@intentius/chant 0.124.40 → 0.124.41

package/dist/gate-decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-decision.d.ts","sourceRoot":"","sources":["../src/gate-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAWH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAQzG,OAAO,EAA+B,KAAK,UAAU,EAA+C,MAAM,gCAAgC,CAAC;AAE3I,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAcrD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/C;AAwBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAErE;AAED,0HAA0H;AAC1H,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAmBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAG1E;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,YAAY,CAAC;IAC1B,+HAA+H;IAC/H,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAAC;CACtD;AAoDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,qBAAqB,GAAG,IAAI,CAc9B;AAID,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7F;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAmBnH;AAID,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,sIAAsI;IACtI,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iHAAiH;IACjH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5D,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;CAAE,GAC1E;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,wHAAwH;IACxH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,yGAAyG;IACzG,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,iFAAiF;IACjF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,yDAAyD;IACzD,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,wHAAwH;IACxH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAIN;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,oBAAoB,CA6CjF"}
+{"version":3,"file":"gate-decision.d.ts","sourceRoot":"","sources":["../src/gate-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAWH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAQnG,OAAO,EAA+B,KAAK,UAAU,EAA+C,MAAM,gCAAgC,CAAC;AAE3I,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EACL,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,aAAa,EACb,OAAO,EACP,cAAc,EACd,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAc1B;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/C;AAwBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAEjF;AAED,0HAA0H;AAC1H,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAmBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAG1E;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,YAAY,CAAC;IAC1B,+HAA+H;IAC/H,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAAC;CACtD;AAoDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,qBAAqB,GAAG,IAAI,CAc9B;AAID,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7F;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAmBnH;AAID,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,oGAAoG;IACpG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,sIAAsI;IACtI,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iHAAiH;IACjH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5D,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;CAAE,GAC1E;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,wHAAwH;IACxH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,yGAAyG;IACzG,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,iFAAiF;IACjF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,yDAAyD;IACzD,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,wHAAwH;IACxH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAIN;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,oBAAoB,CA6CjF"}

package/dist/gate-decision.js

@@ -27,6 +27,11 @@
  * counts for nothing, as terragucci's wave gate has it: the caller hands in
  * the lines of `_gates/<op>/applied.jsonl` ({@link parseAppliedGateLines}).
  *
+ * Approval rules (#4290), a quorum as a list of `{ targets, count, roles,
+ * notAuthor }`, are judged with `./op/gate-quorum.ts`, re-exported here:
+ * {@link trustRolesAt} and {@link gateSignersAt} read what
+ * `trustQuorumJudge` judges by, at base.
+ *
  * The module reads the ledger lines and the review it is handed; reading
  * them is the caller's. It imports no TypeScript, esbuild, zod, ajv, lint,
  * fold or codegen module, no package's code, and none of chant's git ledger
@@ -41,17 +46,18 @@ import { join, posix } from "node:path";
 import { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, } from "./lifecycle/gate-ledger-select.js";
 import { samePlanDigest } from "./lifecycle/plan-digest.js";
 import { isApprovalSpent } from "./lifecycle/gate-applied.js";
-import { gateSealRefusal } from "./workspace/trust/gate-seal.js";
+import { gateSealRefusal } from "./lifecycle/gate-seal.js";
 import { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, trustConfigProblems, } from "./workspace/trust/trust-files.js";
 import { parseJsonText } from "./workspace/jsonc.js";
 import { CORE_CLASSES, admitApprover } from "./workspace/identity-gate-rule.js";
 import { diskFiles, findInstalledPackage, mergePinClasses, parseClassDataByHand, readClassFiles } from "./workspace/class-data.js";
 export { GATE_APPROVAL_SOURCES } from "./op/op-waves.js";
 export { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, latestResolutionSince, } from "./lifecycle/gate-ledger-select.js";
-export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, } from "./workspace/trust/gate-seal.js";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sealedFieldsOf, sshKeyFingerprint, verifySshSignatureWith, } from "./lifecycle/gate-seal.js";
 export { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, trustConfigProblems, } from "./workspace/trust/trust-files.js";
 export { CORE_CLASSES, admitApprover, grantedClasses, } from "./workspace/identity-gate-rule.js";
 export { appliedGateApplies, appliedGatePath, isApprovalSpent, parseAppliedGateLines, } from "./lifecycle/gate-applied.js";
+export { quorumNeed, quorumProblems, quorumRuleLine, quorumRuleProgress, quorumRules, quorumRulesFor, quorumWaiting, rolesOf, ruleNeedsProof, samePrincipal, targetGlobMatch, trustQuorumJudge, UNPROVEN_JUDGE, } from "./op/gate-quorum.js";
 // ── reading at base ──────────────────────────────────────────────────────
 function git(repo, args) {
     return spawnSync("git", args, { cwd: repo, encoding: "utf-8" });
@@ -118,6 +124,15 @@ function trustAt(repo, base) {
 export function gateSignersAt(repo, base) {
     return trustAt(repo, base).signers;
 }
+/**
+ * The role grants of `.chant/trust.json` at `base` (#4290): role name to the
+ * principals that hold it, as chant reads them. A missing file gives none,
+ * and so does one that is not valid, which turns chant's trust off.
+ * {@link trustQuorumJudge} takes them with {@link gateSignersAt}'s signers.
+ */
+export function trustRolesAt(repo, base) {
+    return trustAt(repo, base).roles;
+}
 /** The declaration at `base`, parsed, or null when there is none. Throws when it cannot be parsed. */
 function declarationAt(repo, base) {
     for (const file of ["chant.workspace.json", "chant.workspace.jsonc"]) {

