dist/build.d.ts

@@ -117,6 +117,12 @@ export interface BuildOptions {
      * `options.plugins.map(p => p.name)`.
      */
     lexicons?: readonly string[];
+    /**
+     * chant#3612 — host package specifiers to follow a bare import into. Passed
+     * straight through to {@link DiscoveryOptions.lexiconPackages}; ignored
+     * unless {@link fold} is set. Never needed for a chant project.
+     */
+    lexiconPackages?: readonly string[];
     /**
      * chant #1442 — lexicon name → the version of the plugin that served it.
      * Recorded on {@link BuildResult.lexiconVersions} so a build digest can say

package/dist/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAyB,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC3F,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAiC,MAAM,UAAU,CAAC;AACzE,OAAO,EAAE,aAAa,EAAmB,MAAM,kBAAkB,CAAC;AAQlE,OAAO,EAAkC,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAMvF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,CACb,MAAM,EACN;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CACtD,CAAC;IACF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,wEAAwE;IACxE,UAAU,EAAE,UAAU,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3C,wEAAwE;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IAClB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAOzD;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,MAAM,EAAE,GACrB,UAAU,CAuFZ;AAED;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;OAGG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAEjC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,qDAAqD;IACrD,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6DAA6D;IAC7D,MAAM,EAAE,KAAK,CAAC,cAAc,GAAG,UAAU,CAAC,CAAC;IAC3C,wDAAwD;IACxD,QAAQ,EAAE,aAAa,CAAC;IACxB,uCAAuC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;IAE9B;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAEpC;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAmBtC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CAuEjB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CA+FjB;AAsFD;8DAC8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,aAAa,CAAC,oBAAoB,CAAC,EACjD,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,oBAAoB,CAAC,CAwB/B;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,UAAU,EAAE,EACzB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAYtB;AA8MD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,sBAAsB,EAC5B,WAAW,EAAE,UAAU,EAAE,EACzB,KAAK,SAAsB,EAC3B,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAgBtB"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAyB,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC3F,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAiC,MAAM,UAAU,CAAC;AACzE,OAAO,EAAE,aAAa,EAAmB,MAAM,kBAAkB,CAAC;AAQlE,OAAO,EAAkC,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAMvF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,CACb,MAAM,EACN;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CACtD,CAAC;IACF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,wEAAwE;IACxE,UAAU,EAAE,UAAU,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3C,wEAAwE;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IAClB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAOzD;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,MAAM,EAAE,GACrB,UAAU,CAuFZ;AAED;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;OAGG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAEjC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7B;;;;OAIG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEpC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,qDAAqD;IACrD,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6DAA6D;IAC7D,MAAM,EAAE,KAAK,CAAC,cAAc,GAAG,UAAU,CAAC,CAAC;IAC3C,wDAAwD;IACxD,QAAQ,EAAE,aAAa,CAAC;IACxB,uCAAuC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;IAE9B;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAEpC;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAmBtC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CAuEjB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CA+FjB;AAsFD;8DAC8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,aAAa,CAAC,oBAAoB,CAAC,EACjD,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,oBAAoB,CAAC,CAwB/B;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,UAAU,EAAE,EACzB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAatB;AA8MD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,sBAAsB,EAC5B,WAAW,EAAE,UAAU,EAAE,EACzB,KAAK,SAAsB,EAC3B,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAgBtB"}

package/dist/build.js

@@ -448,6 +448,7 @@ export async function build(path, serializers, parentBuildStack, options) {
         fold: options?.fold,
         intrinsics: options?.intrinsics,
         lexicons: options?.lexicons,
+        lexiconPackages: options?.lexiconPackages,
         sandbox: options?.sandbox,
         executing: options?.executing,
         buildParams: options?.buildParams,

package/dist/change-set.d.ts

@@ -11,7 +11,9 @@
  * Each planner reaches it through an adapter that returns a
  * {@link ChangeSetPart}: one member and its entries. The lifecycle and
  * reconcile adapters are here; the terraform-family ones live in the
- * terraform lexicon's `change-set` subpath. {@link composeChangeSet} joins
+ * terraform lexicon's `change-set` subpath and the SQL ones in the sql
+ * lexicon's. A part another process wrote to a file reads back through
+ * {@link readChangeSetPartFile}. {@link composeChangeSet} joins
  * the parts.
