@intentius/chant 0.124.46 → 0.124.48

package/src/graph-ir.ts

@@ -210,6 +210,33 @@ export interface LexiconWorkspaceOutputs {
   gaps?: string[];
 }
 
+/**
+ * One link a lexicon reads from its own declarations (#4397): an output of
+ * another member that a declaration depends on, such as a table an otel
+ * `clickhouse` exporter writes.
+ */
+export interface LexiconWorkspaceLink {
+  /** The producer's output the declaration reads or writes: `default.otel_logs`, `default.otel_logs.Body`. */
+  output: string;
+  /**
+   * The output that picks the producer when `member` is unset; unset, the
+   * output itself. A column is anchored on its table, so a dropped column is
+   * missing from the member that still has the table.
+   */
+  anchor?: string;
+  /** The producer, when the declaration names it. Unset, the one member exposing `anchor`. */
+  member?: string;
+  /** The entity key that states the link, for the finding's file and line. */
+  entity: string;
+}
+
+/** What a lexicon's `workspaceLinks` hook returns (#4397). */
+export interface LexiconWorkspaceLinks {
+  links: LexiconWorkspaceLink[];
+  /** Places the hook could not read without the environment, one line each. Their links are left out. */
+  gaps?: string[];
+}
+
 /** What a lexicon's `graphEdges` hook returns (#3910). */
 export interface LexiconGraphEdges {
   references: LexiconGraphReference[];

package/src/graph-walk.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, test } from "vitest";
+import { adjacencyOf, walkBreadthFirst } from "./graph-walk";
+
+const edges = [
+  { from: "a", to: "b" },
+  { from: "b", to: "c" },
+  { from: "c", to: "a" },
+  { from: "c", to: "d" },
+];
+const idx = adjacencyOf(edges);
+const out = (id: string) => (idx.out.get(id) ?? []).map((e) => ({ far: e.to, hops: [e] }));
+
+describe("walkBreadthFirst", () => {
+  test("offers every node at its shortest depth first, and ends on a cycle", () => {
+    const first = new Map<string, number>();
+    const found = walkBreadthFirst("a", {
+      steps: out,
+      arrive: ({ id, depth }) => {
+        if (!first.has(id)) first.set(id, depth);
+        return false;
+      },
+    });
+    expect(found).toBeNull();
+    expect([...first]).toEqual([["b", 1], ["c", 2], ["a", 3], ["d", 3]]);
+  });
+
+  test("stops on the first accepted arrival and returns its hops", () => {
+    const found = walkBreadthFirst("a", { steps: out, arrive: ({ id }) => id === "d" });
+    expect(found?.depth).toBe(3);
+    expect(found?.hops.map((h) => `${h.from}->${h.to}`)).toEqual(["a->b", "b->c", "c->d"]);
+  });
+
+  test("min and max bound which arrivals are offered and how far it steps", () => {
+    const offered: string[] = [];
+    walkBreadthFirst("a", { steps: out, min: 2, max: 2, arrive: ({ id }) => (offered.push(id), false) });
+    expect(offered).toEqual(["c"]);
+  });
+
+  test("walks from several starts at once", () => {
+    const offered = new Set<string>();
+    walkBreadthFirst(["c", "b"], { steps: out, arrive: ({ id }) => (offered.add(id), false) });
+    expect([...offered].sort()).toEqual(["a", "b", "c", "d"]);
+  });
+});

