@intentius/chant 0.124.46 → 0.124.48

package/dist/pr-post.d.ts

@@ -14,6 +14,12 @@
  * every hidden HTML comment after its first line is defused, so a forged
  * marker cannot claim another environment's note. A plan job that failed
  * fails the status whatever its report says.
+ *
+ * On GitLab the post runs in a pipeline of the target branch (#4328): a
+ * merge request pipeline is built from the merge request's own files, so a
+ * job there that holds `CHANT_FORGE_TOKEN` runs whatever the change wrote.
+ * `pr-post --open` ({@link postOpenPlanReports}) asks GitLab for each open
+ * merge request's plan job and reads the report from its artifacts.
  */
 import { type PrOverdue, type PrReport } from "./pr-loop.js";
 import { type PrForge } from "./pr-forge.js";
@@ -69,4 +75,40 @@ export declare function planNoteFor(report: PrReport, forge: Pick<PrForge, "kind
  * the caller's sets a failed status and posts no note.
  */
 export declare function postPlanReport(input: PlanPostInput): Promise<PlanPostResult>;
+/** What {@link postOpenPlanReports} posts for. */
+export interface OpenPlanPostInput {
+    /** A GitLab client with {@link PrForge.mergeRequestJobs}, {@link PrForge.jobArtifact} and {@link PrForge.statusUrl}. */
+    forge: PrForge;
+    /** The branch the merge requests merge into: the pipeline's own. */
+    branch: string;
+    /** The plan job's name in the merge request pipeline: `plan`, or `<member>-plan`. */
+    job: string;
+    /** The report directory from the repository root, as the plan job kept it as its artifact. */
+    artifactDir: string;
+    env: string;
+    member?: string;
+    overdue?: () => Promise<PrOverdue[]>;
+}
+/** What {@link postOpenPlanReports} did for one merge request. */
+export interface OpenPlanPost {
+    pr: number;
+    head: string;
+    /** What was posted, or why nothing was: the plan job has not settled, or its result is already posted. */
+    posted?: PlanPostResult;
+    skipped?: string;
+}
+/**
+ * Post the plan note and status of every open merge request into `branch`
+ * whose plan job settled (#4328), from a pipeline of `branch`. GitLab says
+ * which merge requests are open, their heads, and their newest pipeline's
+ * plan job; the report is the one file `pr-plan.json` of that job's
+ * artifacts, read as data as {@link postPlanReport} reads any. The status
+ * links to the plan job, and a status that already links to it is the
+ * job's result posted, so a job is posted for once. The overdue check runs
+ * once for every merge request.
+ */
+export declare function postOpenPlanReports(input: OpenPlanPostInput): Promise<{
+    posts: OpenPlanPost[];
+    warnings: string[];
+}>;
 //# sourceMappingURL=pr-post.d.ts.map

package/dist/pr-post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-post.d.ts","sourceRoot":"","sources":["../src/pr-post.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAmF,KAAK,SAAS,EAAE,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3I,OAAO,EAAoB,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5D,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;CACtC;AAED,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,KAAK,EAAE,OAAO,CAAC;IACf,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,IAAI,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAoB/I;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ3G;AAID;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAkDlF"}
+{"version":3,"file":"pr-post.d.ts","sourceRoot":"","sources":["../src/pr-post.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,EAAmF,KAAK,SAAS,EAAE,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3I,OAAO,EAAoB,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5D,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;CACtC;AAED,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,KAAK,EAAE,OAAO,CAAC;IACf,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,IAAI,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAoB/I;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ3G;AAID;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAkDlF;AAED,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC,wHAAwH;IACxH,KAAK,EAAE,OAAO,CAAC;IACf,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;CACtC;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,0GAA0G;IAC1G,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA6C1H"}

