@intentius/chant 0.124.28 → 0.124.30

package/dist/lifecycle/publish-targets.js

@@ -0,0 +1,85 @@
+/**
+ * The publish targets (#4047): a member's `release.publish` declarations
+ * (./publish-declaration.ts) made into {@link PublishTarget}s, and what the
+ * targets share.
+ *
+ * - `npm` (./publish-npm.ts): `npm publish` per package, in order, with
+ *   `--provenance` when the run has an OIDC token.
+ * - `oci` (./publish-oci.ts): an OCI image layout pushed to a registry such
+ *   as GHCR or Docker Hub over the registry HTTP API, by digest, then tagged.
+ * - `forge` (./publish-forge.ts): files attached to the GitHub, GitLab or
+ *   Forgejo release named by the release's tag.
+ *
+ * A file a target reads that the release records as an artifact at the same
+ * path is checked against the release's digest, and a file that differs is
+ * refused (`publish-artifact-digest-mismatch`). Other files are the commit's
+ * by the checkout check (`checkCheckoutIsRelease` in ./release-publish.ts).
+ */
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { isAbsolute, normalize, relative, resolve } from "node:path";
+import { PublishTargetError } from "./release-publish.js";
+import { sortedJsonReplacer } from "../utils.js";
+/** Make each declaration a target, in the order declared. */
+export async function createPublishTargets(decls, deps = {}) {
+    const out = [];
+    for (const d of decls) {
+        switch (d.type) {
+            case "npm":
+                out.push((await import("./publish-npm.js")).npmTarget(d, deps));
+                break;
+            case "oci":
+                out.push((await import("./publish-oci.js")).ociTarget(d, deps));
+                break;
+            case "forge":
+                out.push((await import("./publish-forge.js")).forgeTarget(d, deps));
+                break;
+        }
+    }
+    return out;
+}
+/**
+ * The key of a target made from `decl` (#4048): its kind and the first 16 hex
+ * digits of the SHA-256 of its sorted JSON. A declaration holds variable
+ * names, never a credential, so the key holds none either.
+ */
+export function publishTargetKey(decl) {
+    return `${decl.type}:${createHash("sha256").update(JSON.stringify(decl, sortedJsonReplacer)).digest("hex").slice(0, 16)}`;
+}
+/** `path` resolved in the member at `cwd`, refused when it is not there. */
+export function memberFile(cwd, path) {
+    const abs = isAbsolute(path) ? path : resolve(cwd, path);
+    if (!existsSync(abs)) {
+        throw new PublishTargetError("publish-file-missing", `${path} does not exist in ${cwd}`, "Build it before publishing: a publish uploads what is there and never builds.");
+    }
+    return abs;
+}
+/** `sha256:<hex>` of a file's bytes. */
+export function fileDigest(abs) {
+    return `sha256:${createHash("sha256").update(readFileSync(abs)).digest("hex")}`;
+}
+/** `sha256:<hex>` of bytes. */
+export function bytesDigest(bytes) {
+    return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+/** True when `abs` is a directory. */
+export function isDir(abs) {
+    return statSync(abs).isDirectory();
+}
+const normal = (p) => normalize(p).replace(/\\/g, "/").replace(/^\.\//, "");
+/** The release's artifact of `kind` at `path` (relative to the member at `cwd`), if it records one. */
+export function releaseArtifactAt(release, kind, cwd, path) {
+    const rel = normal(isAbsolute(path) ? relative(cwd, path) : path);
+    return release.artifactDigests.find((a) => a.kind === kind && normal(a.path) === rel);
+}
+/**
+ * Refuse a file the release records at `path` whose digest is none of
+ * `digests`, the identities the target can compute for it (the file's bytes,
+ * and for an image its manifest and config digests).
+ */
+export function checkReleaseDigest(release, kind, cwd, path, digests) {
+    const recorded = releaseArtifactAt(release, kind, cwd, path);
+    if (!recorded || digests.includes(recorded.digest))
+        return;
+    throw new PublishTargetError("publish-artifact-digest-mismatch", `${path} is not the ${kind} release ${release.releaseDigest} built: the release records ${recorded.digest}, and the file here is ${digests[0]}`, "Publish the files the cut built. A publish never builds, so restore them from the cut's build, or cut a new release.");
+}