package/src/graph-walk.ts

@@ -0,0 +1,102 @@
+/**
+ * The one breadth-first edge walk in core.
+ *
+ * `chant search`'s transitive edge terms (#4359) walk the graph IR, and carve's
+ * reachability (#2325) and reference-closed sets (#3909) walk a `TfGraph`. The
+ * two graphs have different node and edge shapes but the same walk: an index of
+ * each node's edges by direction, built once, and a frontier that steps along
+ * it. This module is that walk, generic over what a step carries, so neither
+ * caller keeps a traversal of its own.
+ *
+ * Pure: no IR or Terraform types, no filesystem.
+ */
+
+/** Edges grouped by the node they leave (`out`) and the node they enter (`in`). */
+export interface Adjacency<E> {
+  out: Map<string, E[]>;
+  in: Map<string, E[]>;
+}
+
+/**
+ * Index edges by both ends, once. Looking a node's edges up in here is O(1),
+ * where filtering the edge list for them is O(E) per node and O(V·E) per walk
+ * (#2325 measured 21 s against 52 ms at 6 000 nodes).
+ */
+export function adjacencyOf<E extends { from: string; to: string }>(edges: Iterable<E>): Adjacency<E> {
+  const idx: Adjacency<E> = { out: new Map(), in: new Map() };
+  for (const e of edges) {
+    let out = idx.out.get(e.from);
+    if (!out) idx.out.set(e.from, (out = []));
+    out.push(e);
+    let inn = idx.in.get(e.to);
+    if (!inn) idx.in.set(e.to, (inn = []));
+    inn.push(e);
+  }
+  return idx;
+}
+
+/** One step out of a node: where it lands, and the hops (edges) it took to get there. */
+export interface WalkStep<H> {
+  far: string;
+  hops: readonly H[];
+}
+
+/** A node reached by the walk: its id, how many steps from the start, and the hops on the way. */
+export interface WalkArrival<H> {
+  id: string;
+  depth: number;
+  hops: H[];
+}
+
+export interface WalkOptions<H> {
+  /** The steps out of a node. The walk follows exactly these; filter here. */
+  steps: (id: string) => readonly WalkStep<H>[];
+  /** Arrivals shallower than this are walked through but not offered. Default 1. */
+  min?: number;
+  /** No step is taken from a node this deep. Default unbounded. */
+  max?: number;
+  /**
+   * Called for each arrival at a depth of at least `min`, in breadth-first
+   * order, so a node's first arrival is at its shortest depth. A node can
+   * arrive more than once (by several edges, or again past `min` on a cycle);
+   * return true to stop the walk and return this arrival.
+   */
+  arrive?: (arrival: WalkArrival<H>) => boolean;
+}
+
+/**
+ * Walk breadth-first from one or more start nodes (#4359, #2325).
+ *
+ * Termination on a cycle: a state is (node, depth capped at `min`). Past the
+ * minimum, arriving at a node again by a longer walk can reach nothing the
+ * first arrival could not, so it is not queued twice. The state space is
+ * finite and the walk always ends, which matters for carve: chant never runs
+ * Terraform, so a `depends_on` cycle in a malformed estate reaches it
+ * unvalidated.
+ *
+ * Returns the arrival `arrive` stopped on, or null when the walk ran out.
+ */
+export function walkBreadthFirst<H>(start: string | Iterable<string>, opts: WalkOptions<H>): WalkArrival<H> | null {
+  const min = opts.min ?? 1;
+  const max = opts.max ?? Infinity;
+  const starts = typeof start === "string" ? [start] : [...start];
+  const seen = new Set<string>(starts.map((id) => `${id}|0`));
+  let frontier: WalkArrival<H>[] = starts.map((id) => ({ id, depth: 0, hops: [] }));
+  while (frontier.length > 0) {
+    const next: WalkArrival<H>[] = [];
+    for (const s of frontier) {
+      if (s.depth >= max) continue;
+      for (const step of opts.steps(s.id)) {
+        const depth = s.depth + 1;
+        const arrival: WalkArrival<H> = { id: step.far, depth, hops: step.hops.length ? [...s.hops, ...step.hops] : s.hops };
+        if (depth >= min && opts.arrive?.(arrival)) return arrival;
+        const key = `${step.far}|${Math.min(depth, min)}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        next.push(arrival);
+      }
+    }
+    frontier = next;
+  }
+  return null;
+}

package/src/import/parser.ts

@@ -57,6 +57,24 @@ export interface OutputIR {
   readonly condition?: string;
 }
 
+/**
+ * A finding a parser reports about the translation it made (#4398): a
+ * judgment call the author must confirm, or something it could not carry.
+ * `chant import --report <path>` writes these as SARIF and `--strict` fails
+ * while any `warning` or `error` is open, as `chant migrate` does.
+ */
+export interface ImportDiagnostic {
+  readonly ruleId: string;
+  readonly severity: "error" | "warning" | "info";
+  readonly message: string;
+  /** 1-based line in the template, when the parser knows it. */
+  readonly line?: number;
+  /** 1-based column in the template. */
+  readonly column?: number;
+  /** The object the finding is about, as the source names it. */
+  readonly entity?: string;
+}
+
 /**
  * Intermediate representation of a parsed template
  */
@@ -71,6 +89,8 @@ export interface TemplateIR {
   /** Sections or keys the parser read but import cannot carry, named so the
    * import surfaces them instead of dropping them silently (#2069). */
   readonly warnings?: string[];
+  /** Findings for `--report` and `--strict` (#4398); a parser that has none leaves it out. */
+  readonly diagnostics?: ImportDiagnostic[];
 }
 
