@intentius/chant 0.124.31 → 0.124.33

package/dist/lifecycle/release-store.js

@@ -14,6 +14,7 @@
  *   _releases/<releaseDigest>.json      the release, written once and never rewritten
  *   _releases/cuts.jsonl                one line per cut, with the release's label
  *   _releases/templates/<digest>.txt    each template's bytes, by content digest
+ *   _releases/templates/<digest>.b64    a file that is not UTF-8, base64 (#4155)
  *
  * `:` is written as `_` in file names, as `_plans/` and `_builds/` do. A
  * workspace member's copy sits under `_members/<member>/` through the same
@@ -24,6 +25,14 @@
  * (ws-104 question 5). They are named by content digest, so a template that
  * two environments or two releases share is stored once.
  *
+ * Since #4155 a cut records every local file a deploy step deploys from, not
+ * only `template`, `manifest` and `values` files: a chart, a kustomize
+ * directory, a site's tree. A directory is recorded as one template per file
+ * under it, and named in the target's `trees`, so a promote deploys the
+ * recorded tree. A target with `trees` is one such cut; a target without the
+ * field was cut before #4155, and a promote of it reads directories and the
+ * other fields from the checkout, as it did then.
+ *
  * `releaseDigest` is `computePlanDigest("release", subject)` over the member,
  * the commit, the artifact digests and each target's env, templates and the
  * name and value of each param. A param's `source`, the label, the actor, the
@@ -31,7 +40,7 @@
  * same digest.
  */
 import { sortedJsonReplacer } from "../utils.js";
-import { contentDigest } from "../content-digest.js";
+import { contentDigest, sha256Hex } from "../content-digest.js";
 import { computePlanDigest } from "./plan-digest.js";
 import { ledgerDir, listFilesInDir, readBlobBySha, readBlobFromPath, readPathSha, RefCASConflictError, writeLedgerFiles, } from "./git.js";
 /** The directory on `chant/lifecycle` that holds releases, cuts and template bytes. */
@@ -54,9 +63,12 @@ export function normalizeRelease(release) {
             .map((t) => ({
             env: t.env,
             templates: [...t.templates]
-                .map(({ component, path, digest }) => ({ component, path, digest }))
+                .map(({ component, path, digest, encoding }) => ({ component, path, digest, ...(encoding ? { encoding } : {}) }))
                 .sort((a, b) => byString(a.component ?? "", b.component ?? "") || byString(a.path, b.path)),
             params: [...t.params].map(({ name, value, source }) => ({ name, value, source })).sort((a, b) => byString(a.name, b.name)),
+            ...(t.trees
+                ? { trees: [...t.trees].map(({ component, path }) => ({ component, path })).sort((a, b) => byString(a.component ?? "", b.component ?? "") || byString(a.path, b.path)) }
+                : {}),
         }))
             .sort((a, b) => byString(a.env, b.env)),
     };
@@ -68,7 +80,12 @@ export function releaseHashInput(release) {
         member: n.member,
         commit: n.commit,
         artifactDigests: n.artifactDigests,
-        targets: n.targets.map((t) => ({ env: t.env, templates: t.templates, params: t.params.map(({ name, value }) => ({ name, value })) })),
+        targets: n.targets.map((t) => ({
+            env: t.env,
+            templates: t.templates,
+            params: t.params.map(({ name, value }) => ({ name, value })),
+            ...(t.trees ? { trees: t.trees } : {}),
+        })),
     };
 }
 /** `computePlanDigest("release", input)` over {@link releaseHashInput}. */
@@ -86,7 +103,11 @@ export function verifyReleaseDigest(release) {
 }
 const stem = (digest) => digest.replace(/:/g, "_");
 const releaseFile = (digest) => `${stem(digest)}.json`;
-const templateFile = (digest) => `${stem(digest)}.txt`;