package/dist/lifecycle/release-cut.d.ts

@@ -32,7 +32,7 @@
  * `ci.green.signedSince` declared, a green tag counts only with a valid
  * statement (`../workspace/ci-green.ts`), so a hand-pushed tag cuts nothing.
  */
-import { type Release, type ReleaseCut } from "./release-store.js";
+import { type Release, type ReleaseCut, type ReleaseTarget } from "./release-store.js";
 import type { CompiledTarget, TargetCompiler } from "../components/release-compile.js";
 /** The stable codes a cut refuses with. */
 export type ReleaseCutCode = "not-a-git-repository" | "release-commit-not-green" | "release-commit-revoked" | "release-worktree-dirty" | "release-no-environments" | "release-no-components" | "release-build-inputs-differ" | "release-unsigned" | "release-signer-refused" | "declaration-invalid";
@@ -95,6 +95,49 @@ export declare function differingBuildSteps(targets: readonly CompiledTarget[]):
     component: string;
     envs: string[];
 }>;
+/** What a dry run of the cut found (#4027): what the cut would do, with nothing built, signed or written. */
+export interface CutPlan {
+    commit: string;
+    member: string | null;
+    label: string | null;
+    /** The release's digest when no artifact needs building, so it is known now; null when a build decides it. */
+    releaseDigest: string | null;
+    /** The digest already cut under `label`, or this digest when it is already cut: the cut would then write no new release. */
+    alreadyCut: string | null;
+    /** Each environment's target: its params, and its templates by component and path. */
+    targets: Array<{
+        env: string;
+        params: ReleaseTarget["params"];
+        templates: Array<{
+            component: string | null;
+            path: string;
+        }>;
+    }>;
+    /** The components whose artifacts would be built, and the environment each is built in. */
+    build: Array<{
+        component: string;
+        env: string;
+    }>;
+    /** The components whose artifacts would be carried from an earlier release. */
+    reused: CutResult["reused"];
+    /** Each component's publish steps, with the environments whose deploy runs them. */
+    publishSteps: Array<{
+        component: string;
+        kind: string;
+        to: string | null;
+        envs: string[];
+    }>;
+    /** Whether the release gate in identity.gates requires a signed cut. */
+    signatureRequired: boolean;
+}
+/**
+ * The dry run of {@link cutRelease} (#4027): the same checks and compile,
+ * then what the cut would build, carry and record, without building an
+ * artifact, signing, or writing anything. Throws what the cut throws before
+ * it builds, and `ReleaseLabelError` when the label is invalid or names a
+ * release of another commit.
+ */
+export declare function planRelease(req: CutRequest): Promise<CutPlan>;
 /**
  * Cut a release of the member at `req.cwd` from its checkout's `HEAD`. Writes
  * the release and the cut to the local `chant/lifecycle` branch and does not
@@ -102,6 +145,10 @@ export declare function differingBuildSteps(targets: readonly CompiledTarget[]):
  * commit isn't green, the tree is dirty, or an environment can't be compiled
  * to the same artifacts, and `ReleaseLabelError` (./release-store.ts) when the
  * label is taken or the release already carries another one.
+ *
+ * The cut line names its run (#4027): the CI run's id and origin in CI, and
+ * outside CI an id minted from the cut's time, `local-<epoch ms>`, with the
+ * origin `{ forge: "local" }`.
  */
 export declare function cutRelease(req: CutRequest): Promise<CutResult>;
 //# sourceMappingURL=release-cut.d.ts.map

package/dist/lifecycle/release-cut.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-cut.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-cut.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAUH,OAAO,EAML,KAAK,OAAO,EAEZ,KAAK,UAAU,EAGhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpF,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GACtB,sBAAsB,GACtB,0BAA0B,GAC1B,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,GAC7B,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,CAAC;AAE1B,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAE7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAHvB,YACW,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;CACF;AAED,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,cAAc,CAAC;IACzB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;IAChB,oGAAoG;IACpG,MAAM,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAcD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,OAAO,0BAA0B,EAAE,OAAO,GAAG,IAAW,GAC9D,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAkBnH;AAED,uGAAuG;AACvG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAapH;AAiBD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA0KpE"}
+{"version":3,"file":"release-cut.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-cut.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAUH,OAAO,EAUL,KAAK,OAAO,EAEZ,KAAK,UAAU,EACf,KAAK,aAAa,EAEnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpF,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GACtB,sBAAsB,GACtB,0BAA0B,GAC1B,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,GAC7B,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,CAAC;AAE1B,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAE7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAHvB,YACW,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;CACF;AAED,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,cAAc,CAAC;IACzB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;IAChB,oGAAoG;IACpG,MAAM,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAcD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,OAAO,0BAA0B,EAAE,OAAO,GAAG,IAAW,GAC9D,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAanH;AAED,uGAAuG;AACvG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAapH;AAyKD,6GAA6G;AAC7G,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8GAA8G;IAC9G,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4HAA4H;IAC5H,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sFAAsF;IACtF,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/H,2FAA2F;IAC3F,KAAK,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,+EAA+E;IAC/E,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5B,oFAAoF;IACpF,YAAY,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC5F,wEAAwE;IACxE,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CA4DnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6DpE"}

