@intentius/chant 0.46.0 → 0.50.0

package/dist/lifecycle/lease.d.ts

@@ -0,0 +1,113 @@
+export declare const LEASE_REF_PREFIX = "refs/chant/lease/";
+/**
+ * Side namespace `readLease` fetches remote lease state into (#1959 finding
+ * 3), rather than into `refs/chant/lease/<op>` itself. That ref is the CAS
+ * write path's alone (`acquireLease`/`releaseLease`, both via
+ * `updateRefCAS`/`deleteRefCAS`); a read path force-fetching directly into
+ * it would risk clobbering a just-acquired, not-yet-pushed local lease with
+ * the still-stale remote value — the exact race a concurrent `chant operator
+ * status` in the same clone could hit during the acquire→push window. See
+ * `readLease`'s doc for how the two are reconciled without that risk.
+ */
+export declare const LEASE_REMOTE_TRACKING_PREFIX = "refs/chant/lease-remote/";
+/**
+ * Default lease TTL — long enough that a normal tick (observe, classify,
+ * a budget-bounded number of dispatches) finishes well inside it; short
+ * enough that a crashed operator's environment resumes converging soon
+ * after, without a human intervening. The operator loop renews well before
+ * this elapses (every round it still owns the lease for), so under normal
+ * operation the TTL is never actually reached.
+ */
+export declare const DEFAULT_LEASE_TTL_MS: number;
+export declare function leaseRef(opName: string): string;
+/** One lease's live state — the entire durable record; there is no history, only the current holder (see this module's doc on why no separate ledger). */
+export interface LeaseRecord {
+    op: string;
+    /** `<hostname>:<pid>:<random>` — a diagnostic identity, not itself the fencing mechanism (`token` is). */
+    holder: string;
+    /** Fencing token — new only when the lease actually changes hands; see module doc. */
+    token: string;
+    acquiredAt: string;
+    expiresAt: string;
+}
+/** A stable-enough identity for "who holds this lease", for logs and `chant operator status` — hostname:pid, plus a short random suffix so two processes started in the same pid-reuse window never read as the same holder. */
+export declare function currentHolderId(): string;
+export interface ReadLeaseResult {
+    /** The ref's current SHA (the CAS anchor for the next write), or `null` if no lease has ever been written. */
+    sha: string | null;
+    record?: LeaseRecord;
+}
+/**
+ * Read the live lease for `opName`, fetching the remote ref first (best-
+ * effort) so a lease held by another machine is visible before deciding
+ * whether to acquire.
+ *
+ * The fetch lands in a side tracking ref (`refs/chant/lease-remote/<op>`),
+ * never directly into `refs/chant/lease/<op>` itself (#1959 finding 3) — the
+ * canonical local ref is written *only* by the CAS path
+ * (`acquireLease`/`releaseLease`), so a read (this function is called
+ * before every `acquireLease`, and directly by `chant operator status`) can
+ * never force it back to a stale remote value out from under a concurrent
+ * local acquirer. The returned `record` is whichever of the local/remote
+ * views is more current by `leaseFreshnessKey` (ties keep local): this
+ * still gives full cross-machine visibility — a genuinely newer remote
+ * holder wins — while a just-acquired, not-yet-pushed local lease (freshest
+ * by construction) always survives a same-clone concurrent read. `sha`
+ * — the CAS anchor a subsequent `acquireLease`/`releaseLease` writes
+ * against — is always the local ref's own actual value; only the local
+ * canonical ref is ever a valid basis for a `updateRefCAS`/`deleteRefCAS`
+ * call against it, regardless of what the comparison decided about `record`.
+ */
+export declare function readLease(opName: string, opts?: {
+    cwd?: string;
+}): Promise<ReadLeaseResult>;
+export interface AcquireLeaseResult {
+    acquired: boolean;
+    lease?: LeaseRecord;
+    /** Present when not acquired: the lease record currently held by someone else. */
+    heldBy?: LeaseRecord;
+}
+/**
+ * Acquire or renew the lease for `opName` as `holder`. Succeeds when the ref
+ * doesn't exist yet, is expired, or is already held by `holder` (a renewal:
+ * same token, pushed-out expiry). Fails — returns `acquired: false`, without
+ * throwing — when it's live-held by someone else, or when a concurrent CAS
+ * write is lost to a race that happened between this call's read and its
+ * write ({@link RefCASConflictError}); both read identically to a caller
+ * deciding whether to tick this round ("someone else has it right now,
+ * skip").
+ *
+ * Deliberately does NOT swallow a `StaleLockError` (./git.ts) into that same
+ * "someone else has it" outcome (#1959 finding 2): a leftover `.lock` file
+ * from a killed process is not contention, it's wreckage, and treating it as
+ * "held by someone else" would make `chant operator` back off forever
+ * against a lease nobody can ever actually acquire again without manual
+ * intervention. It propagates instead, so the caller (`../op/operator.ts`'s
+ * `runOperatorRound`) can surface it as its own distinct, diagnosable event
+ * rather than a silent, permanent skip.
+ */
+export declare function acquireLease(opName: string, holder: string, opts?: {
+    cwd?: string;
+    ttlMs?: number;
+    now?: () => Date;
+}): Promise<AcquireLeaseResult>;
+/**
+ * Release the lease, but only when `holder`/`token` still match the live
+ * value — releasing a lease this caller no longer actually holds would
+ * silently drop someone else's. Best-effort courtesy: a lease nobody
+ * releases is reclaimed anyway once its TTL passes, so a failed release
+ * (returns `false`, never throws) is not itself a correctness problem.
+ */
+export declare function releaseLease(opName: string, holder: string, token: string, opts?: {
+    cwd?: string;
+}): Promise<boolean>;
+/**
+ * Does `holder`/`token` still match the live lease? The fencing check a
+ * tick uses right before trusting its own work as authoritative (see
+ * `../op/operator.ts`). Fetches first, so a lease stolen by another machine
+ * is detected, not just a stale local read.
+ */
+export declare function stillHoldsLease(opName: string, holder: string, token: string, opts?: {
+    cwd?: string;
+}): Promise<boolean>;
+//# sourceMappingURL=lease.d.ts.map

