@intentius/chant 0.124.26 → 0.124.28

package/dist/lifecycle/release-store.d.ts

@@ -0,0 +1,190 @@
+/**
+ * The release (#4026, ws-104): one green commit of one member, compiled for
+ * every environment the member declares, stored on `chant/lifecycle`.
+ *
+ * A release is a different object from a deploy record. A deploy record is
+ * one line of `<env>/releases.jsonl` (./release-ledger.ts) saying a component
+ * was deployed. A release is what is cut once from a green commit and then
+ * moves through the environments: the commit, the artifacts built once from
+ * it, and one compile target per environment, each with the template digests
+ * and the build parameters that environment was compiled with.
+ *
+ * Storage, per ws-104 question 3:
+ *
+ *   _releases/<releaseDigest>.json      the release, written once and never rewritten
+ *   _releases/cuts.jsonl                one line per cut, with the release's label
+ *   _releases/templates/<digest>.txt    each template's bytes, by content digest
+ *
+ * `:` is written as `_` in file names, as `_plans/` and `_builds/` do. A
+ * workspace member's copy sits under `_members/<member>/` through the same
+ * `ledgerDir` prefix every other store uses.
+ *
+ * The template bytes are kept so that a promote under a release deploys the
+ * templates the cut recorded, not whatever the promoting checkout holds
+ * (ws-104 question 5). They are named by content digest, so a template that
+ * two environments or two releases share is stored once.
+ *
+ * `releaseDigest` is `computePlanDigest("release", subject)` over the member,
+ * the commit, the artifact digests and each target's env, templates and the
+ * name and value of each param. A param's `source`, the label, the actor, the
+ * time and any signature stay outside it, so two cuts of one commit give the
+ * same digest.
+ */
+import { type LedgerLocation } from "./git.js";
+import type { RunOrigin } from "./release-ledger.js";
+/** The directory on `chant/lifecycle` that holds releases, cuts and template bytes. */
+export declare const RELEASES_DIR = "_releases";
+/** The cut log inside {@link RELEASES_DIR}. */
+export declare const CUTS_FILE = "cuts.jsonl";
+/** The directory inside {@link RELEASES_DIR} that holds template bytes by content digest. */
+export declare const TEMPLATES_SUBDIR = "templates";
+/** The `kind` a release digest is computed under, so it can never equal a plan digest of another kind. */
+export declare const RELEASE_DIGEST_KIND = "release";
+/** An artifact built once from the release's commit: an `image` or `asset` archive entry. */
+export interface ReleaseArtifact {
+    component: string;
+    kind: "image" | "asset";
+    /** The archive path the build step wrote. */
+    path: string;
+    digest: string;
+}
+/** One template of a target: a file a component's deploy reads, compiled for the target's environment. */
+export interface ReleaseTemplate {
+    /** The component whose deploy reads it, or null for a project with no components. */
+    component: string | null;
+    /** The path the deploy step names, relative to the member's directory. */
+    path: string;
+    /** `sha256:<hex>` of the file's bytes. */
+    digest: string;
+}
+/** One resolved build parameter of a target. */
+export interface ReleaseParam {
+    name: string;
+    value: string | number | boolean;
+    /** Where the value came from: `cli`, `params-file`, `env` or `default`. Outside the digest. */
+    source: string;
+}
+/** What one environment compiles to. */
+export interface ReleaseTarget {
+    env: string;
+    templates: ReleaseTemplate[];
+    params: ReleaseParam[];
+}
+/** The release file, `_releases/<releaseDigest>.json`. */
+export interface Release {
+    version: 1;
+    releaseDigest: string;
+    /** The workspace member, its path of names joined with `/` when nested, or null outside a workspace. */
+    member: string | null;
+    /** The full sha of the green commit. */
+    commit: string;
+    artifactDigests: ReleaseArtifact[];
+    targets: ReleaseTarget[];
+}
+/** One line of `_releases/cuts.jsonl`. */
+export interface ReleaseCut {
+    version: 1;
+    releaseDigest: string;
+    /** The human name of the release, such as `v1.4.0`, or null for a cut with none. */
+    label: string | null;
+    actor: string;
+    timestamp: string;
+    /** The CI run the cut ran in, or null outside CI. */
+    runOrigin: RunOrigin | null;
+    /**
+     * The cut's signature (#4031): an armored ssh signature by the actor's key
+     * in the `chant-release` namespace over the release digest, the label, the
+     * actor and the time, one per line (`releaseSealPayload`). Null for an