 /**

package/src/lexicon.ts

@@ -3,8 +3,8 @@ import type { Serializer } from "./serializer";
 import type { Declarable } from "./declarable";
 import type { LintRule } from "./lint/rule";
 import type { RuleSpec } from "./lint/declarative";
-import type { PostSynthCheck } from "./lint/post-synth";
-import type { TemplateParser, TemplateIR, ParseContext, ParserOptions, ParserOptionSpec } from "./import/parser";
+import type { CrossRootCheck, PostSynthCheck } from "./lint/post-synth";
+import type { TemplateParser, TemplateIR, ParseContext, ParserOptions, ParserOptionSpec, ImportDiagnostic } from "./import/parser";
 import type { TypeScriptGenerator } from "./import/generator";
 import type { EmbeddedContentImporter } from "./import/embedded";
 import type { AgentConfigImporter } from "./agents/importer";
@@ -24,7 +24,7 @@ import type { OwnershipChannel, OwnershipMarker } from "./ownership";
 import type { LexiconConfigSchema } from "./lexicon-config";
 import type { RuleMeta } from "./audit/catalog";
 import type { ReferenceCatalog } from "./graph-refs";
-import type { IREdge, LexiconGraphEdges, LexiconUnreadSource, LexiconWorkspaceOutputs } from "./graph-ir";
+import type { IREdge, LexiconGraphEdges, LexiconUnreadSource, LexiconWorkspaceLinks, LexiconWorkspaceOutputs } from "./graph-ir";
 import type { DescribeResourcesResult, UnobservedReason } from "./observation";
 import type { DescribeIdentityOptions, DescribeIdentityResult } from "./identity";
 import type { DeepNormalizationHooks, DeepObservationResult } from "./deep-observation";
@@ -382,8 +382,11 @@ export function intrinsicCallFoldsEagerly(def: { isTag?: boolean; foldsEagerly?:
  * Options passed to a MigrationSource by `chant migrate`.
  */
 export interface MigrateOptions {
-  /** Output format. */
-  emit?: "yaml" | "ts";
+  /**
+   * Output format. `yaml` and `ts` are the gitlab pair's; `sql` writes plain
+   * DDL for a pair whose target is a database (#4399).
+   */
+  emit?: "yaml" | "ts" | "sql";
   /** Recognise composite patterns when emitting. */
   useComposites?: boolean;
   /** Source file path (for provenance display only). */
@@ -411,6 +414,20 @@ export interface MigrationResult {
   diagnostics: Array<Record<string, unknown>>;
   /** Markdown "Security posture" section, when security analysis ran (#306). */
   securityPosture?: string;
+  /**
+   * Outputs of the source member that the rendered output reads, by the names
+   * a workspace link takes (#4399). In a workspace, `chant migrate` writes
+   * them as `links` of the member the output lands in, so a source that drops
+   * or renames one fails `chant workspace check`.
+   */
+  links?: string[];
+  /**
+   * The checks that need the target's own server, run for `--validate`
+   * instead of the external linter (#4399). Returns the diagnostics found,
+   * `error` severity for a refusal. Throws when the server cannot start, which
+   * `chant migrate` reports as a validation that did not run.
+   */
+  validate?(): Promise<Array<Record<string, unknown>>>;
 }
 
