@intentius/chant 0.124.51 → 0.124.54

package/dist/config.js

@@ -12,6 +12,19 @@ import { PublishDeclarationSchema } from "./lifecycle/publish-declaration.js";
 // needs only them stays clear of the loader below (#4356 follow-up).
 export { environmentEndpoint, environmentExecutor, environmentName, EXECUTOR_FORGES, environmentNames, isEnvironmentPattern, isOwnershipParamRef, matchesDeclaredEnvironment, matchesEnvironmentPattern, resolveOwnershipStack, } from "./config-environments.js";
 import { EXECUTOR_FORGES, isOwnershipParamRef, resolveOwnershipStack } from "./config-environments.js";
+/** An s3 index store's settings (#4519, ./lifecycle/snapshot-store-s3.ts). */
+const S3StoreSettingsShape = {
+    bucket: z.string().min(1),
+    prefix: z.string().optional(),
+    region: z.string().min(1).optional(),
+    endpoint: z.string().url().optional(),
+    forcePathStyle: z.boolean().optional(),
+    credentials: z.object({
+        accessKeyId: z.string().min(1),
+        secretAccessKey: z.string().min(1),
+        sessionToken: z.string().min(1).optional(),
+    }).strict().optional(),
+};
 /**
  * Zod schema for ChantConfig validation.
  */
@@ -112,6 +125,20 @@ export const ChantConfigSchema = z.object({
     exclude: z.array(z.string().min(1)).optional(),
     include: z.array(z.string().min(1)).optional(),
     rootOnly: z.boolean().optional(),
+    // Strict: a misspelt key would send snapshots somewhere nobody looks (#4519).
+    snapshots: z.discriminatedUnion("store", [
+        z.object({ store: z.literal("git-ref"), ref: z.string().regex(/^refs\/chant\//).optional(), readOrphanBranch: z.boolean().optional() }).strict(),
+        z.object({ store: z.literal("orphan-branch") }).strict(),
+        z.object({ store: z.literal("local"), dir: z.string().min(1).optional() }).strict(),
+        z.object({ store: z.literal("s3"), ...S3StoreSettingsShape }).strict(),
+        z.object({ store: z.literal("none") }).strict(),
+    ]).optional(),
+    observationBaseline: z.object({
+        store: z.enum(["file", "git-ref", "s3", "none"]),
+        dir: z.string().min(1).optional(),
+        ref: z.string().regex(/^refs\/chant\//).optional(),
+        s3: z.object(S3StoreSettingsShape).strict().optional(),
+    }).strict().optional(),
 }).passthrough();
 /**
  * Default configuration when no config file exists.

package/dist/deep-observation.d.ts

@@ -163,19 +163,7 @@ export declare function normalizeDeepObservation(value: DeepObservationResult |
 export declare const UNRESOLVED = "<chant:unresolved>";
 /** Value a masked (secret-bearing) property takes. Matches the thin path's convention. */
 export declare const MASKED = "[REDACTED]";
-/**
- * Property-name patterns that mark a value secret-bearing. Deliberately narrow
- * and key-name based: broadening this to e.g. `/key/i` would mask an AWS tag's
- * `Key` field and every `*KeyName` reference, which is how masking turns into
- * its own drift signal.
- *
- * Shared with the thin snapshot path (`./lifecycle/snapshot.ts`), which warns
- * on the same names — one list, so the two paths cannot disagree about what
- * counts as a secret.