+     * unsigned cut, and on every cut written before 0.124.28.
+     */
+    signature: string | null;
+}
+/** The parts of a release a digest is computed from. */
+export type ReleaseSubject = Pick<Release, "member" | "commit" | "artifactDigests" | "targets">;
+/** The same release with every list in the order ws-104 sets: artifacts by component then path, targets by env, templates by component then path, params by name. */
+export declare function normalizeRelease<T extends ReleaseSubject>(release: T): T;
+/** The hash input of ws-104 question 3: a param's `source` is left out. */
+export declare function releaseHashInput(release: ReleaseSubject): unknown;
+/** `computePlanDigest("release", input)` over {@link releaseHashInput}. */
+export declare function computeReleaseDigest(release: ReleaseSubject): string;
+/** A release with its digest computed and its lists in order. */
+export declare function makeRelease(subject: ReleaseSubject): Release;
+/** Whether a release's own `releaseDigest` is the digest of what it holds. */
+export declare function verifyReleaseDigest(release: Release): boolean;
+/** Why a label can't be used, or undefined when it can. */
+export declare function invalidLabel(label: string): string | undefined;
+/** Thrown when a cut would give a label two digests, or a digest two labels. */
+export declare class ReleaseLabelError extends Error {
+    readonly code: "release-label-taken" | "release-already-labelled" | "release-label-invalid";
+    constructor(code: "release-label-taken" | "release-already-labelled" | "release-label-invalid", message: string);
+}
+/** A release's template bytes, as the cut read them. */
+export interface TemplateContent {
+    digest: string;
+    content: string;
+}
+/**
+ * Store a release and its template bytes in one commit. A release already
+ * stored under its digest is never rewritten, and a template already stored
+ * is not written again. Does not push.
+ */
+export declare function persistRelease(release: Release, templates: readonly TemplateContent[], opts?: {
+    cwd?: string;
+}): Promise<{
+    commit: string | null;
+    written: boolean;
+}>;
+/** Parse a stored release file, or null when it is not a release. */
+export declare function parseRelease(text: string): Release | null;
+/** Read one release by digest. Null when none is stored, or when the file is not a release whose content hashes to its digest. */
+export declare function readRelease(digest: string, opts?: LedgerLocation): Promise<Release | null>;
+/** Every stored release, and how many release files could not be read as one. */
+export declare function readAllReleases(opts?: LedgerLocation): Promise<{
+    releases: Release[];
+    malformed: number;
+}>;
+/** Parse the lines of `cuts.jsonl`. A line that is not a cut is counted and skipped. */
+export declare function parseCuts(text: string | null): {
+    cuts: ReleaseCut[];
+    malformed: number;
+};
+/** Every cut, oldest first. */
+export declare function readCuts(opts?: LedgerLocation): Promise<{
+    cuts: ReleaseCut[];
+    malformed: number;
+}>;
+/** The label each digest carries, from its labelled cuts. */
+export declare function labelsByDigest(cuts: readonly ReleaseCut[]): Map<string, string>;
+/** What {@link appendCut} did. */
+export type CutOutcome = {
+    appended: true;
+    cut: ReleaseCut;
+}
+/** The digest was already cut; nothing was written. `label` is the label it carries, or null. */
+ | {
+    appended: false;
+    label: string | null;
+};
+/**
+ * Append a cut for `releaseDigest`. A label names one digest and a digest
+ * takes at most one label (ws-104 question 3): cutting a digest again is a
+ * no-op that returns its label, giving an unlabelled digest a label appends a
+ * cut, and cutting a digest under a label other than its own, or under a
+ * label another digest has, throws {@link ReleaseLabelError}. Does not push.
+ */
+export declare function appendCut(input: Omit<ReleaseCut, "version" | "signature"> & {
+    signature?: string | null;
+}, opts?: {
+    cwd?: string;
+}): Promise<CutOutcome>;
+/** A template's bytes by digest, or null when none is stored. */
+export declare function readReleaseTemplate(digest: string, opts?: LedgerLocation): Promise<string | null>;
+/**
+ * Find a release by its digest or its label. Null when neither names one.
+ * A string that names a digest is read as a digest first.
+ */
+export declare function resolveRelease(ref: string, opts?: LedgerLocation): Promise<{
+    release: Release;
+    label: string | null;
+} | null>;
+//# sourceMappingURL=release-store.d.ts.map

