@intentius/chant 0.124.39 → 0.124.41

package/dist/components/promote.js

@@ -38,7 +38,7 @@
  * the same spirit as `DEPLOY_UNIT_RULES` (./deploy-units.ts).
  */
 import { parseWiringRef } from "../lint/rules/comp/support.js";
-import { latestPerComponent } from "../lifecycle/release-ledger.js";
+import { isApplyRecord, latestPerComponent } from "../lifecycle/release-ledger.js";
 import { CapabilityRegistry } from "./capability.js";
 import { runInterpretDriver, DriverRunFailure, } from "./driver.js";
 /**
@@ -68,20 +68,35 @@ export const PUBLISH_STEP_KINDS = [
  * A digest the ledger never recorded for the component is an error.
  */
 export function selectRelease(records, component, env, digest) {
-    const own = records.filter((r) => r.component === component);
-    if (own.length === 0)
-        return { error: `no release of "${component}" is recorded in "${env}"` };
+    const own = deployableRecords(records, component, env);
+    if ("error" in own)
+        return own;
     if (digest === undefined)
-        return { record: latestPerComponent(own).get(component) };
-    const matching = own.filter((r) => r.digest === digest);
+        return { record: latestPerComponent(own.records).get(component) };
+    const matching = own.records.filter((r) => r.digest === digest);
     if (matching.length === 0) {
         return {
             error: `digest ${digest} is not recorded for "${component}" in "${env}"; ` +
-                `its recorded digests are ${[...new Set(own.map((r) => r.digest))].join(", ")}`,
+                `its recorded digests are ${[...new Set(own.records.map((r) => r.digest))].join(", ")}`,
         };
     }
     return { record: latestPerComponent(matching).get(component) };
 }
+/**
+ * The records of `component` a promote, rollback or redeploy can deploy from
+ * (#4274): every one but those that only say it applied ({@link isApplyRecord}),
+ * whose digest is a plan or deploy-input digest and names no artifact.
+ */
+function deployableRecords(records, component, env) {
+    const own = records.filter((r) => r.component === component);
+    if (own.length === 0)
+        return { error: `no release of "${component}" is recorded in "${env}"` };
+    const deployable = own.filter((r) => !isApplyRecord(r));
+    if (deployable.length === 0)
+        return { error: appliesOnly(component, env) };
+    return { records: deployable };
+}
+const appliesOnly = (component, env) => `"${component}" has only applies recorded in "${env}", each by a plan or deploy-input digest, so no artifact of it can be deployed again`;
 /**
  * Read `--digest <component>=<digest>` values (#2602) into a component-to-
  * digest map. A value with no `=` is left to the single-component form
@@ -150,7 +165,7 @@ export function planPromotion(input) {
             return picked;
         return { from, to, items: [{ component, digest: picked.record.digest, source: picked.record }], notPromoted: [] };
     }
-    const latest = latestPerComponent(sourceRecords);
+    const latest = latestPerComponent(sourceRecords.filter((r) => !isApplyRecord(r)));
     const items = [];
     const notPromoted = [];
     for (const [name, record] of [...latest].sort(([a], [b]) => a.localeCompare(b))) {
@@ -159,6 +174,10 @@ export function planPromotion(input) {
         else
             notPromoted.push({ component: name, reason: "recorded but not declared in this checkout" });
     }
+    // #4274: a component that only applied (infrastructure, no artifact) has nothing to promote.