- */
-export declare const SENSITIVE_KEY_PATTERNS: readonly RegExp[];
-/** True when a property name looks secret-bearing (see {@link SENSITIVE_KEY_PATTERNS}). */
-export declare function isSensitiveKey(key: string): boolean;
+export { SENSITIVE_KEY_PATTERNS, isSensitiveKey } from "./sensitive-key.js";
 /** Which tree a hook is being invoked on. */
 export type DeepSide = "declared" | "live";
 /** One node the normalization pass offers to {@link DeepNormalizationHooks.prune}. */

package/dist/deep-observation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observation.d.ts","sourceRoot":"","sources":["../src/deep-observation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtD;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,4GAA4G;IAC5G,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,uGAAuG;IACvG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,2EAA2E;AAC3E,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAMtF;AAED,6GAA6G;AAC7G,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC7C,OAAO,CAAC,EAAE,iBAAiB,EAAE,GAC5B,qBAAqB,CAOvB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,yBAAyB,CAO3B;AAID;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,uBAAuB,CAAC;AAE/C,0FAA0F;AAC1F,eAAO,MAAM,MAAM,eAAe,CAAC;AAEnC;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAOnD,CAAC;AAEF,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,6CAA6C;AAC7C,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3C,sFAAsF;AACtF,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC/C;AAED,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;IACzD;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnH;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACxC;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CA+BtE;AA0CD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyIzB;AAKD,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAoDtB;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAK9D"}
+{"version":3,"file":"deep-observation.d.ts","sourceRoot":"","sources":["../src/deep-observation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItD;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,4GAA4G;IAC5G,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,uGAAuG;IACvG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,2EAA2E;AAC3E,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAMtF;AAED,6GAA6G;AAC7G,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC7C,OAAO,CAAC,EAAE,iBAAiB,EAAE,GAC5B,qBAAqB,CAOvB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,yBAAyB,CAO3B;AAID;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,uBAAuB,CAAC;AAE/C,0FAA0F;AAC1F,eAAO,MAAM,MAAM,eAAe,CAAC;AAKnC,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzE,6CAA6C;AAC7C,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3C,sFAAsF;AACtF,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC/C;AAED,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;IACzD;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnH;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACxC;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CA+BtE;AA0CD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyIzB;AAKD,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAoDtB;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAK9D"}

package/dist/deep-observation.js

@@ -43,6 +43,7 @@
  * when nobody declared the property.
  */
 import { isHeldElsewhere, isNormalizedHeldElsewhere, normalizeHeldElsewhere } from "./held-elsewhere.js";
+import { isSensitiveKey } from "./sensitive-key.js";
 /** True when `value` is the versioned {@link DeepObservationResult} envelope. */
 export function isDeepObservationResult(value) {
     return (typeof value === "object" &&
@@ -84,28 +85,10 @@ export function normalizeDeepObservation(value) {
 export const UNRESOLVED = "<chant:unresolved>";
 /** Value a masked (secret-bearing) property takes. Matches the thin path's convention. */
 export const MASKED = "[REDACTED]";
-/**
- * Property-name patterns that mark a value secret-bearing. Deliberately narrow
- * and key-name based: broadening this to e.g. `/key/i` would mask an AWS tag's
- * `Key` field and every `*KeyName` reference, which is how masking turns into
- * its own drift signal.
- *
- * Shared with the thin snapshot path (`./lifecycle/snapshot.ts`), which warns
- * on the same names — one list, so the two paths cannot disagree about what
- * counts as a secret.
- */
-export const SENSITIVE_KEY_PATTERNS = [
-    /password/i,
-    /secret/i,
-    /token/i,
-    /private.?key/i,
-    /credential/i,
-    /connection.?string/i,
-];
-/** True when a property name looks secret-bearing (see {@link SENSITIVE_KEY_PATTERNS}). */
-export function isSensitiveKey(key) {
-    return SENSITIVE_KEY_PATTERNS.some((p) => p.test(key));
-}
+// The secret-key list lives in `./sensitive-key.ts` so the drift record
+// (`./drift-record.ts`) can redact with it inside the change-set bundle,
+// which may not import this module's normalization code.
+export { SENSITIVE_KEY_PATTERNS, isSensitiveKey } from "./sensitive-key.js";
 /** True for a value the pass will walk into rather than treat as a leaf. */
 function isPlainObject(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value))

package/dist/drift-record.d.ts

@@ -0,0 +1,542 @@
+/**
+ * One drift record across engines (#4450, #4451).
+ *
+ * Drift had four vocabularies for one question: the converge observers'
+ * `in-sync | drifted | unknown` (`./lifecycle/symptoms.ts`), component
+ * status's `reconciled | unrecorded | stale | drifted | unknown`
+ * (`./lifecycle/status.ts`), the graph overlay's tones, and the live diff's
+ * buckets (`./lifecycle/live-diff.ts`). A renderer colouring a terraform, a
+ * choudoufu and a chant member side by side had to know all four, and behold
+ * read choudoufu's documents itself. This module is the one shape they all
+ * become: a {@link DriftRecord} per resource instance, and a
+ * {@link DriftDocument} (`drift: "v1"`) that holds them. Its schema is
+ * `./workspace/drift.schema.json`, `$id` {@link DRIFT_SCHEMA_ID}.
+ *
+ * A record says which read answered (`read`) and what it found (`status`).