package/dist/lifecycle/release-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-store.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,uFAAuF;AACvF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,+CAA+C;AAC/C,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,0GAA0G;AAC1G,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,6FAA6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,eAAe;IAC9B,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,0DAA0D;AAC1D,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,wGAAwG;IACxG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,eAAe,EAAE,CAAC;IACnC,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,iBAAiB,GAAG,SAAS,CAAC,CAAC;AAIhG,qKAAqK;AACrK,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,cAAc,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAgBxE;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAQjE;AAED,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAEpE;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAG5D;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AASD,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG9D;AAED,gFAAgF;AAChF,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,GAAG,uBAAuB;IAD7F,YACW,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,GAAG,uBAAuB,EAC3F,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,eAAe,EAAE,EACrC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4BtD;AAED,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CA2BzD;AAED,kIAAkI;AAClI,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAMhG;AAED,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhH;AAED,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAyBxF;AAED,+BAA+B;AAC/B,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAExG;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED,kCAAkC;AAClC,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE;AACrC,iGAAiG;GAC/F;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAI9C;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAChF,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,UAAU,CAAC,CAgDrB;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEvG;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAQnI"}

package/dist/lifecycle/release-store.js

@@ -0,0 +1,318 @@
+/**
+ * The release (#4026, ws-104): one green commit of one member, compiled for
+ * every environment the member declares, stored on `chant/lifecycle`.
+ *
+ * A release is a different object from a deploy record. A deploy record is
+ * one line of `<env>/releases.jsonl` (./release-ledger.ts) saying a component
+ * was deployed. A release is what is cut once from a green commit and then
+ * moves through the environments: the commit, the artifacts built once from
+ * it, and one compile target per environment, each with the template digests
+ * and the build parameters that environment was compiled with.
+ *
+ * Storage, per ws-104 question 3:
+ *
+ *   _releases/<releaseDigest>.json      the release, written once and never rewritten
+ *   _releases/cuts.jsonl                one line per cut, with the release's label
+ *   _releases/templates/<digest>.txt    each template's bytes, by content digest
+ *
+ * `:` is written as `_` in file names, as `_plans/` and `_builds/` do. A
+ * workspace member's copy sits under `_members/<member>/` through the same
+ * `ledgerDir` prefix every other store uses.
+ *
+ * The template bytes are kept so that a promote under a release deploys the
+ * templates the cut recorded, not whatever the promoting checkout holds
+ * (ws-104 question 5). They are named by content digest, so a template that
+ * two environments or two releases share is stored once.
+ *
+ * `releaseDigest` is `computePlanDigest("release", subject)` over the member,
+ * the commit, the artifact digests and each target's env, templates and the
+ * name and value of each param. A param's `source`, the label, the actor, the
+ * time and any signature stay outside it, so two cuts of one commit give the
+ * same digest.
+ */
+import { sortedJsonReplacer } from "../utils.js";
+import { contentDigest } from "../content-digest.js";
+import { computePlanDigest } from "./plan-digest.js";
+import { ledgerDir, listFilesInDir, readBlobBySha, readBlobFromPath, readPathSha, RefCASConflictError, writeLedgerFiles, } from "./git.js";