package/dist/gate-policy.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Gate-time policy (#4294): a policy engine run over a plan's change set,
+ * with the policy read at base, whose rules deny a plan or hold it for a
+ * person.
+ *
+ * The engine is any command that prints conftest's JSON result
+ * (`conftest test --output json`) or OPA's (`opa eval --format json`). The
+ * rules are counted as conftest counts them:
+ *
+ * - `deny`, `violation`, `deny_<name>` and `violation_<name>` deny the plan.
+ *   A denied plan applies only under an override that counts
+ *   (`./override-gate.ts`), on top of the gate's own approval.
+ * - `hold` and `hold_<name>` hold the plan: it waits for a person's approval
+ *   of its digest, even where the gate would let it through without one.
+ *   conftest runs only deny and warn rules, so a hold needs the opa shape.
+ * - `warn` and `warn_<name>` are advice. They fail nothing.
+ *
+ * There is no outcome that lets a plan apply with nobody approving it: a
+ * non-empty change set always waits for a person (ws-104, ws-080). A rule
+ * named `allow_unattended` is read as no rule at all.
+ *
+ * A policy that cannot run, or gives no answer this module can read, is an
+ * error, and the caller stops the apply: no path waives a policy.
+ *
+ * Like `./override-gate.ts` this module reads what it is handed and imports
+ * only node built-ins, so a product can bundle it into one file
+ * (`gate-policy-bundle.test.ts`). The pull-request jobs' use of it is in
+ * `./components/pr-policy.ts`.
+ */
+/** The result shapes chant reads: conftest's and OPA's. */
+export declare const GATE_POLICY_ENGINES: readonly ["conftest", "opa"];
+export type GatePolicyEngine = (typeof GATE_POLICY_ENGINES)[number];
+/** Where the policy is read when the settings name no `path`. */
+export declare const DEFAULT_POLICY_PATH = "policy";
+/** The settings of one policy step, read at base. */
+export interface GatePolicySettings {
+    /** The result shape, and the default command. Default `conftest`. */
+    engine?: GatePolicyEngine;
+    /** The policy directory, relative to the declaration at base. Default {@link DEFAULT_POLICY_PATH}. */
+    path?: string;
+    /** The package to read. conftest default: every namespace. opa default: `main`. */
+    namespace?: string;
+    /**
+     * The command to run instead of the engine's own, as argv. `{policy}` is
+     * the policy directory exported from base and `{input}` the input file. It
+     * prints the result shape `engine` names.
+     */
+    command?: string[];
+}
+/** A rule that matched, and what it said. */
+export interface GatePolicyFinding {
+    /** `<package>.<rule>`, such as `main.deny_public_bucket`. */
+    rule: string;
+    message: string;
+}
+/** What an engine's answer holds. */
+export interface GatePolicyFindings {
+    denials: GatePolicyFinding[];
+    holds: GatePolicyFinding[];
+    warnings: string[];
+}
+/**
+ * One policy check's outcome. `denied` wins over `held`. `error`: the
+ * policy did not run or gave no readable answer, and the apply stops.
+ */
+export interface GatePolicyVerdict {
+    result: "passed" | "denied" | "held" | "error";
+    engine: GatePolicyEngine;
+    denials: GatePolicyFinding[];
+    /** The ids of the rules that denied, sorted, each once: what an override names. */
+    rules: string[];
+    holds: GatePolicyFinding[];
+    warnings: string[];
+    error?: string;
+}
+export declare const DENY_RULE: RegExp;
+export declare const WARN_RULE: RegExp;
+export declare const HOLD_RULE: RegExp;
+/** The findings in `conftest test --output json`. Undefined when it is not that shape. */
+export declare function conftestFindings(stdout: string): GatePolicyFindings | undefined;
+/**
+ * The findings in `opa eval --format json data.<namespace>`. The query's
+ * value is the package: its rules are read by name. An array value is a
+ * deny set named after the query. A query that is undefined has no rule
+ * that matched. Undefined when the output is not that shape.
+ */
+export declare function opaFindings(stdout: string, namespace?: string): GatePolicyFindings | undefined;
+/** A verdict from what the engine found. */
+export declare function gatePolicyVerdict(engine: GatePolicyEngine, found: GatePolicyFindings): GatePolicyVerdict;
+/** The argv one check runs: the settings' `command` with its placeholders filled, or the engine's own. */
+export declare function gatePolicyArgv(settings: GatePolicySettings, at: {
+    policy: string;
+    input: string;
+}): string[];
+/** What one run of the engine printed and how it exited. `status` is null when it did not start. */
+export interface GatePolicyRun {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+export type GatePolicyExec = (argv: string[], cwd: string) => GatePolicyRun;
+/** Runs the engine with the job's environment. */
+export declare const defaultGatePolicyExec: GatePolicyExec;
+export interface CheckGatePolicyOptions {
+    settings: GatePolicySettings;
+    /** The input document, or its JSON text. */
+    input: unknown;
+    /** The policy directory, already exported from base. */
+    policyDir: string;
+    /** Where the engine runs. Default the policy directory. */
+    cwd?: string;
+    exec?: GatePolicyExec;
+}
+/** Run the engine once over `input` and read its answer. */
+export declare function checkGatePolicy(options: CheckGatePolicyOptions): GatePolicyVerdict;
+/** The part of a tree a policy is exported from: a workspace tree at base fits. */
+export interface GatePolicyTree {
+    stat(path: string): "file" | "dir" | undefined;
+    list(path: string): Array<{
+        name: string;
+        type: "file" | "dir";
+    }> | undefined;
+    read(path: string): string;
+    bytes?(path: string): Uint8Array;
+}
+/**
+ * Copy the policy directory `path` out of `tree` (the tree at base) into a
+ * new temporary directory, so the engine reads the policy as the base has
+ * it and never the change's copy. Returns the directory and how to remove
+ * it, or the reason there is no policy to read.
+ */
+export declare function exportGatePolicy(tree: GatePolicyTree, path: string): {
+    dir: string;
+    cleanup: () => void;
+} | {
+    error: string;
+};
+/** The settings, checked. Throws with what is wrong. `where` names them, such as `ci.policy`. */
+export declare function assertGatePolicySettings(where: string, raw: unknown): asserts raw is GatePolicySettings;
+//# sourceMappingURL=gate-policy.d.ts.map