+ * The two travel together because they are different claims: a `state` read
+ * says what the last apply recorded and can never say the account matches,
+ * so {@link driftRecord} refuses a state read whose status is anything but
+ * `recorded`, `pending` or `not-observed`. Every record goes through that
+ * constructor, so the rule holds for every adapter, and for a document read
+ * back with {@link parseDriftDocument}.
+ *
+ * `not-observed` is never absence. It always carries a reason from the
+ * observation contract's closed list (`./observation.ts`), and
+ * `not-reached` is the reason a stream gives an address it expected and
+ * never heard about ({@link driftSettle}).
+ *
+ * ## Redaction
+ *
+ * An attribute the planner marked sensitive keeps its path and loses both
+ * values (`sensitive: true`), as the change set spells it
+ * (`./change-set.ts`). A second pass redacts any path with a segment
+ * {@link isSensitiveKey} names, whatever the planner said, so an engine
+ * that marks nothing still never ships a `password` value. Values are
+ * optional: a card needs only the names.
+ *
+ * ## Not digest-bound
+ *
+ * A drift read authorizes nothing and goes stale on the next read, so a
+ * record is ephemeral. {@link driftDocumentDigest} exists for one case, a
+ * WatchOp writing its document into its own run ledger as evidence, and
+ * leaves out `observedAt` and `evidence`, which change on every read.
+ *
+ * ## Adapters
+ *
+ * The chant ones are here: `lifecycle diff --live` ({@link liveDiffDriftRecords}),
+ * deep observe ({@link deepDiffDriftRecords}, {@link mergeDeepDrift}) and
+ * component status ({@link componentStatusDriftRecords}). The terraform and
+ * choudoufu ones live in the terraform lexicon's `drift-record` subpath,
+ * beside its readers, and the Pulumi one (`refresh --preview-only`, #4453)
+ * in the pulumi lexicon's.
+ *
+ * ## The graph and the rollup
+ *
+ * A record's `node` and `instanceOf` come from the change set's own rule
+ * (`graphNodeFor`, #4454), and a block's status from core's one rollup
+ * (`rollupInstances`) over {@link DRIFT_INSTANCE_ROLLUP}. Neither is
+ * written a second time here.
+ *
+ * ## The import graph
+ *
+ * This module ships in the change-set bundle (`change-set-bundle.test.ts`,
+ * #3421): at run time it imports the plan digest, the observation
+ * contract's reason list, the change-set graph's node rule, the instance
+ * rollup and the sensitive-key list, and types only otherwise.
+ */
+import { type ChangeSetGraphNodes } from "./change-set-graph.js";
+import type { ChangeSetPlanner } from "./change-set.js";
+import type { DeepDiffResult } from "./lifecycle/deep-diff.js";
+import type { LiveDiffResult } from "./lifecycle/live-diff.js";
+import type { ComponentStatusRow } from "./lifecycle/status.js";
+import { type UnobservedReason } from "./observation.js";
+/** The schema a drift document names in `$schema`. */
+export declare const DRIFT_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/drift/v1/drift.schema.json";
+/** The document's version. */
+export declare const DRIFT_VERSION = "v1";
+/**
+ * Which engine read the resource: a change-set planner (`pulumi` among them
+ * since #4453), or plunge, which has no planner of its own. A plunge
+ * address is a Pulumi URN, so a plunge record is placed on the graph by the
+ * `pulumi` planner's rule ({@link driftPlanner}).
+ */
+export type DriftEngine = ChangeSetPlanner | "plunge";
+/** The planner whose node rule places an engine's records: plunge's URNs go by `pulumi`'s (#4453). */
+export declare function driftPlanner(engine: DriftEngine): ChangeSetPlanner;
+/** Every engine, in the order the schema lists them. */
+export declare const DRIFT_ENGINES: readonly DriftEngine[];
+/**
+ * Which read answered.
+ *
+ * - `state` — the engine's state file: what the last apply recorded.
+ * - `plan` — a plan: what the next apply would do, after a refresh.
+ * - `refresh` — a refresh preview (Pulumi's `refresh --preview-only`).
+ * - `live-read` — chant's own read of the provider.
+ * - `ownership` — an ownership read (choudoufu's `live-plan` and `live-ls`),
+ *   which says who holds each object and not what its attributes are.
+ */
+export type DriftRead = "state" | "plan" | "refresh" | "live-read" | "ownership";
+/** Every read, in the order the schema lists them. */
+export declare const DRIFT_READS: readonly DriftRead[];
+/**
+ * What the read found.