+/** The directory on `chant/lifecycle` that holds releases, cuts and template bytes. */
+export const RELEASES_DIR = "_releases";
+/** The cut log inside {@link RELEASES_DIR}. */
+export const CUTS_FILE = "cuts.jsonl";
+/** The directory inside {@link RELEASES_DIR} that holds template bytes by content digest. */
+export const TEMPLATES_SUBDIR = "templates";
+/** The `kind` a release digest is computed under, so it can never equal a plan digest of another kind. */
+export const RELEASE_DIGEST_KIND = "release";
+const byString = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+/** The same release with every list in the order ws-104 sets: artifacts by component then path, targets by env, templates by component then path, params by name. */
+export function normalizeRelease(release) {
+    return {
+        ...release,
+        artifactDigests: [...release.artifactDigests]
+            .map(({ component, kind, path, digest }) => ({ component, kind, path, digest }))
+            .sort((a, b) => byString(a.component, b.component) || byString(a.path, b.path)),
+        targets: [...release.targets]
+            .map((t) => ({
+            env: t.env,
+            templates: [...t.templates]
+                .map(({ component, path, digest }) => ({ component, path, digest }))
+                .sort((a, b) => byString(a.component ?? "", b.component ?? "") || byString(a.path, b.path)),
+            params: [...t.params].map(({ name, value, source }) => ({ name, value, source })).sort((a, b) => byString(a.name, b.name)),
+        }))
+            .sort((a, b) => byString(a.env, b.env)),
+    };
+}
+/** The hash input of ws-104 question 3: a param's `source` is left out. */
+export function releaseHashInput(release) {
+    const n = normalizeRelease(release);
+    return {
+        member: n.member,
+        commit: n.commit,
+        artifactDigests: n.artifactDigests,
+        targets: n.targets.map((t) => ({ env: t.env, templates: t.templates, params: t.params.map(({ name, value }) => ({ name, value })) })),
+    };
+}
+/** `computePlanDigest("release", input)` over {@link releaseHashInput}. */
+export function computeReleaseDigest(release) {
+    return computePlanDigest(RELEASE_DIGEST_KIND, releaseHashInput(release));
+}
+/** A release with its digest computed and its lists in order. */
+export function makeRelease(subject) {
+    const normalized = normalizeRelease(subject);
+    return { version: 1, releaseDigest: computeReleaseDigest(normalized), ...normalized };
+}
+/** Whether a release's own `releaseDigest` is the digest of what it holds. */
+export function verifyReleaseDigest(release) {
+    return release.releaseDigest === computeReleaseDigest(release);
+}
+const stem = (digest) => digest.replace(/:/g, "_");
+const releaseFile = (digest) => `${stem(digest)}.json`;
+const templateFile = (digest) => `${stem(digest)}.txt`;
+/** A label names a release in commands such as `chant release cut <label>`, so it is one plain word. */
+const LABEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
+/** Why a label can't be used, or undefined when it can. */
+export function invalidLabel(label) {
+    if (LABEL_PATTERN.test(label))
+        return undefined;
+    return `"${label}" is not a release label: use letters, digits and . _ + -, starting with a letter or digit, at most 128 characters`;
+}
+/** Thrown when a cut would give a label two digests, or a digest two labels. */
+export class ReleaseLabelError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "ReleaseLabelError";
+    }
+}
+/**
+ * Store a release and its template bytes in one commit. A release already
+ * stored under its digest is never rewritten, and a template already stored
+ * is not written again. Does not push.
+ */
+export async function persistRelease(release, templates, opts) {
+    if (!verifyReleaseDigest(release)) {
+        throw new Error(`release ${release.releaseDigest} does not hash to its own digest; refusing to store it`);
+    }
+    for (const t of templates) {
+        if (contentDigest(t.content) !== t.digest)
+            throw new Error(`template bytes do not hash to ${t.digest}; refusing to store them`);
+    }
+    const dir = await ledgerDir(RELEASES_DIR, opts);
+    const files = [];