  *
  * ## The digest
@@ -52,7 +54,14 @@ export declare const CHANGE_SET_ACTIONS: readonly ChangeSetAction[];
 /** How much applying one change hurts, in the vocabulary of `./lifecycle/disruption.ts`. */
 export type ChangeSetDisruption = "in-place" | "rolling" | "replace" | "destroy" | "unknown";
 /** Which tool produced a member's plan. */
-export type ChangeSetPlanner = "terraform" | "tofu" | "choudoufu" | "chant" | "warden";
+/**
+ * Which tool produced a member's plan. `sql` is a SQL schema change: a
+ * versioned plan (a product's migrations) or one of the sql lexicon's
+ * migration Ops' plans, through `@intentius/chant-lexicon-sql/change-set`.
+ */
+export type ChangeSetPlanner = "terraform" | "tofu" | "choudoufu" | "chant" | "warden" | "sql";
+/** Every planner, in the order the schema lists them. */
+export declare const CHANGE_SET_PLANNERS: readonly ChangeSetPlanner[];
 /** One attribute a change writes, at top-level granularity. */
 export interface ChangeSetAttribute {
     path: string;
@@ -251,4 +260,17 @@ export interface ReconcilePlanPartInput {
  * the managed counts, which are guardrail denominators rather than changes.
  */
 export declare function reconcilePlanPart(input: ReconcilePlanPartInput): ChangeSetPart;
+/**
+ * A part an adapter in another process wrote as JSON, read back as `member`'s
+ * part. The `sql` planner's plans arrive this way: the sql lexicon's
+ * `change-set` adapters, or a product that fills them, write the part, and
+ * `readChangeSetPart` with `planner: "sql"` reads it.
+ *
+ * The part must name `planner` on its member and on every entry, and say
+ * `status`, `planDigest` and `holes`. Its member and entries are renamed to
+ * `member`, so the file need not know the name the run gives it; a `lexicon`
+ * given here replaces the part's. Nothing is recomputed: the plan digest is
+ * the one the writer took, over a plan this process never sees.
+ */
+export declare function readChangeSetPartFile(part: unknown, planner: ChangeSetPlanner, member: string, lexicon?: string): ChangeSetPart;
 //# sourceMappingURL=change-set.d.ts.map

package/dist/change-set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-set.d.ts","sourceRoot":"","sources":["../src/change-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,KAAK,EAAE,SAAS,IAAI,kBAAkB,EAAoC,MAAM,wBAAwB,CAAC;AAChH,OAAO,KAAK,EAAE,SAAS,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEnE,2DAA2D;AAC3D,eAAO,MAAM,oBAAoB,sFAAsF,CAAC;AAExH,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wHAAwH;AACxH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvG,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAAyE,CAAC;AAEnI,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7F,2CAA2C;AAC3C,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvF,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,0EAA0E;IAC1E,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,2FAA2F;IAC3F,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,2IAA2I;IAC3I,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC;CAC1D;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACzC,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvC,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,mCAAmC;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,oBAAoB,CAAC;IACrC,QAAQ,EAAE,OAAO,mBAAmB,CAAC;IACrC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,uFAAuF;IACvF,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAWD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC,CAAC,GAAG,MAAM,CAS9H;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,GAAG,MAAM,CASnH;AAED,mDAAmD;AACnD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAiC1G;AAMD,MAAM,WAAW,uBAAuB;IACtC,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,EAAE,OAAO,GAAE,uBAA4B,GAAG,iBAAiB,CAwB9H;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,GAAG,OAAO,CAM7H;AAID,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,IAAI,EAAE,kBAAkB,CAAC;IACzB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAkD9E;AAID,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,IAAI,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAC;IAChD,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAyC9E"}
