@intentius/chant 0.124.39 → 0.124.41

package/dist/lifecycle/__fixtures__/publish-fakes.js

@@ -179,7 +179,12 @@ if (args[0] === "publish") {
   const [name, version] = split(args[1]);
   const p = reg.packages[name];
   if (!p) { console.error("npm error 404 Not Found - " + name); process.exit(1); }
-  if (p.lag && p.lag[version] > 0) { p.lag[version] -= 1; save(); }
+  if (process.env.FAKE_NPM_VIEW_ERROR && name.includes(process.env.FAKE_NPM_VIEW_ERROR) && p.versions.includes(version)) { console.error("npm error code E500"); console.error("npm error 500 Internal Server Error - GET https://registry.example/" + name); process.exit(1); }
+  if (p.lag && p.lag[version] > 0) {
+    p.lag[version] -= 1; save();
+    // A new package npm does not serve yet answers 404, as the real registry does.
+    if (process.env.FAKE_NPM_LAG_404) { console.error("npm error code E404"); console.error("npm error 404 No match found for version " + version); process.exit(1); }
+  }
   else if (p.versions.includes(version)) console.log(version);
 } else if (args[0] === "dist-tag" && args[1] === "add") {
   const [name, version] = split(args[2]);

package/dist/lifecycle/gate-checkpoint.d.ts

@@ -6,7 +6,7 @@
  * The run writes the file just before it appends the pending fact, and puts
  * the file's digest on that fact as `checkpointDigest`. `chant approve`
  * copies the digest onto the approval, the way it copies the plan digest, and
- * a seal covers it (`../workspace/trust/gate-seal.ts`). A later run that
+ * a seal covers it (`./gate-seal.ts`). A later run that
  * resumes at the gate reads the file back and checks it against the digest
  * the approver saw, so a value pushed onto the branch after the approval is
  * refused rather than carried into the steps after the gate.

package/dist/lifecycle/gate-checkpoint.js

@@ -6,7 +6,7 @@
  * The run writes the file just before it appends the pending fact, and puts
  * the file's digest on that fact as `checkpointDigest`. `chant approve`
  * copies the digest onto the approval, the way it copies the plan digest, and
- * a seal covers it (`../workspace/trust/gate-seal.ts`). A later run that
+ * a seal covers it (`./gate-seal.ts`). A later run that
  * resumes at the gate reads the file back and checks it against the digest
  * the approver saw, so a value pushed onto the branch after the approval is
  * refused rather than carried into the steps after the gate.

package/dist/{workspace/trust → lifecycle}/gate-seal.d.ts

@@ -17,7 +17,7 @@
  * signers line with no `no-touch-required` option (which the signers parser
  * does not accept). An RSA signature over SHA-1 does not verify.
  */
-import type { Signer } from "./trust-files.js";
+import type { Signer } from "../workspace/trust/trust-files.js";
 /**
  * The ssh signature namespace of a gate approval's seal (#3163, ws-080), so a
  * verdict, record or commit signature can't stand in for one.

package/dist/lifecycle/gate-seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-seal.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD,kIAAkI;AAClI,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iGAAiG;IACjG,WAAW,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAWxE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAGtG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAKpE;AA8BD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAmCD,iDAAiD;AACjD,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CA0CtI;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU9D;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID,kJAAkJ;AAClJ,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAYrF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAmB1F"}

package/dist/lifecycle/publish-declaration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-declaration.d.ts","sourceRoot":"","sources":["../../src/lifecycle/publish-declaration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;kBAoClB,CAAC;AAEZ,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB;;;;;;;;kBAgBlB,CAAC;AAEZ,wFAAwF;AACxF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;kBAiBpB,CAAC;AAEZ,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAAyF,CAAC;AAE/H,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACrE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACrE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACzE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"publish-declaration.d.ts","sourceRoot":"","sources":["../../src/lifecycle/publish-declaration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;kBAqClB,CAAC;AAEZ,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB;;;;;;;;kBAgBlB,CAAC;AAEZ,wFAAwF;AACxF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;kBAiBpB,CAAC;AAEZ,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAAyF,CAAC;AAE/H,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACrE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACrE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACzE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/lifecycle/publish-declaration.js

@@ -57,9 +57,10 @@ export const NpmPublishSchema = z
      */
     tokenEnv: envName.optional(),
     /**
-     * Seconds the reveal waits for the registry to serve every version it
-     * published before installing them to audit (#4244). A registry accepts a
-     * publish before it serves it. Default 600.
+     * A cap, in seconds, on the reveal's wait for the registry to serve every
+     * version it published before installing them to audit (#4244). A
+     * registry accepts a publish before it serves it. Unset, the wait ends
+     * only when every version is served or the registry fails (#4271).
      */
     registryWait: z.number().int().min(0).optional(),
 })

package/dist/lifecycle/publish-npm.d.ts

@@ -61,9 +61,9 @@ export declare function npmDistTagArgs(decl: Pick<NpmPublishDeclaration, "regist
 export declare function npmAuditInstallArgs(decl: Pick<NpmPublishDeclaration, "registry">): string[];
 /** The arguments of `npm audit signatures`. */
 export declare function npmAuditSignaturesArgs(decl: Pick<NpmPublishDeclaration, "registry">): string[];
-/** Seconds the reveal waits for the registry to serve what it published, by default (#4244). */
-export declare const NPM_REGISTRY_WAIT_SECONDS = 600;
 /** Between polls of the registry while it waits. */
 export declare const NPM_REGISTRY_POLL_MS = 10000;
+/** Between progress lines while the reveal waits for the registry (#4271). */
+export declare const NPM_REGISTRY_PROGRESS_MS = 60000;
 export declare function npmTarget(decl: NpmPublishDeclaration, deps: PublishDeps): PublishTarget;
 //# sourceMappingURL=publish-npm.d.ts.map