+const templateFile = (digest, encoding) => `${stem(digest)}.${encoding === "base64" ? "b64" : "txt"}`;
+/** The digest of a template's bytes: its text, or what its base64 decodes to. */
+export function templateBytesDigest(content, encoding) {
+    return encoding === "base64" ? `sha256:${sha256Hex(Buffer.from(content, "base64"))}` : contentDigest(content);
+}
 /** A label names a release in commands such as `chant release cut <label>`, so it is one plain word. */
 const LABEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
 /** Why a label can't be used, or undefined when it can. */
@@ -113,7 +134,7 @@ export async function persistRelease(release, templates, opts) {
         throw new Error(`release ${release.releaseDigest} does not hash to its own digest; refusing to store it`);
     }
     for (const t of templates) {
-        if (contentDigest(t.content) !== t.digest)
+        if (templateBytesDigest(t.content, t.encoding) !== t.digest)
             throw new Error(`template bytes do not hash to ${t.digest}; refusing to store them`);
     }
     const dir = await ledgerDir(RELEASES_DIR, opts);
@@ -124,12 +145,13 @@ export async function persistRelease(release, templates, opts) {
         files.push({ path: releasePath, content: `${JSON.stringify(release, sortedJsonReplacer)}\n`, expectPriorSha: null });
     const seen = new Set();
     for (const t of templates) {
-        if (seen.has(t.digest))
+        const file = templateFile(t.digest, t.encoding);
+        if (seen.has(file))
             continue;
-        seen.add(t.digest);
-        if ((await readPathSha(`${RELEASES_DIR}/${TEMPLATES_SUBDIR}`, templateFile(t.digest), opts)) !== null)
+        seen.add(file);
+        if ((await readPathSha(`${RELEASES_DIR}/${TEMPLATES_SUBDIR}`, file, opts)) !== null)
             continue;
-        files.push({ path: `${dir}/${TEMPLATES_SUBDIR}/${templateFile(t.digest)}`, content: t.content, expectPriorSha: null });
+        files.push({ path: `${dir}/${TEMPLATES_SUBDIR}/${file}`, content: t.content, expectPriorSha: null });
     }
     if (files.length === 0)
         return { commit: null, written: false };
@@ -166,7 +188,12 @@ export function parseRelease(text) {
         r.targets.every((t) => t &&
             typeof t.env === "string" &&
             Array.isArray(t.templates) &&
-            t.templates.every((x) => x && (x.component === null || typeof x.component === "string") && typeof x.path === "string" && typeof x.digest === "string") &&
+            t.templates.every((x) => x &&
+                (x.component === null || typeof x.component === "string") &&
+                typeof x.path === "string" &&
+                typeof x.digest === "string" &&
+                (x.encoding === undefined || x.encoding === "base64")) &&
+            (t.trees === undefined || (Array.isArray(t.trees) && t.trees.every((x) => x && (x.component === null || typeof x.component === "string") && typeof x.path === "string"))) &&
             Array.isArray(t.params) &&
             t.params.every((p) => p && typeof p.name === "string" && ["string", "number", "boolean"].includes(typeof p.value) && typeof p.source === "string"));
     return ok ? r : null;
@@ -297,9 +324,9 @@ export async function appendCut(input, opts) {
     }
     throw lastErr;
 }
-/** A template's bytes by digest, or null when none is stored. */
-export async function readReleaseTemplate(digest, opts) {
-    return readBlobFromPath(`${RELEASES_DIR}/${TEMPLATES_SUBDIR}`, templateFile(digest), opts);
+/** A template's bytes by digest, or null when none is stored. Under `base64` (#4155), the stored base64 of the bytes. */
+export async function readReleaseTemplate(digest, opts, encoding) {
+    return readBlobFromPath(`${RELEASES_DIR}/${TEMPLATES_SUBDIR}`, templateFile(digest, encoding), opts);
 }
 /**
  * Find a release by its digest or its label. Null when neither names one.

