@intentius/chant 0.124.15 → 0.124.17

package/dist/cli/commands/check-lexicon-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-lexicon-plugin.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/check-lexicon-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAGpE,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAoB9D;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB5E;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa,GAAG,OAAO,CAE/F;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,SAAS,GAAG;IAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAOvF"}
+{"version":3,"file":"check-lexicon-plugin.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/check-lexicon-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAIpE,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAoB9D;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB5E;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa,GAAG,OAAO,CAE/F;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,SAAS,GAAG;IAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAOvF"}

package/dist/cli/commands/check-lexicon-plugin.js

@@ -23,6 +23,7 @@ import { isAbsolute, join, resolve } from "path";
 import { pathToFileURL } from "url";
 import { isLexiconPlugin } from "../../lexicon.js";
 import { ensureTypeScriptLoader } from "../../ts-loader.js";
+import { esModuleNamespace } from "../../module-interop.js";
 /**
  * The module a lexicon package presents to consumers.
  *
@@ -64,7 +65,7 @@ export async function loadLexiconFromDir(dir) {
     let mod;
     try {
         ensureTypeScriptLoader();
-        mod = (await import(pathToFileURL(entry).href));
+        mod = esModuleNamespace((await import(pathToFileURL(entry).href)));
     }
     catch (error) {
         return { entry, error: `import failed: ${error instanceof Error ? error.message : String(error)}` };

package/dist/cli/commands/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAwCzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAoBhC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,WAAW,CAAC;AAsBnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AA2I9C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AA6eD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA+N3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAyCzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAoBhC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,WAAW,CAAC;AAsBnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AA2I9C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AA6eD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA+N3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}

package/dist/cli/commands/lint.js

@@ -30,6 +30,7 @@ import { getProvenance } from "../../provenance.js";
 import { runLexiconPostSynthChecks } from "./build.js";
 import { armSandboxPolicyExecution, runProjectPolicies } from "../../lint/policy-sandbox.js";
 import { ensureTypeScriptLoader } from "../../ts-loader.js";
+import { esModuleNamespace } from "../../module-interop.js";
 // Import config loader
 import { loadConfig, resolveRulesForFile, resolveConfiguredSeverity, findProjectRoot } from "../../lint/config.js";
 import { loadChantConfig, resolveKnowledgeDir, resolveDiscoveryGlobs } from "../../config.js";
@@ -79,7 +80,7 @@ export async function loadPluginRules(plugins, configDir) {
         let mod;
         try {
             ensureTypeScriptLoader();
-            mod = await import(resolved);
+            mod = esModuleNamespace(await import(resolved));
         }
         catch (err) {
             throw new Error(`Failed to load plugin "${pluginPath}": ${err instanceof Error ? err.message : String(err)}`);
@@ -482,7 +483,7 @@ async function runOpCheckDiagnostics(infraPath, files, buildParams, plugins = []
     for (const filePath of opFiles) {
         try {
             ensureTypeScriptLoader();
-            const mod = await import(filePath);
+            const mod = esModuleNamespace(await import(filePath));
             const entity = mod.default;
             if (!entity || typeof entity !== "object")
                 continue;

package/dist/cli/flush.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Exiting without truncating piped output, shared by the full CLI (`./main.ts`)
+ * and the slim wave-job runtime (`../wave-runtime.ts`, #3896).
+ */
+/**
+ * Wait until a writable stream has flushed its buffer. `process.exit()` discards
+ * data still buffered for an async sink (a pipe or file), truncating large output
+ * at the ~64 KB pipe buffer — so `chant graph --format ir` piped into a consumer
+ * loses everything past 64 KB and its JSON won't parse. A TTY writes
+ * synchronously (`writableLength` stays 0), so this is a no-op there. Resolves on
+ * `error`/`close` too, so a reader that closes early (EPIPE) can't hang exit.
+ */
+export declare function waitForStreamDrain(stream: NodeJS.WriteStream): Promise<void>;
+/** Flush stdout+stderr, then exit — so a large piped payload isn't truncated. */
+export declare function flushAndExit(code: number): Promise<never>;
+//# sourceMappingURL=flush.d.ts.map

package/dist/cli/flush.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flush.d.ts","sourceRoot":"","sources":["../../src/cli/flush.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB5E;AAED,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAI/D"}

package/dist/cli/flush.js

@@ -0,0 +1,42 @@
+/**
+ * Exiting without truncating piped output, shared by the full CLI (`./main.ts`)
+ * and the slim wave-job runtime (`../wave-runtime.ts`, #3896).
+ */
+/**
+ * Wait until a writable stream has flushed its buffer. `process.exit()` discards
+ * data still buffered for an async sink (a pipe or file), truncating large output
+ * at the ~64 KB pipe buffer — so `chant graph --format ir` piped into a consumer
+ * loses everything past 64 KB and its JSON won't parse. A TTY writes
+ * synchronously (`writableLength` stays 0), so this is a no-op there. Resolves on
+ * `error`/`close` too, so a reader that closes early (EPIPE) can't hang exit.
+ */
+export function waitForStreamDrain(stream) {
+    return new Promise((resolve) => {
+        const tick = () => {
+            if (stream.writableLength === 0 || stream.writableEnded || stream.destroyed) {
+                cleanup();
+                resolve();
+                return;
+            }
+            stream.once("drain", tick);
+        };
+        const stop = () => {
+            cleanup();
+            resolve();
+        };
+        const cleanup = () => {
+            stream.off("drain", tick);
+            stream.off("error", stop);
+            stream.off("close", stop);
+        };
+        stream.once("error", stop);
+        stream.once("close", stop);
+        tick();
+    });
+}
+/** Flush stdout+stderr, then exit — so a large piped payload isn't truncated. */
+export async function flushAndExit(code) {
+    await waitForStreamDrain(process.stdout);
+    await waitForStreamDrain(process.stderr);
+    process.exit(code);
+}

