@intentius/chant 0.124.27 → 0.124.29

package/dist/lifecycle/release-join.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Join a commit, a release, its gates and its deploy records through the
+ * release digest (#4043, ws-104).
+ *
+ * The records already name one another. A release file holds its `commit`; a
+ * release gate's pending fact and resolution hold the `releaseDigest`; a deploy
+ * record holds the `releaseDigest` when the deploy was made from a release.
+ * From any one of the four, the others are one lookup away:
+ *
+ *   commit  to releases      `_releases/*.json` `commit`
+ *   release to gates         `releaseDigest` on the records of `_gates/release.jsonl`
+ *   release to deploys       `releaseDigest` on the records of every `<env>/releases.jsonl`
+ *
+ * This is the one place that does it, for the readers that need the chain
+ * (the why chain of #4023, behold). Release plus a deploy record's `env`
+ * names the release target.
+ *
+ * Read-only. Reads the local `chant/lifecycle` branch; fetch it first for the
+ * remote's records. A release digest or commit that nothing recorded joins to
+ * an empty list rather than an error.
+ */
+import { type GateResolutionRecord, type PendingGateRecord } from "./gate-ledger.js";
+import { type ReleaseRecord } from "./release-ledger.js";
+import { type Release, type ReleaseCut } from "./release-store.js";
+import type { LedgerLocation } from "./git.js";
+/** Where a join starts. Each names the others one lookup away. */
+export type ReleaseJoinStart = 
+/** A full commit sha, or a prefix of at least 7 characters. Joins to every release cut from it. */
+{
+    commit: string;
+}
+/**
+ * Several full commit shas, or prefixes of at least 7 characters. Joins to
+ * every release cut from any of them, reading the ledgers once (#4023).
+ */
+ | {
+    commits: readonly string[];
+}
+/** A release's label or its `releaseDigest`. */
+ | {
+    release: string;
+}
+/**
+ * A deploy record. It joins through its `releaseDigest`; a record with none
+ * but an admission by the release gate joins through the resolution that
+ * admission names.
+ */
+ | {
+    deploy: Pick<ReleaseRecord, "releaseDigest" | "admission">;
+}
+/** A release gate's pending fact or resolution. */
+ | {
+    gate: Pick<PendingGateRecord | GateResolutionRecord, "releaseDigest">;
+};
+/** One release with everything the digest joins to it. */
+export interface JoinedRelease {
+    releaseDigest: string;
+    /** The label of the release, or null when it was cut with none. */
+    label: string | null;
+    /** The green commit the release was cut from. */
+    commit: string;
+    release: Release;
+    /** Every cut of the release, oldest first. */
+    cuts: ReleaseCut[];
+    /** The release gate's facts for this release (`_gates/release.jsonl`), oldest first. */
+    gates: {
+        pending: PendingGateRecord[];
+        resolutions: GateResolutionRecord[];
+    };
+    /** Every deploy record that names the release, across environments, oldest first: by its `releaseDigest`, or, without one, by the release gate resolution its admission names. Each record's `env` with the release names the target. */
+    deploys: ReleaseRecord[];
+}
+/** What {@link joinRelease} returns. */
+export interface ReleaseJoin {
+    /** The releases the starting point joins to: one for a release, a gate or a deploy, any number for a commit. */
+    releases: JoinedRelease[];
+    /** Why `releases` is empty, when the starting point could not be followed. Absent otherwise. */
+    reason?: string;
+}
+/** The version of the shape above, for a reader that stores it. Chant 0.124.29 and newer. */
+export declare const RELEASE_JOIN_VERSION = 1;
+/**
+ * Follow one record to the rest of its chain. Never throws for an unknown
+ * starting point; a ledger that can't be read does throw, as those readers do.
+ */
+export declare function joinRelease(from: ReleaseJoinStart, loc?: LedgerLocation): Promise<ReleaseJoin>;
+/**
+ * The release a deploy record names, over the release gate's resolutions
+ * already read: its own `releaseDigest`, else the one on the resolution its
+ * admission names. Undefined when it was not made from a release. The rule
+ * {@link joinRelease} follows, for a reader that holds the ledgers already,
+ * such as retention's garbage collection (#4036).
+ */
+export declare function releaseOfDeploy(record: Pick<ReleaseRecord, "releaseDigest" | "admission">, releaseGateResolutions: readonly Pick<GateResolutionRecord, "gate" | "timestamp" | "releaseDigest">[]): string | undefined;
+//# sourceMappingURL=release-join.d.ts.map