package/dist/lifecycle/run-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAA+C,MAAM,eAAe,CAAC;AASrI,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjC,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,CAiDlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCxD"}
+{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAA+C,MAAM,eAAe,CAAC;AASrI,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjC,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,CAkDlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCxD"}

package/dist/lifecycle/run-ledger.js

@@ -91,6 +91,7 @@ export function buildRunRecord(config, records, times) {
             ...(record.point ? { point: record.point } : {}),
             ...(record.gate ? { gate: record.gate } : {}),
             ...(record.resumed ? { resumed: record.resumed } : {}),
+            ...(record.fn === "shellCmd" && typeof record.args?.image === "string" ? { image: record.args.image } : {}),
         });
         if (record.outcome)
             outcomes[record.outcome.name] = record.outcome.value;

package/dist/lifecycle/work-dir.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Where an Op that changes the checkout makes its work worktrees (#2893).
+ *
+ * A work item's worktree is `<checkout>/.chant/work/[<member>/]<item>`. It
+ * sits inside the checkout, so a coding agent whose project root is the
+ * checkout may write there, and `node_modules` above it still resolves. It
+ * used to be `<git-common-dir>/chant-work/...`, where Claude Code refuses
+ * every write. `/.chant/work/` goes in `<git-common-dir>/info/exclude`, so the
+ * checkout's `git status` never lists it, and the rest of `.chant/` (the
+ * workspace lock, the factory's check logs) stays tracked.
+ *
+ * This module imports nothing from the workspace or the Op runner, so the
+ * hand-written walkers can ask it which directory to skip.
+ */
+/** The work directory, relative to a checkout's top, `/`-separated. */
+export declare const WORK_DIR = ".chant/work";
+/** The line `<git-common-dir>/info/exclude` gets, anchored at each checkout's top. */
+export declare const WORK_DIR_EXCLUDE = "/.chant/work/";
+/** The directory where earlier versions made work worktrees, under the git common directory. */
+export declare const LEGACY_WORK_DIR = "chant-work";
+/**
+ * Whether a directory, given as a `/`-separated path relative to the root a
+ * walker started from, is a work directory: `.chant/work` at that root or at
+ * any depth below it. A walker skips it, since each worktree in it is a whole
+ * copy of the checkout.
+ */
+export declare function isWorkDir(rel: string): boolean;
+/** The worktree for `id` under the checkout whose top is `top`. */
+export declare function workWorktreePath(top: string, members: readonly string[], id: string): string;
+/** The worktree an earlier version made for `id`, under the git common directory. */
+export declare function legacyWorkWorktreePath(commonDir: string, members: readonly string[], id: string): string;
+/**
+ * Add {@link WORK_DIR_EXCLUDE} to `<commonDir>/info/exclude` unless the file
+ * already has it, or `ignored` says git already ignores the work directory
+ * (a `.gitignore` of the project's, or the global excludes file). Returns
+ * whether it wrote the line.
+ */
+export declare function excludeWorkDir(commonDir: string, ignored: boolean): boolean;
+/**
+ * After a work worktree is removed, remove the directories above it that are
+ * left empty, up to and including the checkout's `.chant`, so a run leaves
+ * nothing behind in a checkout that had no `.chant` before it.
+ */
+export declare function removeEmptyWorkDirs(worktree: string): void;
+//# sourceMappingURL=work-dir.d.ts.map

package/dist/lifecycle/work-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-dir.d.ts","sourceRoot":"","sources":["../../src/lifecycle/work-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,uEAAuE;AACvE,eAAO,MAAM,QAAQ,gBAAgB,CAAC;AAEtC,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,gGAAgG;AAChG,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9C;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED,qFAAqF;AACrF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAExG;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAa1D"}