package/dist/pr-post.js

@@ -14,8 +14,15 @@
  * every hidden HTML comment after its first line is defused, so a forged
  * marker cannot claim another environment's note. A plan job that failed
  * fails the status whatever its report says.
+ *
+ * On GitLab the post runs in a pipeline of the target branch (#4328): a
+ * merge request pipeline is built from the merge request's own files, so a
+ * job there that holds `CHANT_FORGE_TOKEN` runs whatever the change wrote.
+ * `pr-post --open` ({@link postOpenPlanReports}) asks GitLab for each open
+ * merge request's plan job and reads the report from its artifacts.
  */
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { prNoteMarker, prStatusContext, prStatusDescription, prStatusState, renderPrNote } from "./pr-loop.js";
 import { forgePrincipalOf } from "./pr-forge.js";
@@ -132,3 +139,62 @@ export async function postPlanReport(input) {
     }
     return { state, description: cut(description), noted: note !== undefined, ...(refused ? { refused } : {}), warnings };
 }
+/**
+ * Post the plan note and status of every open merge request into `branch`
+ * whose plan job settled (#4328), from a pipeline of `branch`. GitLab says
+ * which merge requests are open, their heads, and their newest pipeline's
+ * plan job; the report is the one file `pr-plan.json` of that job's
+ * artifacts, read as data as {@link postPlanReport} reads any. The status
+ * links to the plan job, and a status that already links to it is the
+ * job's result posted, so a job is posted for once. The overdue check runs
+ * once for every merge request.
+ */
+export async function postOpenPlanReports(input) {
+    const { forge } = input;
+    if (!forge.mergeRequestJobs || !forge.jobArtifact || !forge.statusUrl) {
+        throw new Error(`pr-post --open reads the plan jobs of open merge requests, which ${forge.kind} cannot say; it is for GitLab`);
+    }
+    const context = prStatusContext("plan", input.member);
+    const warnings = [];
+    let overdue;
+    const overdueOnce = input.overdue ? () => (overdue ?? (overdue = input.overdue())) : undefined;
+    const posts = [];
+    for (const job of await forge.mergeRequestJobs(input.branch, input.job)) {
+        const settled = job.status === "success" ? "success" : job.status === "failed" ? "failure" : job.status === "canceled" ? "cancelled" : undefined;
+        if (!settled) {
+            posts.push({ pr: job.pr, head: job.head, skipped: `the plan job is ${job.status}` });
+            continue;
+        }
+        try {
+            if (job.url && (await forge.statusUrl(job.head, context)) === job.url) {
+                posts.push({ pr: job.pr, head: job.head, skipped: "this plan job's result is already posted" });
+                continue;
+            }
+            const dir = mkdtempSync(join(tmpdir(), "chant-pr-post-"));
+            try {
+                const text = await forge.jobArtifact(job.id, `${input.artifactDir.replace(/\/+$/, "")}/${PR_PLAN_REPORT_FILE}`);
+                if (text !== undefined)
+                    writeFileSync(join(dir, PR_PLAN_REPORT_FILE), text);
+                const posted = await postPlanReport({
+                    // The status links to the plan job it reports on, which is how the next run knows it is posted.
+                    forge: job.url ? { ...forge, runUrl: job.url } : forge,
+                    dir,
+                    pr: job.pr,
+                    head: job.head,
+                    env: input.env,
+                    ...(input.member ? { member: input.member } : {}),
+                    result: settled,
+                    ...(overdueOnce ? { overdue: overdueOnce } : {}),
+                });
+                posts.push({ pr: job.pr, head: job.head, posted });
+            }
+            finally {
+                rmSync(dir, { recursive: true, force: true });
+            }
+        }
+        catch (err) {
+            warnings.push(`!${job.pr}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return { posts, warnings };
+}