package/dist/lifecycle/lease.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease.d.ts","sourceRoot":"","sources":["../../src/lifecycle/lease.ts"],"names":[],"mappings":"AAqCA,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/C;AAoBD,0JAA0J;AAC1J,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,0GAA0G;IAC1G,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gOAAgO;AAChO,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAwBD,MAAM,WAAW,eAAe;IAC9B,8GAA8G;IAC9G,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAajG;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC,kBAAkB,CAAC,CAoC7B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,OAAO,CAAC,CAGlB"}

package/dist/lifecycle/observation-baseline.d.ts

@@ -91,15 +91,33 @@ export interface DeviationToAccept {
     value: unknown;
     note?: string;
 }
+/** Options for {@link acceptDeviations}. */
+export interface AcceptDeviationsOptions {
+    /** ISO timestamp to stamp instead of the wall clock (tests, replays). */
+    now?: string;
+    /**
+     * Entity names the caller recognized as effect receipts (#1833) — the
+     * marker-based read (`collectEffectReceipts`, ../effect-receipt.ts) over
+     * the build's entities, which is how a lexicon-materialized receipt row is
+     * caught even though its `entityType` is the row's own. Core-typed
+     * receipts are refused regardless, via {@link DeviationToAccept.type}.
+     */
+    receipts?: ReadonlySet<string>;
+}
 /**
  * Record deviations as accepted, returning a new baseline (the input is not
  * mutated). An existing acceptance for the same entity+path is replaced — that
  * is how re-accepting after a deliberate change works, and it keeps the file
  * from growing a second entry for every value a path has ever held.
+ *
+ * REFUSES a deviation on an effect receipt (#1833, epic #1703), throwing
+ * before anything is recorded: a receipt is the declared witness that its
+ * effect ran, and the `effect()` step is its only writer — baselining a
+ * receipt's live value would accept "the effect never fired" as the new
+ * normal and silently defuse the effect. The whole acceptance aborts, not
+ * just the receipt's row, so a partial baseline never lands.
  */
-export declare function acceptDeviations(baseline: ObservationBaseline, lexicon: string, deviations: readonly DeviationToAccept[], opts?: {
-    now?: string;
-}): ObservationBaseline;
+export declare function acceptDeviations(baseline: ObservationBaseline, lexicon: string, deviations: readonly DeviationToAccept[], opts?: AcceptDeviationsOptions): ObservationBaseline;
 /** Total accepted deviations across every lexicon — for the "N accepted" line. */
 export declare function countAccepted(baseline: ObservationBaseline | null | undefined): number;
 /**