+    for (const name of [...new Set(sourceRecords.filter((r) => isApplyRecord(r) && !latest.has(r.component)).map((r) => r.component))].sort()) {
+        notPromoted.push({ component: name, reason: "only applies are recorded, by a plan or deploy-input digest; there is no artifact to promote" });
+    }
     if (items.length === 0) {
         return { error: `nothing to promote: no component declared here has a release recorded in "${from}"` };
     }
@@ -175,10 +194,11 @@ export function planRollback(input) {
     if (!declared.includes(component)) {
         return { error: `component "${component}" is not declared in this checkout` };
     }
-    const own = records.filter((r) => r.component === component);
+    const deployable = deployableRecords(records, component, env);
+    if ("error" in deployable)
+        return deployable;
+    const own = deployable.records;
     const current = latestPerComponent(own).get(component);
-    if (!current)
-        return { error: `no release of "${component}" is recorded in "${env}"` };
     let target;
     if (digest !== undefined) {
         const picked = selectRelease(own, component, env, digest);
@@ -226,7 +246,7 @@ export function planReleaseRollback(input) {
             notPromoted.push({ component, reason: `in release ${name} but not declared in this checkout` });
             continue;
         }
-        const ran = records.filter((r) => r.component === component && r.releaseDigest === release.releaseDigest);
+        const ran = records.filter((r) => r.component === component && r.releaseDigest === release.releaseDigest && !isApplyRecord(r));
         if (ran.length === 0) {
             neverRan.push(component);
             continue;
@@ -242,7 +262,7 @@ export function planReleaseRollback(input) {
     }
     if (items.length === 0)
         return { error: `release ${name} has no component declared in this checkout` };
-    const current = latestPerComponent(records);
+    const current = latestPerComponent(records.filter((r) => !isApplyRecord(r)));
     const already = items.every((i) => {
         const now = current.get(i.component);
         return now !== undefined && now.releaseDigest === release.releaseDigest && now.digest === i.digest && !input.unsettled?.has(i.component);
@@ -265,9 +285,10 @@ export function planRedeploy(input) {
     if (!declared.includes(component)) {
         return { error: `component "${component}" is not declared in this checkout` };
     }
-    const current = latestPerComponent(records.filter((r) => r.component === component)).get(component);
-    if (!current)
-        return { error: `no release of "${component}" is recorded in "${env}"` };
+    const deployable = deployableRecords(records, component, env);
+    if ("error" in deployable)
+        return deployable;
+    const current = latestPerComponent(deployable.records).get(component);
     if (digest !== undefined && digest !== current.digest) {
         return {
             error: `${digest} is not the current release of "${component}" in "${env}" (that is ${current.digest}); ` +
@@ -589,6 +610,8 @@ function sharedRecord(item, env, run) {
         ...(run.admission ? { admission: run.admission } : {}),
         ...(source.manifestDigest ? { manifestDigest: source.manifestDigest } : {}),
         ...(source.inputDigest ? { inputDigest: source.inputDigest } : {}),
+        // #4274: a release's templates digest stays one when it is deployed again.
+        ...(source.digestKind ? { digestKind: source.digestKind } : {}),
     };
 }
 /** Name an earlier record the way `promotedFrom`, `restores` and `redeploys` do. */

package/dist/gate-decision.d.ts

@@ -27,6 +27,11 @@
  * counts for nothing, as terragucci's wave gate has it: the caller hands in
  * the lines of `_gates/<op>/applied.jsonl` ({@link parseAppliedGateLines}).
  *
+ * Approval rules (#4290), a quorum as a list of `{ targets, count, roles,
+ * notAuthor }`, are judged with `./op/gate-quorum.ts`, re-exported here:
+ * {@link trustRolesAt} and {@link gateSignersAt} read what
+ * `trustQuorumJudge` judges by, at base.
+ *
  * The module reads the ledger lines and the review it is handed; reading
  * them is the caller's. It imports no TypeScript, esbuild, zod, ajv, lint,
  * fold or codegen module, no package's code, and none of chant's git ledger
@@ -36,19 +41,20 @@
  * `gate-decision.test.ts` decides the same ledgers both ways.
  */
 import { type AppliedGateRecord } from "./lifecycle/gate-applied.js";
-import { type GateSigners, type SealedGateApproval } from "./workspace/trust/gate-seal.js";
+import { type GateSigners, type SealedGateApproval } from "./lifecycle/gate-seal.js";
 import { type ClassGrant } from "./workspace/identity-gate-rule.js";
 import type { GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-ledger.js";
 import type { MergedReview } from "./op/gate-review.js";
 import type { GateApprovalSource } from "./op/op-waves.js";
 export { GATE_APPROVAL_SOURCES, type GateApprovalSource } from "./op/op-waves.js";
 export { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, latestResolutionSince, type PlanBoundResolution, } from "./lifecycle/gate-ledger-select.js";
-export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, type GateSigners, type SealedGateApproval, type SshSignatureCheck, } from "./workspace/trust/gate-seal.js";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, type GateSigners, type SealedGateApproval, type SshSignatureCheck, } from "./lifecycle/gate-seal.js";
 export { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, trustConfigProblems, type Signer, type SignerSet, } from "./workspace/trust/trust-files.js";
 export type { GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-ledger.js";
 export { CORE_CLASSES, admitApprover, grantedClasses, type ClassGrant, type GateAdmissionRule, type PrincipalClass, } from "./workspace/identity-gate-rule.js";
 export { appliedGateApplies, appliedGatePath, isApprovalSpent, parseAppliedGateLines, type AppliedGateRecord, } from "./lifecycle/gate-applied.js";
 export type { MergedReview } from "./op/gate-review.js";
+export { quorumNeed, quorumProblems, quorumRuleLine, quorumRuleProgress, quorumRules, quorumRulesFor, quorumWaiting, rolesOf, ruleNeedsProof, samePrincipal, targetGlobMatch, trustQuorumJudge, UNPROVEN_JUDGE, type GateQuorumJudge, type GateQuorumRule, type GateQuorumRuleProgress, type GateQuorumSpec, type QuorumApprover, type QuorumJudgement, type TrustQuorumInput, } from "./op/gate-quorum.js";
 /**
  * The commit a gate's rule is read at when the default branch applies its
  * own commit: the first parent of HEAD, the branch as it stood before the
@@ -65,6 +71,13 @@ export declare function baseCommit(repo: string): string;
  * commit the repository holds, such as {@link baseCommit}'s answer.