package/dist/gate-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-policy.d.ts","sourceRoot":"","sources":["../src/gate-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAOH,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,YAAI,UAAU,EAAE,KAAK,CAAU,CAAC;AAChE,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC/C,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,mFAAmF;IACnF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,SAAS,QAAuC,CAAC;AAC9D,eAAO,MAAM,SAAS,QAA2B,CAAC;AAClD,eAAO,MAAM,SAAS,QAA2B,CAAC;AAUlD,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAmB/E;AAmBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAkB9F;AAED,4CAA4C;AAC5C,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,GAAG,iBAAiB,CAUxG;AAID,0GAA0G;AAC1G,wBAAgB,cAAc,CAAC,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAM5G;AAED,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,aAAa,CAAC;AAE5E,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,EAAE,cAGnC,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,4CAA4C;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAID,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,iBAAiB,CAkBlF;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAC9E,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA0B7H;AAED,iGAAiG;AACjG,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,kBAAkB,CAiBvG"}

package/dist/gate-policy.js

@@ -0,0 +1,242 @@
+/**
+ * Gate-time policy (#4294): a policy engine run over a plan's change set,
+ * with the policy read at base, whose rules deny a plan or hold it for a
+ * person.
+ *
+ * The engine is any command that prints conftest's JSON result
+ * (`conftest test --output json`) or OPA's (`opa eval --format json`). The
+ * rules are counted as conftest counts them:
+ *
+ * - `deny`, `violation`, `deny_<name>` and `violation_<name>` deny the plan.
+ *   A denied plan applies only under an override that counts
+ *   (`./override-gate.ts`), on top of the gate's own approval.
+ * - `hold` and `hold_<name>` hold the plan: it waits for a person's approval
+ *   of its digest, even where the gate would let it through without one.
+ *   conftest runs only deny and warn rules, so a hold needs the opa shape.
+ * - `warn` and `warn_<name>` are advice. They fail nothing.
+ *
+ * There is no outcome that lets a plan apply with nobody approving it: a
+ * non-empty change set always waits for a person (ws-104, ws-080). A rule
+ * named `allow_unattended` is read as no rule at all.
+ *
+ * A policy that cannot run, or gives no answer this module can read, is an
+ * error, and the caller stops the apply: no path waives a policy.
+ *
+ * Like `./override-gate.ts` this module reads what it is handed and imports
+ * only node built-ins, so a product can bundle it into one file
+ * (`gate-policy-bundle.test.ts`). The pull-request jobs' use of it is in
+ * `./components/pr-policy.ts`.
+ */
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** The result shapes chant reads: conftest's and OPA's. */
+export const GATE_POLICY_ENGINES = ["conftest", "opa"];
+/** Where the policy is read when the settings name no `path`. */
+export const DEFAULT_POLICY_PATH = "policy";
+export const DENY_RULE = /^(deny|violation)(_[A-Za-z0-9]+)*$/;
+export const WARN_RULE = /^warn(_[A-Za-z0-9]+)*$/;
+export const HOLD_RULE = /^hold(_[A-Za-z0-9]+)*$/;
+const ruleId = (query) => query.replace(/^data\./, "");
+function messageOf(v) {
+    if (typeof v === "string")
+        return v;
+    if (v !== null && typeof v === "object" && typeof v.msg === "string")
+        return v.msg;
+    return JSON.stringify(v);
+}
+/** The findings in `conftest test --output json`. Undefined when it is not that shape. */
+export function conftestFindings(stdout) {
+    let results;
+    try {
+        results = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    if (!Array.isArray(results))
+        return undefined;
+    const out = { denials: [], holds: [], warnings: [] };
+    for (const r of results) {
+        if (r === null || typeof r !== "object")
+            return undefined;
+        for (const f of r.failures ?? []) {
+            // conftest names the query that denied in the failure's metadata; an older one gives only the namespace.
+            const rule = typeof f.metadata?.query === "string" ? ruleId(f.metadata.query) : `${r.namespace ?? "main"}.deny`;
