@intentius/chant 0.124.52 → 0.124.54

package/dist/components/verbs/member-outputs.d.ts

@@ -0,0 +1,187 @@
+/**
+ * `member-outputs`: another workspace member's outputs, read through the
+ * engine that member runs on, so a chant member's parameters can be planned
+ * against them (#4455, design record choudoufu#2258 lane T6).
+ *
+ * In `behold/example-three-cloud`, `dns` (a chant member) reads each cloud's
+ * endpoint as a parameter of the same name as the output the cloud's member
+ * publishes. When the Azure site is a choudoufu estate, `azureEndpoint` is a
+ * Terraform root output, and when the AWS site is a Pulumi stack it is a
+ * stack output. Neither is a chant component, so there is nothing for a
+ * `stackOutput()` reference to read. This verb is that something: a
+ * component in the consumer's project whose one step names the upstream
+ * member, and whose capability answers the two questions the components
+ * machinery already asks of an upstream:
+ *
+ * - `outputs` (applied): what the member exposes now. A pull request that
+ *   does not touch the member plans the consumer against these
+ *   (`deployedOutputs`, #4104).
+ * - `plan` (planned): what the member will expose once its own plan applies,
+ *   with the outputs known only after apply named (`PlannedOutputs`, #3999).
+ *   A pull request that touches the member plans the consumer against the
+ *   known ones. A reference to an unknown one is unresolved, so the
+ *   consumer's step is planned with `DeployContext.unresolvedInputs` naming
+ *   the member, the pull request's report lists `<member>.<output>` under the
+ *   consumer's `unknownInputs`, and the apply holds the consumer back until
+ *   the member applied, then plans it again (`pr-run.ts`, "Planning again
+ *   once an upstream applied"). That is the hold chant already puts on a
+ *   root waiting on another root's unknown output; nothing here adds a
+ *   second one.
+ *
+ * The consumer writes it as two components:
+ *
+ * ```ts
+ * export const azure = memberOutputsComponent("azure");
+ * export const records: Component = {
+ *   name: "records",
+ *   dependsOn: ["azure"],
+ *   deploy: [phase("Apply", [{ kind: "cfn-deploy", template: "dist/dns.json",
+ *     inputs: { azureEndpoint: stackOutput("azure", "azureEndpoint") } }])],
+ * };
+ * ```
+ *
+ * ## Engines: the seam
+ *
+ * The member is looked up in the workspace declaration (`chant.workspace.json`)
+ * by name, and its `kind` picks the {@link EngineOutputSource} that reads it.
+ * Sources are not capabilities: each lexicon that drives an engine
+ * contributes one through `CapabilityPlugin.engineOutputSources()`, the way
+ * the cloud lexicons contribute registry logins to `publish-image`, and the
+ * registry binds them into this one verb when it is built
+ * (`registerCapabilityPlugins`). So two engines never register the same
+ * kind, and a consumer's step does not change when the member moves between
+ * engines.
+ *
+ * - `choudoufu` (the terraform lexicon, `choudoufuOutputSource`): applied
+ *   values from `choudoufu output -json` in the member's directory, which in
+ *   live mode reads the estate's record store; planned values from
+ *   `live-plan-set -json` over the member's root, its plan's
+ *   `planned_values.outputs` with every output whose `output_changes` entry
+ *   marks any part `after_unknown` named unknown (`terraformPlannedOutputs`).
+ * - `pulumi` (the pulumi lexicon, `pulumiOutputSource`): applied values
+ *   from `pulumi stack output --json --show-secrets=false`, or from the
+ *   member's checked-in `stack-export.json` when chant must not run pulumi
+ *   (`CHANT_PULUMI_APPLIED_OUTPUTS=export`); planned values from `pulumi
+ *   preview --json`, the stack step's outputs, where an output holding
+ *   Pulumi's unknown sentinel is unknown. Secret outputs are left out of
+ *   both. A member on plunge runs the same commands under `plunge`.
+ *   Nothing in this module or in the consumer changes for it.
+ *
+ * ## Run reads, it never applies
+ *
+ * The member applies through its own pipeline. `run` checks that the
+ * member's plan has nothing left to apply (`changes` false) and answers its
+ * applied outputs; a member with changes still to apply refuses the run
+ * with {@link MemberOutputsPendingError}, so the consumer is blocked behind
+ * it and never applies against values from before the member's change. A
+ * workspace orders the member's own run before the consumer's (members that
+ * link to a producer run after it, `chant workspace run`).
+ *
+ * ## Which changes reach the member
+ *
+ * The component is a deploy unit named after the member (`DEPLOY_UNIT_RULES`),
+ * so a change signal that names the member as a changed unit puts it in the
+ * change. The terraform lexicon names it when the consumer's
+ * `terraform.roots` has an entry of that name whose files changed;
+ * `--from-affected` can name it too.
+ */
+import type { Capability, DeployContext, PlannedOutputs } from "../capability.js";
+import type { Component } from "../component.js";
+/** The step kind. */
+export declare const MEMBER_OUTPUTS_KIND = "member-outputs";
+/** The `member-outputs` step's input. */
+export interface MemberOutputsInput {
+    /** The upstream member's name in the workspace declaration. Also the component's name, by convention. */
+    member: string;
+    /**
+     * Where the declaration search starts. Default: the current directory,
+     * which is the consumer's project root under `chant run`.
+     */
+    cwd?: string;
+}
+/** What `run` returns: the member's applied outputs, under `outputs`, where the driver collects a stack's outputs from. */
+export interface MemberOutputsOutput {
+    member: string;
+    outputs: Record<string, unknown>;
+}
+/** The upstream member a source reads, as the workspace declares it. */
+export interface EngineMemberRef {
+    /** The member's name. */
+    member: string;
+    /** Its declared kind, which picked the source: `choudoufu`, `pulumi`. */
+    kind: string;
+    /** Its directory, absolute. */
+    dir: string;
+    /** The workspace root, absolute. A source that must run from above the member's directory runs from here. */
+    workspaceRoot: string;
+}
+/** What a source's plan of the member says about its outputs. */
+export interface EnginePlannedOutputs extends PlannedOutputs {
+    /**
+     * A digest of the member's plan, the engine's own or chant's over it. The
+     * consumer's approval binds it, so a plan of the member that moves after
+     * review moves the consumer's digest too.
+     */
+    planDigest: string;
+    /** Whether the member's plan has anything to apply. `run` refuses while it does. */
+    changes: boolean;
+}
+/**
+ * Reads one engine's member outputs (#4455). One per engine, contributed by
+ * the lexicon that drives it through `CapabilityPlugin.engineOutputSources()`.
+ */
+export interface EngineOutputSource {
+    /** The member kinds this source reads, as declared in `chant.workspace.json`. */
+    readonly kinds: readonly string[];
+    /** The member's outputs as applied now, by name. */
+    applied(ctx: DeployContext, ref: EngineMemberRef): Promise<Record<string, unknown>>;
+    /** The member's outputs once its current plan applies, the ones known only after apply named. */
+    planned(ctx: DeployContext, ref: EngineMemberRef): Promise<EnginePlannedOutputs>;
+}
+/** Finds a member in the workspace above `cwd`: its kind and directory. */
+export type MemberLookup = (cwd: string, member: string) => Promise<EngineMemberRef>;
+/** No source for the member's kind is loaded. */
+export declare class EngineOutputSourceMissingError extends Error {
+    readonly member: string;
+    readonly kind: string;
+    readonly available: readonly string[];
+    constructor(member: string, kind: string, available: readonly string[]);
+}
+/** The member's plan has changes its own pipeline has not applied. Nothing was read. */
+export declare class MemberOutputsPendingError extends Error {
+    readonly member: string;
+    constructor(member: string);
+}
+/** The member a {@link MemberOutputsInput} reads plans as, in the consumer's change set. */
+export declare const memberOutputsMemberName: (member: string) => string;
+/**
+ * The member's name in the declaration above `cwd`, with its kind and
+ * directory. Reads the working tree. Imported lazily: the verb set is
+ * loaded where the workspace reader's dependencies may not be.
+ */
+export declare const workspaceMemberLookup: MemberLookup;
+/** Implemented by a capability that wants the plugins' engine output sources injected when a registry is built. */
+export interface EngineOutputSourceConsumer {
+    withEngineOutputSources(sources: readonly EngineOutputSource[]): Capability<never, unknown>;
+}
+export declare function isEngineOutputSourceConsumer(value: unknown): value is EngineOutputSourceConsumer;
+export interface MemberOutputsCapabilityOptions {
+    /** The engines' sources. Bound by the registry from the loaded plugins; empty until then. */
+    sources?: readonly EngineOutputSource[];
+    /** How a member is found. Default: {@link workspaceMemberLookup}. */
+    lookup?: MemberLookup;
+}
+/** `member-outputs` over the given sources. */
+export declare function memberOutputsCapability(options?: MemberOutputsCapabilityOptions): Capability<MemberOutputsInput, MemberOutputsOutput> & EngineOutputSourceConsumer;
+/** The starter set's `member-outputs`, with no sources until a registry binds the loaded plugins' ones. */
+export declare const memberOutputsStarterCapability: Capability<MemberOutputsInput, MemberOutputsOutput> & EngineOutputSourceConsumer;
+/**
+ * A component in the consumer's project that stands for workspace member
+ * `member` (#4455): one step reading its outputs. Named after the member, so
+ * `stackOutput(member, "<output>")` reads them and `dependsOn: [member]`
+ * orders the consumer after it.
+ */
+export declare function memberOutputsComponent(member: string, options?: {
+    cwd?: string;
+}): Component;
+//# sourceMappingURL=member-outputs.d.ts.map