+    const releasePath = `${dir}/${releaseFile(release.releaseDigest)}`;
+    const exists = (await readPathSha(RELEASES_DIR, releaseFile(release.releaseDigest), opts)) !== null;
+    if (!exists)
+        files.push({ path: releasePath, content: `${JSON.stringify(release, sortedJsonReplacer)}\n`, expectPriorSha: null });
+    const seen = new Set();
+    for (const t of templates) {
+        if (seen.has(t.digest))
+            continue;
+        seen.add(t.digest);
+        if ((await readPathSha(`${RELEASES_DIR}/${TEMPLATES_SUBDIR}`, templateFile(t.digest), opts)) !== null)
+            continue;
+        files.push({ path: `${dir}/${TEMPLATES_SUBDIR}/${templateFile(t.digest)}`, content: t.content, expectPriorSha: null });
+    }
+    if (files.length === 0)
+        return { commit: null, written: false };
+    try {
+        const commit = await writeLedgerFiles(files, `Release ${release.releaseDigest}`, opts);
+        return { commit, written: !exists };
+    }
+    catch (err) {
+        // Another writer stored the same content-addressed files first.
+        if (err instanceof RefCASConflictError)
+            return { commit: null, written: false };
+        throw err;
+    }
+}
+/** Parse a stored release file, or null when it is not a release. */
+export function parseRelease(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object")
+        return null;
+    const r = parsed;
+    const ok = r.version === 1 &&
+        typeof r.releaseDigest === "string" &&
+        (r.member === null || typeof r.member === "string") &&
+        typeof r.commit === "string" &&
+        Array.isArray(r.artifactDigests) &&
+        r.artifactDigests.every((a) => a && typeof a.component === "string" && (a.kind === "image" || a.kind === "asset") && typeof a.path === "string" && typeof a.digest === "string") &&
+        Array.isArray(r.targets) &&
+        r.targets.every((t) => t &&
+            typeof t.env === "string" &&
+            Array.isArray(t.templates) &&
+            t.templates.every((x) => x && (x.component === null || typeof x.component === "string") && typeof x.path === "string" && typeof x.digest === "string") &&
+            Array.isArray(t.params) &&
+            t.params.every((p) => p && typeof p.name === "string" && ["string", "number", "boolean"].includes(typeof p.value) && typeof p.source === "string"));
+    return ok ? r : null;
+}
+/** Read one release by digest. Null when none is stored, or when the file is not a release whose content hashes to its digest. */
+export async function readRelease(digest, opts) {
+    const text = await readBlobFromPath(RELEASES_DIR, releaseFile(digest), opts);
+    if (text === null)
+        return null;
+    const release = parseRelease(text);
+    if (!release || release.releaseDigest !== digest || !verifyReleaseDigest(release))
+        return null;
+    return release;
+}
+/** Every stored release, and how many release files could not be read as one. */
+export async function readAllReleases(opts) {
+    const releases = [];
+    let malformed = 0;
+    for (const name of await listFilesInDir(RELEASES_DIR, opts)) {
+        if (!name.endsWith(".json"))
+            continue;
+        const digest = name.slice(0, -".json".length).replace(/_/g, ":");
+        const release = await readRelease(digest, opts);
+        if (release)
+            releases.push(release);
+        else
+            malformed++;
+    }
+    return { releases, malformed };
+}
+/** Parse the lines of `cuts.jsonl`. A line that is not a cut is counted and skipped. */
+export function parseCuts(text) {
+    const cuts = [];
+    let malformed = 0;
+    for (const line of (text ?? "").split("\n").map((l) => l.trim()).filter(Boolean)) {
+        try {
+            const c = JSON.parse(line);
+            const ok = c &&
+                c.version === 1 &&
+                typeof c.releaseDigest === "string" &&
+                (c.label === null || typeof c.label === "string") &&
+                typeof c.actor === "string" &&
+                typeof c.timestamp === "string" &&
+                (c.runOrigin === null || (typeof c.runOrigin === "object" && typeof c.runOrigin?.forge === "string")) &&
+                (c.signature === null || c.signature === undefined || typeof c.signature === "string");
+            if (!ok) {