+            out.denials.push({ rule, message: messageOf(f.msg) });
+        }
+        for (const w of r.warnings ?? [])
+            out.warnings.push(messageOf(w.msg));
+    }
+    return out;
+}
+/** The rules of one package's value, and with `nested` its child packages one level down. */
+function packageFindings(doc, out, pkg, nested) {
+    for (const [name, value] of Object.entries(doc).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+        // A rule matches when its value is true, a message, or a non-empty set of messages.
+        const said = Array.isArray(value) ? value.map(messageOf) : value === true ? [name] : typeof value === "string" && value !== "" ? [value] : [];
+        if (DENY_RULE.test(name)) {
+            for (const message of said)
+                out.denials.push({ rule: `${pkg}.${name}`, message });
+        }
+        else if (HOLD_RULE.test(name)) {
+            for (const message of said)
+                out.holds.push({ rule: `${pkg}.${name}`, message });
+        }
+        else if (WARN_RULE.test(name)) {
+            out.warnings.push(...said);
+        }
+        else if (nested && value !== null && typeof value === "object" && !Array.isArray(value)) {
+            packageFindings(value, out, `${pkg}.${name}`, false);
+        }
+    }
+}
+/**
+ * The findings in `opa eval --format json data.<namespace>`. The query's
+ * value is the package: its rules are read by name. An array value is a
+ * deny set named after the query. A query that is undefined has no rule
+ * that matched. Undefined when the output is not that shape.
+ */
+export function opaFindings(stdout, namespace = "main") {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed) || parsed.errors !== undefined)
+        return undefined;
+    const value = parsed.result?.[0]?.expressions?.[0]?.value;
+    const out = { denials: [], holds: [], warnings: [] };
+    if (value === undefined)
+        return out;
+    if (Array.isArray(value)) {
+        out.denials.push(...value.map((v) => ({ rule: namespace, message: messageOf(v) })));
+        return out;
+    }
+    if (value === null || typeof value !== "object")
+        return undefined;
+    packageFindings(value, out, namespace, true);
+    return out;
+}
+/** A verdict from what the engine found. */
+export function gatePolicyVerdict(engine, found) {
+    const rules = [...new Set(found.denials.map((d) => d.rule))].sort();
+    return {
+        result: found.denials.length > 0 ? "denied" : found.holds.length > 0 ? "held" : "passed",
+        engine,
+        denials: found.denials,
+        rules,
+        holds: found.holds,
+        warnings: found.warnings,
+    };
+}
+const errorVerdict = (engine, error) => ({ result: "error", engine, denials: [], rules: [], holds: [], warnings: [], error });
+/** The argv one check runs: the settings' `command` with its placeholders filled, or the engine's own. */
+export function gatePolicyArgv(settings, at) {
+    if (settings.command)
+        return settings.command.map((a) => a.replaceAll("{policy}", at.policy).replaceAll("{input}", at.input));
+    if ((settings.engine ?? "conftest") === "opa") {
+        return ["opa", "eval", "--format", "json", "--data", at.policy, "--input", at.input, `data.${settings.namespace ?? "main"}`];
+    }
+    return ["conftest", "test", "--no-color", "--output", "json", "--policy", at.policy, ...(settings.namespace ? ["--namespace", settings.namespace] : ["--all-namespaces"]), at.input];
+}
+/** Runs the engine with the job's environment. */
+export const defaultGatePolicyExec = (argv, cwd) => {
+    const r = spawnSync(argv[0], argv.slice(1), { cwd, encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 });
+    return { status: r.error ? null : r.status, stdout: r.stdout ?? "", stderr: `${r.stderr ?? ""}${r.error ? r.error.message : ""}` };
+};
+const tail = (text) => text.trim().split("\n").slice(-3).join(" ");
+/** Run the engine once over `input` and read its answer. */
+export function checkGatePolicy(options) {
+    const { settings } = options;
+    const engine = settings.engine ?? "conftest";
+    const work = mkdtempSync(join(tmpdir(), "chant-policy-input-"));
+    try {
+        const file = join(work, "input.json");
+        writeFileSync(file, typeof options.input === "string" ? options.input : JSON.stringify(options.input));
+        const argv = gatePolicyArgv(settings, { policy: options.policyDir, input: file });