+ *
+ * - `in-sync` — present, and nothing the read compares differs.
+ * - `drifted` — present, and something differs; `attributes` says what.
+ * - `pending` — declared and confirmed absent, never deployed.
+ * - `missing` — recorded or deployed, and now gone.
+ * - `unclaimed` — something live sits at a declared identity and does not
+ *   carry this member's marker: adoptable, or held by someone else.
+ * - `undeclared` — live or recorded, and the member does not declare it.
+ * - `runtime` — live, undeclared, and expected: a controller's child.
+ * - `recorded` — in the engine's state. The only presence a state read gives.
+ * - `not-observed` — the read could not say; `unobserved` says why.
+ */
+export type DriftStatus = "in-sync" | "drifted" | "pending" | "missing" | "unclaimed" | "undeclared" | "runtime" | "recorded" | "not-observed";
+/** Every status, in the order the schema lists them. */
+export declare const DRIFT_STATUSES: readonly DriftStatus[];
+/** The only statuses a `state` read may give. It never says in-sync or drifted. */
+export declare const STATE_READ_STATUSES: readonly DriftStatus[];
+/** Who an ownership facet says holds the object. */
+export type DriftOwnershipVerdict = "owned" | "foreign" | "adoptable" | "unknown";
+/** Every ownership verdict. */
+export declare const DRIFT_OWNERSHIP_VERDICTS: readonly DriftOwnershipVerdict[];
+/** What the ownership verdict rests on. */
+export type DriftOwnershipBy = "marker" | "derived" | "record" | "cache" | "state" | "label";
+/** Every ownership basis. */
+export declare const DRIFT_OWNERSHIP_BY: readonly DriftOwnershipBy[];
+/**
+ * One attribute that differs. `before` is what was expected (the record, the
+ * snapshot, the declaration) and `after` what the read found. A path in the
+ * plan-observation grammar: keys joined with `.`, indexes and keys that are
+ * not identifiers in brackets (`tags["kubernetes.io/role"]`).
+ */
+export interface DriftAttribute {
+    path: string;
+    before?: unknown;
+    after?: unknown;
+    /** The planner marked it sensitive, or its name looks secret-bearing, so neither value is carried. */
+    sensitive?: true;
+}
+/** Why a record is `not-observed`. */
+export interface DriftUnobserved {
+    reason: UnobservedReason;
+    detail?: string;
+    /** The address the read was issued against, when the engine reported one. */
+    queried?: string;
+}
+/** Who holds the object, from an ownership read. */
+export interface DriftOwnership {
+    verdict: DriftOwnershipVerdict;
+    by?: DriftOwnershipBy;
+    /** The marker was read off the object itself, not derived or remembered. */
+    markerOnObject?: boolean;
+    /** The estate, stack or controller that does hold it, when not this member. */
+    ownedBy?: string;
+    /** The address an adoption would write onto the object. */
+    adopt?: string;
+}
+/** What produced the record. */
+export interface DriftEvidence {
+    tool: string;
+    version?: string;
+    command?: string;
+    /** The engine's own token for the verdict (`UNOWNED`, `NEEDS_DISCOVERY`, `ABSENT`), so a pane can show it. */
+    engineCode?: string;
+}
+export interface DriftRecord {
+    member: string;
+    engine: DriftEngine;
+    /** The engine's own address, at instance level: `aws_eip.pool[0]`, a Pulumi URN, a chant entity name. */
+    address: string;
+    /** The resource type, when the read reports one. Not `type`, which a stream line uses for its kind. */
+    resourceType?: string;
+    /**
+     * The graph node, by the change set's mapping rules (`graphNodeFor` in
+     * `./change-set-graph.ts`, {@link mapDriftToGraph}): for an instance of a
+     * `count` or `for_each` block the instance node, `<blockNode>[0]` or
+     * `<blockNode>["a"]`, and the block node otherwise. Null when the graph
+     * holds none. A Pulumi URN's node is `<member>/<key>` by the URN rule
+     * (#4456), and a plunge URN's by the same rule (#4453).
+     */
+    node: string | null;
+    /** On a record whose `node` is an instance node (#4454): the block node it is an instance of, the rollup. */
+    instanceOf?: string;
+    /** RFC 3339. Per record, because a stream's rows finish at different times. */
+    observedAt: string;
+    read: DriftRead;
+    /**
+     * The read that was asked for and failed, when this one answered instead:
+     * what `RootRead.depth` holds (`"plan"`, `"live+plan"`) on a root whose
+     * `RootRead.fellBackTo` is set (`./observation.ts`).