package/dist/read-filter.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Typed filters for the contract reads (#4363): `--where <field><op><value>`
+ * and `--since <time>`, in place of an embedded SQL engine.
+ *
+ * Each read declares the fields it can be filtered on and their types
+ * ({@link FilterFields}). A clause naming a field the read doesn't declare, an
+ * operator its type doesn't take, or a value that isn't of its type is a
+ * {@link FilterError} before anything is read, so a typo never filters to an
+ * empty answer. Several `--where` clauses all have to hold.
+ *
+ * Operators: `=` and `!=` for every type; `<`, `<=`, `>` and `>=` for
+ * numbers, times and text (text compares by code point); `~` for text, which
+ * holds when the field contains the value. The value `null` matches a field
+ * that is null or absent, with `=` and `!=` only.
+ *
+ * A field of type `json` holds an object: a clause can name a key under it
+ * with dots (`labels.team=core`), and the value is compared as the type it
+ * holds there (a number with a number, a boolean with `true` or `false`, any
+ * other value as text). A JSON text is parsed first, so a ledger row that
+ * keeps the object as text filters the same way.
+ *
+ * A null or absent field matches only `=null` and `!=` with a value other
+ * than null; the other operators never hold for it.
+ *
+ * Pure: no I/O, so a bundle that filters rows loads nothing else.
+ */
+export type FilterFieldType = "text" | "number" | "boolean" | "time" | "json";
+/** The fields a read can be filtered on, by name, with their types. */
+export type FilterFields = Readonly<Record<string, FilterFieldType>>;
+/** Every operator, longest first so `!=` is not read as `=`. */
+export declare const WHERE_OPERATORS: readonly ["!=", "<=", ">=", "=", "<", ">", "~"];
+export type WhereOperator = (typeof WHERE_OPERATORS)[number];
+/** One parsed `--where` clause. */
+export interface WhereClause {
+    /** The field as written, with any path under a `json` field. */
+    field: string;
+    /** The declared field the clause starts at. */
+    base: string;
+    /** The keys under a `json` field, or `[]`. */
+    path: string[];
+    type: FilterFieldType;
+    op: WhereOperator;
+    /** The value as written. */
+    raw: string;
+    /** The value read as the field's type: a number for `number` and `time` (epoch ms), a boolean, a string, or null. */
+    value: string | number | boolean | null;
+}
+/** A clause or a `--since` that can't be applied. The message is for a person. */
+export declare class FilterError extends Error {
+}
+/**
+ * An instant from an ISO 8601 date or time, or from a span back from `now`:
+ * `<n>m`, `<n>h`, `<n>d` or `<n>w`. Epoch milliseconds, or null when `text`
+ * is neither.
+ */
+export declare function parseInstant(text: string, now?: Date): number | null;
+/** `--since <time>` as an ISO instant, or a {@link FilterError}. */
+export declare function parseSince(text: string, now?: Date): string;
+/** Parse each `--where` against the fields a read declares. Throws a {@link FilterError}. */
+export declare function parseWhere(exprs: readonly string[], fields: FilterFields, now?: Date): WhereClause[];
+/** Whether one clause holds for `row`. */
+export declare function clauseHolds(row: unknown, c: WhereClause): boolean;
+/** Whether every clause holds for `row`. */
+export declare function matchesWhere(row: unknown, clauses: readonly WhereClause[]): boolean;
+//# sourceMappingURL=read-filter.d.ts.map

package/dist/read-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-filter.d.ts","sourceRoot":"","sources":["../src/read-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9E,uEAAuE;AACvE,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;AAErE,gEAAgE;AAChE,eAAO,MAAM,eAAe,YAAI,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;AAC/E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,mCAAmC;AACnC,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,eAAe,CAAC;IACtB,EAAE,EAAE,aAAa,CAAC;IAClB,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,qHAAqH;IACrH,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;CACzC;AAED,kFAAkF;AAClF,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAIzC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,GAAG,IAAI,CAShF;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,CAIvE;AAaD,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,GAAE,IAAiB,GAAG,WAAW,EAAE,CAqChH;AA+BD,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CA0BjE;AAED,4CAA4C;AAC5C,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAEnF"}