package/dist/cli/handlers/approve.d.ts

@@ -0,0 +1,98 @@
+import type { GateResolutionRecord, PendingGateRecord } from "../../lifecycle/gate-ledger.js";
+import { type GateOrigin } from "../../lifecycle/gate-origin.js";
+import { type GatePolicyEvaluator, type ResolvedGateApproval } from "../../op/gate-approval.js";
+import type { CommandContext } from "../registry.js";
+export declare function runApprove(ctx: CommandContext): Promise<number>;
+/** What a caller supplies alongside the op and gate names. */
+export interface GateApprovalOptions {
+    /**
+     * The channel this resolution arrived on (chant#2384). Defaults to the
+     * process's own — `"cli"` unless an entry point declared otherwise — and is
+     * a parameter only so a caller that knows better can say so.
+     */
+    origin?: GateOrigin;
+    /**
+     * Record a resolution that the same-origin rule would refuse (chant#2384).
+     *
+     * There is a legitimate case: a single operator driving an agent, who wants
+     * the model's run resolved from the same session and accepts what that
+     * means. The override exists so that is a deliberate act with a trace on the
+     * record, rather than the default.
+     */
+    allowSameOrigin?: boolean;
+    /** `--actor`/`--approver`; falls back to the CI or shell identity. */
+    actor?: string;
+    /** `--note` — free-text prose. */
+    note?: string;
+    /**
+     * `--relayed-by <principal>` (#3402): who carried this approval to chant for
+     * the approver, such as a follower program relaying a person's approval.
+     * Recorded as `relayedBy` on the resolution line and covered by `--sign`.
+     * The approver is still `--actor`; the relay is not an approver.
+     */
+    relayedBy?: string;
+    /** `--url` — the approval surface, validated as absolute http/https. */
+    url?: string;
+    /**
+     * `--plan <digest>` (#2300) — the plan this approval is for. Omitted, the
+     * digest is read off the gate's standing pending fact, so the common path
+     * stays one command: run, read what it planned, approve it.
+     */
+    plan?: string;
+    /**
+     * `--env <env>` (#2574) — which environment's pending fact a component gate
+     * approval answers. A component's gate ledger holds every environment's
+     * facts, so without it the newest one is approved. Ignored for a gate whose
+     * pending facts record no environment (every Op gate).
+     */
+    environment?: string;
+    /** `--role` (#2508) — roles the approver claims. */
+    roles?: string[];
+    /**
+     * `--agent` (#2508) — record this as an agent's approval. On a
+     * model-authored channel it is one whether or not this is set.
+     */
+    agent?: boolean;
+    /**
+     * `--sign [<key file>]` (#3163, ws-080): seal the approval with an ssh key,
+     * a key file or true for git's `user.signingkey`. The seal attests the
+     * approver when the signers file at base lists the key for them, and a gate
+     * the declaration's `identity.gates` names counts only sealed approvals.
+     */
+    sign?: string | true;
+    /** Where the workspace and the key file are looked up from. Defaults to the process's directory. */
+    cwd?: string;
+    /** Replaces the lexicon evaluator a gate policy is loaded from. For tests. */
+    evaluator?: GatePolicyEvaluator;
+}
+export type GateApprovalOutcome = {
+    ok: true;
+    record: GateResolutionRecord;
+    pushed: boolean;
+} | {
+    ok: false;
+};
+/**
+ * The ledger write behind `chant approve` — extracted so `chant run approve`
+ * (#2121) records the identical fact before waking the runtime that hosts the
+ * gated run, instead of growing a second, drifting writer.
+ *
+ * Prints the same warning for an undiscovered op and the same success line as
+ * `chant approve` always did; the caller adds whatever it does next.
+ *
+ * Since #2300 the resolution names the plan it approves. By default that is
+ * the standing pending fact's plan — the one the gated run produced — so the
+ * common path is still `chant run`, read, `chant approve`. With no pending
+ * fact and no `--plan`, this refuses: there is nothing on the ledger saying
+ * what would be approved, and writing a resolution anyway is what made an
+ * approval mean "the next run" instead of "this plan".
+ */
+export declare function recordGateApproval(opName: string, gate: string, opts: GateApprovalOptions): Promise<GateApprovalOutcome>;
+/**
+ * What a just-recorded approval did to a gate with an `approval` block
+ * (#2508): the policy's decision and whether it binds, then the quorum count
+ * for this plan. The run decides the gate from the ledger; these lines only
+ * say what it will find.
+ */
+export declare function describeApprovalProgress(approval: ResolvedGateApproval, record: GateResolutionRecord, prior: GateResolutionRecord[], standing: PendingGateRecord | undefined, pending?: readonly PendingGateRecord[]): string[];
+//# sourceMappingURL=approve.d.ts.map

package/dist/cli/handlers/approve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/approve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EACuE,KAAK,UAAU,EAC5F,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EAEuC,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EAChG,MAAM,wBAAwB,CAAC;AAOhC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAkDlD,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuGrE;AAED,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oGAAoG;IACpG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAElB;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CAiT9B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,oBAAoB,EAAE,EAC7B,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,OAAO,GAAE,SAAS,iBAAiB,EAA+B,GACjE,MAAM,EAAE,CA8BV"}