package/dist/lifecycle/publish-npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-npm.d.ts","sourceRoot":"","sources":["../../src/lifecycle/publish-npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAOH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAqC,KAAK,cAAc,EAAE,KAAK,WAAW,EAAoB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAoDnJ,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,GAAG,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,EAAE,CAUpL;AAED,yFAAyF;AACzF,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAElI;AAED,iIAAiI;AACjI,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,GAAG,MAAM,EAAE,CAE3F;AAED,+CAA+C;AAC/C,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,GAAG,MAAM,EAAE,CAE9F;AAuBD,gGAAgG;AAChG,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,oDAAoD;AACpD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAI3C,wBAAgB,SAAS,CAAC,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,GAAG,aAAa,CAgLvF"}
+{"version":3,"file":"publish-npm.d.ts","sourceRoot":"","sources":["../../src/lifecycle/publish-npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAOH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAqC,KAAK,cAAc,EAAE,KAAK,WAAW,EAAoB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAoDnJ,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,GAAG,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,EAAE,CAUpL;AAED,yFAAyF;AACzF,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAElI;AAED,iIAAiI;AACjI,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,GAAG,MAAM,EAAE,CAE3F;AAED,+CAA+C;AAC/C,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,GAAG,MAAM,EAAE,CAE9F;AAuBD,oDAAoD;AACpD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAC3C,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAM/C,wBAAgB,SAAS,CAAC,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,GAAG,aAAa,CAuMvF"}

package/dist/lifecycle/publish-npm.js

@@ -148,10 +148,12 @@ function run(bin, args, ctx, cwd = ctx.cwd, env = ctx.env) {
         });
     });
 }
-/** Seconds the reveal waits for the registry to serve what it published, by default (#4244). */
-export const NPM_REGISTRY_WAIT_SECONDS = 600;
 /** Between polls of the registry while it waits. */
 export const NPM_REGISTRY_POLL_MS = 10000;
+/** Between progress lines while the reveal waits for the registry (#4271). */
+export const NPM_REGISTRY_PROGRESS_MS = 60000;
+/** `npm view`'s answers for a version the registry does not serve yet; any other failure is the registry's error. */
+const NPM_VIEW_NOT_YET = /\bE404\b|\b404 Not Found\b|is not in (this|the npm) registry|No match found for version|\b(ETARGET|notarget)\b/;
 /** npm's errors for a version the registry does not serve yet. */
 const NPM_NOT_SERVED = /\b(ETARGET|ERESOLVE|notarget)\b|No matching version found/;
 export function npmTarget(decl, deps) {
@@ -216,28 +218,49 @@ export function npmTarget(decl, deps) {
      * `npm audit signatures` there (#4049), which checks each package's
      * registry signature and provenance attestation.
      */
+    /**
+     * Whether the registry serves the version yet, while the reveal waits for
+     * it (#4271). A 404, or an answer without the version, is not yet; any other
+     * failure of `npm view` is the registry's error and ends the wait.
+     */
+    const probe = async (ctx, pkg) => {
+        const r = await npm(ctx, ["view", `${pkg.name}@${pkg.version}`, "version", ...(decl.registry ? ["--registry", decl.registry] : [])]);
+        if (r.code === 0)
+            return r.output.some((l) => l.trim() === pkg.version || l.trim() === JSON.stringify(pkg.version));
+        if (r.output.some((l) => NPM_VIEW_NOT_YET.test(l)))
+            return false;
+        const said = r.output.filter((l) => /^npm (error|ERR!)/.test(l)).at(-1) ?? r.output.at(-1) ?? "npm printed nothing";
+        throw new PublishTargetError("publish-npm-registry-failed", `npm view ${pkg.name}@${pkg.version} exited ${r.code} while the reveal waited for the registry to serve it, so nothing was audited: ${said}`, "Each package was published. Once the registry answers, run the publish again: it publishes nothing twice and audits again.");
+    };
     /**
      * Wait until the registry serves every version (#4244): npm accepts a
      * publish minutes before `npm view` and `npm install` find it, so an
-     * install straight after fails with ETARGET or ERESOLVE.
+     * install straight after fails with ETARGET or ERESOLVE. The wait ends when
+     * every version is served or the registry fails (#4271), with a progress
+     * line about once a minute. `registryWait` caps it only when declared.
      */
     const served = async (ctx, pkgs) => {
-        const wait = (decl.registryWait ?? NPM_REGISTRY_WAIT_SECONDS) * 1000;
+        const cap = decl.registryWait === undefined ? undefined : decl.registryWait * 1000;
         const start = now();
+        let logged;
         let missing = pkgs;
         for (;;) {
             const still = [];
             for (const pkg of missing)
-                if (!(await onRegistry(ctx, pkg)))
+                if (!(await probe(ctx, pkg)))
                     still.push(pkg);
             missing = still;
             if (missing.length === 0)
                 return;
             const names = missing.map((p) => `${p.name}@${p.version}`).join(", ");
-            if (now() - start >= wait) {
-                throw new PublishTargetError("publish-npm-not-served", `the registry did not serve ${names} within ${Math.round(wait / 1000)}s of the publish, so nothing was audited`, "Each package was published. Once npm serves them, run the publish again: it publishes nothing twice and audits again. `registryWait` sets the wait.");
+            const waited = now() - start;
+            if (cap !== undefined && waited >= cap) {
+                throw new PublishTargetError("publish-npm-not-served", `the registry did not serve ${names} within ${Math.round(cap / 1000)}s of the publish, so nothing was audited`, "Each package was published. Once npm serves them, run the publish again: it publishes nothing twice and audits again. `registryWait` sets the wait.");
+            }
+            if (logged === undefined || now() - logged >= NPM_REGISTRY_PROGRESS_MS) {
+                ctx.log(`waiting for the registry to serve ${names}${waited > 0 ? ` (${Math.round(waited / 1000)}s so far)` : ""}`);
+                logged = now();
             }
-            ctx.log(`waiting for the registry to serve ${names}`);
             await sleep(NPM_REGISTRY_POLL_MS);
         }
     };