package/dist/read-filter.js

@@ -0,0 +1,179 @@
+/**
+ * Typed filters for the contract reads (#4363): `--where <field><op><value>`
+ * and `--since <time>`, in place of an embedded SQL engine.
+ *
+ * Each read declares the fields it can be filtered on and their types
+ * ({@link FilterFields}). A clause naming a field the read doesn't declare, an
+ * operator its type doesn't take, or a value that isn't of its type is a
+ * {@link FilterError} before anything is read, so a typo never filters to an
+ * empty answer. Several `--where` clauses all have to hold.
+ *
+ * Operators: `=` and `!=` for every type; `<`, `<=`, `>` and `>=` for
+ * numbers, times and text (text compares by code point); `~` for text, which
+ * holds when the field contains the value. The value `null` matches a field
+ * that is null or absent, with `=` and `!=` only.
+ *
+ * A field of type `json` holds an object: a clause can name a key under it
+ * with dots (`labels.team=core`), and the value is compared as the type it
+ * holds there (a number with a number, a boolean with `true` or `false`, any
+ * other value as text). A JSON text is parsed first, so a ledger row that
+ * keeps the object as text filters the same way.
+ *
+ * A null or absent field matches only `=null` and `!=` with a value other
+ * than null; the other operators never hold for it.
+ *
+ * Pure: no I/O, so a bundle that filters rows loads nothing else.
+ */
+/** Every operator, longest first so `!=` is not read as `=`. */
+export const WHERE_OPERATORS = ["!=", "<=", ">=", "=", "<", ">", "~"];
+/** A clause or a `--since` that can't be applied. The message is for a person. */
+export class FilterError extends Error {
+}
+const ORDERED = ["<", "<=", ">", ">="];
+/**
+ * An instant from an ISO 8601 date or time, or from a span back from `now`:
+ * `<n>m`, `<n>h`, `<n>d` or `<n>w`. Epoch milliseconds, or null when `text`
+ * is neither.
+ */
+export function parseInstant(text, now = new Date()) {
+    const span = /^(\d+)([mhdw])$/.exec(text.trim());
+    if (span) {
+        const unit = { m: 60000, h: 3600000, d: 86400000, w: 604800000 }[span[2]];
+        return now.getTime() - Number(span[1]) * unit;
+    }
+    if (!/^\d{4}-\d{2}-\d{2}/.test(text.trim()))
+        return null;
+    const ms = Date.parse(text);
+    return Number.isNaN(ms) ? null : ms;
+}
+/** `--since <time>` as an ISO instant, or a {@link FilterError}. */
+export function parseSince(text, now = new Date()) {
+    const ms = parseInstant(text, now);
+    if (ms === null)
+        throw new FilterError(`--since takes an ISO 8601 date or time, or a span back from now such as 24h or 7d, not ${JSON.stringify(text)}`);
+    return new Date(ms).toISOString();
+}
+/** The declared field a dotted name starts at: the whole name, or its longest declared `json` prefix. */
+function resolveField(name, fields) {
+    if (Object.prototype.hasOwnProperty.call(fields, name))
+        return { base: name, path: [], type: fields[name] };
+    const parts = name.split(".");
+    for (let i = parts.length - 1; i > 0; i--) {
+        const base = parts.slice(0, i).join(".");
+        if (Object.prototype.hasOwnProperty.call(fields, base) && fields[base] === "json")
+            return { base, path: parts.slice(i), type: "json" };
+    }
+    return null;
+}
+/** Parse each `--where` against the fields a read declares. Throws a {@link FilterError}. */
+export function parseWhere(exprs, fields, now = new Date()) {
+    const names = Object.keys(fields).join(", ");
+    return exprs.map((expr) => {
+        const m = /^([A-Za-z_][\w.-]*)\s*(!=|<=|>=|=|<|>|~)(.*)$/s.exec(expr);
+        if (!m)
+            throw new FilterError(`--where takes <field><op><value>, with op one of ${WHERE_OPERATORS.join(" ")}, not ${JSON.stringify(expr)}`);
+        const [, field, op, rawValue] = m;
+        const raw = rawValue.trim();
+        const found = resolveField(field, fields);
+        if (!found)
+            throw new FilterError(`--where ${field}: no such field; this read filters on ${names}`);
+        const { base, path, type } = found;
+        if (type === "json" && path.length === 0)