+{"version":3,"file":"change-set.d.ts","sourceRoot":"","sources":["../src/change-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAGH,OAAO,KAAK,EAAE,SAAS,IAAI,kBAAkB,EAAoC,MAAM,wBAAwB,CAAC;AAChH,OAAO,KAAK,EAAE,SAAS,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEnE,2DAA2D;AAC3D,eAAO,MAAM,oBAAoB,sFAAsF,CAAC;AAExH,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wHAAwH;AACxH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvG,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAAyE,CAAC;AAEnI,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7F,2CAA2C;AAC3C;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE/F,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAAiE,CAAC;AAE7H,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,0EAA0E;IAC1E,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,2FAA2F;IAC3F,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,2IAA2I;IAC3I,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC;CAC1D;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACzC,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvC,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,mCAAmC;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,oBAAoB,CAAC;IACrC,QAAQ,EAAE,OAAO,mBAAmB,CAAC;IACrC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,uFAAuF;IACvF,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAWD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC,CAAC,GAAG,MAAM,CAS9H;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,GAAG,MAAM,CASnH;AAED,mDAAmD;AACnD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAiC1G;AAMD,MAAM,WAAW,uBAAuB;IACtC,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,EAAE,OAAO,GAAE,uBAA4B,GAAG,iBAAiB,CAwB9H;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,GAAG,OAAO,CAM7H;AAID,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,IAAI,EAAE,kBAAkB,CAAC;IACzB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAkD9E;AAID,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,IAAI,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAC;IAChD,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAyC9E;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa,CAsB/H"}

package/dist/change-set.js

@@ -11,7 +11,9 @@
  * Each planner reaches it through an adapter that returns a
  * {@link ChangeSetPart}: one member and its entries. The lifecycle and
  * reconcile adapters are here; the terraform-family ones live in the
- * terraform lexicon's `change-set` subpath. {@link composeChangeSet} joins
+ * terraform lexicon's `change-set` subpath and the SQL ones in the sql
+ * lexicon's. A part another process wrote to a file reads back through
+ * {@link readChangeSetPartFile}. {@link composeChangeSet} joins
  * the parts.
  *
  * ## The digest
@@ -46,6 +48,8 @@ export const CHANGE_SET_SCHEMA_ID = "https://intentius.io/chant/schemas/workspac
 export const CHANGE_SET_CONTRACT = 1;
 /** Every action, in the order the summary lists them. */
 export const CHANGE_SET_ACTIONS = ["create", "update", "replace", "delete", "read", "no-op", "forget"];
+/** Every planner, in the order the schema lists them. */
+export const CHANGE_SET_PLANNERS = ["terraform", "tofu", "choudoufu", "chant", "warden", "sql"];
 const byString = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
 function entryKey(e) {
     return `${e.member}\u0000${e.address}\u0000${e.deposed ?? ""}\u0000${e.action}`;
@@ -310,3 +314,48 @@ export function reconcilePlanPart(input) {
         entries,
     };
 }
+// ── a part written to a file ───────────────────────────────────────────────────
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/**
+ * A part an adapter in another process wrote as JSON, read back as `member`'s
+ * part. The `sql` planner's plans arrive this way: the sql lexicon's
+ * `change-set` adapters, or a product that fills them, write the part, and
+ * `readChangeSetPart` with `planner: "sql"` reads it.
+ *
+ * The part must name `planner` on its member and on every entry, and say
+ * `status`, `planDigest` and `holes`. Its member and entries are renamed to
+ * `member`, so the file need not know the name the run gives it; a `lexicon`
+ * given here replaces the part's. Nothing is recomputed: the plan digest is
+ * the one the writer took, over a plan this process never sees.