package/dist/lifecycle/work-dir.js

@@ -0,0 +1,78 @@
+/**
+ * Where an Op that changes the checkout makes its work worktrees (#2893).
+ *
+ * A work item's worktree is `<checkout>/.chant/work/[<member>/]<item>`. It
+ * sits inside the checkout, so a coding agent whose project root is the
+ * checkout may write there, and `node_modules` above it still resolves. It
+ * used to be `<git-common-dir>/chant-work/...`, where Claude Code refuses
+ * every write. `/.chant/work/` goes in `<git-common-dir>/info/exclude`, so the
+ * checkout's `git status` never lists it, and the rest of `.chant/` (the
+ * workspace lock, the factory's check logs) stays tracked.
+ *
+ * This module imports nothing from the workspace or the Op runner, so the
+ * hand-written walkers can ask it which directory to skip.
+ */
+import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmdirSync } from "node:fs";
+import { dirname, join, sep } from "node:path";
+/** The work directory, relative to a checkout's top, `/`-separated. */
+export const WORK_DIR = ".chant/work";
+/** The line `<git-common-dir>/info/exclude` gets, anchored at each checkout's top. */
+export const WORK_DIR_EXCLUDE = `/${WORK_DIR}/`;
+/** The directory where earlier versions made work worktrees, under the git common directory. */
+export const LEGACY_WORK_DIR = "chant-work";
+/**
+ * Whether a directory, given as a `/`-separated path relative to the root a
+ * walker started from, is a work directory: `.chant/work` at that root or at
+ * any depth below it. A walker skips it, since each worktree in it is a whole
+ * copy of the checkout.
+ */
+export function isWorkDir(rel) {
+    return rel === WORK_DIR || rel.endsWith(`/${WORK_DIR}`);
+}
+/** The worktree for `id` under the checkout whose top is `top`. */
+export function workWorktreePath(top, members, id) {
+    return join(top, ...WORK_DIR.split("/"), ...members, id);
+}
+/** The worktree an earlier version made for `id`, under the git common directory. */
+export function legacyWorkWorktreePath(commonDir, members, id) {
+    return join(commonDir, LEGACY_WORK_DIR, ...members, id);
+}
+/**
+ * Add {@link WORK_DIR_EXCLUDE} to `<commonDir>/info/exclude` unless the file
+ * already has it, or `ignored` says git already ignores the work directory
+ * (a `.gitignore` of the project's, or the global excludes file). Returns
+ * whether it wrote the line.
+ */
+export function excludeWorkDir(commonDir, ignored) {
+    const file = join(commonDir, "info", "exclude");
+    const text = existsSync(file) ? readFileSync(file, "utf-8") : "";
+    if (text.split(/\r?\n/).some((l) => l.trim() === WORK_DIR_EXCLUDE))
+        return false;
+    if (ignored)
+        return false;
+    mkdirSync(join(commonDir, "info"), { recursive: true });
+    appendFileSync(file, `${text === "" || text.endsWith("\n") ? "" : "\n"}${WORK_DIR_EXCLUDE}\n`);
+    return true;
+}
+/**
+ * After a work worktree is removed, remove the directories above it that are
+ * left empty, up to and including the checkout's `.chant`, so a run leaves
+ * nothing behind in a checkout that had no `.chant` before it.
+ */
+export function removeEmptyWorkDirs(worktree) {
+    const marker = `${sep}${WORK_DIR.split("/").join(sep)}${sep}`;
+    const at = worktree.lastIndexOf(marker);
+    if (at < 0)
+        return;
+    const stop = worktree.slice(0, at);
+    for (let dir = dirname(worktree); dir.length > stop.length; dir = dirname(dir)) {
+        try {
+            if (readdirSync(dir).length > 0)
+                return;
+            rmdirSync(dir);
+        }
+        catch {
+            return;
+        }
+    }
+}

package/dist/lint/discover.d.ts

@@ -1,17 +1,20 @@
 /**
  * Auto-discovery for lint rules and post-synth checks.
  *
- * Scans directories for .ts files and loads exported rules/checks,
- * eliminating the need to manually list every rule in plugin.ts.
+ * Scans directories for rule modules and loads exported rules/checks,
+ * eliminating the need to manually list every rule in plugin.ts. A lexicon
+ * run from source has `.ts` rule modules; one run compiled has `.js` modules
+ * beside `.d.ts` declarations (#3981). Both are found, and tsx is registered
+ * only when a module found is TypeScript.
  */
 import type { LintRule } from "./rule.js";
 import type { PostSynthCheck } from "./post-synth.js";
 /**
  * Discover lint rules from a directory.
  *
- * Scans the directory for .ts files (excluding tests, helpers, and index files),
- * loads each module, and collects any exported objects that look like a LintRule
- * (has `id`, `severity`, `category`, and `check` function).
+ * Scans the directory for rule modules (see {@link listRuleFiles}), loads
+ * each one, and collects any exported objects that look like a LintRule (has
+ * `id`, `severity`, `category`, and `check` function).
  *
  * @param dir - Absolute path to the rules directory
  * @param importMetaUrl - The caller's import.meta.url (for createRequire)
@@ -20,16 +23,21 @@ export declare function discoverLintRules(dir: string, importMetaUrl: string): L
 /**
  * Discover post-synth checks from a directory.
  *
- * Scans the directory for .ts files (excluding tests, helpers, and index files),
- * loads each module, and collects any exported objects that look like a PostSynthCheck
- * (has `id`, `description`, and `check` function).
+ * Scans the directory for rule modules (see {@link listRuleFiles}), loads
+ * each one, and collects any exported objects that look like a
+ * PostSynthCheck (has `id`, `description`, and `check` function).
  *
  * @param dir - Absolute path to the post-synth rules directory
  * @param importMetaUrl - The caller's import.meta.url (for createRequire)
  */
 export declare function discoverPostSynthChecks(dir: string, importMetaUrl: string): PostSynthCheck[];
+/** A rule module's name without its extension: `foo` for `foo.ts` and `foo.js`. */
+export declare function ruleModuleBase(file: string): string;
 /**
- * List rule files in a directory (excluding tests, helpers, index).
+ * List rule modules in a directory: `.ts` source or compiled `.js`, leaving
+ * out declarations (`.d.ts`), tests, helpers and the index. A directory
+ * holding both `foo.ts` and `foo.js` lists `foo.ts` alone, so a rule is
+ * never loaded twice.
  */
 export declare function listRuleFiles(dir: string): string[];
 //# sourceMappingURL=discover.d.ts.map