package/dist/lifecycle/query.d.ts

@@ -0,0 +1,68 @@
+import type { LedgerReadPort } from "./ledger-port.js";
+/** The version of the table schema below. */
+export declare const QUERY_SCHEMA_VERSION = 1;
+/**
+ * Each table's columns, in order, with their SQLite type. A column named in
+ * the doc as JSON holds a JSON text, for `json_extract`. Every table starts
+ * with `member`: the workspace member whose ledger the row came from, or NULL
+ * for a project outside a workspace.
+ */
+export declare const QUERY_TABLES: {
+    /** One row per resource in each environment's newest snapshot. `attributes` is JSON. */
+    readonly resources: readonly [readonly ["member", "TEXT"], readonly ["env", "TEXT"], readonly ["stack", "TEXT"], readonly ["lexicon", "TEXT"], readonly ["name", "TEXT"], readonly ["type", "TEXT"], readonly ["physical_id", "TEXT"], readonly ["status", "TEXT"], readonly ["last_updated", "TEXT"], readonly ["ownership", "TEXT"], readonly ["attributes", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["observed_at", "TEXT"]];
+    /** One row per snapshot file: what was observed, when, and how many resources it holds. */
+    readonly snapshots: readonly [readonly ["member", "TEXT"], readonly ["env", "TEXT"], readonly ["stack", "TEXT"], readonly ["lexicon", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["observed_at", "TEXT"], readonly ["depth", "TEXT"], readonly ["resources", "INTEGER"], readonly ["unobserved", "INTEGER"]];
+    /** One row per Op run record. `labels` and `outcomes` are JSON. */
+    readonly runs: readonly [readonly ["member", "TEXT"], readonly ["id", "TEXT"], readonly ["op", "TEXT"], readonly ["env", "TEXT"], readonly ["started", "TEXT"], readonly ["ended", "TEXT"], readonly ["status", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["forge", "TEXT"], readonly ["run_url", "TEXT"], readonly ["failure_code", "TEXT"], readonly ["failure_reason", "TEXT"], readonly ["failed_phase", "TEXT"], readonly ["gate", "TEXT"], readonly ["steward", "TEXT"], readonly ["labels", "TEXT"], readonly ["outcomes", "TEXT"]];
+    /** One row per gate ledger line: `kind` is `pending` or `resolution`. `signed` is 1 for a sealed approval. */
+    readonly gates: readonly [readonly ["member", "TEXT"], readonly ["op", "TEXT"], readonly ["gate", "TEXT"], readonly ["kind", "TEXT"], readonly ["timestamp", "TEXT"], readonly ["resolved_by", "TEXT"], readonly ["relayed_by", "TEXT"], readonly ["approver_kind", "TEXT"], readonly ["plan_digest", "TEXT"], readonly ["environment", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["run_id", "TEXT"], readonly ["url", "TEXT"], readonly ["note", "TEXT"], readonly ["expires_at", "TEXT"], readonly ["origin", "TEXT"], readonly ["empty", "INTEGER"], readonly ["signed", "INTEGER"]];
+    /** One row per deploy record in `<env>/releases.jsonl`. `promoted_from`, `restores` and `redeploys` are JSON. */
+    readonly deploys: readonly [readonly ["member", "TEXT"], readonly ["env", "TEXT"], readonly ["component", "TEXT"], readonly ["digest", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["run_id", "TEXT"], readonly ["forge", "TEXT"], readonly ["run_url", "TEXT"], readonly ["timestamp", "TEXT"], readonly ["actor", "TEXT"], readonly ["approver", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["digest_kind", "TEXT"], readonly ["promoted_from", "TEXT"], readonly ["restores", "TEXT"], readonly ["redeploys", "TEXT"]];
+    /** One row per release file whose content hashes to its digest. `envs` joins its targets' environments with commas; `artifacts` is JSON. */
+    readonly releases: readonly [readonly ["member", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["release_member", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["envs", "TEXT"], readonly ["artifacts", "TEXT"]];
+    /** One row per line of `_releases/cuts.jsonl`. `signed` is 1 for a signed cut. */
+    readonly cuts: readonly [readonly ["member", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["label", "TEXT"], readonly ["actor", "TEXT"], readonly ["timestamp", "TEXT"], readonly ["run_id", "TEXT"], readonly ["forge", "TEXT"], readonly ["channel", "TEXT"], readonly ["signed", "INTEGER"], readonly ["composed_base", "TEXT"]];
+};
+export type QueryTable = keyof typeof QUERY_TABLES;
+/** The table that describes the others: one row per column, with the schema version. */
+export declare const SCHEMA_TABLE = "chant_schema";
+type Value = string | number | null;
+export type QueryRow = Record<string, Value>;
+/** The rows of each table, as loaded. */
+export type QueryData = Record<QueryTable, QueryRow[]>;
+/** One ledger to read: a member's, or the project's own with `member` null. */
+export interface QueryLedger {
+    member: string | null;
+    port: LedgerReadPort;
+}
+export interface QueryLoad {
+    data: QueryData;
+    /** Lines and files that could not be read as their kind, per table. Left out of the rows. */
+    malformed: Record<QueryTable, number>;
+}
+export interface QueryResult {
+    schemaVersion: number;
+    columns: string[];
+    rows: QueryRow[];
+    /** How many rows each table held. */
+    tables: Record<QueryTable, number>;
+    malformed: Record<QueryTable, number>;
+}
+/** A statement that can't run, or a Node.js with no SQLite. The message is for a person. */
+export declare class QueryError extends Error {
+}
+/**
+ * Read every table's rows from the ledgers, in the order given. A ledger
+ * whose branch is absent reads as no rows. A line or file that is not its
+ * kind is counted in `malformed` and left out, as each ledger's own reader
+ * does.
+ */
+export declare function loadQueryData(ledgers: readonly QueryLedger[]): Promise<QueryLoad>;
+/** The first word of a statement, past whitespace and comments. */
+export declare function firstWord(sql: string): string;
+/** Run one read-only statement over the tables. */
+export declare function runQuery(sql: string, load: QueryLoad): Promise<QueryResult>;
+/** The rows as an aligned table, a header and a count. */
+export declare function formatQueryResult(r: QueryResult): string;
+export {};
+//# sourceMappingURL=query.d.ts.map