+ */
+export function readChangeSetPartFile(part, planner, member, lexicon) {
+    const where = `the ${planner} part for ${member}`;
+    if (!isRecord(part) || !isRecord(part.member) || !Array.isArray(part.entries))
+        throw new Error(`${where} is not a change-set part: it needs member and entries`);
+    const m = part.member;
+    if (m.planner !== planner)
+        throw new Error(`${where} names planner ${String(m.planner)}, not ${planner}`);
+    if (m.status !== "planned" && m.status !== "failed")
+        throw new Error(`${where} has no status`);
+    if (m.planDigest !== null && typeof m.planDigest !== "string")
+        throw new Error(`${where} has no planDigest`);
+    if (m.status === "planned" && m.planDigest === null)
+        throw new Error(`${where} planned but has no planDigest`);
+    if (!Array.isArray(m.holes))
+        throw new Error(`${where} has no holes array`);
+    const entries = part.entries.map((e, i) => {
+        if (!isRecord(e) || typeof e.address !== "string" || typeof e.type !== "string" || typeof e.action !== "string" || !Array.isArray(e.attributes)) {
+            throw new Error(`${where}: entries[${i}] needs address, type, action and attributes`);
+        }
+        if (!CHANGE_SET_ACTIONS.includes(e.action))
+            throw new Error(`${where}: entries[${i}] has action ${e.action}`);
+        if (e.planner !== planner)
+            throw new Error(`${where}: entries[${i}] names planner ${String(e.planner)}, not ${planner}`);
+        return { ...e, member, ...(lexicon !== undefined ? { lexicon } : {}) };
+    });
+    return {
+        member: { ...m, member, ...(lexicon !== undefined ? { lexicon } : {}) },
+        entries,
+        ...(Array.isArray(part.sideEffects) ? { sideEffects: part.sideEffects } : {}),
+    };
+}

package/dist/ci-jobs.d.ts

@@ -0,0 +1,227 @@
+/**
+ * The job primitives chant's three CI generators share (#3765): the scheduled
+ * Op pipeline (`generateOpsPipeline`), the Op waves pipeline
+ * (`generateOpWavesPipeline`) and the component pipeline (`chant build
+ * --components --generate`, with `--pr-loop`, `--wave-gate` and
+ * `--promote-to`). Each forge lexicon builds its documents from these, so a
+ * trigger, a token, a permission rule or an image default is decided once:
+ *
+ *  - the image a generated job runs in, {@link CI_IMAGE};
+ *  - the branches a trigger filters on, {@link triggerBranches};
+ *  - the job token and secret expressions of GitHub Actions and Forgejo
+ *    Actions, {@link GITHUB_JOB_TOKEN} and {@link githubSecret};
+ *  - the `permissions:` a finding-mode needs and the rules for adding to it,
+ *    {@link permissionsFor} and {@link mergePermissions};
+ *  - the `setup` steps and `environment` a job may carry, checked once per
+ *    forge ({@link assertSetupSteps}, {@link assertEnvironment},
+ *    {@link gitlabSetupScript}, {@link assertGitlabEnvironment});
+ *  - GitLab's `rules:` expressions and `id_tokens:` declaration.
+ *
+ * The Forgejo dialect (action refs, dropped `permissions:` and
+ * `environment:`, the header note naming what was dropped) is the forgejo
+ * lexicon's, in its `components/ci-jobs.ts`, since the transform it applies
+ * lives there.
+ */
+import type { OpEnvironment, OpFindingMode, OpSetupStep, OpTrigger } from "./lexicon.js";
+/**
+ * The image every generated job runs in unless the caller names another. It
+ * carries node and npm, which `chant` needs, and git, which a job that reads
+ * the base commit or pushes to `chant/lifecycle` needs (#3789).
+ */
+export declare const CI_IMAGE = "node:22";
+/**
+ * The branch a `push` trigger filters on when it names none. A generator
+ * works from a spec, not a checkout, so it cannot read a project's real
+ * default branch; a project on another one names it.
+ */
+export declare const DEFAULT_BRANCH = "main";
+/**
+ * The branches a push trigger filters on: the ones given, or
+ * {@link DEFAULT_BRANCH} when none are. An empty list is none, on every
+ * forge.