package/dist/components/verbs/member-outputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-outputs.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/member-outputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAkB,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,qBAAqB;AACrB,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,kBAAkB;IACjC,yGAAyG;IACzG,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,2HAA2H;AAC3H,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,iEAAiE;AACjE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oDAAoD;IACpD,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpF,iGAAiG;IACjG,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClF;AAED,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAErF,iDAAiD;AACjD,qBAAa,8BAA+B,SAAQ,KAAK;IAErD,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE;IAHvC,YACW,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,MAAM,EAAE,EAQtC;CACF;AAED,wFAAwF;AACxF,qBAAa,yBAA0B,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAnC,YAAqB,MAAM,EAAE,MAAM,EAMlC;CACF;AAED,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,WAAY,MAAM,KAAG,MAA6B,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,YAiBnC,CAAC;AAQF,mHAAmH;AACnH,MAAM,WAAW,0BAA0B;IACzC,uBAAuB,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CAC7F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAEhG;AAmBD,MAAM,WAAW,8BAA8B;IAC7C,6FAA6F;IAC7F,OAAO,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACxC,qEAAqE;IACrE,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,+CAA+C;AAC/C,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,8BAAmC,GAC3C,UAAU,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,GAAG,0BAA0B,CAwClF;AAED,2GAA2G;AAC3G,eAAO,MAAM,8BAA8B,kFAA4B,CAAC;AAExE;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,SAAS,CAOhG"}