package/dist/lifecycle/release-cut.js

@@ -40,7 +40,7 @@ import { contentDigest } from "../content-digest.js";
 import { getHeadCommit } from "./git.js";
 import { resolveMemberLedger } from "./member-ledger.js";
 import { resolveCiRun } from "./release-ledger.js";
-import { appendCut, makeRelease, persistRelease, readAllReleases, readCuts, } from "./release-store.js";
+import { appendCut, invalidLabel, labelsByDigest, makeRelease, persistRelease, readAllReleases, readCuts, readRelease, ReleaseLabelError, } from "./release-store.js";
 export class ReleaseCutError extends Error {
     constructor(code, message, fix) {
         super(message);
@@ -68,15 +68,10 @@ function tryGit(top, args) {
  * every tag counts.
  */
 export async function greenState(top, sha, green = null) {
-    const { readCiTags } = await import("../workspace/ci-green.js");
-    const base = green
-        ? (tryGit(top, ["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${green.branch}^{commit}`]) ??
-            tryGit(top, ["rev-parse", "--verify", "--quiet", `refs/heads/${green.branch}^{commit}`]) ??
-            tryGit(top, ["rev-parse", "HEAD"]))
-        : null;
+    const { judgedCiTags } = await import("./release-revocation.js");
     let tags;
     try {
-        tags = readCiTags(top, green, base);
+        tags = await judgedCiTags(top, green);
     }
     catch (err) {
         const { WorkspaceReadError } = await import("../workspace/declaration.js");
@@ -123,14 +118,12 @@ async function previousRelease(top, commit, cwd) {
     return candidates[0]?.r;
 }
 /**
- * Cut a release of the member at `req.cwd` from its checkout's `HEAD`. Writes
- * the release and the cut to the local `chant/lifecycle` branch and does not
- * push. Throws {@link ReleaseCutError} before anything is written when the
- * commit isn't green, the tree is dirty, or an environment can't be compiled
- * to the same artifacts, and `ReleaseLabelError` (./release-store.ts) when the
- * label is taken or the release already carries another one.
+ * The checks and the compile a cut makes before it builds or writes: the
+ * commit is green and not revoked, the cut is signed when the release gate
+ * asks, the tree is clean, every environment compiles with the same build
+ * steps, and which artifacts are carried from an earlier release.
  */
-export async function cutRelease(req) {
+async function prepare(req) {
     const cwd = resolve(req.cwd);
     const top = tryGit(cwd, ["rev-parse", "--show-toplevel"]);
     if (!top)
@@ -207,11 +200,21 @@ export async function cutRelease(req) {
         }
         toBuild.set(target.env, [...(toBuild.get(target.env) ?? []), component]);
     }
-    for (const env of envs) {
-        const names = toBuild.get(env);
-        if (names)
-            artifacts.push(...(await req.compiler.buildArtifacts(env, names)));
-    }
+    const ledger = await resolveMemberLedger(cwd);
+    return {
+        cwd,
+        commit,
+        envs,
+        compiled,
+        releaseRule,
+        toBuild,
+        carried: artifacts,
+        reused,
+        member: ledger.members.length > 0 ? ledger.members.join("/") : null,
+    };
+}
+/** The targets and template bytes of a compile, each template by its content digest. */
+function targetsOf(compiled) {
     const templates = [];
     const targets = compiled.map((t) => ({
         env: t.env,
@@ -222,8 +225,97 @@ export async function cutRelease(req) {
             return { component: tpl.component, path: tpl.path, digest };
         }),
     }));
-    const ledger = await resolveMemberLedger(cwd);
-    const release = makeRelease({ member: ledger.members.length > 0 ? ledger.members.join("/") : null, commit, artifactDigests: artifacts, targets });
+    return { targets, templates };
+}
+/**
+ * The dry run of {@link cutRelease} (#4027): the same checks and compile,
+ * then what the cut would build, carry and record, without building an
+ * artifact, signing, or writing anything. Throws what the cut throws before
+ * it builds, and `ReleaseLabelError` when the label is invalid or names a
+ * release of another commit.
+ */
+export async function planRelease(req) {
+    const p = await prepare(req);
+    const { targets } = targetsOf(p.compiled);
+    const build = [];
+    for (const env of p.envs)
+        for (const component of p.toBuild.get(env) ?? [])