package/dist/lint/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/lint/discover.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AA8BnD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,QAAQ,EAAE,CAmBhF;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,EAAE,CAmB5F;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAYnD"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/lint/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAsDnD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,QAAQ,EAAE,CAEhF;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,EAAE,CAE5F;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBnD"}

package/dist/lint/discover.js

@@ -1,13 +1,17 @@
 /**
  * Auto-discovery for lint rules and post-synth checks.
  *
- * Scans directories for .ts files and loads exported rules/checks,
- * eliminating the need to manually list every rule in plugin.ts.
+ * Scans directories for rule modules and loads exported rules/checks,
+ * eliminating the need to manually list every rule in plugin.ts. A lexicon
+ * run from source has `.ts` rule modules; one run compiled has `.js` modules
+ * beside `.d.ts` declarations (#3981). Both are found, and tsx is registered
+ * only when a module found is TypeScript.
  */
 import { readdirSync } from "fs";
 import { join } from "path";
 import { createRequire } from "module";
 import { ensureTypeScriptLoader } from "../ts-loader.js";
+import { isTypeScriptModule } from "../module-source.js";
 let cjsTypeScript = false;
 /**
  * Register tsx so createRequire can load TypeScript files in Node.js ESM
@@ -17,7 +21,8 @@ let cjsTypeScript = false;
  * From source this runs when the module loads, as it always has: vitest and
  * the source CLI rely on tsx's CommonJS hook being in place from then on. The
  * compiled CLI imports this module on every start and most commands read no
- * rule directory, so there it waits for the first one (#3878).
+ * rule directory, so there it waits for the first directory that holds a
+ * TypeScript rule module (#3878, #3981).
  */
 function registerTypeScriptRequire() {
     if (cjsTypeScript)
@@ -37,85 +42,88 @@ function registerTypeScriptRequire() {
 if (!import.meta.url.endsWith(".js"))
     registerTypeScriptRequire();
 /**
- * Discover lint rules from a directory.
- *
- * Scans the directory for .ts files (excluding tests, helpers, and index files),
- * loads each module, and collects any exported objects that look like a LintRule
- * (has `id`, `severity`, `category`, and `check` function).
- *
- * @param dir - Absolute path to the rules directory
- * @param importMetaUrl - The caller's import.meta.url (for createRequire)
+ * Load every rule module in `dir` and collect the exports `accept` takes.
+ * Registers tsx first only when one of the modules is TypeScript.
  */
-export function discoverLintRules(dir, importMetaUrl) {
-    registerTypeScriptRequire();
+function discoverExports(dir, importMetaUrl, accept) {
+    const files = listRuleFiles(dir);
+    if (files.some(isTypeScriptModule))
+        registerTypeScriptRequire();
     const require = createRequire(importMetaUrl);
-    const rules = [];
-    for (const file of listRuleFiles(dir)) {
+    const found = [];
+    for (const file of files) {
         try {
-            // Strip .ts extension — require() resolves without it
-            const modPath = join(dir, file.replace(/\.ts$/, ""));
-            const mod = require(modPath);
+            const mod = require(join(dir, file));
             for (const exp of Object.values(mod)) {
-                if (isLintRule(exp))
-                    rules.push(exp);
+                if (accept(exp))
+                    found.push(exp);
             }
         }
         catch {
             // Skip files that fail to load
         }
     }