+            throw new FilterError(`--where ${field}: holds an object; name a key under it, such as ${field}.<key>`);
+        const clause = (value) => ({ field, base, path, type, op, raw, value });
+        if (raw === "null") {
+            if (op !== "=" && op !== "!=")
+                throw new FilterError(`--where ${field}${op}null: null takes = or != only`);
+            return clause(null);
+        }
+        if (op === "~" && type !== "text" && type !== "json")
+            throw new FilterError(`--where ${field}~: ~ (contains) takes a text field; ${field} is ${type}`);
+        switch (type) {
+            case "number": {
+                const n = Number(raw);
+                if (raw === "" || !Number.isFinite(n))
+                    throw new FilterError(`--where ${field}: ${field} is a number, not ${JSON.stringify(raw)}`);
+                return clause(n);
+            }
+            case "boolean": {
+                if (ORDERED.includes(op))
+                    throw new FilterError(`--where ${field}${op}: a boolean takes = or != only`);
+                if (raw !== "true" && raw !== "false")
+                    throw new FilterError(`--where ${field}: ${field} is true or false, not ${JSON.stringify(raw)}`);
+                return clause(raw === "true");
+            }
+            case "time": {
+                const ms = parseInstant(raw, now);
+                if (ms === null)
+                    throw new FilterError(`--where ${field}: ${field} is a time; give an ISO 8601 date or time, or a span back from now such as 24h or 7d, not ${JSON.stringify(raw)}`);
+                return clause(ms);
+            }
+            default:
+                return clause(raw);
+        }
+    });
+}
+/** The value at a clause's field in `row`, parsing a JSON text on the way into a `json` field. */
+function valueAt(row, c) {
+    let v = row;
+    for (const key of c.base.split("."))
+        v = v !== null && typeof v === "object" ? v[key] : undefined;
+    for (const key of c.path) {
+        if (typeof v === "string") {
+            try {
+                v = JSON.parse(v);
+            }
+            catch {
+                return undefined;
+            }
+        }
+        v = v !== null && typeof v === "object" && !Array.isArray(v) ? v[key] : undefined;
+    }
+    return v;
+}
+function compare(a, b, op) {
+    switch (op) {
+        case "=": return a === b;
+        case "!=": return a !== b;
+        case "<": return a < b;
+        case "<=": return a <= b;
+        case ">": return a > b;
+        case ">=": return a >= b;
+        case "~": return String(a).includes(String(b));
+    }
+}
+/** Whether one clause holds for `row`. */
+export function clauseHolds(row, c) {
+    const v = valueAt(row, c);
+    if (c.value === null)
+        return c.op === "=" ? v === null || v === undefined : v !== null && v !== undefined;
+    if (v === null || v === undefined)
+        return c.op === "!=";
+    switch (c.type) {
+        case "number":
+            return typeof v === "number" && compare(v, c.value, c.op);
+        case "boolean":
+            return typeof v === "boolean" ? (c.op === "=") === (v === c.value) : false;
+        case "time": {
+            const ms = typeof v === "string" ? Date.parse(v) : typeof v === "number" ? v : NaN;
+            return !Number.isNaN(ms) && compare(ms, c.value, c.op);
+        }
+        case "text":
+            return typeof v === "string" && compare(v, c.value, c.op);
+        case "json": {
+            // Compared as the type the value holds there.
+            if (typeof v === "number" && c.op !== "~") {
+                const n = Number(c.raw);
+                return Number.isFinite(n) && compare(v, n, c.op);
+            }
+            if (typeof v === "boolean")
+                return (c.raw === "true" || c.raw === "false") && (c.op === "=" || c.op === "!=") ? (c.op === "=") === (String(v) === c.raw) : false;
+            const s = typeof v === "string" ? v : JSON.stringify(v);
+            return compare(s, c.raw, c.op);
+        }
+    }
+}
+/** Whether every clause holds for `row`. */
+export function matchesWhere(row, clauses) {
+    return clauses.every((c) => clauseHolds(row, c));
+}