+            build.push({ component, env });
+    const releaseDigest = build.length === 0 ? makeRelease({ member: p.member, commit: p.commit, artifactDigests: p.carried, targets }).releaseDigest : null;
+    const { cuts } = await readCuts({ cwd: p.cwd });
+    const labels = labelsByDigest(cuts);
+    let alreadyCut = null;
+    if (req.label !== null) {
+        const why = invalidLabel(req.label);
+        if (why)
+            throw new ReleaseLabelError("release-label-invalid", why);
+        const named = [...labels].find(([, l]) => l === req.label)?.[0];
+        if (named !== undefined) {
+            const other = await readRelease(named, { cwd: p.cwd });
+            const sameCommit = other?.commit === p.commit;
+            if (!sameCommit || (releaseDigest !== null && named !== releaseDigest)) {
+                throw new ReleaseLabelError("release-label-taken", `the label "${req.label}" already names release ${named}${other && !sameCommit ? `, cut from commit ${other.commit.slice(0, 12)}` : ""}`);
+            }
+            alreadyCut = named;
+        }
+    }
+    if (releaseDigest !== null && alreadyCut === null && cuts.some((c) => c.releaseDigest === releaseDigest)) {
+        const own = labels.get(releaseDigest);
+        if (own !== undefined && req.label !== null && own !== req.label) {
+            throw new ReleaseLabelError("release-already-labelled", `release ${releaseDigest} is already labelled "${own}", and a release takes one label`);
+        }
+        alreadyCut = releaseDigest;
+    }
+    const steps = new Map();
+    for (const t of p.compiled) {
+        for (const [component, list] of Object.entries(t.publishSteps ?? {})) {
+            for (const step of list) {
+                const kind = typeof step.kind === "string" ? step.kind : "publish";
+                const to = typeof step.to === "string" ? step.to : null;
+                const key = JSON.stringify([component, kind, to]);
+                const entry = steps.get(key) ?? { component, kind, to, envs: [] };
+                if (!entry.envs.includes(t.env))
+                    entry.envs.push(t.env);
+                steps.set(key, entry);
+            }
+        }
+    }
+    return {
+        commit: p.commit,
+        member: p.member,
+        label: req.label,
+        releaseDigest,
+        alreadyCut,
+        targets: targets.map((t) => ({ env: t.env, params: t.params, templates: t.templates.map(({ component, path }) => ({ component, path })) })),
+        build,
+        reused: p.reused,
+        publishSteps: [...steps.values()],
+        signatureRequired: p.releaseRule.requirement !== null,
+    };
+}
+/**
+ * Cut a release of the member at `req.cwd` from its checkout's `HEAD`. Writes
+ * the release and the cut to the local `chant/lifecycle` branch and does not
+ * push. Throws {@link ReleaseCutError} before anything is written when the
+ * commit isn't green, the tree is dirty, or an environment can't be compiled
+ * to the same artifacts, and `ReleaseLabelError` (./release-store.ts) when the
+ * label is taken or the release already carries another one.
+ *
+ * The cut line names its run (#4027): the CI run's id and origin in CI, and
+ * outside CI an id minted from the cut's time, `local-<epoch ms>`, with the
+ * origin `{ forge: "local" }`.
+ */
+export async function cutRelease(req) {
+    const p = await prepare(req);
+    const { cwd, commit, compiled, releaseRule, reused } = p;
+    const artifacts = [...p.carried];
+    for (const env of p.envs) {
+        const names = p.toBuild.get(env);
+        if (names)
+            artifacts.push(...(await req.compiler.buildArtifacts(env, names)));
+    }
+    const { targets, templates } = targetsOf(compiled);
+    const release = makeRelease({ member: p.member, commit, artifactDigests: artifacts, targets });
     const timestamp = (req.now ?? (() => new Date()))().toISOString();
     const signed = { releaseDigest: release.releaseDigest, label: req.label, actor: req.actor, timestamp };
     let signature = null;
@@ -260,7 +352,8 @@ export async function cutRelease(req) {
         label: req.label,
         actor: req.actor,
         timestamp,
-        runOrigin: ci?.runOrigin ?? null,
+        runId: ci?.runId ?? `local-${Date.parse(timestamp)}`,
+        runOrigin: ci?.runOrigin ?? { forge: "local" },
         signature,
     }, { cwd });
     return {