package/dist/lifecycle/release-join.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-join.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-join.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAkB,KAAK,oBAAoB,EAAE,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClG,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAA6C,KAAK,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC3G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAE5C,kEAAkE;AAClE,MAAM,MAAM,gBAAgB;AAC1B,mGAAmG;AACjG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE;AACpB;;;GAGG;GACD;IAAE,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE;AAChC,gDAAgD;GAC9C;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;AACrB;;;;GAIG;GACD;IAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,WAAW,CAAC,CAAA;CAAE;AAChE,mDAAmD;GACjD;IAAE,IAAI,EAAE,IAAI,CAAC,iBAAiB,GAAG,oBAAoB,EAAE,eAAe,CAAC,CAAA;CAAE,CAAC;AAE9E,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,wFAAwF;IACxF,KAAK,EAAE;QAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAAC,WAAW,EAAE,oBAAoB,EAAE,CAAA;KAAE,CAAC;IAC7E,yOAAyO;IACzO,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,gHAAgH;IAChH,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6FAA6F;AAC7F,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAItC;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,GAAE,cAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwExG;AAaD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,WAAW,CAAC,EAC1D,sBAAsB,EAAE,SAAS,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,WAAW,GAAG,eAAe,CAAC,EAAE,GACpG,MAAM,GAAG,SAAS,CAKpB"}