  */
 export declare function gateSignersAt(repo: string, base: string): GateSigners;
+/**
+ * The role grants of `.chant/trust.json` at `base` (#4290): role name to the
+ * principals that hold it, as chant reads them. A missing file gives none,
+ * and so does one that is not valid, which turns chant's trust off.
+ * {@link trustQuorumJudge} takes them with {@link gateSignersAt}'s signers.
+ */
+export declare function trustRolesAt(repo: string, base: string): Record<string, string[]>;
 /** A gate the declaration at base names under `identity.gates`, and the principal class its signer must be in, if any. */
 export interface IdentityGate {
     gate: string;

package/dist/gate-decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-decision.d.ts","sourceRoot":"","sources":["../src/gate-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAWH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAQzG,OAAO,EAA+B,KAAK,UAAU,EAA+C,MAAM,gCAAgC,CAAC;AAE3I,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAcrD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/C;AAwBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAErE;AAED,0HAA0H;AAC1H,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAmBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAG1E;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,YAAY,CAAC;IAC1B,+HAA+H;IAC/H,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAAC;CACtD;AAoDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,qBAAqB,GAAG,IAAI,CAc9B;AAID,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7F;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAmBnH;AAID,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,sIAAsI;IACtI,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iHAAiH;IACjH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5D,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;CAAE,GAC1E;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,wHAAwH;IACxH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,yGAAyG;IACzG,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,iFAAiF;IACjF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,yDAAyD;IACzD,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,wHAAwH;IACxH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAIN;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,oBAAoB,CA6CjF"}
+{"version":3,"file":"gate-decision.d.ts","sourceRoot":"","sources":["../src/gate-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAWH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAQnG,OAAO,EAA+B,KAAK,UAAU,EAA+C,MAAM,gCAAgC,CAAC;AAE3I,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EACL,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,aAAa,EACb,OAAO,EACP,cAAc,EACd,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAc1B;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/C;AAwBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAEjF;AAED,0HAA0H;AAC1H,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAmBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAG1E;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,YAAY,CAAC;IAC1B,+HAA+H;IAC/H,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAAC;CACtD;AAoDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,qBAAqB,GAAG,IAAI,CAc9B;AAID,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7F;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAmBnH;AAID,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,sIAAsI;IACtI,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iHAAiH;IACjH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5D,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;CAAE,GAC1E;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,wHAAwH;IACxH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,yGAAyG;IACzG,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,iFAAiF;IACjF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,yDAAyD;IACzD,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,wHAAwH;IACxH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAIN;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,oBAAoB,CA6CjF"}

package/dist/gate-decision.js

@@ -27,6 +27,11 @@
  * counts for nothing, as terragucci's wave gate has it: the caller hands in
  * the lines of `_gates/<op>/applied.jsonl` ({@link parseAppliedGateLines}).
  *
+ * Approval rules (#4290), a quorum as a list of `{ targets, count, roles,
+ * notAuthor }`, are judged with `./op/gate-quorum.ts`, re-exported here:
+ * {@link trustRolesAt} and {@link gateSignersAt} read what
+ * `trustQuorumJudge` judges by, at base.