+                malformed++;
+                continue;
+            }
+            cuts.push({ ...c, signature: c.signature ?? null });
+        }
+        catch {
+            malformed++;
+        }
+    }
+    return { cuts, malformed };
+}
+/** Every cut, oldest first. */
+export async function readCuts(opts) {
+    return parseCuts(await readBlobFromPath(RELEASES_DIR, CUTS_FILE, opts));
+}
+/** The label each digest carries, from its labelled cuts. */
+export function labelsByDigest(cuts) {
+    const out = new Map();
+    for (const c of cuts)
+        if (c.label !== null && !out.has(c.releaseDigest))
+            out.set(c.releaseDigest, c.label);
+    return out;
+}
+const CUT_RETRY_ATTEMPTS = 5;
+/**
+ * Append a cut for `releaseDigest`. A label names one digest and a digest
+ * takes at most one label (ws-104 question 3): cutting a digest again is a
+ * no-op that returns its label, giving an unlabelled digest a label appends a
+ * cut, and cutting a digest under a label other than its own, or under a
+ * label another digest has, throws {@link ReleaseLabelError}. Does not push.
+ */
+export async function appendCut(input, opts) {
+    if (input.label !== null) {
+        const why = invalidLabel(input.label);
+        if (why)
+            throw new ReleaseLabelError("release-label-invalid", why);
+    }
+    let lastErr;
+    for (let attempt = 1; attempt <= CUT_RETRY_ATTEMPTS; attempt++) {
+        const priorSha = await readPathSha(RELEASES_DIR, CUTS_FILE, opts);
+        const existing = priorSha ? await readBlobBySha(priorSha, opts) : null;
+        const { cuts } = parseCuts(existing);
+        const labels = labelsByDigest(cuts);
+        const own = labels.get(input.releaseDigest);
+        const alreadyCut = cuts.some((c) => c.releaseDigest === input.releaseDigest);
+        if (own !== undefined) {
+            if (input.label === null || input.label === own)
+                return { appended: false, label: own };
+            throw new ReleaseLabelError("release-already-labelled", `release ${input.releaseDigest} is already labelled "${own}", and a release takes one label`);
+        }
+        if (input.label === null && alreadyCut)
+            return { appended: false, label: null };
+        if (input.label !== null) {
+            for (const [digest, label] of labels) {
+                if (label === input.label) {
+                    throw new ReleaseLabelError("release-label-taken", `the label "${input.label}" already names release ${digest}`);
+                }
+            }
+        }
+        const cut = {
+            version: 1,
+            releaseDigest: input.releaseDigest,
+            label: input.label,
+            actor: input.actor,
+            timestamp: input.timestamp,
+            runOrigin: input.runOrigin,
+            signature: input.signature ?? null,
+        };
+        const content = `${existing ? `${existing.replace(/\n$/, "")}\n` : ""}${JSON.stringify(cut, sortedJsonReplacer)}\n`;
+        try {
+            const dir = await ledgerDir(RELEASES_DIR, opts);
+            await writeLedgerFiles([{ path: `${dir}/${CUTS_FILE}`, content, expectPriorSha: priorSha }], "Release cut", opts);
+            return { appended: true, cut };
+        }
+        catch (err) {
+            if (!(err instanceof RefCASConflictError))
+                throw err;
+            lastErr = err;
+        }
+    }
+    throw lastErr;
+}
+/** A template's bytes by digest, or null when none is stored. */
+export async function readReleaseTemplate(digest, opts) {
+    return readBlobFromPath(`${RELEASES_DIR}/${TEMPLATES_SUBDIR}`, templateFile(digest), opts);
+}
+/**
+ * Find a release by its digest or its label. Null when neither names one.
+ * A string that names a digest is read as a digest first.
+ */
+export async function resolveRelease(ref, opts) {
+    const { cuts } = await readCuts(opts);
+    const labels = labelsByDigest(cuts);
+    let digest = ref.includes(":") ? ref : undefined;
+    if (!digest)
+        for (const [d, label] of labels)
+            if (label === ref)
+                digest = d;
+    if (!digest)
+        return null;
+    const release = await readRelease(digest, opts);
+    return release ? { release, label: labels.get(digest) ?? null } : null;
+}