package/dist/lifecycle/observation-baseline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observation-baseline.d.ts","sourceRoot":"","sources":["../../src/lifecycle/observation-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAKH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,yGAAyG;IACzG,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;IACf,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,uEAAuE;AACvE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE7D,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC3C;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAEtE;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAQlF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAU5F;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CAEvE;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,EAChD,OAAO,EAAE,MAAM,GACd,eAAe,CAEjB;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAC/B,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,iBAAiB,GAAG,SAAS,CAE/B;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,SAAS,iBAAiB,EAAE,EACxC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,mBAAmB,CAwBrB;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAOtF;AAID;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAErC;AAED,oFAAoF;AACpF,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAQjB"}
+{"version":3,"file":"observation-baseline.d.ts","sourceRoot":"","sources":["../../src/lifecycle/observation-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAMH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,yGAAyG;IACzG,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;IACf,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,uEAAuE;AACvE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE7D,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC3C;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAEtE;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAQlF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAU5F;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CAEvE;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,EAChD,OAAO,EAAE,MAAM,GACd,eAAe,CAEjB;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAC/B,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,iBAAiB,GAAG,SAAS,CAE/B;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,SAAS,iBAAiB,EAAE,EACxC,IAAI,CAAC,EAAE,uBAAuB,GAC7B,mBAAmB,CAkCrB;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAOtF;AAID;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAErC;AAED,oFAAoF;AACpF,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/dist/lifecycle/receipt-plan.d.ts

@@ -0,0 +1,62 @@
+import { type EffectReceiptDeclaration, type ReceiptInputResolver } from "../effect-receipt.js";
+import type { ResourceMetadata } from "../lexicon.js";
+import type { UnobservedReason } from "../observation.js";
+import type { ChangeSet, ChangeSetEntry } from "./change-set.js";
+/**
+ * The attribute a materialized receipt's live value is read from. A lexicon
+ * receipt row's observation (#1835) maps the stored value onto
+ * `attributes[RECEIPT_VALUE_ATTRIBUTE]`; `Value` is accepted as a fallback for
+ * observations that keep the provider's own casing (SSM's `Value`).
+ */
+export declare const RECEIPT_VALUE_ATTRIBUTE = "value";
+/** Read a live receipt's stored value off an observation's attributes. */
+export declare function readReceiptValue(attributes: Record<string, unknown> | undefined): unknown;
+/**
+ * What the plan's observation pass learned about one declared receipt.
+ * Deliberately tri-state, the same shape the change set rests on (#1089):
+ * `observed: false` means "nobody looked", which is a hole — never absence.
+ * A receipt with no reading at all means no loaded lexicon even claims it.
+ */
+export interface ReceiptReading {
+    /** The lexicon actually looked. `false` → the receipt is a plan hole. */
+    observed: boolean;
+    /** Observed present in the live system. Meaningful only when `observed`. */
+    present: boolean;
+    /** The live receipt's stored value ({@link readReceiptValue}). */
+    value?: unknown;
+    /** Live resource type, when reported. */
+    type?: string;
+    /** Provider-assigned physical id, when reported. */
+    physicalId?: string;
+    /** The lexicon whose observation produced this reading. */
+    lexicon?: string;
+    /** Why the read did not happen, when `observed: false`. */
+    unobservedReason?: UnobservedReason;
+    unobservedDetail?: string;
+}
+/**
+ * A {@link ReceiptInputResolver} over the plan's merged observed values: an
+ * attr-ref resolves to the referenced entity's observed attribute. Anything
+ * that is not among the observed values throws — which `planReceipts` renders
+ * as an effect-will-fire entry with an "unresolved input" note rather than a
+ * guessed expectation.
+ */
+export declare function observedValueResolver(resources: Readonly<Record<string, ResourceMetadata>>): ReceiptInputResolver;
+/**
+ * Classify every declared receipt into its change-set entry. See the module
+ * doc for the classification; entries come back sorted by name.
+ */
+export declare function planReceipts(receipts: ReadonlyMap<string, EffectReceiptDeclaration>, readings: ReadonlyMap<string, ReceiptReading>, resolver: ReceiptInputResolver): ChangeSetEntry[];
+/**
+ * Replace whatever the generic classification proposed for the receipts with
+ * the receipt entries built by {@link planReceipts}, in place.
+ *
+ * This is the plan-side write-exclusion (#1832): the generic change set,
+ * knowing nothing about receipts, classifies a declared-but-absent receipt as
+ * `create` and an undeclared-but-live one as `delete`/`adopt` — proposals the
+ * generic apply path must never act on for a receipt, and prune candidacy a
+ * receipt must never have. Every entry named like a receipt is dropped and
+ * the receipt's own entries stand in.
+ */
+export declare function mergeReceiptEntries(cs: ChangeSet, receipts: ReadonlyMap<string, EffectReceiptDeclaration>, receiptEntries: ChangeSetEntry[]): ChangeSet;
+//# sourceMappingURL=receipt-plan.d.ts.map