+ *
  * The module reads the ledger lines and the review it is handed; reading
  * them is the caller's. It imports no TypeScript, esbuild, zod, ajv, lint,
  * fold or codegen module, no package's code, and none of chant's git ledger
@@ -41,17 +46,18 @@ import { join, posix } from "node:path";
 import { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, } from "./lifecycle/gate-ledger-select.js";
 import { samePlanDigest } from "./lifecycle/plan-digest.js";
 import { isApprovalSpent } from "./lifecycle/gate-applied.js";
-import { gateSealRefusal } from "./workspace/trust/gate-seal.js";
+import { gateSealRefusal } from "./lifecycle/gate-seal.js";
 import { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, trustConfigProblems, } from "./workspace/trust/trust-files.js";
 import { parseJsonText } from "./workspace/jsonc.js";
 import { CORE_CLASSES, admitApprover } from "./workspace/identity-gate-rule.js";
 import { diskFiles, findInstalledPackage, mergePinClasses, parseClassDataByHand, readClassFiles } from "./workspace/class-data.js";
 export { GATE_APPROVAL_SOURCES } from "./op/op-waves.js";
 export { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, latestResolutionSince, } from "./lifecycle/gate-ledger-select.js";
-export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, } from "./workspace/trust/gate-seal.js";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, } from "./lifecycle/gate-seal.js";
 export { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, trustConfigProblems, } from "./workspace/trust/trust-files.js";
 export { CORE_CLASSES, admitApprover, grantedClasses, } from "./workspace/identity-gate-rule.js";
 export { appliedGateApplies, appliedGatePath, isApprovalSpent, parseAppliedGateLines, } from "./lifecycle/gate-applied.js";
+export { quorumNeed, quorumProblems, quorumRuleLine, quorumRuleProgress, quorumRules, quorumRulesFor, quorumWaiting, rolesOf, ruleNeedsProof, samePrincipal, targetGlobMatch, trustQuorumJudge, UNPROVEN_JUDGE, } from "./op/gate-quorum.js";
 // ── reading at base ──────────────────────────────────────────────────────
 function git(repo, args) {
     return spawnSync("git", args, { cwd: repo, encoding: "utf-8" });
@@ -118,6 +124,15 @@ function trustAt(repo, base) {
 export function gateSignersAt(repo, base) {
     return trustAt(repo, base).signers;
 }
+/**
+ * The role grants of `.chant/trust.json` at `base` (#4290): role name to the
+ * principals that hold it, as chant reads them. A missing file gives none,
+ * and so does one that is not valid, which turns chant's trust off.
+ * {@link trustQuorumJudge} takes them with {@link gateSignersAt}'s signers.
+ */
+export function trustRolesAt(repo, base) {
+    return trustAt(repo, base).roles;
+}
 /** The declaration at `base`, parsed, or null when there is none. Throws when it cannot be parsed. */
 function declarationAt(repo, base) {
     for (const file of ["chant.workspace.json", "chant.workspace.jsonc"]) {

package/dist/gate-policy.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Gate-time policy (#4294): a policy engine run over a plan's change set,
+ * with the policy read at base, whose rules deny a plan or hold it for a
+ * person.
+ *
+ * The engine is any command that prints conftest's JSON result
+ * (`conftest test --output json`) or OPA's (`opa eval --format json`). The
+ * rules are counted as conftest counts them:
+ *
+ * - `deny`, `violation`, `deny_<name>` and `violation_<name>` deny the plan.
+ *   A denied plan applies only under an override that counts
+ *   (`./override-gate.ts`), on top of the gate's own approval.
+ * - `hold` and `hold_<name>` hold the plan: it waits for a person's approval
+ *   of its digest, even where the gate would let it through without one.
+ *   conftest runs only deny and warn rules, so a hold needs the opa shape.
+ * - `warn` and `warn_<name>` are advice. They fail nothing.
+ *
+ * There is no outcome that lets a plan apply with nobody approving it: a
+ * non-empty change set always waits for a person (ws-104, ws-080). A rule
+ * named `allow_unattended` is read as no rule at all.
+ *
+ * A policy that cannot run, or gives no answer this module can read, is an
+ * error, and the caller stops the apply: no path waives a policy.
+ *
+ * Like `./override-gate.ts` this module reads what it is handed and imports
+ * only node built-ins, so a product can bundle it into one file
+ * (`gate-policy-bundle.test.ts`). The pull-request jobs' use of it is in
+ * `./components/pr-policy.ts`.
+ */
+/** The result shapes chant reads: conftest's and OPA's. */
+export declare const GATE_POLICY_ENGINES: readonly ["conftest", "opa"];
+export type GatePolicyEngine = (typeof GATE_POLICY_ENGINES)[number];
+/** Where the policy is read when the settings name no `path`. */
+export declare const DEFAULT_POLICY_PATH = "policy";
+/** The settings of one policy step, read at base. */
+export interface GatePolicySettings {
+    /** The result shape, and the default command. Default `conftest`. */
+    engine?: GatePolicyEngine;
+    /** The policy directory, relative to the declaration at base. Default {@link DEFAULT_POLICY_PATH}. */
+    path?: string;
+    /** The package to read. conftest default: every namespace. opa default: `main`. */
+    namespace?: string;
+    /**
+     * The command to run instead of the engine's own, as argv. `{policy}` is
+     * the policy directory exported from base and `{input}` the input file. It
+     * prints the result shape `engine` names.