package/dist/lifecycle/release-join.js

@@ -0,0 +1,139 @@
+/**
+ * Join a commit, a release, its gates and its deploy records through the
+ * release digest (#4043, ws-104).
+ *
+ * The records already name one another. A release file holds its `commit`; a
+ * release gate's pending fact and resolution hold the `releaseDigest`; a deploy
+ * record holds the `releaseDigest` when the deploy was made from a release.
+ * From any one of the four, the others are one lookup away:
+ *
+ *   commit  to releases      `_releases/*.json` `commit`
+ *   release to gates         `releaseDigest` on the records of `_gates/release.jsonl`
+ *   release to deploys       `releaseDigest` on the records of every `<env>/releases.jsonl`
+ *
+ * This is the one place that does it, for the readers that need the chain
+ * (the why chain of #4023, behold). Release plus a deploy record's `env`
+ * names the release target.
+ *
+ * Read-only. Reads the local `chant/lifecycle` branch; fetch it first for the
+ * remote's records. A release digest or commit that nothing recorded joins to
+ * an empty list rather than an error.
+ */
+import { RELEASE_GATE_OP } from "../op/gate-name.js";
+import { readGateLedger } from "./gate-ledger.js";
+import { listReleaseEnvironments, readReleaseLedger } from "./release-ledger.js";
+import { labelsByDigest, readAllReleases, readCuts } from "./release-store.js";
+/** The version of the shape above, for a reader that stores it. Chant 0.124.29 and newer. */
+export const RELEASE_JOIN_VERSION = 1;
+const MIN_COMMIT_PREFIX = 7;
+/**
+ * Follow one record to the rest of its chain. Never throws for an unknown
+ * starting point; a ledger that can't be read does throw, as those readers do.
+ */
+export async function joinRelease(from, loc = {}) {
+    const { releases } = await readAllReleases(loc);
+    const { cuts } = await readCuts(loc);
+    const labels = labelsByDigest(cuts);
+    let digests;
+    let reason;
+    if ("commit" in from) {
+        const sha = from.commit.toLowerCase();
+        if (sha.length < MIN_COMMIT_PREFIX) {
+            return { releases: [], reason: `a commit needs at least ${MIN_COMMIT_PREFIX} characters to join on` };
+        }
+        digests = releases.filter((r) => r.commit.toLowerCase().startsWith(sha)).map((r) => r.releaseDigest);
+        if (digests.length === 0)
+            reason = `no release was cut from commit ${from.commit}`;
+    }
+    else if ("commits" in from) {
+        const shas = from.commits.map((c) => c.toLowerCase());
+        if (shas.some((sha) => sha.length < MIN_COMMIT_PREFIX)) {
+            return { releases: [], reason: `a commit needs at least ${MIN_COMMIT_PREFIX} characters to join on` };
+        }
+        digests = releases.filter((r) => shas.some((sha) => r.commit.toLowerCase().startsWith(sha))).map((r) => r.releaseDigest);
+        if (digests.length === 0)
+            reason = shas.length === 0 ? "no commit was given to join on" : `no release was cut from ${shas.length === 1 ? `commit ${from.commits[0]}` : `any of ${shas.length} commits`}`;
+    }
+    else if ("release" in from) {
+        const ref = from.release;
+        const byDigest = releases.find((r) => r.releaseDigest === ref);
+        const byLabel = [...labels].find(([, label]) => label === ref)?.[0];
+        const found = byDigest?.releaseDigest ?? byLabel;
+        digests = found ? [found] : [];
+        if (digests.length === 0)
+            reason = `no release is labelled or digested "${ref}"`;
+    }
+    else if ("deploy" in from) {
+        const digest = from.deploy.releaseDigest ?? (await releaseOfAdmission(from.deploy.admission, loc));
+        digests = digest ? [digest] : [];
+        if (digests.length === 0)
+            reason = "the deploy record names no release: it was not made from one";
+    }
+    else {
+        const digest = from.gate.releaseDigest;
+        digests = digest ? [digest] : [];
+        if (digests.length === 0)
+            reason = "the gate binds no release: it is not a release gate";
+    }
+    const known = new Map(releases.map((r) => [r.releaseDigest, r]));
+    const wanted = [...new Set(digests)].filter((d) => known.has(d));
+    if (digests.length > 0 && wanted.length === 0)
+        reason = `release ${digests[0]} is named but its file is not on this checkout's chant/lifecycle`;
+    if (wanted.length === 0)
+        return { releases: [], ...(reason ? { reason } : {}) };
+    const gateLedger = await readGateLedger(RELEASE_GATE_OP, loc);
+    // A record names its release by `releaseDigest`, or, with none, through the
+    // release gate resolution its admission names (#4045), as releaseOfDeploy reads it.
+    const records = [];
+    for (const env of await listReleaseEnvironments(loc)) {
+        for (const record of (await readReleaseLedger(env, loc)).records) {
+            const digest = releaseOfDeploy(record, gateLedger.resolutions);
+            if (digest !== undefined && wanted.includes(digest))
+                records.push({ record, digest });
+        }
+    }
+    const byTime = (a, b) => (a.timestamp < b.timestamp ? -1 : a.timestamp > b.timestamp ? 1 : 0);
+    return {
+        releases: wanted.map((digest) => {
+            const release = known.get(digest);
+            return {
+                releaseDigest: digest,
+                label: labels.get(digest) ?? null,
+                commit: release.commit,
+                release,
+                cuts: cuts.filter((c) => c.releaseDigest === digest),
+                gates: {
+                    pending: gateLedger.pending.filter((p) => p.releaseDigest === digest),
+                    resolutions: gateLedger.resolutions.filter((r) => r.releaseDigest === digest),
+                },
+                deploys: records.filter((r) => r.digest === digest).map((r) => r.record).sort(byTime),
+            };
+        }),
+    };
+}
+/**
+ * The release a deploy record's admission names, when the record itself has no
+ * `releaseDigest`: the resolution it points at, in the release gate's ledger,
+ * carries one (#4045).
+ */
+async function releaseOfAdmission(admission, loc) {
+    if (!admission || admission.op !== RELEASE_GATE_OP)
+        return undefined;
+    const { resolutions } = await readGateLedger(RELEASE_GATE_OP, loc);
+    return releaseOfDeploy({ admission }, resolutions);
+}
+/**
+ * The release a deploy record names, over the release gate's resolutions
+ * already read: its own `releaseDigest`, else the one on the resolution its
+ * admission names. Undefined when it was not made from a release. The rule
+ * {@link joinRelease} follows, for a reader that holds the ledgers already,
+ * such as retention's garbage collection (#4036).
+ */
+export function releaseOfDeploy(record, releaseGateResolutions) {
+    if (record.releaseDigest !== undefined)
+        return record.releaseDigest;
+    const admission = record.admission;
+    if (!admission || admission.op !== RELEASE_GATE_OP)
+        return undefined;
+    return releaseGateResolutions.find((r) => r.gate === admission.gate && r.timestamp === admission.resolvedAt && r.releaseDigest !== undefined)?.releaseDigest;
+}