-    return rules.sort((a, b) => a.id.localeCompare(b.id));
+    return found;
+}
+/**
+ * Discover lint rules from a directory.
+ *
+ * Scans the directory for rule modules (see {@link listRuleFiles}), loads
+ * each one, and collects any exported objects that look like a LintRule (has
+ * `id`, `severity`, `category`, and `check` function).
+ *
+ * @param dir - Absolute path to the rules directory
+ * @param importMetaUrl - The caller's import.meta.url (for createRequire)
+ */
+export function discoverLintRules(dir, importMetaUrl) {
+    return discoverExports(dir, importMetaUrl, isLintRule).sort((a, b) => a.id.localeCompare(b.id));
 }
 /**
  * Discover post-synth checks from a directory.
  *
- * Scans the directory for .ts files (excluding tests, helpers, and index files),
- * loads each module, and collects any exported objects that look like a PostSynthCheck
- * (has `id`, `description`, and `check` function).
+ * Scans the directory for rule modules (see {@link listRuleFiles}), loads
+ * each one, and collects any exported objects that look like a
+ * PostSynthCheck (has `id`, `description`, and `check` function).
  *
  * @param dir - Absolute path to the post-synth rules directory
  * @param importMetaUrl - The caller's import.meta.url (for createRequire)
  */
 export function discoverPostSynthChecks(dir, importMetaUrl) {
-    registerTypeScriptRequire();
-    const require = createRequire(importMetaUrl);
-    const checks = [];
-    for (const file of listRuleFiles(dir)) {
-        try {
-            // Strip .ts extension — require() resolves without it
-            const modPath = join(dir, file.replace(/\.ts$/, ""));
-            const mod = require(modPath);
-            for (const exp of Object.values(mod)) {
-                if (isPostSynthCheck(exp))
-                    checks.push(exp);
-            }
-        }
-        catch {
-            // Skip files that fail to load
-        }
-    }
-    return checks.sort((a, b) => a.id.localeCompare(b.id));
+    return discoverExports(dir, importMetaUrl, isPostSynthCheck).sort((a, b) => a.id.localeCompare(b.id));
+}
+/** A rule module's name without its extension: `foo` for `foo.ts` and `foo.js`. */
+export function ruleModuleBase(file) {
+    return file.replace(/\.(?:ts|js)$/, "");
 }
 /**
- * List rule files in a directory (excluding tests, helpers, index).
+ * List rule modules in a directory: `.ts` source or compiled `.js`, leaving
+ * out declarations (`.d.ts`), tests, helpers and the index. A directory
+ * holding both `foo.ts` and `foo.js` lists `foo.ts` alone, so a rule is
+ * never loaded twice.
  */
 export function listRuleFiles(dir) {
+    let entries;
     try {
-        return readdirSync(dir).filter((f) => {
-            if (!f.endsWith(".ts"))
-                return false;
-            if (f.endsWith(".test.ts"))
-                return false;
-            if (f === "index.ts")
-                return false;
-            if (f.includes("helper"))
-                return false;
-            return true;
-        });
+        entries = readdirSync(dir);
     }
     catch {
         return [];
     }
+    const modules = entries.filter((f) => {
+        if (!f.endsWith(".ts") && !f.endsWith(".js"))
+            return false;
+        if (f.endsWith(".d.ts"))
+            return false;
+        if (/\.test\.[tj]s$/.test(f))
+            return false;
+        if (f === "index.ts" || f === "index.js")
+            return false;
+        if (f.includes("helper"))
+            return false;
+        return true;
+    });
+    const sources = new Set(modules.filter((f) => f.endsWith(".ts")).map(ruleModuleBase));
+    return modules.filter((f) => f.endsWith(".ts") || !sources.has(ruleModuleBase(f)));
 }
 function isLintRule(obj) {
     if (typeof obj !== "object" || obj === null)