+     */
+    command?: string[];
+}
+/** A rule that matched, and what it said. */
+export interface GatePolicyFinding {
+    /** `<package>.<rule>`, such as `main.deny_public_bucket`. */
+    rule: string;
+    message: string;
+}
+/** What an engine's answer holds. */
+export interface GatePolicyFindings {
+    denials: GatePolicyFinding[];
+    holds: GatePolicyFinding[];
+    warnings: string[];
+}
+/**
+ * One policy check's outcome. `denied` wins over `held`. `error`: the
+ * policy did not run or gave no readable answer, and the apply stops.
+ */
+export interface GatePolicyVerdict {
+    result: "passed" | "denied" | "held" | "error";
+    engine: GatePolicyEngine;
+    denials: GatePolicyFinding[];
+    /** The ids of the rules that denied, sorted, each once: what an override names. */
+    rules: string[];
+    holds: GatePolicyFinding[];
+    warnings: string[];
+    error?: string;
+}
+export declare const DENY_RULE: RegExp;
+export declare const WARN_RULE: RegExp;
+export declare const HOLD_RULE: RegExp;
+/** The findings in `conftest test --output json`. Undefined when it is not that shape. */
+export declare function conftestFindings(stdout: string): GatePolicyFindings | undefined;
+/**
+ * The findings in `opa eval --format json data.<namespace>`. The query's
+ * value is the package: its rules are read by name. An array value is a
+ * deny set named after the query. A query that is undefined has no rule
+ * that matched. Undefined when the output is not that shape.
+ */
+export declare function opaFindings(stdout: string, namespace?: string): GatePolicyFindings | undefined;
+/** A verdict from what the engine found. */
+export declare function gatePolicyVerdict(engine: GatePolicyEngine, found: GatePolicyFindings): GatePolicyVerdict;
+/** The argv one check runs: the settings' `command` with its placeholders filled, or the engine's own. */
+export declare function gatePolicyArgv(settings: GatePolicySettings, at: {
+    policy: string;
+    input: string;
+}): string[];
+/** What one run of the engine printed and how it exited. `status` is null when it did not start. */
+export interface GatePolicyRun {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+export type GatePolicyExec = (argv: string[], cwd: string) => GatePolicyRun;
+/** Runs the engine with the job's environment. */
+export declare const defaultGatePolicyExec: GatePolicyExec;
+export interface CheckGatePolicyOptions {
+    settings: GatePolicySettings;
+    /** The input document, or its JSON text. */
+    input: unknown;
+    /** The policy directory, already exported from base. */
+    policyDir: string;
+    /** Where the engine runs. Default the policy directory. */
+    cwd?: string;
+    exec?: GatePolicyExec;
+}
+/** Run the engine once over `input` and read its answer. */
+export declare function checkGatePolicy(options: CheckGatePolicyOptions): GatePolicyVerdict;
+/** The part of a tree a policy is exported from: a workspace tree at base fits. */
+export interface GatePolicyTree {
+    stat(path: string): "file" | "dir" | undefined;
+    list(path: string): Array<{
+        name: string;
+        type: "file" | "dir";
+    }> | undefined;
+    read(path: string): string;
+    bytes?(path: string): Uint8Array;
+}
+/**
+ * Copy the policy directory `path` out of `tree` (the tree at base) into a
+ * new temporary directory, so the engine reads the policy as the base has
+ * it and never the change's copy. Returns the directory and how to remove
+ * it, or the reason there is no policy to read.
+ */
+export declare function exportGatePolicy(tree: GatePolicyTree, path: string): {
+    dir: string;
+    cleanup: () => void;
+} | {
+    error: string;
+};
+/** The settings, checked. Throws with what is wrong. `where` names them, such as `ci.policy`. */
+export declare function assertGatePolicySettings(where: string, raw: unknown): asserts raw is GatePolicySettings;
+//# sourceMappingURL=gate-policy.d.ts.map

package/dist/gate-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-policy.d.ts","sourceRoot":"","sources":["../src/gate-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAOH,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,YAAI,UAAU,EAAE,KAAK,CAAU,CAAC;AAChE,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC/C,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,mFAAmF;IACnF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,SAAS,QAAuC,CAAC;AAC9D,eAAO,MAAM,SAAS,QAA2B,CAAC;AAClD,eAAO,MAAM,SAAS,QAA2B,CAAC;AAUlD,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAmB/E;AAmBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAkB9F;AAED,4CAA4C;AAC5C,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,GAAG,iBAAiB,CAUxG;AAID,0GAA0G;AAC1G,wBAAgB,cAAc,CAAC,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAM5G;AAED,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,aAAa,CAAC;AAE5E,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,EAAE,cAGnC,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,4CAA4C;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAID,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,iBAAiB,CAkBlF;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAC9E,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA0B7H;AAED,iGAAiG;AACjG,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,kBAAkB,CAiBvG"}

package/dist/gate-policy.js

@@ -0,0 +1,242 @@
+/**
+ * Gate-time policy (#4294): a policy engine run over a plan's change set,
+ * with the policy read at base, whose rules deny a plan or hold it for a
+ * person.