package/dist/run-event.d.ts

@@ -47,7 +47,7 @@ export type RunEventStepStatus = "ok" | "failed" | "skipped" | "cached" | "gated
 /** Why a step was skipped. */
 export type RunEventSkipReason = "receipt" | "resumed" | "refused" | "not-run";
 /** How a gate's approval passed, when it was more than one person's approval of that gate. */
-export type RunEventGateVia = "quorum" | "policy" | "point" | "alias" | "empty";
+export type RunEventGateVia = "quorum" | "policy" | "point" | "alias" | "empty" | "workspace";
 /** The run every event of a stream names: the same on every line. */
 export interface RunEventRun {
     /**

package/dist/run-event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-event.d.ts","sourceRoot":"","sources":["../src/run-event.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,oFAAoF,CAAC;AAErH,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,8EAA8E;AAC9E,eAAO,MAAM,eAAe,aAAa,CAAC;AAE1C,2FAA2F;AAC3F,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,WAAW,GAAG,UAAU,CAAC;AAE3D,gGAAgG;AAChG,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;AAEzD,gHAAgH;AAChH,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAEzE;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAE9F,8BAA8B;AAC9B,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEhF,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,eAAe,CAAC;IACzB;;;;OAIG;IACH,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,iDAAiD;AACjD,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,OAAO,EAAE,OAAO,mBAAmB,CAAC;IACpC,QAAQ,EAAE,OAAO,0BAA0B,CAAC;IAC5C,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,CAAC;IAClB,mGAAmG;IACnG,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC;CAC1B;AAED,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED,2GAA2G;AAC3G,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,oBAAoB,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAEjG,8GAA8G;AAC9G,eAAO,MAAM,8BAA8B,aAAa,CAAC;AAEzD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,6BAA6B,CAAC;IACtC,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,0HAA0H;AAC1H,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,kBAAkB,CAAC;IAC3B,kEAAkE;IAClE,IAAI,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,sBAAsB,GACtB,uBAAuB,GACvB,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEhD,wFAAwF;AACxF,eAAO,MAAM,eAAe,uMAagB,CAAC;AAE7C,kCAAkC;AAClC,MAAM,MAAM,QAAQ,GAAG,YAAY,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,YAAY,GAAG,gBAAgB,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;AAEtH,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,EAAE,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IACnB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,GAAG,QAAQ,CAiBhF;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,QAAQ,CAI/G;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,IAAI,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAC;IACnC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,WAAW,CAAC;IACjB,yDAAyD;IACzD,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,cAAc,CAYhF;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,CA8BxE;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE;IACH,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC,GACA,YAAY,EAAE,CAqDhB"}
+{"version":3,"file":"run-event.d.ts","sourceRoot":"","sources":["../src/run-event.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,oFAAoF,CAAC;AAErH,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,8EAA8E;AAC9E,eAAO,MAAM,eAAe,aAAa,CAAC;AAE1C,2FAA2F;AAC3F,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,WAAW,GAAG,UAAU,CAAC;AAE3D,gGAAgG;AAChG,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;AAEzD,gHAAgH;AAChH,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAEzE;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAE9F,8BAA8B;AAC9B,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;AAE9F,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,eAAe,CAAC;IACzB;;;;OAIG;IACH,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,iDAAiD;AACjD,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,OAAO,EAAE,OAAO,mBAAmB,CAAC;IACpC,QAAQ,EAAE,OAAO,0BAA0B,CAAC;IAC5C,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,CAAC;IAClB,mGAAmG;IACnG,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC;CAC1B;AAED,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED,2GAA2G;AAC3G,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,oBAAoB,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAEjG,8GAA8G;AAC9G,eAAO,MAAM,8BAA8B,aAAa,CAAC;AAEzD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,6BAA6B,CAAC;IACtC,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,0HAA0H;AAC1H,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,kBAAkB,CAAC;IAC3B,kEAAkE;IAClE,IAAI,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,sBAAsB,GACtB,uBAAuB,GACvB,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEhD,wFAAwF;AACxF,eAAO,MAAM,eAAe,uMAagB,CAAC;AAE7C,kCAAkC;AAClC,MAAM,MAAM,QAAQ,GAAG,YAAY,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,YAAY,GAAG,gBAAgB,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;AAEtH,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,EAAE,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IACnB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,GAAG,QAAQ,CAiBhF;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,QAAQ,CAI/G;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,IAAI,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAC;IACnC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,WAAW,CAAC;IACjB,yDAAyD;IACzD,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,cAAc,CAYhF;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,CA8BxE;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE;IACH,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC,GACA,YAAY,EAAE,CAqDhB"}