package/dist/lint/rules/op/index.d.ts

@@ -16,6 +16,7 @@ export { ops014 } from "./ops014-converge-rule-refusals.js";
 export { ops015 } from "./ops015-gate-approval.js";
 export { ops016 } from "./ops016-gate-resume.js";
 export { ops017, ops017Check, workspaceIdentityGates } from "./ops017-gate-alias.js";
+export { ops018 } from "./ops018-shell-image-digest.js";
 export { sys010, sys010Check } from "./sys010-key-over-plain-http.js";
 export interface CoreOpCheckOptions {
     /** `decide.backends` from the project's chant.config, for SYS010 (#2828). */
@@ -25,7 +26,7 @@ export interface CoreOpCheckOptions {
 }
 /**
  * Core's own post-synth checks over the Op model: OPS012, OPS013, OPS014,
- * OPS015, OPS016, OPS017 over the workspace's `identity.gates`, and SYS010
+ * OPS015, OPS016, OPS017 over the workspace's `identity.gates`, OPS018, and SYS010
  * over the `decide` steps and the configured decide backends.
  */
 export declare function coreOpChecks(opts?: CoreOpCheckOptions): PostSynthCheck[];

package/dist/lint/rules/op/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAQvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;IACpE,6GAA6G;IAC7G,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,kBAAuB,GAAG,cAAc,EAAE,CAE5E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AASvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;IACpE,6GAA6G;IAC7G,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,kBAAuB,GAAG,cAAc,EAAE,CAE5E"}

package/dist/lint/rules/op/index.js

@@ -14,6 +14,7 @@ import { ops014 } from "./ops014-converge-rule-refusals.js";
 import { ops015 } from "./ops015-gate-approval.js";
 import { ops016 } from "./ops016-gate-resume.js";
 import { ops017Check } from "./ops017-gate-alias.js";
+import { ops018 } from "./ops018-shell-image-digest.js";
 import { sys010Check } from "./sys010-key-over-plain-http.js";
 export { ops012 } from "./ops012-activity-contract.js";
 export { ops013 } from "./ops013-step-output-ref.js";
@@ -21,12 +22,13 @@ export { ops014 } from "./ops014-converge-rule-refusals.js";
 export { ops015 } from "./ops015-gate-approval.js";
 export { ops016 } from "./ops016-gate-resume.js";
 export { ops017, ops017Check, workspaceIdentityGates } from "./ops017-gate-alias.js";
+export { ops018 } from "./ops018-shell-image-digest.js";
 export { sys010, sys010Check } from "./sys010-key-over-plain-http.js";
 /**
  * Core's own post-synth checks over the Op model: OPS012, OPS013, OPS014,
- * OPS015, OPS016, OPS017 over the workspace's `identity.gates`, and SYS010
+ * OPS015, OPS016, OPS017 over the workspace's `identity.gates`, OPS018, and SYS010
  * over the `decide` steps and the configured decide backends.
  */
 export function coreOpChecks(opts = {}) {
-    return [ops012, ops013, ops014, ops015, ops016, ops017Check(opts.identityGates), sys010Check(opts.decideBackends)];
+    return [ops012, ops013, ops014, ops015, ops016, ops017Check(opts.identityGates), ops018, sys010Check(opts.decideBackends)];
 }

package/dist/lint/rules/op/ops018-shell-image-digest.d.ts

@@ -0,0 +1,10 @@
+/**
+ * OPS018: a `shellCmd` step that runs in a container (#4015) names its image
+ * pinned by digest, `<ref>@sha256:<digest>`, as a literal string. A tag can
+ * move between two runs of the same Op, and then the step record's image no
+ * longer says what ran. Checked over the main phases, `onFailure`, and the
+ * steps inside an effect.
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+export declare const ops018: PostSynthCheck;
+//# sourceMappingURL=ops018-shell-image-digest.d.ts.map

package/dist/lint/rules/op/ops018-shell-image-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops018-shell-image-digest.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/ops018-shell-image-digest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AAW9F,eAAO,MAAM,MAAM,EAAE,cA6BpB,CAAC"}

package/dist/lint/rules/op/ops018-shell-image-digest.js

@@ -0,0 +1,38 @@
+import { imageProblem } from "../../../op/activities/shell.js";
+import { isOpEntity } from "./support.js";
+function activitySteps(steps) {
+    return steps.flatMap((step) => step.kind === "activity" ? [step] : step.kind === "effect" ? step.steps.filter((s) => s.kind === "activity") : []);
+}
+export const ops018 = {
+    id: "OPS018",
+    description: "A shell step with an image names it pinned by digest, as a literal string",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityKey, entity] of ctx.entities) {
+            if (!isOpEntity(entity))
+                continue;
+            const rec = entity;
+            const props = (entity.props ?? {});
+            if (typeof props.name !== "string" || !Array.isArray(props.phases))
+                continue;
+            const phases = [...props.phases, ...(props.onFailure ?? [])];
+            for (const phase of phases) {
+                for (const step of activitySteps(phase.steps ?? [])) {
+                    if (step.fn !== "shellCmd" || step.args?.image === undefined)
+                        continue;
+                    const problem = imageProblem(step.args.image);
+                    if (!problem)
+                        continue;
+                    diagnostics.push({
+                        checkId: "OPS018",
+                        severity: "error",
+                        message: `Op "${props.name}", phase "${phase.name}", shellCmd: ${problem}`,
+                        entity: entityKey,
+                        lexicon: typeof rec.lexicon === "string" ? rec.lexicon : undefined,
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};