+     */
+    fellBackFrom?: string;
+    status: DriftStatus;
+    /** Set exactly when `status` is `not-observed`. */
+    unobserved?: DriftUnobserved;
+    /** What differs. Only on `drifted`. */
+    attributes?: DriftAttribute[];
+    /**
+     * Presence is known and the attributes are not: a deep read that failed
+     * for an entity the thin read found. On `in-sync` and `drifted` only.
+     */
+    attributesUnobserved?: DriftUnobserved;
+    ownership?: DriftOwnership;
+    evidence: DriftEvidence;
+}
+/** Counts per status, every status present. */
+export type DriftCounts = Record<DriftStatus, number>;
+export interface DriftDocument {
+    $schema: typeof DRIFT_SCHEMA_ID;
+    drift: typeof DRIFT_VERSION;
+    /** The chant that wrote it, when known. */
+    chant?: string;
+    /** Sorted by member, address and read. One per `(member, address, read)`. */
+    records: DriftRecord[];
+    counts: DriftCounts;
+}
+/** Which rule a refused record broke. */
+export type DriftRecordRule = "shape" | "state-read-status" | "unobserved-reason" | "unobserved-on-observed" | "attributes-status" | "attributes-unobserved-status";
+/** A record {@link driftRecord} refused, naming the record and the rule. */
+export declare class DriftRecordError extends Error {
+    readonly rule: DriftRecordRule;
+    constructor(rule: DriftRecordRule, message: string);
+}
+/**
+ * The key segments of an attribute path, indexes left out:
+ * `spec.env[0]["db_password"]` is `spec`, `env`, `db_password`. A keyed
+ * element (`Tags[#api-token-owner].Value`, the deep read's address for an
+ * array it can key) is a key too: it names the element the way a map key
+ * does, so an environment list keyed by `DB_PASSWORD` redacts like a map's.
+ */
+export declare function attributePathKeys(path: string): string[];
+/**
+ * One attribute, redacted: the planner's mark first, then any key segment
+ * {@link isSensitiveKey} names. A redacted attribute is `{ path, sensitive:
+ * true }` and nothing else.
+ */
+export declare function redactDriftAttribute(attribute: DriftAttribute): DriftAttribute;
+/**
+ * Build one record, or refuse it. Every adapter and every reader goes
+ * through here, so these hold for every record that exists:
+ *
+ * - a `state` read's status is `recorded`, `pending` or `not-observed`;
+ * - `not-observed` carries `unobserved` with a legal reason, and no other
+ *   status carries it;
+ * - `attributes` appear only on `drifted`, sorted by path, one per path,
+ *   and redacted ({@link redactDriftAttribute});
+ * - `attributesUnobserved` appears only on `in-sync` or `drifted`.
+ *
+ * A refusal is a {@link DriftRecordError} naming the member, the address,
+ * the read and the status.
+ */
+export declare function driftRecord(input: DriftRecord): DriftRecord;
+/** Read one record from parsed JSON. The same checks as {@link driftRecord}. */
+export declare function parseDriftRecord(value: unknown): DriftRecord;
+/** Counts per status, zero included. */
+export declare function countDriftStatuses(records: Iterable<Pick<DriftRecord, "status">>): DriftCounts;
+export interface DriftDocumentOptions {
+    /** The chant version to record in `chant`. */
+    chant?: string;
+}
+/**
+ * Join records into one document. A later record for the same `(member,
+ * address, read)` replaces the earlier one, as a stream's later line does.
+ * Records are sorted by member, address and read. Every record is checked
+ * with {@link driftRecord}.
+ */
+export declare function driftDocument(records: Iterable<DriftRecord>, options?: DriftDocumentOptions): DriftDocument;
+/** Read a document from parsed JSON, checking every record. Counts are recomputed. */
+export declare function parseDriftDocument(value: unknown): DriftDocument;
+/**
+ * The document's digest, for a WatchOp that keeps its document as evidence
+ * in its own run ledger: `computePlanDigest("drift-document", …)` over the
+ * records sorted as {@link driftDocument} sorts them, without `observedAt`
+ * and `evidence`, which change on every read. No gate binds it.