package/dist/lifecycle/release-ledger.d.ts

@@ -29,6 +29,7 @@
  */
 import { type LegacyDigestFlag } from "./legacy-digest.js";
 import { type LedgerLocation } from "./git.js";
+import type { GateResolutionRecord } from "./gate-ledger.js";
 export { validateReleaseRecord, parseReleaseLedger, releaseLedgerLines, readReleaseRecords, listReleaseEnvironmentsOn } from "./release-read.js";
 export type { LedgerReadPort } from "./ledger-port.js";
 /**
@@ -49,6 +50,35 @@ export interface RunOrigin {
     /** Resolved link to the run, when the environment provided enough to build one. */
     url?: string;
 }
+/**
+ * The gate resolution that admitted a deploy (#4020): the gate's address in the
+ * gate ledger (`_gates/<op>.jsonl`, `op` and `gate`) and when the resolution
+ * was recorded. With `approver` on the same record it names the line a reader
+ * opens to see what was approved. Chant 0.124.28 and newer write it.
+ */
+export interface ReleaseAdmission {
+    /** The op, or for a component gate the component, whose gate ledger holds the resolution. */
+    op: string;
+    /** The gate's name. */
+    gate: string;
+    /** ISO-8601 time the resolution was recorded (`GateResolutionRecord.timestamp`). When several approvals counted, the newest one. */
+    resolvedAt: string;
+}
+/**
+ * The approver and admission a release records for the resolutions of its gate
+ * (#4020): those of `gate` on `op` bound to `planDigest`. The approver is the
+ * distinct `resolvedBy` names, comma joined, as `approver` has always been
+ * written by the release activities; `resolvedAt` is the newest one's time.
+ * Undefined when no resolution is bound to the plan.
+ */
+export declare function admissionOf(resolutions: readonly GateResolutionRecord[], at: {
+    op: string;
+    gate: string;
+    planDigest?: string;
+}): {
+    approver: string;
+    admission: ReleaseAdmission;
+} | undefined;
 /**
  * Points at one earlier release record (#2530, #2531, #2604). A record has no id of its own,
  * so it is named by the environment whose ledger holds it plus the run id and
@@ -118,6 +148,13 @@ export interface ReleaseRecord {
      * the one who triggered the deploy (separation of duties).
      */
     approver?: string;
+    /**
+     * The gate resolution that admitted this deploy (#4020), for a gated change:
+     * which gate (`op` and `gate`) and when it was resolved. The approver is
+     * `approver`. Optional and omitted for an ungated change and for a record
+     * written before 0.124.28, whose gate cannot be recovered from the record.
+     */
+    admission?: ReleaseAdmission;
     /** Optional: the archive's own manifest digest (../components/verbs/build-archive.ts's `manifestDigest`), when the caller has it — lets a reader recover full build contents/provenance, not just the promoted image digest. */
     manifestDigest?: string;
     /**
@@ -167,6 +204,13 @@ export interface ReleaseRecord {
      * partway. Absent on every other record.
      */
     redeploys?: ReleaseRef;
+    /**
+     * Optional: the release this deploy came from (#4026, ws-104), the
+     * `releaseDigest` of `_releases/<releaseDigest>.json`. Written by
+     * `chant components promote --release` since 0.124.28. Absent on every
+     * deploy that was not made from a release.
+     */
+    releaseDigest?: string;
 }
 /** Thrown by `appendReleaseRecord` when the record is missing a required field — a release record can never be recorded partially, since it is never editable afterward. */
 export declare class InvalidReleaseRecordError extends Error {
@@ -200,6 +244,16 @@ export declare function resolveRunId(explicit?: string, env?: NodeJS.ProcessEnv)
     runId: string;
     runOrigin?: RunOrigin;
 };
+/**
+ * The CI run the environment names, with the origin that locates it, or
+ * undefined outside CI (#4020). `resolveRunId` takes its CI branches from
+ * here, and an Op run record takes its `runOrigin` from here, so a run and the
+ * deploy it made name the run the same way.
+ */
+export declare function resolveCiRun(env?: NodeJS.ProcessEnv): {
+    runId: string;
+    runOrigin: RunOrigin;
+} | undefined;
 /**
  * Append one immutable release record to the `<env>` ledger on the
  * `chant/lifecycle` orphan branch. Throws `InvalidReleaseRecordError` before

package/dist/lifecycle/release-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAyC,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAwG,KAAK,cAAc,EAAE,MAAM,OAAO,CAAC;AAIlJ,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC9I,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;OAMG;IACH,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAC5C,gHAAgH;IAChH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iOAAiO;IACjO,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,CAAC;CACxB;AAED,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;IAA7C,YAA4B,OAAO,EAAE,MAAM,EAAE,EAG5C;CACF;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,CAsB1C;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CASpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAS1D;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}
+{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAyC,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAwG,KAAK,cAAc,EAAE,MAAM,OAAO,CAAC;AAElJ,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC9I,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;OAMG;IACH,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAC5C,gHAAgH;IAChH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6FAA6F;IAC7F,EAAE,EAAE,MAAM,CAAC;IACX,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,oIAAoI;IACpI,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,gBAAgB,CAAA;CAAE,GAAG,SAAS,CAO/D;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iOAAiO;IACjO,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;IAA7C,YAA4B,OAAO,EAAE,MAAM,EAAE,EAG5C;CACF;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,CAQ1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,SAAS,CAyBtH;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CASpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAS1D;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}