package/dist/terraform/carve.d.ts

@@ -10,8 +10,9 @@
  * (via live import) and generating the TF patches live in the command/bridge
  * layers; this module just classifies the boundary.
  */
-import { type ScoreOptions } from "./score.js";
-import type { TfGraph } from "./types.js";
+import { type Peelability, type ScoreOptions } from "./score.js";
+import { type Adjacency } from "../graph-walk.js";
+import type { TfEdge, TfGraph, TfNode } from "./types.js";
 /** One resource in the carve set (the selected node plus its folded sub-resources). */
 export interface CarveMember {
     address: string;
@@ -77,7 +78,20 @@ export interface CarveReport {
  * that fold into it (same name, a `foldParentOf` child type whose parent is the
  * selection). Those are carried along and inlined, not left behind.
  */
-export declare function resolveCarveSet(graph: TfGraph, target: string): CarveMember[];
+export declare function resolveCarveSet(graph: TfGraph, target: string, index?: BoundaryIndex): CarveMember[];
+/**
+ * What `boundaryReport` looks up per target, built once per graph: nodes by
+ * address, the edges by both ends, and each fold parent's children in graph
+ * order. Without it each report scans the node and edge lists itself, which
+ * over a whole estate is O(V·E) (#4391).
+ */
+export interface BoundaryIndex {
+    byAddress: Map<string, TfNode>;
+    adjacency: Adjacency<TfEdge>;
+    /** `foldKey(parent type, name)` → resource nodes that fold into that parent. */
+    foldChildren: Map<string, TfNode[]>;
+}
+export declare function boundaryIndex(graph: TfGraph): BoundaryIndex;
 /**
  * Which source the graph came from, and so which vocabulary its bridge patches
  * are named in. Terraform is the default; `cdk` is the read-only cloud-assembly
@@ -89,6 +103,13 @@ export interface BoundaryOptions {
     dialect?: CarveDialect;
     /** Scoring hooks, so `peelability` is the same number the ranking reported. */
     score?: ScoreOptions;
+    /**
+     * The target's score, when the caller already holds it (`carve advise`).
+     * Without it the estate is scored to find it (#4391).
+     */
+    peelability?: Pick<Peelability, "score">;
+    /** `boundaryIndex(graph)`, shared across calls on one graph. */
+    index?: BoundaryIndex;
 }
 /**
  * Classify the boundary of carving `target`: the inbound edges that need an

package/dist/terraform/carve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"carve.d.ts","sourceRoot":"","sources":["../../src/terraform/carve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,UAAU,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;;;;;OAMG;IACH,MAAM,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,YAAY,GAAG,oBAAoB,GAAG,gBAAgB,CAAC;IACxG,QAAQ,EAAE,aAAa,GAAG,UAAU,CAAC;IACrC,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iFAAiF;IACjF,UAAU,EAAE,IAAI,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CAgB7E;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,KAAK,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAQD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,WAAW,GAAG,IAAI,CA0D7G;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CAajE"}
+{"version":3,"file":"carve.d.ts","sourceRoot":"","sources":["../../src/terraform/carve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAe,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEvD,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,UAAU,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;;;;;OAMG;IACH,MAAM,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,YAAY,GAAG,oBAAoB,GAAG,gBAAgB,CAAC;IACxG,QAAQ,EAAE,aAAa,GAAG,UAAU,CAAC;IACrC,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iFAAiF;IACjF,UAAU,EAAE,IAAI,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,aAAa,GAAG,WAAW,EAAE,CAYpG;AAID;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7B,gFAAgF;IAChF,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACrC;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAgB3D;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,KAAK,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACzC,gEAAgE;IAChE,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAQD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,WAAW,GAAG,IAAI,CA0D7G;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CAajE"}