+        const r = (options.exec ?? defaultGatePolicyExec)(argv, options.cwd ?? options.policyDir);
+        if (r.status === null)
+            return errorVerdict(engine, `${argv[0]} did not run: ${tail(r.stderr) || "no such command"}`);
+        const found = engine === "opa" ? opaFindings(r.stdout, settings.namespace ?? "main") : conftestFindings(r.stdout);
+        if (found === undefined)
+            return errorVerdict(engine, `${argv[0]} gave no ${engine} result (exit ${r.status}): ${tail(r.stderr || r.stdout)}`);
+        // conftest exits 1 on a denial and 2 or more when it could not run; opa exits 0 on a query it ran.
+        if (found.denials.length === 0 && r.status !== 0)
+            return errorVerdict(engine, `${argv[0]} exited ${r.status}: ${tail(r.stderr)}`);
+        return gatePolicyVerdict(engine, found);
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}
+/**
+ * Copy the policy directory `path` out of `tree` (the tree at base) into a
+ * new temporary directory, so the engine reads the policy as the base has
+ * it and never the change's copy. Returns the directory and how to remove
+ * it, or the reason there is no policy to read.
+ */
+export function exportGatePolicy(tree, path) {
+    const root = path.replace(/^\.\/+/, "").replace(/\/+$/, "");
+    const kind = root === "" || root === "." ? "dir" : tree.stat(root);
+    if (kind === undefined)
+        return { error: `the policy directory ${path} does not exist at base` };
+    const dir = mkdtempSync(join(tmpdir(), "chant-policy-"));
+    const cleanup = () => rmSync(dir, { recursive: true, force: true });
+    const copy = (from, to) => {
+        for (const entry of tree.list(from) ?? []) {
+            const src = from === "" || from === "." ? entry.name : `${from}/${entry.name}`;
+            const dest = join(to, entry.name);
+            if (entry.type === "dir") {
+                mkdirSync(dest, { recursive: true });
+                copy(src, dest);
+            }
+            else {
+                writeFileSync(dest, tree.bytes ? tree.bytes(src) : tree.read(src));
+            }
+        }
+    };
+    try {
+        if (kind === "file")
+            writeFileSync(join(dir, root.split("/").pop()), tree.bytes ? tree.bytes(root) : tree.read(root));
+        else
+            copy(root, dir);
+    }
+    catch (err) {
+        cleanup();
+        return { error: `the policy at ${path} could not be read at base: ${err instanceof Error ? err.message : String(err)}` };
+    }
+    return { dir, cleanup };
+}
+/** The settings, checked. Throws with what is wrong. `where` names them, such as `ci.policy`. */
+export function assertGatePolicySettings(where, raw) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error(`${where} must be { engine?, path?, namespace?, command? }`);
+    for (const [key, value] of Object.entries(raw)) {
+        if (key === "engine") {
+            if (!GATE_POLICY_ENGINES.includes(value))
+                throw new Error(`${where}.engine must be ${GATE_POLICY_ENGINES.join(" or ")}, the result shape the command prints`);
+        }
+        else if (key === "path" || key === "namespace") {
+            if (typeof value !== "string" || value.trim() === "")
+                throw new Error(`${where}.${key} must be a non-empty string`);
+            if (key === "path" && (value.startsWith("/") || value.split("/").includes("..")))
+                throw new Error(`${where}.path must be a directory inside the workspace, relative to its declaration`);
+        }
+        else if (key === "command") {
+            if (!Array.isArray(value) || value.length === 0 || !value.every((a) => typeof a === "string" && a !== ""))
+                throw new Error(`${where}.command must be argv, a non-empty list of strings`);
+            if (!value.some((a) => a.includes("{input}")))
+                throw new Error(`${where}.command must pass the input file as {input}`);
+        }
+        else if (key === "outcomes" || key === "allow_unattended" || key === "allowUnattended") {
+            throw new Error(`${where}.${key}: chant's policy step denies and holds only; a non-empty plan always waits for a person (ws-104), so there is no unattended outcome`);
+        }
+        else {
+            throw new Error(`${where}.${key} is not a setting; the settings are engine, path, namespace and command`);
+        }
+    }
+}