package/dist/components/verbs/member-outputs.js

@@ -0,0 +1,218 @@
+/**
+ * `member-outputs`: another workspace member's outputs, read through the
+ * engine that member runs on, so a chant member's parameters can be planned
+ * against them (#4455, design record choudoufu#2258 lane T6).
+ *
+ * In `behold/example-three-cloud`, `dns` (a chant member) reads each cloud's
+ * endpoint as a parameter of the same name as the output the cloud's member
+ * publishes. When the Azure site is a choudoufu estate, `azureEndpoint` is a
+ * Terraform root output, and when the AWS site is a Pulumi stack it is a
+ * stack output. Neither is a chant component, so there is nothing for a
+ * `stackOutput()` reference to read. This verb is that something: a
+ * component in the consumer's project whose one step names the upstream
+ * member, and whose capability answers the two questions the components
+ * machinery already asks of an upstream:
+ *
+ * - `outputs` (applied): what the member exposes now. A pull request that
+ *   does not touch the member plans the consumer against these
+ *   (`deployedOutputs`, #4104).
+ * - `plan` (planned): what the member will expose once its own plan applies,
+ *   with the outputs known only after apply named (`PlannedOutputs`, #3999).
+ *   A pull request that touches the member plans the consumer against the
+ *   known ones. A reference to an unknown one is unresolved, so the
+ *   consumer's step is planned with `DeployContext.unresolvedInputs` naming
+ *   the member, the pull request's report lists `<member>.<output>` under the
+ *   consumer's `unknownInputs`, and the apply holds the consumer back until
+ *   the member applied, then plans it again (`pr-run.ts`, "Planning again
+ *   once an upstream applied"). That is the hold chant already puts on a
+ *   root waiting on another root's unknown output; nothing here adds a
+ *   second one.
+ *
+ * The consumer writes it as two components:
+ *
+ * ```ts
+ * export const azure = memberOutputsComponent("azure");
+ * export const records: Component = {
+ *   name: "records",
+ *   dependsOn: ["azure"],
+ *   deploy: [phase("Apply", [{ kind: "cfn-deploy", template: "dist/dns.json",
+ *     inputs: { azureEndpoint: stackOutput("azure", "azureEndpoint") } }])],
+ * };
+ * ```
+ *
+ * ## Engines: the seam
+ *
+ * The member is looked up in the workspace declaration (`chant.workspace.json`)
+ * by name, and its `kind` picks the {@link EngineOutputSource} that reads it.
+ * Sources are not capabilities: each lexicon that drives an engine
+ * contributes one through `CapabilityPlugin.engineOutputSources()`, the way
+ * the cloud lexicons contribute registry logins to `publish-image`, and the
+ * registry binds them into this one verb when it is built
+ * (`registerCapabilityPlugins`). So two engines never register the same
+ * kind, and a consumer's step does not change when the member moves between
+ * engines.
+ *
+ * - `choudoufu` (the terraform lexicon, `choudoufuOutputSource`): applied
+ *   values from `choudoufu output -json` in the member's directory, which in
+ *   live mode reads the estate's record store; planned values from
+ *   `live-plan-set -json` over the member's root, its plan's
+ *   `planned_values.outputs` with every output whose `output_changes` entry
+ *   marks any part `after_unknown` named unknown (`terraformPlannedOutputs`).
+ * - `pulumi` (the pulumi lexicon, `pulumiOutputSource`): applied values
+ *   from `pulumi stack output --json --show-secrets=false`, or from the
+ *   member's checked-in `stack-export.json` when chant must not run pulumi
+ *   (`CHANT_PULUMI_APPLIED_OUTPUTS=export`); planned values from `pulumi
+ *   preview --json`, the stack step's outputs, where an output holding
+ *   Pulumi's unknown sentinel is unknown. Secret outputs are left out of
+ *   both. A member on plunge runs the same commands under `plunge`.
+ *   Nothing in this module or in the consumer changes for it.
+ *
+ * ## Run reads, it never applies
+ *
+ * The member applies through its own pipeline. `run` checks that the
+ * member's plan has nothing left to apply (`changes` false) and answers its
+ * applied outputs; a member with changes still to apply refuses the run
+ * with {@link MemberOutputsPendingError}, so the consumer is blocked behind
+ * it and never applies against values from before the member's change. A
+ * workspace orders the member's own run before the consumer's (members that
+ * link to a producer run after it, `chant workspace run`).
+ *
+ * ## Which changes reach the member
+ *
+ * The component is a deploy unit named after the member (`DEPLOY_UNIT_RULES`),
+ * so a change signal that names the member as a changed unit puts it in the
+ * change. The terraform lexicon names it when the consumer's
+ * `terraform.roots` has an entry of that name whose files changed;
+ * `--from-affected` can name it too.
+ */
+import { computePlanDigest } from "../../lifecycle/plan-digest.js";
+/** The step kind. */
+export const MEMBER_OUTPUTS_KIND = "member-outputs";
+/** No source for the member's kind is loaded. */
+export class EngineOutputSourceMissingError extends Error {
+    constructor(member, kind, available) {
+        super(`${MEMBER_OUTPUTS_KIND}: member "${member}" is kind ${kind}, and no loaded lexicon reads that engine's outputs` +
+            (available.length > 0 ? ` (loaded: ${available.join(", ")})` : "") +
+            `. ${kind === "choudoufu" ? 'Add "terraform" to the project\'s lexicons.' : kind === "pulumi" ? 'Add "pulumi" to the project\'s lexicons.' : "Load the lexicon that drives it."}`);
+        this.member = member;
+        this.kind = kind;
+        this.available = available;
+        this.name = "EngineOutputSourceMissingError";
+    }
+}
+/** The member's plan has changes its own pipeline has not applied. Nothing was read. */