package/dist/lifecycle/release-join.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Join a commit, a release, its gates and its deploy records through the
+ * release digest (#4043, ws-104).
+ *
+ * The records already name one another. A release file holds its `commit`; a
+ * release gate's pending fact and resolution hold the `releaseDigest`; a deploy
+ * record holds the `releaseDigest` when the deploy was made from a release.
+ * From any one of the four, the others are one lookup away:
+ *
+ *   commit  to releases      `_releases/*.json` `commit`
+ *   release to gates         `releaseDigest` on the records of `_gates/release.jsonl`
+ *   release to deploys       `releaseDigest` on the records of every `<env>/releases.jsonl`
+ *
+ * This is the one place that does it, for the readers that need the chain
+ * (the why chain of #4023, behold). Release plus a deploy record's `env`
+ * names the release target.
+ *
+ * Read-only. Reads the local `chant/lifecycle` branch; fetch it first for the
+ * remote's records. A release digest or commit that nothing recorded joins to
+ * an empty list rather than an error.
+ */
+import { type GateResolutionRecord, type PendingGateRecord } from "./gate-ledger.js";
+import { type ReleaseRecord } from "./release-ledger.js";
+import { type Release, type ReleaseCut } from "./release-store.js";
+import type { LedgerLocation } from "./git.js";
+/** Where a join starts. Each names the others one lookup away. */
+export type ReleaseJoinStart = 
+/** A full commit sha, or a prefix of at least 7 characters. Joins to every release cut from it. */
+{
+    commit: string;
+}
+/**
+ * Several full commit shas, or prefixes of at least 7 characters. Joins to
+ * every release cut from any of them, reading the ledgers once (#4023).
+ */
+ | {
+    commits: readonly string[];
+}
+/** A release's label or its `releaseDigest`. */
+ | {
+    release: string;
+}
+/**
+ * A deploy record. It joins through its `releaseDigest`; a record with none
+ * but an admission by the release gate joins through the resolution that
+ * admission names.
+ */
+ | {
+    deploy: Pick<ReleaseRecord, "releaseDigest" | "admission">;
+}
+/** A release gate's pending fact or resolution. */
+ | {
+    gate: Pick<PendingGateRecord | GateResolutionRecord, "releaseDigest">;
+};
+/** One release with everything the digest joins to it. */
+export interface JoinedRelease {
+    releaseDigest: string;
+    /** The label of the release, or null when it was cut with none. */
+    label: string | null;
+    /** The green commit the release was cut from. */
+    commit: string;
+    release: Release;
+    /** Every cut of the release, oldest first. */
+    cuts: ReleaseCut[];
+    /** The release gate's facts for this release (`_gates/release.jsonl`), oldest first. */
+    gates: {
+        pending: PendingGateRecord[];
+        resolutions: GateResolutionRecord[];
+    };
+    /** Every deploy record that names the release, across environments, oldest first: by its `releaseDigest`, or, without one, by the release gate resolution its admission names. Each record's `env` with the release names the target. */
+    deploys: ReleaseRecord[];
+}
+/** What {@link joinRelease} returns. */
+export interface ReleaseJoin {
+    /** The releases the starting point joins to: one for a release, a gate or a deploy, any number for a commit. */
+    releases: JoinedRelease[];
+    /** Why `releases` is empty, when the starting point could not be followed. Absent otherwise. */
+    reason?: string;
+}
+/** The version of the shape above, for a reader that stores it. Chant 0.124.29 and newer. */
+export declare const RELEASE_JOIN_VERSION = 1;
+/**
+ * Follow one record to the rest of its chain. Never throws for an unknown
+ * starting point; a ledger that can't be read does throw, as those readers do.
+ */
+export declare function joinRelease(from: ReleaseJoinStart, loc?: LedgerLocation): Promise<ReleaseJoin>;
+/**
+ * The release a deploy record names, over the release gate's resolutions
+ * already read: its own `releaseDigest`, else the one on the resolution its
+ * admission names. Undefined when it was not made from a release. The rule
+ * {@link joinRelease} follows, for a reader that holds the ledgers already,
+ * such as retention's garbage collection (#4036).
+ */
+export declare function releaseOfDeploy(record: Pick<ReleaseRecord, "releaseDigest" | "admission">, releaseGateResolutions: readonly Pick<GateResolutionRecord, "gate" | "timestamp" | "releaseDigest">[]): string | undefined;
+//# sourceMappingURL=release-join.d.ts.map