package/dist/lifecycle/gate-checkpoint.d.ts

@@ -6,7 +6,7 @@
  * The run writes the file just before it appends the pending fact, and puts
  * the file's digest on that fact as `checkpointDigest`. `chant approve`
  * copies the digest onto the approval, the way it copies the plan digest, and
- * a seal covers it (`../workspace/trust/gate-seal.ts`). A later run that
+ * a seal covers it (`./gate-seal.ts`). A later run that
  * resumes at the gate reads the file back and checks it against the digest
  * the approver saw, so a value pushed onto the branch after the approval is
  * refused rather than carried into the steps after the gate.

package/dist/lifecycle/gate-checkpoint.js

@@ -6,7 +6,7 @@
  * The run writes the file just before it appends the pending fact, and puts
  * the file's digest on that fact as `checkpointDigest`. `chant approve`
  * copies the digest onto the approval, the way it copies the plan digest, and
- * a seal covers it (`../workspace/trust/gate-seal.ts`). A later run that
+ * a seal covers it (`./gate-seal.ts`). A later run that
  * resumes at the gate reads the file back and checks it against the digest
  * the approver saw, so a value pushed onto the branch after the approval is
  * refused rather than carried into the steps after the gate.

package/dist/{workspace/trust → lifecycle}/gate-seal.d.ts

@@ -17,7 +17,7 @@
  * signers line with no `no-touch-required` option (which the signers parser
  * does not accept). An RSA signature over SHA-1 does not verify.
  */
-import type { Signer } from "./trust-files.js";
+import type { Signer } from "../workspace/trust/trust-files.js";
 /**
  * The ssh signature namespace of a gate approval's seal (#3163, ws-080), so a
  * verdict, record or commit signature can't stand in for one.

package/dist/lifecycle/gate-seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-seal.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD,kIAAkI;AAClI,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iGAAiG;IACjG,WAAW,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAWxE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAGtG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAKpE;AA8BD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAmCD,iDAAiD;AACjD,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CA0CtI;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU9D;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID,kJAAkJ;AAClJ,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAYrF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAmB1F"}