+ */
+export declare function pushBranches(branches: readonly string[] | undefined): string[];
+/**
+ * The branches a trigger filters on: a `pull_request` trigger's list, or
+ * undefined for every branch; a `push` trigger's, with {@link pushBranches}'
+ * default; none for `cron`.
+ */
+export declare function triggerBranches(trigger: OpTrigger): string[] | undefined;
+/** A job id every forge accepts, from a kebab- or camel-cased name. */
+export declare function ciJobName(name: string): string;
+/** A command template with each `{name}` part filled in. */
+export declare function fillCommand(template: readonly string[], name: string): string[];
+/** `{ [key]: map }` when the map has an entry, else `{}`: for spreading an optional mapping into a document. */
+export declare function nonEmpty<K extends string, V>(key: K, map: Record<string, V> | undefined): {
+    [P in K]?: Record<string, V>;
+};
+/**
+ * A job's `environment:` mapping. Always the mapping form, never the string
+ * shorthand, so adding a `url` later is a new key rather than a reshaped
+ * value. GitHub and GitLab read the same two keys.
+ */
+export declare function environmentDoc(environment: OpEnvironment): {
+    name: string;
+    url?: string;
+};
+/** The directory part of a relative path, `.` when there is none. */
+export declare function dirnameOf(path: string): string;
+/** The runner label a generated job asks for; the Forgejo dialect rewrites it to the project's label. */
+export declare const GITHUB_RUNNER = "ubuntu-latest";
+/** The job token, which GitHub and Forgejo both mint for every run. */
+export declare const GITHUB_JOB_TOKEN = "${{ github.token }}";
+/** A repository secret, by name. */
+export declare function githubSecret(name: string): string;
+/**
+ * A repository secret, or the job token when the secret is unset (#3624). An
+ * unset secret reads as the empty string, so a workflow generated for a
+ * production token still runs in a fork or a fresh repository, with what the
+ * job token may do.
+ */
+export declare function githubSecretOrJobToken(name: string): string;
+/** Each name mapped from the repository secret of the same name. */
+export declare function githubSecretEnv(names: readonly string[]): Record<string, string>;
+/**
+ * Least-privilege `permissions:` for a finding-mode. `report` needs no write
+ * access; `issue` needs only `issues: write`; `pull-request` (and
+ * `merge-request`, generated the same way when a GitLab-authored spec is
+ * targeted at github) needs `contents: write` to push the reconcile branch
+ * plus `pull-requests: write` to open the PR. `comment` changes nothing in
+ * the repository, so its whole scope is `{ contents: read, pull-requests:
+ * write }`.
+ */
+export declare function permissionsForMode(mode: OpFindingMode): Record<string, "read" | "write">;
+/**
+ * {@link permissionsForMode} on a trigger. A `pull_request` trigger reports
+ * its finding as a comment on the triggering PR itself (#2084): any mode but
+ * `report` posts something to act on a finding, so on that trigger every
+ * such mode also gets `pull-requests: write` for the comment.
+ */
+export declare function permissionsFor(mode: OpFindingMode, trigger: OpTrigger): Record<string, "read" | "write">;
+/**
+ * Every scope `GITHUB_TOKEN` accepts in a workflow's `permissions:` mapping,
+ * kebab-cased as GitHub spells them. An additive scope outside this set is
+ * refused by name rather than emitted: GitHub ignores an unknown key, so
+ * `id_token` or `idToken` would generate a workflow that looks like it grants
+ * OIDC and hands the run no token at all.
+ */
+export declare const GITHUB_TOKEN_SCOPES: ReadonlySet<string>;
+/**
+ * Merge a spec's additive `permissions` over the finding-mode's own set
+ * (#2242), refusing by name anything that is not strictly additive:
+ *
+ *  - a blanket `write-all`/`read-all`, in either the key or the value
+ *    position, which is the exact thing {@link permissionsForMode} exists to
+ *    avoid;
+ *  - a scope GitHub does not define ({@link GITHUB_TOKEN_SCOPES}), because
+ *    GitHub ignores the key and the run silently gets nothing;
+ *  - a scope the mode already grants, at any value — additive means additive,
+ *    so this can neither downgrade `contents: write` to read nor restate it.