+ *
+ * The engine is any command that prints conftest's JSON result
+ * (`conftest test --output json`) or OPA's (`opa eval --format json`). The
+ * rules are counted as conftest counts them:
+ *
+ * - `deny`, `violation`, `deny_<name>` and `violation_<name>` deny the plan.
+ *   A denied plan applies only under an override that counts
+ *   (`./override-gate.ts`), on top of the gate's own approval.
+ * - `hold` and `hold_<name>` hold the plan: it waits for a person's approval
+ *   of its digest, even where the gate would let it through without one.
+ *   conftest runs only deny and warn rules, so a hold needs the opa shape.
+ * - `warn` and `warn_<name>` are advice. They fail nothing.
+ *
+ * There is no outcome that lets a plan apply with nobody approving it: a
+ * non-empty change set always waits for a person (ws-104, ws-080). A rule
+ * named `allow_unattended` is read as no rule at all.
+ *
+ * A policy that cannot run, or gives no answer this module can read, is an
+ * error, and the caller stops the apply: no path waives a policy.
+ *
+ * Like `./override-gate.ts` this module reads what it is handed and imports
+ * only node built-ins, so a product can bundle it into one file
+ * (`gate-policy-bundle.test.ts`). The pull-request jobs' use of it is in
+ * `./components/pr-policy.ts`.
+ */
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** The result shapes chant reads: conftest's and OPA's. */
+export const GATE_POLICY_ENGINES = ["conftest", "opa"];
+/** Where the policy is read when the settings name no `path`. */
+export const DEFAULT_POLICY_PATH = "policy";
+export const DENY_RULE = /^(deny|violation)(_[A-Za-z0-9]+)*$/;
+export const WARN_RULE = /^warn(_[A-Za-z0-9]+)*$/;
+export const HOLD_RULE = /^hold(_[A-Za-z0-9]+)*$/;
+const ruleId = (query) => query.replace(/^data\./, "");
+function messageOf(v) {
+    if (typeof v === "string")
+        return v;
+    if (v !== null && typeof v === "object" && typeof v.msg === "string")
+        return v.msg;
+    return JSON.stringify(v);
+}
+/** The findings in `conftest test --output json`. Undefined when it is not that shape. */
+export function conftestFindings(stdout) {
+    let results;
+    try {
+        results = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    if (!Array.isArray(results))
+        return undefined;
+    const out = { denials: [], holds: [], warnings: [] };
+    for (const r of results) {
+        if (r === null || typeof r !== "object")
+            return undefined;
+        for (const f of r.failures ?? []) {
+            // conftest names the query that denied in the failure's metadata; an older one gives only the namespace.
+            const rule = typeof f.metadata?.query === "string" ? ruleId(f.metadata.query) : `${r.namespace ?? "main"}.deny`;
+            out.denials.push({ rule, message: messageOf(f.msg) });
+        }
+        for (const w of r.warnings ?? [])
+            out.warnings.push(messageOf(w.msg));
+    }
+    return out;
+}
+/** The rules of one package's value, and with `nested` its child packages one level down. */
+function packageFindings(doc, out, pkg, nested) {
+    for (const [name, value] of Object.entries(doc).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+        // A rule matches when its value is true, a message, or a non-empty set of messages.
+        const said = Array.isArray(value) ? value.map(messageOf) : value === true ? [name] : typeof value === "string" && value !== "" ? [value] : [];
+        if (DENY_RULE.test(name)) {
+            for (const message of said)
+                out.denials.push({ rule: `${pkg}.${name}`, message });
+        }
+        else if (HOLD_RULE.test(name)) {
+            for (const message of said)
+                out.holds.push({ rule: `${pkg}.${name}`, message });
+        }
+        else if (WARN_RULE.test(name)) {
+            out.warnings.push(...said);
+        }
+        else if (nested && value !== null && typeof value === "object" && !Array.isArray(value)) {
+            packageFindings(value, out, `${pkg}.${name}`, false);
+        }
+    }
+}
+/**
+ * The findings in `opa eval --format json data.<namespace>`. The query's
+ * value is the package: its rules are read by name. An array value is a
+ * deny set named after the query. A query that is undefined has no rule
+ * that matched. Undefined when the output is not that shape.