package/dist/lifecycle/query.d.ts

@@ -0,0 +1,68 @@
+import type { LedgerReadPort } from "./ledger-port.js";
+/** The version of the table schema below. */
+export declare const QUERY_SCHEMA_VERSION = 1;
+/**
+ * Each table's columns, in order, with their SQLite type. A column named in
+ * the doc as JSON holds a JSON text, for `json_extract`. Every table starts
+ * with `member`: the workspace member whose ledger the row came from, or NULL
+ * for a project outside a workspace.
+ */
+export declare const QUERY_TABLES: {
+    /** One row per resource in each environment's newest snapshot. `attributes` is JSON. */
+    readonly resources: readonly [readonly ["member", "TEXT"], readonly ["env", "TEXT"], readonly ["stack", "TEXT"], readonly ["lexicon", "TEXT"], readonly ["name", "TEXT"], readonly ["type", "TEXT"], readonly ["physical_id", "TEXT"], readonly ["status", "TEXT"], readonly ["last_updated", "TEXT"], readonly ["ownership", "TEXT"], readonly ["attributes", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["observed_at", "TEXT"]];
+    /** One row per snapshot file: what was observed, when, and how many resources it holds. */
+    readonly snapshots: readonly [readonly ["member", "TEXT"], readonly ["env", "TEXT"], readonly ["stack", "TEXT"], readonly ["lexicon", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["observed_at", "TEXT"], readonly ["depth", "TEXT"], readonly ["resources", "INTEGER"], readonly ["unobserved", "INTEGER"]];
+    /** One row per Op run record. `labels` and `outcomes` are JSON. */
+    readonly runs: readonly [readonly ["member", "TEXT"], readonly ["id", "TEXT"], readonly ["op", "TEXT"], readonly ["env", "TEXT"], readonly ["started", "TEXT"], readonly ["ended", "TEXT"], readonly ["status", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["forge", "TEXT"], readonly ["run_url", "TEXT"], readonly ["failure_code", "TEXT"], readonly ["failure_reason", "TEXT"], readonly ["failed_phase", "TEXT"], readonly ["gate", "TEXT"], readonly ["steward", "TEXT"], readonly ["labels", "TEXT"], readonly ["outcomes", "TEXT"]];
+    /** One row per gate ledger line: `kind` is `pending` or `resolution`. `signed` is 1 for a sealed approval. */
+    readonly gates: readonly [readonly ["member", "TEXT"], readonly ["op", "TEXT"], readonly ["gate", "TEXT"], readonly ["kind", "TEXT"], readonly ["timestamp", "TEXT"], readonly ["resolved_by", "TEXT"], readonly ["relayed_by", "TEXT"], readonly ["approver_kind", "TEXT"], readonly ["plan_digest", "TEXT"], readonly ["environment", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["run_id", "TEXT"], readonly ["url", "TEXT"], readonly ["note", "TEXT"], readonly ["expires_at", "TEXT"], readonly ["origin", "TEXT"], readonly ["empty", "INTEGER"], readonly ["signed", "INTEGER"]];
+    /** One row per deploy record in `<env>/releases.jsonl`. `promoted_from`, `restores` and `redeploys` are JSON. */
+    readonly deploys: readonly [readonly ["member", "TEXT"], readonly ["env", "TEXT"], readonly ["component", "TEXT"], readonly ["digest", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["run_id", "TEXT"], readonly ["forge", "TEXT"], readonly ["run_url", "TEXT"], readonly ["timestamp", "TEXT"], readonly ["actor", "TEXT"], readonly ["approver", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["digest_kind", "TEXT"], readonly ["promoted_from", "TEXT"], readonly ["restores", "TEXT"], readonly ["redeploys", "TEXT"]];
+    /** One row per release file whose content hashes to its digest. `envs` joins its targets' environments with commas; `artifacts` is JSON. */