+ *    A mode whose set is wrong is fixed by changing the mode, where the
+ *    scope and the behavior that spends it stay together;
+ *  - `pull-requests: write` on a trigger with no pull request. Pull-request
+ *    access is what the finding-modes own: `pull-request` grants it together
+ *    with the `contents: write` needed to push the branch first, and
+ *    `comment` grants it on the one trigger that carries a pull request to
+ *    comment on. Adding it beside a mode that posts nothing, on a cron or
+ *    push run, grants write access no step in the generated job can spend.
+ */
+export declare function mergePermissions(name: string, base: Record<string, "read" | "write">, additive: Record<string, "read" | "write">, trigger: OpTrigger): Record<string, "read" | "write">;
+/**
+ * Validate a `setup` list for GitHub or Forgejo Actions (#2242). A `run`
+ * entry needs a non-empty line and nothing else. A `uses` entry has to be a
+ * pinned `owner/repo[/subpath]@ref`: no bare `owner/repo`, since an unpinned
+ * action resolves to its default branch, and no ref in
+ * {@link DEFAULT_BRANCH_REFS} for the same reason spelled out loud. Local
+ * (`./path`) and container (`docker://`) refs are refused too — they are
+ * legal GitHub Actions, but the generator emits a workflow into a repository
+ * it has never seen, so it cannot know a local path resolves there.
+ */
+export declare function assertSetupSteps(name: string, setup: OpSetupStep[]): void;
+/** One setup entry as a GitHub Actions step: `with:` and `env:` only when they hold something. */
+export declare function setupStepDoc(step: OpSetupStep): Record<string, unknown>;
+/**
+ * Validate an `environment` for GitHub Actions (#2257). GitHub creates an
+ * environment it has never seen on first use rather than failing the run,
+ * and an environment created that way carries no protection rules at all —
+ * so a job can name one and read as gated while being gated by nothing.
+ * Neither the generator nor GitHub can tell those apart at build time, which
+ * is why what is refused here is only the shape that could never bind: a
+ * name that is blank, and a `url` that is neither absolute nor an expression
+ * the forge resolves.
+ */
+export declare function assertEnvironment(name: string, environment: OpEnvironment): void;
+/** The pipeline source GitLab reports for a merge-request pipeline. */
+export declare const GITLAB_MERGE_REQUEST_SOURCE = "$CI_PIPELINE_SOURCE == \"merge_request_event\"";
+/** The pipeline source GitLab reports for a pipeline schedule. */
+export declare const GITLAB_SCHEDULE_SOURCE = "$CI_PIPELINE_SOURCE == \"schedule\"";
+/** A job variable that makes the runner clone the whole history, which a job reading the base commit needs. */
+export declare const GITLAB_FULL_HISTORY: {
+    readonly GIT_DEPTH: "0";
+};
+/** The `rules:` if-expression for a push to `branch`, a quoted name or an expression such as `$CI_DEFAULT_BRANCH`. */
+export declare function gitlabPushRule(branch: string): string;
+/**
+ * Refuse a branch name that cannot be interpolated into a `rules:`
+ * if-expression. The expression is a string GitLab parses, so a `"` would end
+ * it early and a `$` would expand as a variable — either one silently changes
+ * which pipelines match the job, which is worse than not generating it.
+ * `subject` names what filters, such as `Scheduled Op "apply"`.
+ */
+export declare function assertGitlabBranch(subject: string, branch: string): void;
+/**
+ * One `rules:` entry per branch a trigger filters on, each checked by
+ * {@link assertGitlabBranch}. Two or more branches are two or more entries:
+ * `rules:` is an OR over its list, which is how GitLab spells the alternation
+ * github expresses as a `branches:` array. A cron trigger is selected by
+ * `selector`, the CI/CD variable a pipeline schedule sets, and the Op's name.