+ */
+export function opaFindings(stdout, namespace = "main") {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed) || parsed.errors !== undefined)
+        return undefined;
+    const value = parsed.result?.[0]?.expressions?.[0]?.value;
+    const out = { denials: [], holds: [], warnings: [] };
+    if (value === undefined)
+        return out;
+    if (Array.isArray(value)) {
+        out.denials.push(...value.map((v) => ({ rule: namespace, message: messageOf(v) })));
+        return out;
+    }
+    if (value === null || typeof value !== "object")
+        return undefined;
+    packageFindings(value, out, namespace, true);
+    return out;
+}
+/** A verdict from what the engine found. */
+export function gatePolicyVerdict(engine, found) {
+    const rules = [...new Set(found.denials.map((d) => d.rule))].sort();
+    return {
+        result: found.denials.length > 0 ? "denied" : found.holds.length > 0 ? "held" : "passed",
+        engine,
+        denials: found.denials,
+        rules,
+        holds: found.holds,
+        warnings: found.warnings,
+    };
+}
+const errorVerdict = (engine, error) => ({ result: "error", engine, denials: [], rules: [], holds: [], warnings: [], error });
+/** The argv one check runs: the settings' `command` with its placeholders filled, or the engine's own. */
+export function gatePolicyArgv(settings, at) {
+    if (settings.command)
+        return settings.command.map((a) => a.replaceAll("{policy}", at.policy).replaceAll("{input}", at.input));
+    if ((settings.engine ?? "conftest") === "opa") {
+        return ["opa", "eval", "--format", "json", "--data", at.policy, "--input", at.input, `data.${settings.namespace ?? "main"}`];
+    }
+    return ["conftest", "test", "--no-color", "--output", "json", "--policy", at.policy, ...(settings.namespace ? ["--namespace", settings.namespace] : ["--all-namespaces"]), at.input];
+}
+/** Runs the engine with the job's environment. */
+export const defaultGatePolicyExec = (argv, cwd) => {
+    const r = spawnSync(argv[0], argv.slice(1), { cwd, encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 });
+    return { status: r.error ? null : r.status, stdout: r.stdout ?? "", stderr: `${r.stderr ?? ""}${r.error ? r.error.message : ""}` };
+};
+const tail = (text) => text.trim().split("\n").slice(-3).join(" ");
+/** Run the engine once over `input` and read its answer. */
+export function checkGatePolicy(options) {
+    const { settings } = options;
+    const engine = settings.engine ?? "conftest";
+    const work = mkdtempSync(join(tmpdir(), "chant-policy-input-"));
+    try {
+        const file = join(work, "input.json");
+        writeFileSync(file, typeof options.input === "string" ? options.input : JSON.stringify(options.input));
+        const argv = gatePolicyArgv(settings, { policy: options.policyDir, input: file });
+        const r = (options.exec ?? defaultGatePolicyExec)(argv, options.cwd ?? options.policyDir);
+        if (r.status === null)
+            return errorVerdict(engine, `${argv[0]} did not run: ${tail(r.stderr) || "no such command"}`);
+        const found = engine === "opa" ? opaFindings(r.stdout, settings.namespace ?? "main") : conftestFindings(r.stdout);
+        if (found === undefined)
+            return errorVerdict(engine, `${argv[0]} gave no ${engine} result (exit ${r.status}): ${tail(r.stderr || r.stdout)}`);
+        // conftest exits 1 on a denial and 2 or more when it could not run; opa exits 0 on a query it ran.
+        if (found.denials.length === 0 && r.status !== 0)
+            return errorVerdict(engine, `${argv[0]} exited ${r.status}: ${tail(r.stderr)}`);
+        return gatePolicyVerdict(engine, found);
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}
+/**
+ * Copy the policy directory `path` out of `tree` (the tree at base) into a
+ * new temporary directory, so the engine reads the policy as the base has
+ * it and never the change's copy. Returns the directory and how to remove
+ * it, or the reason there is no policy to read.