+    readonly releases: readonly [readonly ["member", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["release_member", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["envs", "TEXT"], readonly ["artifacts", "TEXT"]];
+    /** One row per line of `_releases/cuts.jsonl`. `signed` is 1 for a signed cut. */
+    readonly cuts: readonly [readonly ["member", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["label", "TEXT"], readonly ["actor", "TEXT"], readonly ["timestamp", "TEXT"], readonly ["run_id", "TEXT"], readonly ["forge", "TEXT"], readonly ["channel", "TEXT"], readonly ["signed", "INTEGER"], readonly ["composed_base", "TEXT"]];
+};
+export type QueryTable = keyof typeof QUERY_TABLES;
+/** The table that describes the others: one row per column, with the schema version. */
+export declare const SCHEMA_TABLE = "chant_schema";
+type Value = string | number | null;
+export type QueryRow = Record<string, Value>;
+/** The rows of each table, as loaded. */
+export type QueryData = Record<QueryTable, QueryRow[]>;
+/** One ledger to read: a member's, or the project's own with `member` null. */
+export interface QueryLedger {
+    member: string | null;
+    port: LedgerReadPort;
+}
+export interface QueryLoad {
+    data: QueryData;
+    /** Lines and files that could not be read as their kind, per table. Left out of the rows. */
+    malformed: Record<QueryTable, number>;
+}
+export interface QueryResult {
+    schemaVersion: number;
+    columns: string[];
+    rows: QueryRow[];
+    /** How many rows each table held. */
+    tables: Record<QueryTable, number>;
+    malformed: Record<QueryTable, number>;
+}
+/** A statement that can't run, or a Node.js with no SQLite. The message is for a person. */
+export declare class QueryError extends Error {
+}
+/**
+ * Read every table's rows from the ledgers, in the order given. A ledger
+ * whose branch is absent reads as no rows. A line or file that is not its
+ * kind is counted in `malformed` and left out, as each ledger's own reader
+ * does.
+ */
+export declare function loadQueryData(ledgers: readonly QueryLedger[]): Promise<QueryLoad>;
+/** The first word of a statement, past whitespace and comments. */
+export declare function firstWord(sql: string): string;
+/** Run one read-only statement over the tables. */
+export declare function runQuery(sql: string, load: QueryLoad): Promise<QueryResult>;
+/** The rows as an aligned table, a header and a count. */
+export declare function formatQueryResult(r: QueryResult): string;
+export {};
+//# sourceMappingURL=query.d.ts.map

package/dist/lifecycle/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/lifecycle/query.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAItC;;;;;GAKG;AACH,eAAO,MAAM,YAAY;IACvB,wFAAwF;;IAExF,2FAA2F;;IAE3F,mEAAmE;;IAEnE,8GAA8G;;IAE9G,iHAAiH;;IAEjH,4IAA4I;;IAE5I,kFAAkF;;CAEH,CAAC;AAElF,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,YAAY,CAAC;AAEnD,wFAAwF;AACxF,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,KAAK,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AACpC,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE7C,yCAAyC;AACzC,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEvD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,4FAA4F;AAC5F,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAsDxC;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAyEvF;AA6BD,mEAAmE;AACnE,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG7C;AAED,mDAAmD;AACnD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAoCjF;AAID,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAMxD"}