package/dist/lifecycle/receipt-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-plan.d.ts","sourceRoot":"","sources":["../../src/lifecycle/receipt-plan.ts"],"names":[],"mappings":"AAkCA,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAE/C,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CAIzF;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GACpD,oBAAoB,CAiBtB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EACvD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,EAC7C,QAAQ,EAAE,oBAAoB,GAC7B,cAAc,EAAE,CAoGlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EACvD,cAAc,EAAE,cAAc,EAAE,GAC/B,SAAS,CAMX"}

package/dist/lifecycle/release-ledger.d.ts

@@ -74,6 +74,26 @@ export interface ReleaseRecord {
     approver?: string;
     /** Optional: the archive's own manifest digest (../components/verbs/build-archive.ts's `manifestDigest`), when the caller has it — lets a reader recover full build contents/provenance, not just the promoted image digest. */
     manifestDigest?: string;
+    /**
+     * Optional: set when the deploy's capability-profile assertion (chant
+     * #1244, helm lexicon) was deliberately overridden — carries the named
+     * divergences that were bypassed (declared vs live), so the ledger shows
+     * this release knowingly skewed from its declared profile. Absent for a
+     * deploy whose target matched, and for deploys with no declared profile.
+     */
+    profileOverride?: string;
+    /**
+     * Optional: the deploy's input-side digest, when `digest` is a
+     * rendered-content identity rather than an input identity. A pinned helm
+     * deploy (chant #1242) records the render's `contentDigest` as `digest` —
+     * what this cluster actually received — and carries the input digest
+     * (chart, chart version, resolved values, capability facts; chant #1243)
+     * here, because profiles are per cluster: two environments legitimately
+     * render to different bytes, so cross-environment "is prod running what
+     * staging tested" joins on this field while `digest` proves the exact
+     * bytes each cluster got. Absent when `digest` is already input-side.
+     */
+    inputDigest?: string;
 }
 /** Thrown by `appendReleaseRecord` when the record is missing a required field — a release record can never be recorded partially, since it is never editable afterward. */
 export declare class InvalidReleaseRecordError extends Error {

package/dist/lifecycle/release-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iJAAiJ;IACjJ,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAaD,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;gBAAjB,OAAO,EAAE,MAAM,EAAE;CAI9C;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,EAAE,CAO9E;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CAQpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB1D;AAED,4EAA4E;AAC5E,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}
+{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iJAAiJ;IACjJ,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAaD,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;gBAAjB,OAAO,EAAE,MAAM,EAAE;CAI9C;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,EAAE,CAO9E;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CAQpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB1D;AAED,4EAA4E;AAC5E,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}

package/dist/lifecycle/scenario-eval.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Pure evaluation of a plan scenario's `expect` clause against a `ChangeSet`
+ * (#1292).
+ *
+ * `evaluateScenario` reads only what the caller hands it — a `ChangeSet` and
+ * a `ScenarioExpect` — and does no I/O. Building the change set (reading a
+ * fixture, replaying it in place of a live observation) is the CLI handler's
+ * job (../cli/handlers/scenario.ts); this module is the part that stays
+ * testable without a filesystem, a build, or a fixture.
+ *
+ * Built on the same primitives `chant lifecycle plan` already computes from:
+ * `summarize` for counts, a filter over `cs.entries` for named deletes and
+ * ownership, and `evaluateUnobservedGate` (./unobserved-gate.ts, #1568) for
+ * the unobserved clause.
+ */
+import { type ChangeSet } from "./change-set.js";
+import type { ScenarioExpect } from "./scenario.js";
+/**
+ * One clause's verdict — always present in {@link ScenarioVerdict.checks}, in
+ * declaration order, whether it passed or not. A scenario with no failing
+ * clauses is legible too: every check that ran, and that it held.
+ */
+export interface ScenarioCheckResult {
+    /** Which `expect` clause this is (`"noop"`, `"create"`, `"deletes"`, …). */
+    clause: string;
+    pass: boolean;
+    /** Present when `pass` is false — what was expected vs what the plan proposes, naming resources for delete/ownership failures. */
+    detail?: string;
+}
+/** The result of evaluating one scenario's `expect` against a change set. */
+export interface ScenarioVerdict {
+    pass: boolean;
+    /** Every clause `expect` declared, evaluated — see {@link ScenarioCheckResult}. */
+    checks: ScenarioCheckResult[];
+}
+/**
+ * Evaluate `expect` against `cs`. Pure: reads `cs` and `expect`, computes
+ * nothing else. Every clause present on `expect` is checked independently and
+ * every one contributes to `checks`; `pass` is true only when all of them are.
+ */
+export declare function evaluateScenario(cs: ChangeSet, expect: ScenarioExpect): ScenarioVerdict;
+//# sourceMappingURL=scenario-eval.d.ts.map