+export class MemberOutputsPendingError extends Error {
+    constructor(member) {
+        super(`${MEMBER_OUTPUTS_KIND}: member "${member}" has changes its own pipeline has not applied yet, ` +
+            `so its outputs are still the ones from before them. Apply ${member} first; whatever reads its outputs runs after it.`);
+        this.member = member;
+        this.name = "MemberOutputsPendingError";
+    }
+}
+/** The member a {@link MemberOutputsInput} reads plans as, in the consumer's change set. */
+export const memberOutputsMemberName = (member) => `${member}#outputs`;
+/**
+ * The member's name in the declaration above `cwd`, with its kind and
+ * directory. Reads the working tree. Imported lazily: the verb set is
+ * loaded where the workspace reader's dependencies may not be.
+ */
+export const workspaceMemberLookup = async (cwd, member) => {
+    const { locateWorkspace } = await import("../../workspace/which-chant.js");
+    const { readDeclaration } = await import("../../workspace/declaration.js");
+    const { join } = await import("node:path");
+    const located = locateWorkspace(cwd);
+    const declaration = readDeclaration(located.tree);
+    const found = declaration.members.find((m) => m.name === member);
+    if (!found) {
+        const names = declaration.members.map((m) => m.name).sort();
+        throw new Error(`${MEMBER_OUTPUTS_KIND}: the workspace at ${located.rootOnDisk} declares no member "${member}" (members: ${names.join(", ")})`);
+    }
+    return {
+        member: found.name,
+        kind: found.kind,
+        dir: found.dir === "." ? located.rootOnDisk : join(located.rootOnDisk, ...found.dir.split("/")),
+        workspaceRoot: located.rootOnDisk,
+    };
+};
+function requireMember(input) {
+    if (typeof input?.member !== "string" || input.member === "") {
+        throw new Error(`${MEMBER_OUTPUTS_KIND}: "member" is required and names a member of the workspace`);
+    }
+}
+export function isEngineOutputSourceConsumer(value) {
+    return typeof value === "object" && value !== null && typeof value.withEngineOutputSources === "function";
+}
+/**
+ * The member's part of the consumer's change set: no entries, since the
+ * member's own pipeline plans and applies its changes, and a hole per output
+ * known only after apply, naming the member and the output.
+ */
+function outputsPart(member, planDigest, unknown) {
+    const holes = unknown.map((name) => ({
+        address: `${member}.${name}`,
+        type: "output",
+        reason: `${member}.${name} is known only after ${member} applies; what reads it is planned again then`,
+    }));
+    return {
+        member: { member: memberOutputsMemberName(member), lexicon: "chant", planner: "chant", status: "planned", planDigest, holes },
+        entries: [],
+    };
+}
+/** `member-outputs` over the given sources. */
+export function memberOutputsCapability(options = {}) {
+    const sources = options.sources ?? [];
+    const lookup = options.lookup ?? workspaceMemberLookup;
+    async function resolve(input) {
+        requireMember(input);
+        const ref = await lookup(input.cwd ?? process.cwd(), input.member);
+        const source = sources.find((s) => s.kinds.includes(ref.kind));
+        if (!source)
+            throw new EngineOutputSourceMissingError(ref.member, ref.kind, [...new Set(sources.flatMap((s) => s.kinds))].sort());
+        return { ref, source };
+    }
+    return {
+        kind: MEMBER_OUTPUTS_KIND,
+        // It reads; the member's own pipeline applies. Nothing to compensate.
+        rollbackPolicy: "none-by-design",
+        targets: { refuse: "it reads another member's outputs; narrow that member's own plan instead" },
+        async plan(ctx, input) {
+            const { ref, source } = await resolve(input);
+            const planned = await source.planned(ctx, ref);
+            const unknown = [...new Set(planned.unknown)].sort();
+            const known = Object.fromEntries(Object.entries(planned.known).filter(([name]) => !unknown.includes(name)));
+            const member = memberOutputsMemberName(ref.member);
+            const planDigest = computePlanDigest(MEMBER_OUTPUTS_KIND, { env: ctx.env, member: ref.member, kind: ref.kind, plan: planned.planDigest, known, unknown });
+            return { member, planDigest, changeSet: outputsPart(ref.member, planDigest, unknown), outputs: { known, unknown } };
+        },
+        async outputs(ctx, input) {
+            const { ref, source } = await resolve(input);
+            return source.applied(ctx, ref);
+        },
+        async run(ctx, input) {
+            const { ref, source } = await resolve(input);
+            const now = await source.planned(ctx, ref);
+            if (now.changes)
+                throw new MemberOutputsPendingError(ref.member);
+            return { member: ref.member, outputs: await source.applied(ctx, ref) };
+        },
+        withEngineOutputSources(next) {
+            return memberOutputsCapability({ ...options, sources: next });
+        },
+    };
+}
+/** The starter set's `member-outputs`, with no sources until a registry binds the loaded plugins' ones. */
+export const memberOutputsStarterCapability = memberOutputsCapability();
+/**
+ * A component in the consumer's project that stands for workspace member
+ * `member` (#4455): one step reading its outputs. Named after the member, so
+ * `stackOutput(member, "<output>")` reads them and `dependsOn: [member]`
+ * orders the consumer after it.
+ */
+export function memberOutputsComponent(member, options = {}) {
+    return {
+        name: member,
+        archetype: "infra",
+        dependsOn: [],
+        deploy: [{ phase: "Outputs", steps: [{ kind: MEMBER_OUTPUTS_KIND, member, ...(options.cwd ? { cwd: options.cwd } : {}) }] }],
+    };
+}