 /**
@@ -420,6 +437,12 @@ export interface MigrationResult {
 export interface MigrationSource {
   /** Lightweight detector: does this content look like the expected source? */
   detect(content: string): boolean;
+  /**
+   * The source may be a directory, which `transform` reads itself from
+   * `opts.sourceFile` (a workspace member, #4399). `chant migrate` then skips
+   * `detect` and passes empty content.
+   */
+  directory?: boolean;
   /** Run the translation. */
   transform(content: string, opts: MigrateOptions): Promise<MigrationResult>;
 }
@@ -870,6 +893,19 @@ export interface ScheduledOpSpec {
    * per-job environment mapping to put a value in.
    */
   variables?: Record<string, string>;
+  /**
+   * The Op runs a `reviewAgent` step in `handoff` mode (#4326): generate the
+   * review as two jobs. The first runs `chant run <name>` with no forge write
+   * token (the checkout's fetches get the job's token and nothing after
+   * them does) and hands the review on as job outputs. The second checks
+   * nothing out, takes the review as data and posts it as one note with the
+   * write token (`postReviewNote`). GitHub and Forgejo only: a GitLab merge
+   * request pipeline hands every job the project's unprotected variables, so
+   * the gitlab generator refuses this by name. The trigger must be
+   * `pull_request` and the finding-mode `report`, since the first job posts
+   * nothing.
+   */
+  reviewAgent?: boolean;
 }
 
 /**
@@ -1191,6 +1227,14 @@ export interface LexiconPlugin {
   /** Return post-synthesis checks for build validation */
   postSynthChecks?(): PostSynthCheck[];
 
+  /**
+   * Checks that read across build roots (chant #1939). Only a cross-root run
+   * (`runCrossRootChecks`, ./lint/post-synth.ts) calls this; `chant build`
+   * and `chant lint` never do, so a lexicon that adds one costs a
+   * single-build project nothing.
+   */
+  crossRootChecks?(): CrossRootCheck[];
+
   /**
    * Activity contracts (`ActivityContract`, `./op/activity-contract.ts`) for
    * the activities this lexicon implements, so another lexicon's post-synth
@@ -1305,6 +1349,15 @@ export interface LexiconPlugin {
    */
   parserOptions?(): ParserOptionSpec[];
 
+  /**
+   * `chant import --validate` (#4398): check what the import would write
+   * against the lexicon's own emulator, and return one diagnostic per
+   * failure (severity `error`). Called with the parsed IR and the checked
+   * parser options. A lexicon without an emulator leaves this out, and
+   * `--validate` then fails the import with a message saying so.
+   */
+  validateImport?(ir: TemplateIR, options: ParserOptions): Promise<ImportDiagnostic[]>;
+
   /** Return a generator for converting IR to TypeScript */
   templateGenerator?(): TypeScriptGenerator;
 
@@ -1499,6 +1552,17 @@ export interface LexiconPlugin {
    */
   workspaceOutputs?(entities: ReadonlyMap<string, Declarable>, unread?: readonly LexiconUnreadSource[]): LexiconWorkspaceOutputs | undefined;
 
+  /**
+   * The outputs of other workspace members this lexicon's declarations read
+   * or write (#4397), such as the ClickHouse tables an otel `clickhouse`
+   * exporter writes. `chant workspace check` calls it offline on the member's
+   * folded source, as it calls `workspaceOutputs`, and checks each link like
+   * one a kind's reader found (WSP093 to WSP095, WSP099 for `gaps`), naming
+   * the file and line of the declaring entity. Pure: no I/O. Return
+   * `undefined` when the project declares nothing that links.
+   */
+  workspaceLinks?(entities: ReadonlyMap<string, Declarable>, unread?: readonly LexiconUnreadSource[]): LexiconWorkspaceLinks | undefined;
+
   // LSP
   /** Provide completions for LSP */
   completionProvider?(ctx: CompletionContext): CompletionItem[];
@@ -1544,10 +1608,14 @@ export interface LexiconPlugin {
    * Return a migration source for translating from another lexicon's
    * format into this lexicon. Returns undefined if `from` is not supported.
    *
+   * `to` is the target as `--to` names it. A side may add a dialect after the
+   * lexicon, `sql/clickhouse` (#4399); `from` is passed as written, and a
+   * lexicon with one target ignores `to`.
+   *
    * Example: the gitlab lexicon implements `migrationSource("github")` to
    * translate `.github/workflows/*.yml` into `.gitlab-ci.yml`.
    */
-  migrationSource?(from: string): MigrationSource | undefined;
+  migrationSource?(from: string, to?: string): MigrationSource | undefined;
 