package/dist/lifecycle/release-ledger.js

@@ -33,6 +33,22 @@ import { appendReleaseRecordLine, readReleaseLedgerLines, listLedgerEnvironments
 import { parseReleaseLedger, validateReleaseRecord } from "./release-read.js";
 // The pure readers live apart, so a bundle can import them without git (#3865).
 export { validateReleaseRecord, parseReleaseLedger, releaseLedgerLines, readReleaseRecords, listReleaseEnvironmentsOn } from "./release-read.js";
+/**
+ * The approver and admission a release records for the resolutions of its gate
+ * (#4020): those of `gate` on `op` bound to `planDigest`. The approver is the
+ * distinct `resolvedBy` names, comma joined, as `approver` has always been
+ * written by the release activities; `resolvedAt` is the newest one's time.
+ * Undefined when no resolution is bound to the plan.
+ */
+export function admissionOf(resolutions, at) {
+    const bound = resolutions.filter((r) => r.gate === at.gate && r.planDigest === at.planDigest);
+    if (bound.length === 0)
+        return undefined;
+    return {
+        approver: [...new Set(bound.map((r) => r.resolvedBy))].join(", "),
+        admission: { op: at.op, gate: at.gate, resolvedAt: bound.map((r) => r.timestamp).sort().at(-1) },
+    };
+}
 /** Thrown by `appendReleaseRecord` when the record is missing a required field — a release record can never be recorded partially, since it is never editable afterward. */
 export class InvalidReleaseRecordError extends Error {
     constructor(missing) {
@@ -63,31 +79,48 @@ export class InvalidReleaseRecordError extends Error {
  * remove.
  */
 export function resolveRunId(explicit, env = process.env) {
-    const githubOrigin = (id) => ({
-        forge: "github",
-        ...(env.GITHUB_REPOSITORY ? { repo: env.GITHUB_REPOSITORY } : {}),
-        ...(env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY
-            ? { url: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${id}` }
-            : {}),
-    });
-    const gitlabOrigin = () => ({
-        forge: "gitlab",
-        ...(env.CI_PROJECT_PATH ? { repo: env.CI_PROJECT_PATH } : {}),
-        ...(env.CI_PIPELINE_URL ? { url: env.CI_PIPELINE_URL } : {}),
-    });
+    const ci = resolveCiRun(env);
     if (explicit) {
-        if (env.GITHUB_RUN_ID && explicit === env.GITHUB_RUN_ID)
-            return { runId: explicit, runOrigin: githubOrigin(explicit) };
-        if (env.CI_PIPELINE_ID && explicit === env.CI_PIPELINE_ID)
-            return { runId: explicit, runOrigin: gitlabOrigin() };
+        if (ci && explicit === ci.runId)
+            return ci;
         return { runId: explicit };
     }
-    if (env.GITHUB_RUN_ID)
-        return { runId: env.GITHUB_RUN_ID, runOrigin: githubOrigin(env.GITHUB_RUN_ID) };
-    if (env.CI_PIPELINE_ID)
-        return { runId: env.CI_PIPELINE_ID, runOrigin: gitlabOrigin() };
+    if (ci)
+        return ci;
     return { runId: `local-${Date.now()}`, runOrigin: { forge: "local" } };
 }
+/**
+ * The CI run the environment names, with the origin that locates it, or
+ * undefined outside CI (#4020). `resolveRunId` takes its CI branches from
+ * here, and an Op run record takes its `runOrigin` from here, so a run and the
+ * deploy it made name the run the same way.
+ */
+export function resolveCiRun(env = process.env) {
+    if (env.GITHUB_RUN_ID) {
+        const id = env.GITHUB_RUN_ID;
+        return {
+            runId: id,
+            runOrigin: {
+                forge: "github",
+                ...(env.GITHUB_REPOSITORY ? { repo: env.GITHUB_REPOSITORY } : {}),
+                ...(env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY
+                    ? { url: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${id}` }
+                    : {}),
+            },
+        };
+    }
+    if (env.CI_PIPELINE_ID) {
+        return {
+            runId: env.CI_PIPELINE_ID,
+            runOrigin: {
+                forge: "gitlab",
+                ...(env.CI_PROJECT_PATH ? { repo: env.CI_PROJECT_PATH } : {}),
+                ...(env.CI_PIPELINE_URL ? { url: env.CI_PIPELINE_URL } : {}),
+            },
+        };
+    }
+    return undefined;
+}
 /**
  * Append one immutable release record to the `<env>` ledger on the
  * `chant/lifecycle` orphan branch. Throws `InvalidReleaseRecordError` before