package/dist/config.d.ts

@@ -175,6 +175,52 @@ export declare const ChantConfigSchema: z.ZodObject<{
     exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
     include: z.ZodOptional<z.ZodArray<z.ZodString>>;
     rootOnly: z.ZodOptional<z.ZodBoolean>;
+    snapshots: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        store: z.ZodLiteral<"git-ref">;
+        ref: z.ZodOptional<z.ZodString>;
+        readOrphanBranch: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodObject<{
+        store: z.ZodLiteral<"orphan-branch">;
+    }, z.core.$strict>, z.ZodObject<{
+        store: z.ZodLiteral<"local">;
+        dir: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        bucket: z.ZodString;
+        prefix: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodString>;
+        endpoint: z.ZodOptional<z.ZodString>;
+        forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+        credentials: z.ZodOptional<z.ZodObject<{
+            accessKeyId: z.ZodString;
+            secretAccessKey: z.ZodString;
+            sessionToken: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        store: z.ZodLiteral<"s3">;
+    }, z.core.$strict>, z.ZodObject<{
+        store: z.ZodLiteral<"none">;
+    }, z.core.$strict>], "store">>;
+    observationBaseline: z.ZodOptional<z.ZodObject<{
+        store: z.ZodEnum<{
+            file: "file";
+            "git-ref": "git-ref";
+            none: "none";
+            s3: "s3";
+        }>;
+        dir: z.ZodOptional<z.ZodString>;
+        ref: z.ZodOptional<z.ZodString>;
+        s3: z.ZodOptional<z.ZodObject<{
+            bucket: z.ZodString;
+            prefix: z.ZodOptional<z.ZodString>;
+            region: z.ZodOptional<z.ZodString>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+            credentials: z.ZodOptional<z.ZodObject<{
+                accessKeyId: z.ZodString;
+                secretAccessKey: z.ZodString;
+                sessionToken: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
 }, z.core.$loose>;
 /**
  * Top-level chant project configuration.
@@ -519,6 +565,20 @@ export interface ChantConfig {
      * in a project with no `chant.workspace.json`.
      */
     rootOnly?: boolean;
+    /**
+     * Where snapshots and every other index are kept (#4519): `git-ref`
+     * (default, `refs/chant/snapshots`, still reading `chant/lifecycle` for
+     * snapshots written before), `local` (a directory), `s3` (a bucket under a
+     * prefix), `none`, or `orphan-branch` (read-only). `CHANT_SNAPSHOT_STORE`
+     * and its companions override it. See `./lifecycle/snapshot-store.ts`.
+     */
+    snapshots?: import("./lifecycle/snapshot-store.js").SnapshotStoreConfig;
+    /**
+     * Where accepted observation deviations are kept (#4519): `file` (default,
+     * `.chant/observation-baseline/<env>.json`, committed and reviewed),
+     * `git-ref`, `s3` or `none`. See `./lifecycle/observation-baseline.ts`.
+     */
+    observationBaseline?: import("./lifecycle/observation-baseline.js").ObservationBaselineStoreConfig;
 }
 /**
  * Resolved project configuration with metadata about how it was loaded.