   // State
   /**

package/src/lifecycle/gate-ledger.ts

@@ -181,6 +181,14 @@ export interface GateResolutionRecord {
    * other resolution.
    */
   empty?: true;
+  /**
+   * The workspace gate that stood in for this member gate (#2554, ws-039):
+   * its name and the digest of the member plans it covers. Set only on the
+   * resolution a run builds when a workspace approval passes the gate; it is
+   * never written to the member's ledger, where the approval stays the
+   * workspace's (`_members/_workspace/_gates/`).
+   */
+  workspaceGate?: { gate: string; digest: string };
   /**
    * The channel this resolution was authored on (chant#2384) — set by the
    * writer, never by the caller. `chant approve` records `"cli"`, the

package/src/lifecycle/git.ts

@@ -148,7 +148,7 @@ export async function writeBlobToPath(
   filename: string,
   content: string,
   commitMessage: string,
-  opts?: { cwd?: string; expectPriorPathSha?: string | null },
+  opts?: LedgerLocation & { expectPriorPathSha?: string | null },
 ): Promise<string> {
   const dir = await ledgerDir(environment, opts);
   return writeLedgerFiles(
@@ -447,7 +447,7 @@ export async function readBlobFromPath(
 export async function readPathSha(
   environment: string,
   filename: string,
-  opts?: { cwd?: string },
+  opts?: LedgerLocation,
 ): Promise<string | null> {
   const rt = getRuntime();
   const dir = await ledgerDir(environment, opts);