package/dist/lifecycle/scenario-eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenario-eval.d.ts","sourceRoot":"","sources":["../../src/lifecycle/scenario-eval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzD,OAAO,KAAK,EAA6B,cAAc,EAA4B,MAAM,YAAY,CAAC;AAEtG;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,kIAAkI;IAClI,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,mFAAmF;IACnF,MAAM,EAAE,mBAAmB,EAAE,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,GAAG,eAAe,CAgDvF"}

package/dist/lifecycle/scenario.d.ts

@@ -0,0 +1,163 @@
+/**
+ * Plan scenarios (chant #1292): a declared expectation about what a change
+ * SHOULD do, checkable offline against a fixture snapshot.
+ *
+ * Everything else chant validates is about shape — is this declaration
+ * well-formed, does this reference resolve. Nothing answers "what will this
+ * change do" as something source can assert about itself, until now. A
+ * `Scenario` pairs a `given` (a stand-in for live observation) with an
+ * `expect` (a claim about the resulting change set) — `chant scenario check`
+ * (../cli/handlers/scenario.ts) builds the project, replays `given` in place
+ * of a live read, and evaluates `expect` against the resulting `ChangeSet`
+ * (./change-set.ts) via `evaluateScenario` (./scenario-eval.ts).
+ *
+ * Modeled precisely on the other non-resource Declarables (../effect-receipt.ts,
+ * ../secret-provenance.ts): discovery collects a `Scenario` like any entity
+ * (it is a Declarable), but it carries no resource payload and no serializer
+ * ever emits it — `partitionByLexicon` (../build.ts) excludes it from every
+ * lexicon's partition, the same way it excludes a secret declaration.
+ *
+ * This module is pure and does no I/O: `snapshot()` records where the fixture
+ * comes from without reading it, and the factory validates and freezes. The
+ * CLI handler is where the fixture is actually read, replayed, and compared —
+ * the same synthesis/plan split every other lifecycle primitive here follows.
+ */
+import { type Declarable } from "../declarable.js";
+import type { Ownership } from "./change-set.js";
+/** Marker symbol identifying a scenario declaration. `Symbol.for` so it
+ * survives the entity-wire codec, the same reason ../effect-receipt.ts and
+ * ../secret-provenance.ts use `Symbol.for` for their markers. */
+export declare const SCENARIO_MARKER: unique symbol;
+/** The `entityType` every scenario declaration carries. */
+export declare const SCENARIO_ENTITY_TYPE = "Chant::Scenario";
+/**
+ * `given: snapshot("fixtures/prod-baseline.json")` — a checked-in fixture, in
+ * the same {@link LifecycleSnapshot} JSON shape `chant lifecycle snapshot`
+ * writes (a single lexicon's recorded resources). Path-relative to the
+ * project root, read at check time — never here.
+ */
+export interface ScenarioGivenFile {
+    readonly kind: "file";
+    /** Repo-relative path to the fixture JSON file. */
+    readonly path: string;
+}
+/**
+ * `given: snapshot("prod")` — the last snapshot recorded for that environment
+ * on the `chant/lifecycle` orphan branch (one file per lexicon, read via
+ * `readSnapshot`/`readEnvironmentSnapshots`, ../lifecycle/git.ts), replayed
+ * exactly as `chant lifecycle plan` reads its own prior snapshot.
+ */
+export interface ScenarioGivenEnv {
+    readonly kind: "env";
+    /** Environment name, matching a `chant.config.ts` `environments` entry. */
+    readonly env: string;
+}
+/** What a scenario's `given` stands in for — a fixture file or a recorded environment. */
+export type ScenarioGiven = ScenarioGivenFile | ScenarioGivenEnv;
+/**
+ * Declare `given` from a single string. Pure and offline: no filesystem
+ * access, no git — the factory only classifies the string's SHAPE, never
+ * checks whether it exists. That is what keeps `Scenario` foldable under
+ * `--sandbox`, the same discipline `declareSecret`'s committed-encrypted path
+ * validation follows (../secret-provenance.ts).
+ *
+ * The classification is structural: a string containing a path separator or
+ * ending in `.json` is a fixture file; anything else (a bare token like
+ * `"prod"`) is an environment name. A `chant.config.ts` environment name that
+ * happens to contain a slash or end in `.json` is not supported by this
+ * heuristic — pass `{ kind: "env", env }` directly in that unlikely case.
+ */
+export declare function snapshot(source: string): ScenarioGiven;
+/** One named delete an `expect.deletes` clause requires — the resource must
+ * be proposed for deletion, and with exactly this ownership verdict. */
+export interface ScenarioDeleteExpectation {
+    /** The change-set entry name (ChangeSetEntry.name) expected to delete. */
+    readonly name: string;