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD,OAAO,EAA8D,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvH,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAKpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAA+D,KAAK,sBAAsB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AA2BpJ,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgFd,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAEhC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAExC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,0EAA0E;QAC1E,IAAI,EAAE,MAAM,CAAC;QACb,8EAA8E;QAC9E,GAAG,EAAE,MAAM,CAAC;QACZ;mFAC2E;QAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IAEH,8DAA8D;IAC9D,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;QACzB;;;;;;;WAOG;QACH,MAAM,CAAC,EAAE;YACP,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAClC,CAAC;KACH,CAAC;IAEF;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE;QACV,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IAEF;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,2EAA2E;QAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;;;;;WASG;QACH,GAAG,CAAC,EAAE,YAAY,CAAC;QACnB,kEAAkE;QAClE,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;OAEG;IACH,KAAK,CAAC,EAAE;QACN;;;;;;;WAOG;QACH,IAAI,CAAC,EAAE,OAAO,CAAC;QAEf;;;;;;;WAOG;QACH,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,8KAA8K;QAC9K,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB;;;;WAIG;QACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;KAChC,CAAC;IAEF,4DAA4D;IAC5D,GAAG,CAAC,EAAE;QACJ;;;;WAIG;QACH,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;IAEF;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,+OAA+O;QAC/O,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,4cAA4c;QAC5c,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE;QACR,wJAAwJ;QACxJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,sRAAsR;QACtR,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,2IAA2I;QAC3I,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,0IAA0I;QAC1I,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,4UAA4U;QAC5U,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE;QACX,kEAAkE;QAClE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,2EAA2E;QAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,gEAAgE;QAChE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,wEAAwE;QACxE,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,0FAA0F;QAC1F,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,0FAA0F;QAC1F,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,0EAA0E;QAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,8DAA8D;QAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,wEAAwE;QACxE,yBAAyB,CAAC,EAAE,OAAO,CAAC;QACpC,+EAA+E;QAC/E,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAChD,yKAAyK;QACzK,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAC5B,kHAAkH;QAClH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IAEF;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE;QACV,iFAAiF;QACjF,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QACR,qFAAqF;QACrF,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,MAAM,EAAE,iBAAiB,CAAC;IAE1B,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,iBAAsB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAkB1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAIrF;AAED,sGAAsG;AACtG,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAQrG;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAcjG;AAwBD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAY9D;AAsCD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC5C,eAAe,GAAG,SAAS,CAI7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAG1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAIlF;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAGrF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,CAE1F;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,gJAAgJ;IAChJ,OAAO,EAAE,OAAO,CAAC;IACjB,qIAAqI;IACrI,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,6RAA6R;IAC7R,sBAAsB,EAAE;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,uBAAuB,CAanF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAiB1E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACnB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAAlD,YAAY,OAAO,EAAE,MAAM,EAAW,GAAG,CAAC,EAAE,MAAM,YAAA,EAEjD;CACF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD,OAAO,EAA8D,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvH,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAKpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAA+D,KAAK,sBAAsB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAyCpJ,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8Fd,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAEhC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAExC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,0EAA0E;QAC1E,IAAI,EAAE,MAAM,CAAC;QACb,8EAA8E;QAC9E,GAAG,EAAE,MAAM,CAAC;QACZ;mFAC2E;QAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IAEH,8DAA8D;IAC9D,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;QACzB;;;;;;;WAOG;QACH,MAAM,CAAC,EAAE;YACP,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAClC,CAAC;KACH,CAAC;IAEF;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE;QACV,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IAEF;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,2EAA2E;QAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;;;;;WASG;QACH,GAAG,CAAC,EAAE,YAAY,CAAC;QACnB,kEAAkE;QAClE,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;OAEG;IACH,KAAK,CAAC,EAAE;QACN;;;;;;;WAOG;QACH,IAAI,CAAC,EAAE,OAAO,CAAC;QAEf;;;;;;;WAOG;QACH,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,8KAA8K;QAC9K,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB;;;;WAIG;QACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;KAChC,CAAC;IAEF,4DAA4D;IAC5D,GAAG,CAAC,EAAE;QACJ;;;;WAIG;QACH,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;IAEF;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,+OAA+O;QAC/O,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,4cAA4c;QAC5c,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE;QACR,wJAAwJ;QACxJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,sRAAsR;QACtR,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,2IAA2I;QAC3I,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,0IAA0I;QAC1I,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,4UAA4U;QAC5U,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE;QACX,kEAAkE;QAClE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,2EAA2E;QAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,gEAAgE;QAChE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,wEAAwE;QACxE,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,0FAA0F;QAC1F,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,0FAA0F;QAC1F,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,0EAA0E;QAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,8DAA8D;QAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,wEAAwE;QACxE,yBAAyB,CAAC,EAAE,OAAO,CAAC;QACpC,+EAA+E;QAC/E,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAChD,yKAAyK;QACzK,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAC5B,kHAAkH;QAClH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IAEF;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE;QACV,iFAAiF;QACjF,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QACR,qFAAqF;QACrF,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,4BAA4B,EAAE,mBAAmB,CAAC;IAErE;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,kCAAkC,EAAE,8BAA8B,CAAC;CACjG;AAED;;GAEG;AACH;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,MAAM,EAAE,iBAAiB,CAAC;IAE1B,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,iBAAsB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAkB1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAIrF;AAED,sGAAsG;AACtG,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAQrG;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAcjG;AAwBD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAY9D;AAsCD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC5C,eAAe,GAAG,SAAS,CAI7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAG1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAIlF;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAGrF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,CAE1F;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,gJAAgJ;IAChJ,OAAO,EAAE,OAAO,CAAC;IACjB,qIAAqI;IACrI,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,6RAA6R;IAC7R,sBAAsB,EAAE;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,uBAAuB,CAanF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAiB1E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACnB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAAlD,YAAY,OAAO,EAAE,MAAM,EAAW,GAAG,CAAC,EAAE,MAAM,YAAA,EAEjD;CACF"}