+ */
+export declare function gitlabRules(subject: string, trigger: OpTrigger, selector: {
+    variable: string;
+    value: string;
+}): Array<{
+    if: string;
+}>;
+/**
+ * The `id_tokens:` entry an `id-token: write` spec gets. The name is the
+ * environment variable the JWT lands in, which the job's own setup line reads
+ * (`aws sts assume-role-with-web-identity --web-identity-token
+ * "$CHANT_ID_TOKEN"`, or the provider's equivalent).
+ *
+ * `$CI_SERVER_URL` as the audience is GitLab's own documented default: an
+ * identity provider federated to a GitLab instance is registered with that
+ * instance's URL as its audience, and the variable expands to exactly that on
+ * gitlab.com and on a self-managed instance alike.
+ */
+export declare const GITLAB_ID_TOKEN_NAME = "CHANT_ID_TOKEN";
+export declare const GITLAB_ID_TOKEN_AUDIENCE = "$CI_SERVER_URL";
+/**
+ * Turn additive `permissions` (#2242) into the one GitLab declaration that
+ * carries the same meaning, refusing everything else by name.
+ *
+ * `id-token: write` is that one: GitLab's OIDC surface is `id_tokens:`, a
+ * per-job declaration of a JWT the job exchanges for cloud credentials
+ * itself. `id-token: read` is refused rather than mapped, because GitLab
+ * either mints the token into the job or does not. Every other scope is
+ * refused: GitLab has no per-job token-scope mapping at all, and a scope
+ * quietly dropped would emit a job that reads as granted and runs with
+ * nothing.
+ */
+export declare function gitlabIdTokens(name: string, permissions: Record<string, "read" | "write"> | undefined): Record<string, unknown> | undefined;
+/**
+ * A `setup` list as GitLab `script:` lines. A `uses` entry is a GitHub
+ * Actions marketplace action, which GitLab has no shape for, so it is refused
+ * by name rather than dropped. `subject` names whose setup it is, such as
+ * `Scheduled Op "apply"`.
+ */
+export declare function gitlabSetupScript(subject: string, setup: readonly OpSetupStep[] | undefined): string[];
+/**
+ * Validate an `environment` on GitLab's own terms (#2257). A GitLab job
+ * naming an environment that does not exist creates an unprotected one on
+ * first deploy rather than failing, so the only shapes worth refusing at
+ * build time are the ones that could never bind: a blank name, and a `url`
+ * that is neither absolute nor a variable expression GitLab expands, which
+ * would render as a dead "View deployment" link.
+ */
+export declare function assertGitlabEnvironment(name: string, environment: OpEnvironment): void;
+//# sourceMappingURL=ci-jobs.d.ts.map

package/dist/ci-jobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-jobs.d.ts","sourceRoot":"","sources":["../src/ci-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItF;;;;GAIG;AACH,eAAO,MAAM,QAAQ,YAAY,CAAC;AAElC;;;;GAIG;AACH,eAAO,MAAM,cAAc,SAAS,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CASxE;AAED,uEAAuE;AACvE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,4DAA4D;AAC5D,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE/E;AAED,gHAAgH;AAChH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS,GAAG;KAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;CAAE,CAE1H;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAEzF;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG9C;AAID,yGAAyG;AACzG,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,oCAAoC;AACpC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAYxF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAIxG;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAgBlD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AAeD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAsBhF;AAID,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,mDAAiD,CAAC;AAE1F,kEAAkE;AAClE,eAAO,MAAM,sBAAsB,wCAAsC,CAAC;AAE1E,+GAA+G;AAC/G,eAAO,MAAM,mBAAmB;aAAK,SAAS,EAAE,GAAG;CAAW,CAAC;AAE/D,sHAAsH;AACtH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAYxE;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBrI;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAuB3I;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAWtG;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAqBtF"}