package/dist/lifecycle/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/lifecycle/query.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAItC;;;;;GAKG;AACH,eAAO,MAAM,YAAY;IACvB,wFAAwF;;IAExF,2FAA2F;;IAE3F,mEAAmE;;IAEnE,8GAA8G;;IAE9G,iHAAiH;;IAEjH,4IAA4I;;IAE5I,kFAAkF;;CAEH,CAAC;AAElF,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,YAAY,CAAC;AAEnD,wFAAwF;AACxF,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,KAAK,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AACpC,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE7C,yCAAyC;AACzC,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEvD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,4FAA4F;AAC5F,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAsDxC;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAyEvF;AA6BD,mEAAmE;AACnE,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG7C;AAED,mDAAmD;AACnD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAoCjF;AAID,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAMxD"}

package/dist/lifecycle/query.js

@@ -0,0 +1,246 @@
+import { parseGateLedger, GATES_DIR } from "./gate-ledger.js";
+import { parseReleaseLedger, releaseLedgerLines } from "./release-read.js";
+import { CUTS_FILE, parseCuts, parseRelease, RELEASES_DIR, verifyReleaseDigest } from "./release-store.js";
+import { opOfRunLedgerFile, parseRunLedger } from "./run-ledger.js";
+/** The version of the table schema below. */
+export const QUERY_SCHEMA_VERSION = 1;
+/**
+ * Each table's columns, in order, with their SQLite type. A column named in
+ * the doc as JSON holds a JSON text, for `json_extract`. Every table starts
+ * with `member`: the workspace member whose ledger the row came from, or NULL
+ * for a project outside a workspace.
+ */
+export const QUERY_TABLES = {
+    /** One row per resource in each environment's newest snapshot. `attributes` is JSON. */
+    resources: [["member", "TEXT"], ["env", "TEXT"], ["stack", "TEXT"], ["lexicon", "TEXT"], ["name", "TEXT"], ["type", "TEXT"], ["physical_id", "TEXT"], ["status", "TEXT"], ["last_updated", "TEXT"], ["ownership", "TEXT"], ["attributes", "TEXT"], ["git_sha", "TEXT"], ["observed_at", "TEXT"]],
+    /** One row per snapshot file: what was observed, when, and how many resources it holds. */
+    snapshots: [["member", "TEXT"], ["env", "TEXT"], ["stack", "TEXT"], ["lexicon", "TEXT"], ["git_sha", "TEXT"], ["observed_at", "TEXT"], ["depth", "TEXT"], ["resources", "INTEGER"], ["unobserved", "INTEGER"]],
+    /** One row per Op run record. `labels` and `outcomes` are JSON. */
+    runs: [["member", "TEXT"], ["id", "TEXT"], ["op", "TEXT"], ["env", "TEXT"], ["started", "TEXT"], ["ended", "TEXT"], ["status", "TEXT"], ["git_sha", "TEXT"], ["forge", "TEXT"], ["run_url", "TEXT"], ["failure_code", "TEXT"], ["failure_reason", "TEXT"], ["failed_phase", "TEXT"], ["gate", "TEXT"], ["steward", "TEXT"], ["labels", "TEXT"], ["outcomes", "TEXT"]],
+    /** One row per gate ledger line: `kind` is `pending` or `resolution`. `signed` is 1 for a sealed approval. */
+    gates: [["member", "TEXT"], ["op", "TEXT"], ["gate", "TEXT"], ["kind", "TEXT"], ["timestamp", "TEXT"], ["resolved_by", "TEXT"], ["relayed_by", "TEXT"], ["approver_kind", "TEXT"], ["plan_digest", "TEXT"], ["environment", "TEXT"], ["release_digest", "TEXT"], ["git_sha", "TEXT"], ["run_id", "TEXT"], ["url", "TEXT"], ["note", "TEXT"], ["expires_at", "TEXT"], ["origin", "TEXT"], ["empty", "INTEGER"], ["signed", "INTEGER"]],
+    /** One row per deploy record in `<env>/releases.jsonl`. `promoted_from`, `restores` and `redeploys` are JSON. */
+    deploys: [["member", "TEXT"], ["env", "TEXT"], ["component", "TEXT"], ["digest", "TEXT"], ["git_sha", "TEXT"], ["run_id", "TEXT"], ["forge", "TEXT"], ["run_url", "TEXT"], ["timestamp", "TEXT"], ["actor", "TEXT"], ["approver", "TEXT"], ["release_digest", "TEXT"], ["digest_kind", "TEXT"], ["promoted_from", "TEXT"], ["restores", "TEXT"], ["redeploys", "TEXT"]],
+    /** One row per release file whose content hashes to its digest. `envs` joins its targets' environments with commas; `artifacts` is JSON. */
+    releases: [["member", "TEXT"], ["release_digest", "TEXT"], ["release_member", "TEXT"], ["git_sha", "TEXT"], ["envs", "TEXT"], ["artifacts", "TEXT"]],
+    /** One row per line of `_releases/cuts.jsonl`. `signed` is 1 for a signed cut. */
+    cuts: [["member", "TEXT"], ["release_digest", "TEXT"], ["label", "TEXT"], ["actor", "TEXT"], ["timestamp", "TEXT"], ["run_id", "TEXT"], ["forge", "TEXT"], ["channel", "TEXT"], ["signed", "INTEGER"], ["composed_base", "TEXT"]],
+};
+/** The table that describes the others: one row per column, with the schema version. */
+export const SCHEMA_TABLE = "chant_schema";
+/** A statement that can't run, or a Node.js with no SQLite. The message is for a person. */
+export class QueryError extends Error {
+}
+const TABLE_NAMES = Object.keys(QUERY_TABLES);
+const empty = (v) => Object.fromEntries(TABLE_NAMES.map((t) => [t, v()]));
+const json = (v) => (v === undefined || v === null ? null : JSON.stringify(v));
+const str = (v) => (typeof v === "string" ? v : null);
+const bit = (v) => (v ? 1 : 0);
+/** Whether a parsed `.json` file under an environment is a snapshot (an observation baseline or another file is not). */
+function isSnapshot(v) {
+    if (!v || typeof v !== "object")
+        return false;
+    const s = v;
+    return typeof s.lexicon === "string" && typeof s.environment === "string" && typeof s.commit === "string" && typeof s.timestamp === "string" && !!s.resources && typeof s.resources === "object" && !Array.isArray(s.resources);