+ */
+export declare function driftDocumentDigest(doc: Pick<DriftDocument, "records">): string;
+/**
+ * The precedence a block's instance records roll up in, most significant
+ * first, for core's one rollup (`rollupInstances` in `./instance-nodes.ts`,
+ * #4454). Partial knowledge is not knowledge, so one not-observed instance
+ * makes the block not-observed, as `TERRAFORM_INSTANCE_ROLLUP` puts
+ * `unobserved` first. A difference outranks an absence, an absence
+ * outranks agreement, and `runtime` is last because a controller's children
+ * never decide a block.
+ */
+export declare const DRIFT_INSTANCE_ROLLUP: readonly DriftStatus[];
+/** One block node's rolled-up status and the records it came from. */
+export interface DriftBlockRollup {
+    /** The block node: the records' `instanceOf`, or their `node` when they are on the block itself. */
+    node: string;
+    status: DriftStatus;
+    /** Every read that answered for the block's records, sorted. */
+    reads: DriftRead[];
+    records: DriftRecord[];
+}
+/**
+ * Records grouped by block node (`instanceOf`, else `node`) and rolled up
+ * with `rollupInstances` over {@link DRIFT_INSTANCE_ROLLUP}. A record with a
+ * null `node` is on no block and is left out. Sorted by node.
+ */
+export declare function rollupDriftByBlock(records: Iterable<DriftRecord>): DriftBlockRollup[];
+/**
+ * The document with each record's `node` and `instanceOf` set from `graph`
+ * by `graphNodeFor` (`./change-set-graph.ts`), the rule a change-set entry
+ * uses, so a drift row and a change-set entry for one instance name the
+ * same node: an instance of a `count` or `for_each` block is on
+ * `<blockNode>[0]` with `instanceOf` the block node, and an instance under
+ * an expanded module call is on `<root>/module.app[0]/<block>[1]` with the
+ * same `instanceOf` (#4486). A Pulumi URN is on
+ * `<member>/<key>` by the URN rule (`./pulumi-urn.ts`, #4456), through the
+ * `pulumi` planner's case, and so is a plunge URN ({@link driftPlanner}).
+ * A null `graph` gives every record `node: null`.
+ */
+export declare function mapDriftToGraph(doc: DriftDocument, graph: ChangeSetGraphNodes | null): DriftDocument;
+/**
+ * The NDJSON stream, one JSON object per line, built like the run-event
+ * stream and in the layout choudoufu's `live-plan -resource` writes
+ * (choudoufu `internal/command/views/live_drift.go`): every line has a
+ * `type`, `drift-start`, `drift-record` or `drift-settle`, and a record
+ * line is the record itself with `type` beside its fields.
+ */
+/** One address a stream expects to hear about, with the node and type a not-reached record should carry. */
+export interface DriftExpected {
+    address: string;
+    node?: string | null;
+    instanceOf?: string;
+    resourceType?: string;
+}
+/** Opens a member's read: which member, engine and read, and every address it expects. */
+export interface DriftStartLine {
+    type: "drift-start";
+    drift: typeof DRIFT_VERSION;
+    member: string;
+    engine: DriftEngine;
+    read: DriftRead;
+    /** The one address the read was asked about, on a single-resource read (`live-plan -resource`). */
+    resource?: string;
+    fellBackFrom?: string;
+    /** RFC 3339, when the writer gives it. */
+    at?: string;
+    /** Bare addresses, or addresses with the node and type a not-reached record is given. */
+    expected: Array<string | DriftExpected>;
+    /** The evidence a not-reached record is given. Default `{ tool: <engine> }`. */
+    evidence?: DriftEvidence;
+}
+/** One record, as its read finishes: the record's own fields beside `type`. A later line for the same `(member, address, read)` replaces it. */
+export type DriftRecordLine = DriftRecord & {
+    type: "drift-record";
+};
+/** Closes a member's read. */
+export interface DriftSettleLine {
+    type: "drift-settle";
+    drift: typeof DRIFT_VERSION;
+    member: string;
+    engine: DriftEngine;
+    read: DriftRead;
+    /** Records per status. A writer may leave out a status it has none of. */
+    counts: Partial<DriftCounts>;
+    /** The engine's own account of what the read cost (choudoufu: `recordsRead`, `sweepCalls`, ...). Carried, never interpreted. */
+    reads?: Record<string, unknown>;
+    /** RFC 3339, when the writer gives it: every not-reached record's `observedAt`. */
+    at?: string;
+    /**
+     * Expected addresses with no record line, when the writer lists them. A
+     * reader treats every expected address with no record as not-reached
+     * whether or not this is given; a writer that emits its own not-reached
+     * records (choudoufu does) leaves it out.