package/dist/config.js

@@ -12,6 +12,19 @@ import { PublishDeclarationSchema } from "./lifecycle/publish-declaration.js";
 // needs only them stays clear of the loader below (#4356 follow-up).
 export { environmentEndpoint, environmentExecutor, environmentName, EXECUTOR_FORGES, environmentNames, isEnvironmentPattern, isOwnershipParamRef, matchesDeclaredEnvironment, matchesEnvironmentPattern, resolveOwnershipStack, } from "./config-environments.js";
 import { EXECUTOR_FORGES, isOwnershipParamRef, resolveOwnershipStack } from "./config-environments.js";
+/** An s3 index store's settings (#4519, ./lifecycle/snapshot-store-s3.ts). */
+const S3StoreSettingsShape = {
+    bucket: z.string().min(1),
+    prefix: z.string().optional(),
+    region: z.string().min(1).optional(),
+    endpoint: z.string().url().optional(),
+    forcePathStyle: z.boolean().optional(),
+    credentials: z.object({
+        accessKeyId: z.string().min(1),
+        secretAccessKey: z.string().min(1),
+        sessionToken: z.string().min(1).optional(),
+    }).strict().optional(),
+};
 /**
  * Zod schema for ChantConfig validation.
  */
@@ -112,6 +125,20 @@ export const ChantConfigSchema = z.object({
     exclude: z.array(z.string().min(1)).optional(),
     include: z.array(z.string().min(1)).optional(),
     rootOnly: z.boolean().optional(),
+    // Strict: a misspelt key would send snapshots somewhere nobody looks (#4519).
+    snapshots: z.discriminatedUnion("store", [
+        z.object({ store: z.literal("git-ref"), ref: z.string().regex(/^refs\/chant\//).optional(), readOrphanBranch: z.boolean().optional() }).strict(),
+        z.object({ store: z.literal("orphan-branch") }).strict(),
+        z.object({ store: z.literal("local"), dir: z.string().min(1).optional() }).strict(),
+        z.object({ store: z.literal("s3"), ...S3StoreSettingsShape }).strict(),
+        z.object({ store: z.literal("none") }).strict(),
+    ]).optional(),
+    observationBaseline: z.object({
+        store: z.enum(["file", "git-ref", "s3", "none"]),
+        dir: z.string().min(1).optional(),
+        ref: z.string().regex(/^refs\/chant\//).optional(),
+        s3: z.object(S3StoreSettingsShape).strict().optional(),
+    }).strict().optional(),
 }).passthrough();
 /**
  * Default configuration when no config file exists.