+}
+function snapshotRows(member, env, file, s, data) {
+    // The file name folds the stack in as `<stack>__<lexicon>` (git.ts snapshotStorageKey); the record names it too.
+    const key = file.slice(0, -".json".length);
+    const stack = s.stack ?? (key.includes("__") ? key.slice(0, key.lastIndexOf("__")) : null);
+    const at = { git_sha: s.commit, observed_at: s.timestamp };
+    const resources = Object.entries(s.resources);
+    data.snapshots.push({ member, env, stack, lexicon: s.lexicon, ...at, depth: s.depth ?? "identity", resources: resources.length, unobserved: Object.keys(s.unobserved ?? {}).length });
+    for (const [name, r] of resources) {
+        data.resources.push({ member, env, stack, lexicon: s.lexicon, name, type: str(r?.type), physical_id: str(r?.physicalId), status: str(r?.status), last_updated: str(r?.lastUpdated), ownership: str(r?.ownership), attributes: json(r?.attributes), ...at });
+    }
+}
+function gateRow(member, r) {
+    const pending = r.kind === "pending";
+    const res = pending ? undefined : r;
+    const origin = r.origin;
+    return {
+        member,
+        op: r.op,
+        gate: r.gate,
+        kind: pending ? "pending" : "resolution",
+        timestamp: r.timestamp,
+        resolved_by: res?.resolvedBy ?? null,
+        relayed_by: str(res?.relayedBy),
+        approver_kind: str(res?.approver?.kind),
+        plan_digest: str(r.planDigest),
+        environment: str(r.environment),
+        release_digest: str(r.releaseDigest),
+        git_sha: str(r.gitSha),
+        run_id: str(r.runId),
+        url: str(res?.url),
+        note: str(res?.note),
+        expires_at: pending ? str(r.expiresAt) : null,
+        origin: str(origin),
+        empty: bit(res?.empty === true),
+        signed: bit(res?.seal !== undefined),
+    };
+}
+/**
+ * Read every table's rows from the ledgers, in the order given. A ledger
+ * whose branch is absent reads as no rows. A line or file that is not its
+ * kind is counted in `malformed` and left out, as each ledger's own reader
+ * does.
+ */
+export async function loadQueryData(ledgers) {
+    const data = empty(() => []);
+    const malformed = empty(() => 0);
+    for (const { member, port } of ledgers) {
+        const trees = (await port.trees()).sort();
+        for (const env of trees.filter((t) => !t.startsWith("_"))) {
+            for (const file of (await port.list(env)).sort()) {
+                if (file.endsWith(".json")) {
+                    const text = await port.read(env, file);
+                    let parsed;
+                    try {
+                        parsed = text === null ? null : JSON.parse(text);
+                    }
+                    catch {
+                        parsed = null;
+                    }
+                    // Other JSON files live beside the snapshots (the observation baseline); only a snapshot-shaped one is read.
+                    if (isSnapshot(parsed))
+                        snapshotRows(member, env, file, parsed, data);
+                    continue;
+                }
+                if (file === "releases.jsonl") {
+                    const { records, malformed: bad } = parseReleaseLedger(releaseLedgerLines(await port.read(env, file)));
+                    malformed.deploys += bad;
+                    for (const d of records) {
+                        data.deploys.push({ member, env: d.env, component: d.component, digest: d.digest, git_sha: d.gitSha, run_id: d.runId, forge: str(d.runOrigin?.forge), run_url: str(d.runOrigin?.url), timestamp: d.timestamp, actor: d.actor, approver: str(d.approver), release_digest: str(d.releaseDigest), digest_kind: str(d.digestKind), promoted_from: json(d.promotedFrom), restores: json(d.restores), redeploys: json(d.redeploys) });
+                    }
+                    continue;
+                }
+                if (opOfRunLedgerFile(file) !== null) {
+                    const text = await port.read(env, file);
+                    if (text === null)
+                        continue;
+                    const { records, malformed: bad } = parseRunLedger(text);
+                    malformed.runs += bad;
+                    for (const r of records) {
+                        data.runs.push({ member, id: r.id, op: r.op, env: r.env, started: r.started, ended: r.ended, status: r.status, git_sha: str(r.gitSha), forge: str(r.runOrigin?.forge), run_url: str(r.runOrigin?.url), failure_code: str(r.failure?.code), failure_reason: str(r.failure?.reason), failed_phase: str(r.failure?.phase), gate: str(r.gate?.name), steward: str(r.steward), labels: json(r.labels ?? {}), outcomes: json(r.outcomes ?? {}) });
+                    }
+                }
+            }
+        }
+        if (trees.includes(GATES_DIR)) {
+            for (const file of (await port.list(GATES_DIR)).sort()) {
+                if (!file.endsWith(".jsonl"))
+                    continue;
+                const text = await port.read(GATES_DIR, file);
+                if (text === null)
+                    continue;
+                const { resolutions, pending, malformed: bad } = parseGateLedger(text);
+                malformed.gates += bad;
+                // Both kinds share the file; ledger order is time order, so they are merged back by timestamp.