package/dist/lifecycle/release-join.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-join.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-join.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAkB,KAAK,oBAAoB,EAAE,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClG,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAA6C,KAAK,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC3G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAE5C,kEAAkE;AAClE,MAAM,MAAM,gBAAgB;AAC1B,mGAAmG;AACjG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE;AACpB;;;GAGG;GACD;IAAE,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE;AAChC,gDAAgD;GAC9C;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;AACrB;;;;GAIG;GACD;IAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,WAAW,CAAC,CAAA;CAAE;AAChE,mDAAmD;GACjD;IAAE,IAAI,EAAE,IAAI,CAAC,iBAAiB,GAAG,oBAAoB,EAAE,eAAe,CAAC,CAAA;CAAE,CAAC;AAE9E,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,wFAAwF;IACxF,KAAK,EAAE;QAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAAC,WAAW,EAAE,oBAAoB,EAAE,CAAA;KAAE,CAAC;IAC7E,yOAAyO;IACzO,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,gHAAgH;IAChH,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6FAA6F;AAC7F,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAItC;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,GAAE,cAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwExG;AAaD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,WAAW,CAAC,EAC1D,sBAAsB,EAAE,SAAS,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,WAAW,GAAG,eAAe,CAAC,EAAE,GACpG,MAAM,GAAG,SAAS,CAKpB"}