+     */
+    notReached?: string[];
+}
+export type DriftLine = DriftStartLine | DriftRecordLine | DriftSettleLine;
+/** A start line's expected entries, bare addresses made objects. */
+export declare function driftExpected(start: Pick<DriftStartLine, "expected">): DriftExpected[];
+/** A record as its stream line. */
+export declare function driftRecordLine(record: DriftRecord): DriftRecordLine;
+/** One line of the stream, newline-terminated. */
+export declare function encodeDriftLine(line: DriftLine): string;
+/** The whole stream for one or more reads, in order. */
+export declare function encodeDriftLines(lines: Iterable<DriftLine>): string;
+/** Read one line, checking it. A record line goes through {@link driftRecord}. Unknown fields are dropped. */
+export declare function decodeDriftLine(text: string): DriftLine;
+/** Every non-blank line of an NDJSON stream, decoded. */
+export declare function decodeDriftLines(text: string): DriftLine[];
+/** Open a read: the start line for a member's expected addresses, each once. */
+export declare function driftStart(input: Omit<DriftStartLine, "type" | "drift">): DriftStartLine;
+/**
+ * Close a read. `records` are the records sent since `start`, in order; a
+ * later one for an address and read replaces an earlier one, and records
+ * for another member are ignored. A record for an expected address answers
+ * it whatever its read, since one read can answer an address with another
+ * (a plan stream's unclaimed row is an `ownership` record). Every expected
+ * address with no record becomes `not-observed / not-reached` at `at`.
+ * Returns the settle line, which lists them in `notReached`, and the
+ * member's final records.
+ */
+export declare function driftSettle(start: DriftStartLine, records: Iterable<DriftRecord>, at: string): {
+    line: DriftSettleLine;
+    records: DriftRecord[];
+};
+/** An address a started read expects and has not reported yet. Not a status: a settle always resolves it. */
+export interface DriftReading {
+    member: string;
+    read: DriftRead;
+    address: string;
+    node: string | null;
+}
+/**
+ * Fold a stream into a document. Record lines replace earlier ones for the
+ * same `(member, address, read)`. At a settle line, every address its start
+ * expected that no record answered (by member and address, whatever the
+ * read) becomes `not-observed / not-reached`, with the node and type the
+ * start gave, at the settle's `at`, else the start's, else the latest
+ * record's `observedAt` in the stream; `notReached` addresses the start did
+ * not list are added the same way. A start with no settle yet leaves its
+ * unanswered addresses in `reading`, which a renderer shows as "reading"
+ * and nothing else.
+ */
+export declare function foldDriftLines(lines: Iterable<DriftLine>, options?: DriftDocumentOptions): {
+    document: DriftDocument;
+    reading: DriftReading[];
+};
+/** What every adapter takes beside its source document. */
+export interface DriftAdapterBase {
+    member: string;
+    /** RFC 3339, given to every record. */
+    observedAt: string;
+    /**
+     * The member's graph, to place each record with `graphNodeFor` as it is
+     * made. Omit to leave `node` null, for {@link mapDriftToGraph} to fill.
+     */
+    graph?: ChangeSetGraphNodes | null;
+    /** The read that was asked for and failed, when this one answered instead. */
+    fellBackFrom?: string;
+    /** The chant or engine version, for `evidence.version`. */
+    version?: string;
+}
+/**
+ * Where an adapter's record for `address` sits: `graphNodeFor` on the
+ * input's graph, plunge's by the `pulumi` rule ({@link driftPlanner}). Exported
+ * for the lexicons' adapters.
+ */
+export declare function placeDriftRecord(input: Pick<DriftAdapterBase, "member" | "graph">, engine: DriftEngine, address: string): {
+    node: string | null;
+    instanceOf?: string;
+};
+export interface LiveDiffDriftInput extends DriftAdapterBase {
+    /** `chant lifecycle diff --live --json`, parsed. */
+    diff: LiveDiffResult;
+    /** Entity types by name, for the records whose diff row carries none. */
+    types?: Record<string, string>;
+}
+/**
+ * A chant member's records, from `lifecycle diff --live`: `unchanged` and
+ * `newlyObserved` are in-sync, `driftedSinceSnapshot` drifted (before is the
+ * snapshot, after the read), `missing` pending, `disappeared` missing,
+ * `orphan` undeclared, `runtimeChildren` runtime, `unobserved` not-observed.