+                const lines = [...pending, ...resolutions].sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+                for (const r of lines)
+                    data.gates.push(gateRow(member, r));
+            }
+        }
+        if (trees.includes(RELEASES_DIR)) {
+            for (const file of (await port.list(RELEASES_DIR)).sort()) {
+                if (file === CUTS_FILE) {
+                    const { cuts, malformed: bad } = parseCuts(await port.read(RELEASES_DIR, file));
+                    malformed.cuts += bad;
+                    for (const c of cuts) {
+                        data.cuts.push({ member, release_digest: c.releaseDigest, label: c.label, actor: c.actor, timestamp: c.timestamp, run_id: c.runId, forge: str(c.runOrigin?.forge), channel: str(c.channel), signed: bit(c.signature !== null), composed_base: str(c.composed?.base) });
+                    }
+                    continue;
+                }
+                if (!file.endsWith(".json"))
+                    continue;
+                const text = await port.read(RELEASES_DIR, file);
+                const release = text === null ? null : parseRelease(text);
+                // `readAllReleases` (release-store.ts) counts a file whose content does not hash to its digest as malformed; so does this.
+                if (!release || release.releaseDigest.replace(/:/g, "_") !== file.slice(0, -".json".length) || !verifyReleaseDigest(release)) {
+                    malformed.releases++;
+                    continue;
+                }
+                data.releases.push({ member, release_digest: release.releaseDigest, release_member: release.member, git_sha: release.commit, envs: release.targets.map((t) => t.env).join(","), artifacts: json(release.artifactDigests) });
+            }
+        }
+    }
+    return { data, malformed };
+}
+/** node:sqlite, without the experimental warning some Node.js versions print when it loads. */
+async function sqlite() {
+    const emit = process.emitWarning;
+    process.emitWarning = ((warning, ...rest) => {
+        if (/SQLite/.test(typeof warning === "string" ? warning : warning.message))
+            return;
+        return emit.call(process, warning, ...rest);
+    });
+    try {
+        const name = "node:sqlite";
+        return (await import(name));
+    }
+    catch {
+        throw new QueryError(`chant query runs on the SQLite built into Node.js 22.13 or later; this is Node.js ${process.versions.node}`);
+    }
+    finally {
+        process.emitWarning = emit;
+    }
+}
+/** The first word of a statement, past whitespace and comments. */
+export function firstWord(sql) {
+    const s = sql.replace(/^(\s+|--[^\n]*(\n|$)|\/\*[\s\S]*?\*\/)*/, "");
+    return (/^[A-Za-z]+/.exec(s)?.[0] ?? "").toLowerCase();
+}
+/** Run one read-only statement over the tables. */
+export async function runQuery(sql, load) {
+    if (sql.trim() === "")
+        throw new QueryError('chant query needs a statement: chant query "SELECT * FROM resources"');
+    if (!["select", "with", "values"].includes(firstWord(sql)))
+        throw new QueryError("chant query runs one SELECT (or WITH, or VALUES) statement; it changes nothing");
+    const { DatabaseSync } = await sqlite();
+    const db = new DatabaseSync(":memory:");
+    try {
+        db.exec(`CREATE TABLE ${SCHEMA_TABLE} ("version" INTEGER, "table_name" TEXT, "column_name" TEXT, "type" TEXT, "position" INTEGER)`);
+        const describe = db.prepare(`INSERT INTO ${SCHEMA_TABLE} VALUES (?, ?, ?, ?, ?)`);
+        for (const table of TABLE_NAMES) {
+            const cols = QUERY_TABLES[table];
+            db.exec(`CREATE TABLE ${table} (${cols.map(([c, t]) => `"${c}" ${t}`).join(", ")})`);
+            cols.forEach(([c, t], i) => describe.run(QUERY_SCHEMA_VERSION, table, c, t, i + 1));
+            const insert = db.prepare(`INSERT INTO ${table} VALUES (${cols.map(() => "?").join(", ")})`);
+            db.exec("BEGIN");
+            for (const row of load.data[table])
+                insert.run(...cols.map(([c]) => row[c] ?? null));
+            db.exec("COMMIT");
+        }
+        db.exec("PRAGMA query_only = ON");
+        let stmt;
+        try {
+            stmt = db.prepare(sql);
+        }
+        catch (e) {
+            throw new QueryError(`the query does not run: ${e.message}`);
+        }
+        let rows;
+        try {
+            rows = stmt.all();
+        }
+        catch (e) {
+            throw new QueryError(`the query does not run: ${e.message}`);
+        }
+        const columns = typeof stmt.columns === "function" ? stmt.columns().map((c) => c.name) : Object.keys(rows[0] ?? {});
+        const tables = Object.fromEntries(TABLE_NAMES.map((t) => [t, load.data[t].length]));
+        return { schemaVersion: QUERY_SCHEMA_VERSION, columns, rows: rows.map((r) => ({ ...r })), tables, malformed: load.malformed };
+    }
+    finally {
+        db.close();
+    }
+}
+const cell = (v) => (v === null || v === undefined ? "" : String(v));
+/** The rows as an aligned table, a header and a count. */
+export function formatQueryResult(r) {
+    const widths = r.columns.map((c) => Math.max(c.length, ...r.rows.map((row) => cell(row[c]).length)));
+    const line = (vals) => vals.map((v, i) => v.padEnd(widths[i])).join("  ").trimEnd();
+    const out = [line(r.columns), line(widths.map((w) => "-".repeat(w))), ...r.rows.map((row) => line(r.columns.map((c) => cell(row[c]))))];
+    out.push(`(${r.rows.length} ${r.rows.length === 1 ? "row" : "rows"})`);
+    return out.join("\n");
+}