package/dist/lifecycle/release-join.js

@@ -0,0 +1,139 @@
+/**
+ * Join a commit, a release, its gates and its deploy records through the
+ * release digest (#4043, ws-104).
+ *
+ * The records already name one another. A release file holds its `commit`; a
+ * release gate's pending fact and resolution hold the `releaseDigest`; a deploy
+ * record holds the `releaseDigest` when the deploy was made from a release.
+ * From any one of the four, the others are one lookup away:
+ *
+ *   commit  to releases      `_releases/*.json` `commit`
+ *   release to gates         `releaseDigest` on the records of `_gates/release.jsonl`
+ *   release to deploys       `releaseDigest` on the records of every `<env>/releases.jsonl`
+ *
+ * This is the one place that does it, for the readers that need the chain
+ * (the why chain of #4023, behold). Release plus a deploy record's `env`
+ * names the release target.
+ *
+ * Read-only. Reads the local `chant/lifecycle` branch; fetch it first for the
+ * remote's records. A release digest or commit that nothing recorded joins to
+ * an empty list rather than an error.
+ */
+import { RELEASE_GATE_OP } from "../op/gate-name.js";
+import { readGateLedger } from "./gate-ledger.js";
+import { listReleaseEnvironments, readReleaseLedger } from "./release-ledger.js";
+import { labelsByDigest, readAllReleases, readCuts } from "./release-store.js";
+/** The version of the shape above, for a reader that stores it. Chant 0.124.29 and newer. */
+export const RELEASE_JOIN_VERSION = 1;
+const MIN_COMMIT_PREFIX = 7;
+/**
+ * Follow one record to the rest of its chain. Never throws for an unknown
+ * starting point; a ledger that can't be read does throw, as those readers do.
+ */
+export async function joinRelease(from, loc = {}) {
+    const { releases } = await readAllReleases(loc);
+    const { cuts } = await readCuts(loc);
+    const labels = labelsByDigest(cuts);
+    let digests;
+    let reason;
+    if ("commit" in from) {
+        const sha = from.commit.toLowerCase();
+        if (sha.length < MIN_COMMIT_PREFIX) {
+            return { releases: [], reason: `a commit needs at least ${MIN_COMMIT_PREFIX} characters to join on` };
+        }
+        digests = releases.filter((r) => r.commit.toLowerCase().startsWith(sha)).map((r) => r.releaseDigest);
+        if (digests.length === 0)
+            reason = `no release was cut from commit ${from.commit}`;
+    }
+    else if ("commits" in from) {
+        const shas = from.commits.map((c) => c.toLowerCase());
+        if (shas.some((sha) => sha.length < MIN_COMMIT_PREFIX)) {
+            return { releases: [], reason: `a commit needs at least ${MIN_COMMIT_PREFIX} characters to join on` };
+        }
+        digests = releases.filter((r) => shas.some((sha) => r.commit.toLowerCase().startsWith(sha))).map((r) => r.releaseDigest);
+        if (digests.length === 0)
+            reason = shas.length === 0 ? "no commit was given to join on" : `no release was cut from ${shas.length === 1 ? `commit ${from.commits[0]}` : `any of ${shas.length} commits`}`;
+    }
+    else if ("release" in from) {
+        const ref = from.release;
+        const byDigest = releases.find((r) => r.releaseDigest === ref);
+        const byLabel = [...labels].find(([, label]) => label === ref)?.[0];
+        const found = byDigest?.releaseDigest ?? byLabel;
+        digests = found ? [found] : [];
+        if (digests.length === 0)
+            reason = `no release is labelled or digested "${ref}"`;
+    }
+    else if ("deploy" in from) {
+        const digest = from.deploy.releaseDigest ?? (await releaseOfAdmission(from.deploy.admission, loc));
+        digests = digest ? [digest] : [];
+        if (digests.length === 0)
+            reason = "the deploy record names no release: it was not made from one";
+    }
+    else {
+        const digest = from.gate.releaseDigest;
+        digests = digest ? [digest] : [];
+        if (digests.length === 0)
+            reason = "the gate binds no release: it is not a release gate";
+    }
+    const known = new Map(releases.map((r) => [r.releaseDigest, r]));
+    const wanted = [...new Set(digests)].filter((d) => known.has(d));
+    if (digests.length > 0 && wanted.length === 0)
+        reason = `release ${digests[0]} is named but its file is not on this checkout's chant/lifecycle`;
+    if (wanted.length === 0)
+        return { releases: [], ...(reason ? { reason } : {}) };
+    const gateLedger = await readGateLedger(RELEASE_GATE_OP, loc);
+    // A record names its release by `releaseDigest`, or, with none, through the
+    // release gate resolution its admission names (#4045), as releaseOfDeploy reads it.
+    const records = [];
+    for (const env of await listReleaseEnvironments(loc)) {
+        for (const record of (await readReleaseLedger(env, loc)).records) {
+            const digest = releaseOfDeploy(record, gateLedger.resolutions);
+            if (digest !== undefined && wanted.includes(digest))
+                records.push({ record, digest });
+        }
+    }
+    const byTime = (a, b) => (a.timestamp < b.timestamp ? -1 : a.timestamp > b.timestamp ? 1 : 0);
+    return {
+        releases: wanted.map((digest) => {
+            const release = known.get(digest);
+            return {
+                releaseDigest: digest,
+                label: labels.get(digest) ?? null,
+                commit: release.commit,
+                release,
+                cuts: cuts.filter((c) => c.releaseDigest === digest),
+                gates: {
+                    pending: gateLedger.pending.filter((p) => p.releaseDigest === digest),
+                    resolutions: gateLedger.resolutions.filter((r) => r.releaseDigest === digest),
+                },
+                deploys: records.filter((r) => r.digest === digest).map((r) => r.record).sort(byTime),
+            };
+        }),
+    };
+}
+/**
+ * The release a deploy record's admission names, when the record itself has no
+ * `releaseDigest`: the resolution it points at, in the release gate's ledger,
+ * carries one (#4045).
+ */
+async function releaseOfAdmission(admission, loc) {
+    if (!admission || admission.op !== RELEASE_GATE_OP)
+        return undefined;
+    const { resolutions } = await readGateLedger(RELEASE_GATE_OP, loc);
+    return releaseOfDeploy({ admission }, resolutions);
+}
+/**
+ * The release a deploy record names, over the release gate's resolutions
+ * already read: its own `releaseDigest`, else the one on the resolution its
+ * admission names. Undefined when it was not made from a release. The rule
+ * {@link joinRelease} follows, for a reader that holds the ledgers already,
+ * such as retention's garbage collection (#4036).
+ */
+export function releaseOfDeploy(record, releaseGateResolutions) {
+    if (record.releaseDigest !== undefined)
+        return record.releaseDigest;
+    const admission = record.admission;
+    if (!admission || admission.op !== RELEASE_GATE_OP)
+        return undefined;
+    return releaseGateResolutions.find((r) => r.gate === admission.gate && r.timestamp === admission.resolvedAt && r.releaseDigest !== undefined)?.releaseDigest;
+}