+    /** The ownership verdict (./change-set.ts's `Ownership`) the delete must carry. */
+    readonly ownership: Ownership;
+}
+/**
+ * How a scenario treats the change set's `unobserved` rows (#1089):
+ *
+ * - `"refuse"` — any unobserved entry fails the scenario. The plan admitting
+ *   a hole is never a pass, the same fail-closed instinct
+ *   `evaluateUnobservedGate`'s default takes (./unobserved-gate.ts).
+ * - `{ allow: [names] }` — the named entities may be unobserved without
+ *   failing the scenario; any unobserved entity NOT in the list still fails
+ *   it. Unlike `evaluateUnobservedGate`'s policy (which allows by *reason*),
+ *   this allows by entity *name* — the natural unit for a scenario written
+ *   against one fixture, where "this specific resource has no binding in the
+ *   fixture" is a known, accepted gap rather than a class of reason to trust
+ *   everywhere.
+ */
+export type ScenarioUnobservedPolicy = "refuse" | {
+    readonly allow: readonly string[];
+};
+/**
+ * The assertion vocabulary (#1292 research, settled shape). Every clause is
+ * independently optional and clauses compose within one `expect` object — a
+ * scenario can assert `noop`, exact counts, specific named deletes, and an
+ * unobserved policy together. At least one clause must be present; an empty
+ * `expect` asserts nothing and is refused as a likely mistake.
+ */
+export interface ScenarioExpect {
+    /** The plan proposes no create, update, or delete, and no declared effect
+     * receipt (#1832) fires — the majority-value case (refactors, upgrades,
+     * no-op deploys). Equivalent to `{ create: 0, update: 0, delete: 0 }` plus
+     * "no receipt classifies as `effect`", but reads as the specific claim it
+     * is: a pending effect fire is a real proposed action even though it never
+     * joins the create/update/delete triad. */
+    readonly noop?: true;
+    /** Exact count of `create` rows the plan must propose. Omitted = unconstrained. */
+    readonly create?: number;
+    /** Exact count of `update` rows the plan must propose. Omitted = unconstrained. */
+    readonly update?: number;
+    /** Exact count of `delete` rows the plan must propose. Omitted = unconstrained. */
+    readonly delete?: number;
+    /** Exactly these resources must delete, each with the stated ownership —
+     * and no OTHER delete may be proposed. The highest-value assertion in the
+     * vocabulary: "this plan deletes nothing foreign", made precise per-name. */
+    readonly deletes?: readonly ScenarioDeleteExpectation[];
+    /** How the scenario treats unobserved rows. Omitted = unconstrained (an
+     * unobserved entity neither passes nor fails the scenario on its own). */
+    readonly unobserved?: ScenarioUnobservedPolicy;
+}
+/**
+ * A scenario declaration — a Declarable, so discovery collects it and `chant
+ * list` shows it, but it carries no resource payload: `partitionByLexicon`
+ * (../build.ts) excludes it from every serializer partition, so no lexicon
+ * ever emits it and no apply-bound document ever contains one.
+ */
+export interface ScenarioDeclaration extends Declarable {
+    readonly [SCENARIO_MARKER]: true;
+    readonly lexicon: "chant";
+    readonly entityType: typeof SCENARIO_ENTITY_TYPE;
+    /** The scenario's own name — what `chant scenario check` reports pass/fail against. */
+    readonly name: string;
+    readonly given: ScenarioGiven;
+    readonly expect: ScenarioExpect;
+}
+/** Factory options for {@link Scenario}. */
+export interface ScenarioOptions {
+    /** What stands in for live observation — a fixture file or a recorded environment. */
+    readonly given: ScenarioGiven;
+    /** The claim about the resulting change set. At least one clause required. */
+    readonly expect: ScenarioExpect;
+}
+/**
+ * Declare a plan scenario. The returned object is a locked Declarable:
+ * declared fields are immutable and nested structures are frozen, the same
+ * shape ../effect-receipt.ts and ../secret-provenance.ts lock down; the
+ * top-level object stays extensible so discovery can still stamp its own
+ * symbol-keyed metadata.
+ */
+export declare function Scenario(name: string, options: ScenarioOptions): ScenarioDeclaration;
+/** Type guard for a scenario declaration. */
+export declare function isScenario(value: unknown): value is ScenarioDeclaration;
+/**
+ * Extract the scenario declarations from a discovered entity map — the read
+ * surface `chant scenario check` (../cli/handlers/scenario.ts) uses. Keyed by
+ * entity name (export name), the same key `DiscoveryResult.entities` uses.
+ */
+export declare function collectScenarios(entities: ReadonlyMap<string, Declarable>): Map<string, ScenarioDeclaration>;
+//# sourceMappingURL=scenario.d.ts.map