package/dist/lifecycle/release-ledger.d.ts

@@ -227,7 +227,32 @@ export interface ReleaseRecord {
      * deploy that was not made from a release.
      */
     releaseDigest?: string;
+    /**
+     * Optional: what `digest` names when it is not an artifact digest (#4274).
+     * Absent on a record whose digest is the artifact the deploy promoted, and on
+     * every record written before 0.124.35.
+     *
+     * - `plan`: the component published nothing, and the digest is its plan
+     *   digest, the one its approval bound (`pr-apply`).
+     * - `deploy-input`: the component published nothing and planned nothing, and
+     *   the digest is its deploy-input digest (`componentInputDigests`,
+     *   ../components/fan-out-inputs.ts).
+     * - `templates`: the digest of the templates the release records for the
+     *   component (#4222, `releaseTemplatesDigest`).
+     *
+     * A `plan` or `deploy-input` record says the component applied; it names no
+     * artifact, so promote, rollback and redeploy never deploy it
+     * ({@link isApplyRecord}).
+     */
+    digestKind?: ReleaseDigestKind;
 }
+/** What a release record's `digest` names when it is not an artifact digest (#4274). */
+export type ReleaseDigestKind = "plan" | "deploy-input" | "templates";
+/**
+ * Whether `record` only says its component applied (#4274): its digest is a
+ * plan or deploy-input digest, not one anything can be deployed from again.
+ */
+export declare function isApplyRecord(record: Pick<ReleaseRecord, "digestKind">): boolean;
 /** Thrown by `appendReleaseRecord` when the record is missing a required field — a release record can never be recorded partially, since it is never editable afterward. */
 export declare class InvalidReleaseRecordError extends Error {
     readonly missing: string[];
@@ -270,6 +295,12 @@ export declare function resolveCiRun(env?: NodeJS.ProcessEnv): {
     runId: string;
     runOrigin: RunOrigin;
 } | undefined;
+/** The run id `chant ci run` hands each step of a job it runs (#4275), the id its run index lists. */
+export declare const CHANT_CI_RUN_ID_ENV = "CHANT_CI_RUN_ID";
+/** The run's origin `chant ci run` hands each step with {@link CHANT_CI_RUN_ID_ENV}: always `chant`. */
+export declare const CHANT_CI_RUN_FORGE_ENV = "CHANT_CI_RUN_FORGE";
+/** The forge's run variables, which a step of a job the chant runner ran never gets (#4275). */
+export declare const FORGE_RUN_ENV: readonly ["GITHUB_RUN_ID", "GITHUB_RUN_ATTEMPT", "GITHUB_JOB", "CI_PIPELINE_ID", "CI_PIPELINE_URL", "CI_JOB_ID"];
 /**
  * The CI run the environment names, as {@link resolveCiRun} has it, with the
  * job within the run and the run's attempt when the forge gives them