package/src/lifecycle/ledger-read.test.ts

@@ -0,0 +1,107 @@
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import Ajv2020 from "ajv/dist/2020";
+import { afterAll, describe, expect, it } from "vitest";
+import type { LedgerReadPort } from "./ledger-port";
+import { ledgerFields, readLedgerTable, resolveLedgerRevision, revisionLedgerReadPort, LedgerRevisionError } from "./ledger-read";
+
+const validate = new Ajv2020({ strict: false, allErrors: true }).compile(JSON.parse(readFileSync(join(__dirname, "..", "workspace", "ledger.schema.json"), "utf-8")) as object);
+const valid = (doc: unknown) => {
+  const ok = validate(doc);
+  if (!ok) throw new Error(JSON.stringify(validate.errors));
+  return ok;
+};
+
+/** A port over files held in memory: `{ "<dir>/<file>": text }`. */
+function memoryPort(files: Record<string, string>): LedgerReadPort {
+  return {
+    read: async (dir, file) => files[`${dir}/${file}`] ?? null,
+    list: async (dir) => Object.keys(files).filter((k) => k.startsWith(`${dir}/`)).map((k) => k.slice(dir.length + 1)),
+    trees: async () => [...new Set(Object.keys(files).map((k) => k.split("/")[0]))],
+  };
+}
+
+const pending = { version: 1, kind: "pending", op: "tf-apply", gate: "wave-1", timestamp: "2026-10-09T05:00:00.000Z", expiresAt: "2026-10-10T05:00:00.000Z", planDigest: "sha256:aa" };
+const approval = { version: 1, op: "tf-apply", gate: "wave-1", timestamp: "2026-10-09T05:10:00.000Z", resolvedBy: "approver-one", planDigest: "sha256:aa" };
+const other = { version: 1, kind: "pending", op: "deploy", gate: "prod", timestamp: "2026-10-20T05:00:00.000Z", expiresAt: "2026-10-21T05:00:00.000Z", planDigest: "sha256:bb" };
+const gates = { "_gates/tf-apply.jsonl": `${JSON.stringify(pending)}\n${JSON.stringify(approval)}\nnot json\n`, "_gates/deploy.jsonl": `${JSON.stringify(other)}\n` };
+const now = new Date("2026-10-23T00:00:00.000Z");
+
+describe("chant ledger (#4363)", () => {
+  it("prints a table's rows as chant query loads them, filtered by --where", async () => {
+    const doc = await readLedgerTable("gates", [{ member: null, port: memoryPort(gates) }], { where: ["op=tf-apply", "kind=resolution"], now });
+    expect(valid(doc)).toBe(true);
+    if ("error" in doc) throw new Error(doc.error.message);
+    expect(doc.total).toBe(3);
+    expect(doc.malformed).toBe(1);
+    expect(doc.filter).toEqual({ where: ["op=tf-apply", "kind=resolution"], since: null });
+    expect(doc.rows).toHaveLength(1);
+    expect(doc.rows[0]).toMatchObject({ member: null, op: "tf-apply", gate: "wave-1", resolved_by: "approver-one", plan_digest: "sha256:aa", signed: false, empty: false });
+    expect(Object.keys(doc.rows[0])).toEqual(doc.columns);
+  });
+
+  it("keeps the rows at or after --since on the table's time column", async () => {
+    const doc = await readLedgerTable("gates", [{ member: null, port: memoryPort(gates) }], { since: "7d", now });
+    if ("error" in doc) throw new Error(doc.error.message);
+    expect(doc.filter.since).toBe("2026-10-16T00:00:00.000Z");
+    expect(doc.rows.map((r) => r.op)).toEqual(["deploy"]);
+  });
+
+  it("prints a JSON column parsed, and filters on a key under it", async () => {
+    const run = { version: 1, id: "r1", op: "tf-apply", env: "prod", started: "2026-10-22T00:00:00.000Z", ended: "2026-10-22T00:01:00.000Z", status: "succeeded", phases: [], labels: { team: "core" }, outcomes: {} };
+    const port = memoryPort({ "prod/runs__tf-apply.jsonl": `${JSON.stringify(run)}\n` });
+    const doc = await readLedgerTable("runs", [{ member: "app", port }], { where: ["labels.team=core"], now });
+    expect(valid(doc)).toBe(true);
+    if ("error" in doc) throw new Error(doc.error.message);
+    expect(doc.rows).toHaveLength(1);
+    expect(doc.rows[0]).toMatchObject({ member: "app", id: "r1", labels: { team: "core" } });
+  });
+
+  it("refuses an unknown table, a bad filter, and --since on a table with no time, without reading", async () => {
+    const never = async (): Promise<never> => {
+      throw new Error("read");
+    };
+    for (const [table, opts, code] of [
+      ["states", {}, "table-unknown"],
+      ["gates", { where: ["approver=x"] }, "filter-invalid"],
+      ["snapshots", { where: ["resources>many"] }, "filter-invalid"],
+      ["releases", { since: "7d" }, "filter-invalid"],
+    ] as const) {
+      const doc = await readLedgerTable(table, never, opts);
+      expect(valid(doc)).toBe(true);
+      expect(doc).toMatchObject({ error: { code } });
+    }
+  });
+
+  it("types each table's columns from chant query's schema", () => {
+    expect(ledgerFields("snapshots")).toMatchObject({ resources: "number", observed_at: "time", lexicon: "text" });
+    expect(ledgerFields("cuts")).toMatchObject({ signed: "boolean", timestamp: "time" });
+    expect(ledgerFields("resources").attributes).toBe("json");
+  });
+
+  describe("--at", () => {
+    const repo = mkdtempSync(join(tmpdir(), "chant-ledger-at-"));
+    afterAll(() => rmSync(repo, { recursive: true, force: true }));
+    const git = (...a: string[]): string => execFileSync("git", ["-C", repo, "-c", "user.name=t", "-c", "user.email=t@t", "-c", "commit.gpgsign=false", ...a], { encoding: "utf-8" });
+
+    it("reads the ledger as a commit of chant/lifecycle held it", async () => {
+      git("init", "-q", "-b", "chant/lifecycle");
+      mkdirSync(join(repo, "_gates"));
+      writeFileSync(join(repo, "_gates", "tf-apply.jsonl"), `${JSON.stringify(pending)}\n`);
+      git("add", "-A");
+      git("commit", "-q", "-m", "one");
+      writeFileSync(join(repo, "_gates", "tf-apply.jsonl"), `${JSON.stringify(pending)}\n${JSON.stringify(approval)}\n`);
+      git("commit", "-q", "-am", "two");
+      const at = (rev: string) => readLedgerTable("gates", [{ member: null, port: revisionLedgerReadPort(repo, resolveLedgerRevision(repo, rev), "") }], { at: rev });
+      const then = await at("chant/lifecycle~1");
+      const tip = await at("chant/lifecycle");
+      if ("error" in then || "error" in tip) throw new Error("read failed");
+      expect(then.at).toBe("chant/lifecycle~1");
+      expect(then.rows.map((r) => r.kind)).toEqual(["pending"]);
+      expect(tip.rows.map((r) => r.kind)).toEqual(["pending", "resolution"]);
+      expect(() => resolveLedgerRevision(repo, "no-such-rev")).toThrow(LedgerRevisionError);
+    });
+  });
+});