package/dist/terraform/carve.js

@@ -13,29 +13,47 @@
 import { inboundEdges, outboundEdges } from "./graph.js";
 import { foldParentOf, resolveTier } from "./tier-map.js";
 import { scoreEstate } from "./score.js";
+import { adjacencyOf } from "../graph-walk.js";
 /**
  * The carve set for a selected address: the node itself plus any sub-resources
  * that fold into it (same name, a `foldParentOf` child type whose parent is the
  * selection). Those are carried along and inlined, not left behind.
  */
-export function resolveCarveSet(graph, target) {
-    const byAddress = new Map(graph.nodes.map((n) => [n.address, n]));
+export function resolveCarveSet(graph, target, index) {
+    const { byAddress, foldChildren } = index ?? boundaryIndex(graph);
     const selected = byAddress.get(target);
     if (!selected)
         return [];
     const members = [{ address: selected.address, type: selected.type }];
     if (selected.kind === "resource" && selected.type) {
-        for (const node of graph.nodes) {
-            if (node.kind !== "resource" || !node.type)
-                continue;
-            const parentType = foldParentOf(node.type);
-            if (parentType === selected.type && node.name === selected.name) {
-                members.push({ address: node.address, type: node.type, foldedInto: selected.address });
-            }
+        for (const node of foldChildren.get(foldKey(selected.type, selected.name)) ?? []) {
+            members.push({ address: node.address, type: node.type, foldedInto: selected.address });
         }
     }
     return members;
 }
+const foldKey = (parentType, name) => `${parentType}\u001f${name}`;
+export function boundaryIndex(graph) {
+    const foldChildren = new Map();
+    for (const node of graph.nodes) {
+        if (node.kind !== "resource" || !node.type)
+            continue;
+        const parentType = foldParentOf(node.type);
+        if (!parentType)
+            continue;
+        const key = foldKey(parentType, node.name);
+        const list = foldChildren.get(key);
+        if (list)
+            list.push(node);
+        else
+            foldChildren.set(key, [node]);
+    }
+    return {
+        byAddress: new Map(graph.nodes.map((n) => [n.address, n])),
+        adjacency: adjacencyOf(graph.edges),
+        foldChildren,
+    };
+}
 /** The bridge patch an inbound cut needs, per source. */
 function inboundBridge(dialect, fromOutput) {
     if (dialect === "cdk")
@@ -50,14 +68,14 @@ function inboundBridge(dialect, fromOutput) {
  */
 export function boundaryReport(graph, target, opts = {}) {
     const dialect = opts.dialect ?? "terraform";
-    const carveSet = resolveCarveSet(graph, target);
+    const carveSet = resolveCarveSet(graph, target, opts.index);
     if (carveSet.length === 0)
         return null;
     const inSet = new Set(carveSet.map((m) => m.address));
     const inbound = [];
     const outbound = [];
     for (const member of carveSet) {
-        for (const e of inboundEdges(graph, member.address)) {
+        for (const e of (opts.index ? (opts.index.adjacency.in.get(member.address) ?? []) : inboundEdges(graph, member.address))) {
             if (inSet.has(e.from))
                 continue; // internal edge
             inbound.push({
@@ -71,7 +89,7 @@ export function boundaryReport(graph, target, opts = {}) {
                 ...(e.crossStack ? { crossStack: true } : {}),
             });
         }
-        for (const e of outboundEdges(graph, member.address)) {
+        for (const e of (opts.index ? (opts.index.adjacency.out.get(member.address) ?? []) : outboundEdges(graph, member.address))) {
             if (inSet.has(e.to))
                 continue; // internal edge
             outbound.push({
@@ -86,12 +104,12 @@ export function boundaryReport(graph, target, opts = {}) {
             });
         }
     }
-    const score = scoreEstate(graph, opts.score).find((r) => r.address === target);
+    const score = opts.peelability ?? scoreEstate(graph, { ...opts.score, radius: false }).find((r) => r.address === target);
     const diagnostics = [];
     const tierOf = opts.score?.tierOf ?? resolveTier;
     if (carveSet[0].type &&
         tierOf(carveSet[0].type) === null &&
-        graph.nodes.find((n) => n.address === target)?.kind === "resource") {
+        (opts.index?.byAddress ?? new Map(graph.nodes.map((n) => [n.address, n]))).get(target)?.kind === "resource") {
         diagnostics.push(`No known native mapping for ${carveSet[0].type} — emit will have no target type.`);
     }
     return {