package/dist/lifecycle/release-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAyC,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAwG,KAAK,cAAc,EAAE,MAAM,OAAO,CAAC;AAElJ,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC9I,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;OASG;IACH,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC;IACtD,gHAAgH;IAChH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+HAA+H;IAC/H,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,oGAAoG;AACpG,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,8HAA8H;AAC9H,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6FAA6F;IAC7F,EAAE,EAAE,MAAM,CAAC;IACX,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,oIAAoI;IACpI,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,gBAAgB,CAAA;CAAE,GAAG,SAAS,CAO/D;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iOAAiO;IACjO,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;IAA7C,YAA4B,OAAO,EAAE,MAAM,EAAE,EAG5C;CACF;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,CAQ1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,SAAS,CAyBtH;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,SAAS,CActH;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CASpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAS1D;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}
+{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAyC,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAwG,KAAK,cAAc,EAAE,MAAM,OAAO,CAAC;AAElJ,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC9I,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;OASG;IACH,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC;IACtD,gHAAgH;IAChH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+HAA+H;IAC/H,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,oGAAoG;AACpG,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,8HAA8H;AAC9H,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6FAA6F;IAC7F,EAAE,EAAE,MAAM,CAAC;IACX,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,oIAAoI;IACpI,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,gBAAgB,CAAA;CAAE,GAAG,SAAS,CAO/D;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iOAAiO;IACjO,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED,wFAAwF;AACxF,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,cAAc,GAAG,WAAW,CAAC;AAEtE;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,GAAG,OAAO,CAEhF;AAED,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;IAA7C,YAA4B,OAAO,EAAE,MAAM,EAAE,EAG5C;CACF;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,CAQ1C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,SAAS,CA8BtH;AAED,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,wGAAwG;AACxG,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAC3D,gGAAgG;AAChG,eAAO,MAAM,aAAa,YAAI,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,WAAW,CAAU,CAAC;AAE9I;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,SAAS,CActH;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CASpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAS1D;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}

package/dist/lifecycle/release-ledger.js

@@ -53,6 +53,13 @@ export function admissionOf(resolutions, at) {
         admission: { op: at.op, gate: at.gate, resolvedAt: bound.map((r) => r.timestamp).sort().at(-1) },
     };
 }
+/**
+ * Whether `record` only says its component applied (#4274): its digest is a
+ * plan or deploy-input digest, not one anything can be deployed from again.
+ */
+export function isApplyRecord(record) {
+    return record.digestKind === "plan" || record.digestKind === "deploy-input";
+}
 /** Thrown by `appendReleaseRecord` when the record is missing a required field — a release record can never be recorded partially, since it is never editable afterward. */
 export class InvalidReleaseRecordError extends Error {
     constructor(missing) {
@@ -123,8 +130,19 @@ export function resolveCiRun(env = process.env) {
             },
         };
     }
+    // #4275: a step of a job the chant runner ran. The forge branches come first, and the runner
+    // strips the forge's run variables from its steps, so neither kind of job is taken for the other.
+    if (env[CHANT_CI_RUN_ID_ENV] && env[CHANT_CI_RUN_FORGE_ENV] === "chant") {
+        return { runId: env[CHANT_CI_RUN_ID_ENV], runOrigin: { forge: "chant" } };
+    }
     return undefined;
 }
+/** The run id `chant ci run` hands each step of a job it runs (#4275), the id its run index lists. */
+export const CHANT_CI_RUN_ID_ENV = "CHANT_CI_RUN_ID";
+/** The run's origin `chant ci run` hands each step with {@link CHANT_CI_RUN_ID_ENV}: always `chant`. */
+export const CHANT_CI_RUN_FORGE_ENV = "CHANT_CI_RUN_FORGE";
+/** The forge's run variables, which a step of a job the chant runner ran never gets (#4275). */
+export const FORGE_RUN_ENV = ["GITHUB_RUN_ID", "GITHUB_RUN_ATTEMPT", "GITHUB_JOB", "CI_PIPELINE_ID", "CI_PIPELINE_URL", "CI_JOB_ID"];
 /**
  * The CI run the environment names, as {@link resolveCiRun} has it, with the
  * job within the run and the run's attempt when the forge gives them
@@ -136,7 +154,7 @@ export function resolveCiJob(env = process.env) {
     if (!ci)
         return undefined;
     const github = ci.runOrigin.forge === "github";
-    const jobId = github ? env.GITHUB_JOB : env.CI_JOB_ID;
+    const jobId = github ? env.GITHUB_JOB : ci.runOrigin.forge === "gitlab" ? env.CI_JOB_ID : undefined;
     const attempt = github ? Number(env.GITHUB_RUN_ATTEMPT) : NaN;
     return {
         runId: ci.runId,

package/dist/lifecycle/run-ledger.d.ts

@@ -60,4 +60,17 @@ export declare function readRunLedger(environment: string, op: string, opts?: {
     records: OpRunRecord[];
     malformed: number;
 }>;
+/** The run ledger file name for `op` under `<env>/`, `runs__<op>.jsonl`. */
+export declare function runLedgerFile(op: string): string;
+/** The op a run ledger file name holds, or null when `file` is not one. */
+export declare function opOfRunLedgerFile(file: string): string | null;
+/**
+ * Parse the text of one run ledger file the way {@link readRunLedger} reads
+ * it (#4297): a reader that fetches the file itself, such as `chant query`,
+ * gets the same records and the same malformed count.
+ */
+export declare function parseRunLedger(content: string): {
+    records: OpRunRecord[];
+    malformed: number;
+};
 //# sourceMappingURL=run-ledger.d.ts.map