package/dist/lifecycle/release-ledger.d.ts

@@ -41,15 +41,20 @@ export interface RunOrigin {
      * Which id space minted `runId`: `github` (a GitHub Actions run id — also
      * the spelling Forgejo Actions uses, since it implements the same env
      * contract; `url` disambiguates the actual host), `gitlab` (a CI pipeline
-     * id), `op` (an orchestrator/Op run id), or `local` (minted on the machine
-     * that ran the deploy, resolvable nowhere).
+     * id), `op` (an orchestrator/Op run id), `local` (minted on the machine
+     * that ran the deploy, resolvable nowhere), or `chant` (a job the chant
+     * runner ran, `chant ci run`, #4094, named by its Op run id). `chant` was
+     * added within contract 1 by {@link RUN_ORIGIN_CHANT_FLOOR}, so a reader
+     * that switches on `forge` keeps a case for a value it does not know.
      */
-    forge: "github" | "gitlab" | "op" | "local";
+    forge: "github" | "gitlab" | "op" | "local" | "chant";
     /** Repo/project slug on the forge (`GITHUB_REPOSITORY` / `CI_PROJECT_PATH`), when the environment named one. */
     repo?: string;
     /** Resolved link to the run, when the environment provided enough to build one. */
     url?: string;
 }
+/** The first chant that writes `runOrigin.forge: "chant"`, for a job `chant ci run` ran (#4094). */
+export declare const RUN_ORIGIN_CHANT_FLOOR = "0.124.30";
 /**
  * The gate resolution that admitted a deploy (#4020): the gate's address in the
  * gate ledger (`_gates/<op>.jsonl`, `op` and `gate`) and when the resolution

package/dist/lifecycle/release-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAyC,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAwG,KAAK,cAAc,EAAE,MAAM,OAAO,CAAC;AAElJ,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC9I,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;OAMG;IACH,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAC5C,gHAAgH;IAChH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6FAA6F;IAC7F,EAAE,EAAE,MAAM,CAAC;IACX,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,oIAAoI;IACpI,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,gBAAgB,CAAA;CAAE,GAAG,SAAS,CAO/D;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iOAAiO;IACjO,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;IAA7C,YAA4B,OAAO,EAAE,MAAM,EAAE,EAG5C;CACF;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,CAQ1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,SAAS,CAyBtH;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CASpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAS1D;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}
+{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAyC,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAwG,KAAK,cAAc,EAAE,MAAM,OAAO,CAAC;AAElJ,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC9I,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;OASG;IACH,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC;IACtD,gHAAgH;IAChH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oGAAoG;AACpG,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6FAA6F;IAC7F,EAAE,EAAE,MAAM,CAAC;IACX,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,oIAAoI;IACpI,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,gBAAgB,CAAA;CAAE,GAAG,SAAS,CAO/D;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iOAAiO;IACjO,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;IAA7C,YAA4B,OAAO,EAAE,MAAM,EAAE,EAG5C;CACF;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,CAQ1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,SAAS,CAyBtH;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CASpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAS1D;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}

package/dist/lifecycle/release-ledger.js

@@ -33,6 +33,8 @@ import { appendReleaseRecordLine, readReleaseLedgerLines, listLedgerEnvironments
 import { parseReleaseLedger, validateReleaseRecord } from "./release-read.js";
 // The pure readers live apart, so a bundle can import them without git (#3865).
 export { validateReleaseRecord, parseReleaseLedger, releaseLedgerLines, readReleaseRecords, listReleaseEnvironmentsOn } from "./release-read.js";
+/** The first chant that writes `runOrigin.forge: "chant"`, for a job `chant ci run` ran (#4094). */
+export const RUN_ORIGIN_CHANT_FLOOR = "0.124.30";
 /**
  * The approver and admission a release records for the resolutions of its gate
  * (#4020): those of `gate` on `op` bound to `planDigest`. The approver is the