package/dist/deep-observation.d.ts

@@ -163,19 +163,7 @@ export declare function normalizeDeepObservation(value: DeepObservationResult |
 export declare const UNRESOLVED = "<chant:unresolved>";
 /** Value a masked (secret-bearing) property takes. Matches the thin path's convention. */
 export declare const MASKED = "[REDACTED]";
-/**
- * Property-name patterns that mark a value secret-bearing. Deliberately narrow
- * and key-name based: broadening this to e.g. `/key/i` would mask an AWS tag's
- * `Key` field and every `*KeyName` reference, which is how masking turns into
- * its own drift signal.
- *
- * Shared with the thin snapshot path (`./lifecycle/snapshot.ts`), which warns
- * on the same names — one list, so the two paths cannot disagree about what
- * counts as a secret.
- */
-export declare const SENSITIVE_KEY_PATTERNS: readonly RegExp[];
-/** True when a property name looks secret-bearing (see {@link SENSITIVE_KEY_PATTERNS}). */
-export declare function isSensitiveKey(key: string): boolean;
+export { SENSITIVE_KEY_PATTERNS, isSensitiveKey } from "./sensitive-key.js";
 /** Which tree a hook is being invoked on. */
 export type DeepSide = "declared" | "live";
 /** One node the normalization pass offers to {@link DeepNormalizationHooks.prune}. */

package/dist/deep-observation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observation.d.ts","sourceRoot":"","sources":["../src/deep-observation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtD;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,4GAA4G;IAC5G,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,uGAAuG;IACvG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,2EAA2E;AAC3E,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAMtF;AAED,6GAA6G;AAC7G,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC7C,OAAO,CAAC,EAAE,iBAAiB,EAAE,GAC5B,qBAAqB,CAOvB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,yBAAyB,CAO3B;AAID;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,uBAAuB,CAAC;AAE/C,0FAA0F;AAC1F,eAAO,MAAM,MAAM,eAAe,CAAC;AAEnC;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAOnD,CAAC;AAEF,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,6CAA6C;AAC7C,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3C,sFAAsF;AACtF,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC/C;AAED,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;IACzD;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnH;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACxC;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CA+BtE;AA0CD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyIzB;AAKD,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAoDtB;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAK9D"}
+{"version":3,"file":"deep-observation.d.ts","sourceRoot":"","sources":["../src/deep-observation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItD;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,4GAA4G;IAC5G,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,uGAAuG;IACvG,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,2EAA2E;AAC3E,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAMtF;AAED,6GAA6G;AAC7G,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC7C,OAAO,CAAC,EAAE,iBAAiB,EAAE,GAC5B,qBAAqB,CAOvB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,yBAAyB,CAO3B;AAID;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,uBAAuB,CAAC;AAE/C,0FAA0F;AAC1F,eAAO,MAAM,MAAM,eAAe,CAAC;AAKnC,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzE,6CAA6C;AAC7C,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3C,sFAAsF;AACtF,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC/C;AAED,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;IACzD;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnH;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACxC;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CA+BtE;AA0CD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyIzB;AAKD,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAoDtB;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAK9D"}

package/dist/deep-observation.js

@@ -43,6 +43,7 @@
  * when nobody declared the property.
  */
 import { isHeldElsewhere, isNormalizedHeldElsewhere, normalizeHeldElsewhere } from "./held-elsewhere.js";
+import { isSensitiveKey } from "./sensitive-key.js";
 /** True when `value` is the versioned {@link DeepObservationResult} envelope. */
 export function isDeepObservationResult(value) {
     return (typeof value === "object" &&
@@ -84,28 +85,10 @@ export function normalizeDeepObservation(value) {
 export const UNRESOLVED = "<chant:unresolved>";
 /** Value a masked (secret-bearing) property takes. Matches the thin path's convention. */
 export const MASKED = "[REDACTED]";
-/**
- * Property-name patterns that mark a value secret-bearing. Deliberately narrow
- * and key-name based: broadening this to e.g. `/key/i` would mask an AWS tag's
- * `Key` field and every `*KeyName` reference, which is how masking turns into
- * its own drift signal.
- *
- * Shared with the thin snapshot path (`./lifecycle/snapshot.ts`), which warns
- * on the same names — one list, so the two paths cannot disagree about what
- * counts as a secret.
- */
-export const SENSITIVE_KEY_PATTERNS = [
-    /password/i,
-    /secret/i,
-    /token/i,
-    /private.?key/i,
-    /credential/i,
-    /connection.?string/i,
-];
-/** True when a property name looks secret-bearing (see {@link SENSITIVE_KEY_PATTERNS}). */
-export function isSensitiveKey(key) {
-    return SENSITIVE_KEY_PATTERNS.some((p) => p.test(key));
-}
+// The secret-key list lives in `./sensitive-key.ts` so the drift record
+// (`./drift-record.ts`) can redact with it inside the change-set bundle,
+// which may not import this module's normalization code.
+export { SENSITIVE_KEY_PATTERNS, isSensitiveKey } from "./sensitive-key.js";
 /** True for a value the pass will walk into rather than treat as a leaf. */
 function isPlainObject(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value))