+ * An entity in both `missing` and `disappeared` was deployed and is gone,
+ * so it is missing.
+ */
+export declare function liveDiffDriftRecords(input: LiveDiffDriftInput): DriftRecord[];
+export interface DeepDiffDriftInput extends DriftAdapterBase {
+    /** `chant lifecycle diff --live --deep --json`'s deep result, parsed. */
+    diff: DeepDiffResult;
+    /**
+     * The command for `evidence.command`, when the deep result came from
+     * somewhere other than a live read: `chant lifecycle diff --index <ref>`
+     * (#4526) diffs against an index version. Default
+     * `chant lifecycle diff --live --deep`.
+     */
+    command?: string;
+}
+/**
+ * A chant member's records from the deep diff alone: `drifted` with paths
+ * (before is the declared value, after the live one; an `absent` path has
+ * no after), `unchanged` in-sync, `unobserved` not-observed and
+ * `undeclaredEntities` undeclared. Accepted and held paths are not drift and
+ * are left out. To lay these over the thin read's records, so a deep hole
+ * stays on the attribute surface, use {@link mergeDeepDrift}.
+ */
+export declare function deepDiffDriftRecords(input: DeepDiffDriftInput): DriftRecord[];
+/**
+ * The thin read's records with the deep read laid over them, by member and
+ * address. A thin in-sync record the deep read found drifted becomes
+ * drifted with the deep paths. A deep not-observed record never changes the
+ * thin status: presence is known, so it becomes `attributesUnobserved` on an
+ * in-sync or drifted record and is dropped elsewhere. Deep records with no
+ * thin record are added as they are.
+ */
+export declare function mergeDeepDrift(thin: Iterable<DriftRecord>, deep: Iterable<DriftRecord>): DriftRecord[];
+export interface ComponentStatusDriftInput extends DriftAdapterBase {
+    /** `chant components status [env] --json`'s rows. */
+    rows: readonly ComponentStatusRow[];
+}
+/**
+ * A member's records from component status, one per component, addressed
+ * by component name: `reconciled` in-sync, `drifted` drifted, `stale`
+ * missing (recorded and no longer observed live), `unknown` not-observed
+ * with the row's reason, or `not-reached` when live status was never asked
+ * for. `unrecorded` is drifted when the component is live, since something
+ * runs that no release accounts for, pending when nothing is, and
+ * not-observed when live status was not asked for.
+ */
+export declare function componentStatusDriftRecords(input: ComponentStatusDriftInput): DriftRecord[];
+/**
+ * What `chant lifecycle drift` asks a lexicon for (`LexiconPlugin.readDrift`,
+ * behold#995). `chant workspace drift` runs that command in a member's reader
+ * project, so a lexicon that reads members of a package kind (the terraform
+ * lexicon's `terraform` and `choudoufu` kinds) answers with its own engine,
+ * and chant core never imports the lexicon.
+ */
+export interface ReadDriftOptions {
+    /** The workspace member the records are for. Every line the lexicon returns names it. */
+    member: string;
+    /** The directory holding the project's `chant.config.*`. */
+    projectRoot: string;
+    /** The project's resolved config, for the lexicon's own namespace. */
+    config: Record<string, unknown>;
+    /** The read asked for. Unset, the lexicon's default read for what it finds. */
+    read?: DriftRead;
+    /** One address to read, on an engine that can read one resource on its own. */
+    resource?: string;
+    /** RFC 3339, the `observedAt` of every record the lexicon builds itself. */
+    observedAt: string;
+}
+/** Why a lexicon will not answer a drift read, in a code a caller can branch on. */
+export type ReadDriftRefusalCode = "read-unsupported" | "resource-unsupported" | "no-drift-read";
+/**
+ * A lexicon's answer: the stream lines of each read it ran, in order (a
+ * `drift-start`, its records, a `drift-settle`, per root), or a refusal. A
+ * read that ran and failed is not a refusal: its addresses are records
+ * with status `not-observed`.
+ */
+export type ReadDriftResult = {
+    lines: DriftLine[];
+} | {
+    refused: {
+        code: ReadDriftRefusalCode;
+        message: string;
+    };
+};
+//# sourceMappingURL=drift-record.d.ts.map