+ */
+export function exportGatePolicy(tree, path) {
+    const root = path.replace(/^\.\/+/, "").replace(/\/+$/, "");
+    const kind = root === "" || root === "." ? "dir" : tree.stat(root);
+    if (kind === undefined)
+        return { error: `the policy directory ${path} does not exist at base` };
+    const dir = mkdtempSync(join(tmpdir(), "chant-policy-"));
+    const cleanup = () => rmSync(dir, { recursive: true, force: true });
+    const copy = (from, to) => {
+        for (const entry of tree.list(from) ?? []) {
+            const src = from === "" || from === "." ? entry.name : `${from}/${entry.name}`;
+            const dest = join(to, entry.name);
+            if (entry.type === "dir") {
+                mkdirSync(dest, { recursive: true });
+                copy(src, dest);
+            }
+            else {
+                writeFileSync(dest, tree.bytes ? tree.bytes(src) : tree.read(src));
+            }
+        }
+    };
+    try {
+        if (kind === "file")
+            writeFileSync(join(dir, root.split("/").pop()), tree.bytes ? tree.bytes(root) : tree.read(root));
+        else
+            copy(root, dir);
+    }
+    catch (err) {
+        cleanup();
+        return { error: `the policy at ${path} could not be read at base: ${err instanceof Error ? err.message : String(err)}` };
+    }
+    return { dir, cleanup };
+}
+/** The settings, checked. Throws with what is wrong. `where` names them, such as `ci.policy`. */
+export function assertGatePolicySettings(where, raw) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error(`${where} must be { engine?, path?, namespace?, command? }`);
+    for (const [key, value] of Object.entries(raw)) {
+        if (key === "engine") {
+            if (!GATE_POLICY_ENGINES.includes(value))
+                throw new Error(`${where}.engine must be ${GATE_POLICY_ENGINES.join(" or ")}, the result shape the command prints`);
+        }
+        else if (key === "path" || key === "namespace") {
+            if (typeof value !== "string" || value.trim() === "")
+                throw new Error(`${where}.${key} must be a non-empty string`);
+            if (key === "path" && (value.startsWith("/") || value.split("/").includes("..")))
+                throw new Error(`${where}.path must be a directory inside the workspace, relative to its declaration`);
+        }
+        else if (key === "command") {
+            if (!Array.isArray(value) || value.length === 0 || !value.every((a) => typeof a === "string" && a !== ""))
+                throw new Error(`${where}.command must be argv, a non-empty list of strings`);
+            if (!value.some((a) => a.includes("{input}")))
+                throw new Error(`${where}.command must pass the input file as {input}`);
+        }
+        else if (key === "outcomes" || key === "allow_unattended" || key === "allowUnattended") {
+            throw new Error(`${where}.${key}: chant's policy step denies and holds only; a non-empty plan always waits for a person (ws-104), so there is no unattended outcome`);
+        }
+        else {
+            throw new Error(`${where}.${key} is not a setting; the settings are engine, path, namespace and command`);
+        }
+    }
+}

package/dist/lifecycle/__fixtures__/publish-fakes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-fakes.d.ts","sourceRoot":"","sources":["../../../src/lifecycle/__fixtures__/publish-fakes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtE,0EAA0E;IAC1E,QAAQ,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAmE3H;AAED,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,SAAgB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAqB7G;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;CACpF;AAED,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,QAAS,MAAM,WAA2B,CAAC;AAE3E,oCAAoC;AACpC,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAGhE;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAEhF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CA4EhE;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvE;AAED,oJAAoJ;AACpJ,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE;YAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;QAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;IAChO,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3G,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,wFAAwF;IACxF,OAAO,IAAI,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACpD,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,gBAAgB,EAAO,GAAG,SAAS,CAmF9I;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,2GAA2G;AAC3G,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,UAAO,GAAG,IAAI,CAI1F;AAED,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAM/C"}
+{"version":3,"file":"publish-fakes.d.ts","sourceRoot":"","sources":["../../../src/lifecycle/__fixtures__/publish-fakes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtE,0EAA0E;IAC1E,QAAQ,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAmE3H;AAED,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,SAAgB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAqB7G;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;CACpF;AAED,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,QAAS,MAAM,WAA2B,CAAC;AAE3E,oCAAoC;AACpC,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAGhE;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAEhF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAiFhE;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvE;AAED,oJAAoJ;AACpJ,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE;YAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;QAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;IAChO,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3G,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,wFAAwF;IACxF,OAAO,IAAI,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACpD,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,gBAAgB,EAAO,GAAG,SAAS,CAmF9I;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,2GAA2G;AAC3G,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,UAAO,GAAG,IAAI,CAI1F;AAED,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAM/C"}