package/dist/lifecycle/run-ledger.d.ts

@@ -26,6 +26,10 @@ export declare function buildRunRecord(config: Pick<OpConfig, "name" | "labels">
     steward?: string;
     /** The gate the run resumed at, for a run that resumed (#3947). */
     resumed?: OpRunRecord["resumed"];
+    /** The commit the run built from (#4020). */
+    gitSha?: string;
+    /** The CI run the Op ran in (#4020), when it ran in CI. */
+    runOrigin?: OpRunRecord["runOrigin"];
     /** Each phase's wall-clock time, by name, as the executor measured it. */
     phaseDurations?: Record<string, number>;
 }): OpRunRecordInput;

package/dist/lifecycle/run-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAqC,MAAM,eAAe,CAAC;AAStG,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,CA+ClB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA4BxD"}
+{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAqC,MAAM,eAAe,CAAC;AAStG,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjC,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,CAiDlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA4BxD"}

package/dist/lifecycle/run-ledger.js

@@ -114,6 +114,8 @@ export function buildRunRecord(config, records, times) {
         ...(times.point ? { point: times.point } : {}),
         ...(times.steward ? { steward: times.steward } : {}),
         ...(times.resumed ? { resumed: times.resumed } : {}),
+        ...(times.gitSha ? { gitSha: times.gitSha } : {}),
+        ...(times.runOrigin ? { runOrigin: times.runOrigin } : {}),
     };
 }
 /**

package/dist/op/activities/change-coverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-coverage.d.ts","sourceRoot":"","sources":["../../../src/op/activities/change-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE9E,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAClC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;IACjG,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,SAAS,CAAC,CAAC;CAClE;AAED,wBAAsB,cAAc,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAmBjG"}
+{"version":3,"file":"change-coverage.d.ts","sourceRoot":"","sources":["../../../src/op/activities/change-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE9E,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAClC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;IACjG,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,SAAS,CAAC,CAAC;CAClE;AAED,wBAAsB,cAAc,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAsBjG"}

package/dist/op/activities/change-coverage.js

@@ -34,7 +34,9 @@ export async function changeCoverage(args = {}) {
         findings: doc.findings.map(({ code, path, message, severity, records, triage }) => ({ code, path, message, severity, records, triage })),
         summary: doc.summary,
     };
-    if (!doc.ok)
-        throw new Error(`changeCoverage: ${doc.findings.length} change ${doc.findings.length === 1 ? "finding" : "findings"} at severity fail: ${doc.findings.map((f) => `${f.code} ${f.path}`).join(", ")}`);
+    if (!doc.ok) {
+        const all = [...doc.findings.map((f) => `${f.code} ${f.path}`), ...(doc.links?.findings ?? []).map((f) => `${f.code} ${f.commit.slice(0, 8)}`)];
+        throw new Error(`changeCoverage: ${all.length} change ${all.length === 1 ? "finding" : "findings"} at severity fail: ${all.join(", ")}`);
+    }
     return result;
 }

package/dist/op/activities/source-release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-release.d.ts","sourceRoot":"","sources":["../../../src/op/activities/source-release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,EAAmC,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIxF,MAAM,WAAW,iBAAiB;IAChC,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEhD,gFAAgF;AAChF,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEzF;AAID,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,iHAAiH;IACjH,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAGvE;AAED,qDAAqD;AACrD,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CASnF;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAM3G;AAID,MAAM,WAAW,iBAAiB;IAChC,wGAAwG;IACxG,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,mEAAmE;AACnE,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+CzF"}
+{"version":3,"file":"source-release.d.ts","sourceRoot":"","sources":["../../../src/op/activities/source-release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,EAAmC,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIxF,MAAM,WAAW,iBAAiB;IAChC,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEhD,gFAAgF;AAChF,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEzF;AAID,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,iHAAiH;IACjH,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAGvE;AAED,qDAAqD;AACrD,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CASnF;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAM3G;AAID,MAAM,WAAW,iBAAiB;IAChC,wGAAwG;IACxG,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,mEAAmE;AACnE,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmDzF"}

package/dist/op/activities/source-release.js

@@ -60,15 +60,18 @@ export async function releaseRecord(args) {
     const component = plan.component;
     const env = plan.env;
     const gitSha = plan.gitSha;
-    const { readReleaseLedger, latestPerComponent, appendReleaseRecord, resolveRunId } = await import("../../lifecycle/release-ledger.js");
+    const { readReleaseLedger, latestPerComponent, appendReleaseRecord, resolveRunId, admissionOf } = await import("../../lifecycle/release-ledger.js");
     const { persistReleasePlan } = await import("../../lifecycle/plan-ledger.js");
     const { pushLifecycle } = await import("../../lifecycle/git.js");
     let approver = null;
+    let admission;
     if (args.approval) {
         const { readGateLedger } = await import("../../lifecycle/gate-ledger.js");
         const { resolutions } = await readGateLedger(args.approval.op, opts);
-        const bound = resolutions.filter((r) => r.gate === args.approval.gate && r.planDigest === plan.digest);
-        approver = bound.length > 0 ? [...new Set(bound.map((r) => r.resolvedBy))].join(", ") : null;
+        // #4020: the approver and the gate resolution that admitted the release.
+        const admitted = admissionOf(resolutions, { ...args.approval, planDigest: plan.digest });
+        approver = admitted?.approver ?? null;
+        admission = admitted?.admission;
     }
     const latest = latestPerComponent((await readReleaseLedger(env, opts)).records).get(component);
     if (latest?.digest === plan.digest && latest.gitSha === gitSha) {
@@ -91,6 +94,7 @@ export async function releaseRecord(args) {
         timestamp: new Date().toISOString(),
         actor,
         ...(approver ? { approver } : {}),
+        ...(admission ? { admission } : {}),
     }, opts);
     await pushLifecycle(opts);
     return { recorded: true, digest: plan.digest, env, component, approver };

package/dist/op/activities/source-rollback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-rollback.d.ts","sourceRoot":"","sources":["../../../src/op/activities/source-rollback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,gCAAgC,CAAC;AAMhF,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,2GAA2G;IAC3G,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,yBAAyB;IACxC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,iHAAiH;IACjH,EAAE,EAAE,MAAM,CAAC;IACX,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;CACb;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,aAAa,EAAE,EACxB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,EAAE,CAAC,EAAE,MAAM,GACV;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAmBxE;AAED,kIAAkI;AAClI,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA0D3G;AAID,MAAM,WAAW,yBAAyB;IACxC,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA2B;IAC1C,4DAA4D;IAC5D,QAAQ,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,qDAAqD;AACrD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA8CjH"}
+{"version":3,"file":"source-rollback.d.ts","sourceRoot":"","sources":["../../../src/op/activities/source-rollback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAoB,aAAa,EAAc,MAAM,gCAAgC,CAAC;AAMlG,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,2GAA2G;IAC3G,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,yBAAyB;IACxC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,iHAAiH;IACjH,EAAE,EAAE,MAAM,CAAC;IACX,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;CACb;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,aAAa,EAAE,EACxB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,EAAE,CAAC,EAAE,MAAM,GACV;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAmBxE;AAED,kIAAkI;AAClI,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA0D3G;AAID,MAAM,WAAW,yBAAyB;IACxC,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA2B;IAC1C,4DAA4D;IAC5D,QAAQ,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,qDAAqD;AACrD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAkDjH"}

package/dist/op/activities/source-rollback.js

@@ -131,14 +131,17 @@ export async function releaseRollbackRecord(args) {
     const component = plan.component;
     const env = plan.env;
     const gitSha = plan.gitSha;
-    const { readReleaseLedger, latestPerComponent, appendReleaseRecord, resolveRunId } = await import("../../lifecycle/release-ledger.js");
+    const { readReleaseLedger, latestPerComponent, appendReleaseRecord, resolveRunId, admissionOf } = await import("../../lifecycle/release-ledger.js");
     const { pushLifecycle } = await import("../../lifecycle/git.js");
     let approver = null;
+    let admission;
     if (args.approval) {
         const { readGateLedger } = await import("../../lifecycle/gate-ledger.js");
         const { resolutions } = await readGateLedger(args.approval.op, opts);
-        const bound = resolutions.filter((r) => r.gate === args.approval.gate && r.planDigest === plan.digest);
-        approver = bound.length > 0 ? [...new Set(bound.map((r) => r.resolvedBy))].join(", ") : null;
+        // #4020: the approver and the gate resolution that admitted the release.
+        const admitted = admissionOf(resolutions, { ...args.approval, planDigest: plan.digest });
+        approver = admitted?.approver ?? null;
+        admission = admitted?.admission;
     }
     const latest = latestPerComponent((await readReleaseLedger(env, opts)).records.filter((r) => r.component === component)).get(component);
     if (latest?.digest === rollback.to && latest.restores?.runId === rollback.restores.runId && latest.restores.timestamp === rollback.restores.timestamp) {
@@ -158,6 +161,7 @@ export async function releaseRollbackRecord(args) {
         timestamp: new Date().toISOString(),
         actor,
         ...(approver ? { approver } : {}),
+        ...(admission ? { admission } : {}),
         restores: rollback.restores,
     }, opts);
     await pushLifecycle(opts);