package/dist/lifecycle/scenario.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenario.d.ts","sourceRoot":"","sources":["../../src/lifecycle/scenario.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C;;iEAEiE;AACjE,eAAO,MAAM,eAAe,eAA+B,CAAC;AAE5D,2DAA2D;AAC3D,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,0FAA0F;AAC1F,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAMtD;AAED;wEACwE;AACxE,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;+CAK2C;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;iFAE6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD;8EAC0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;CAChD;AAQD;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,QAAQ,CAAC,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,oBAAoB,CAAC;IACjD,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,mBAAmB,CAoBpF;AAuGD,6CAA6C;AAC7C,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAOvE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAM5G"}

package/dist/lifecycle/symptoms.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Symptom derivation (#1484, epic #1487 feature 5) — one typed record joining
+ * the status join (./status.ts), change-set summaries (./change-set.ts), and
+ * unobserved evidence (../observation.ts) into the shape `ConvergeOp`'s rule
+ * table evaluates against.
+ *
+ * Derive-only, per the issue's leaning on its own open question 4: no new
+ * `LexiconPlugin.symptoms?()` interface in v1 — everything here is a pure
+ * projection of structures chant already computes (`ChangeSet`,
+ * `ComponentStatusRow[]`). No I/O in this module; a caller (the `convergeTick`
+ * activity, lexicons/temporal/src/op/activities/converge.ts) gathers those
+ * inputs and hands them here.
+ *
+ * One record per tick, not per component: the issue's own rule sketch reads
+ * `s.status`/`s.backupVerifiedAge` as a single symptom `s` a rule closes
+ * over, and epic feature 5 calls it "one typed record" (singular). A
+ * multi-component environment still resolves to one record per tick —
+ * `components` carries the per-component detail behind the aggregate for
+ * reporting, and `status` is the worst verdict across all of them (see
+ * {@link worstStatus}), so "any component is unknown" is enough to trip
+ * `unknown never remediates` for the whole tick.
+ */
+import type { ChangeSet } from "./change-set.js";
+import type { ComponentStatusRow } from "./status.js";
+import { type UnobservedReason } from "../observation.js";
+/** The worst (most-cautious) reconciliation verdict across a set of component rows. `"reconciled"` for an empty set — nothing to converge is a quiet environment. */
+export declare function worstStatus(rows: ComponentStatusRow[]): ComponentStatusRow["reconciliation"];
+/**
+ * One tick's typed symptom record. Every field a `ConvergeOp` rule may
+ * reference — see `../op/converge-rule.ts`'s `SymptomPredicate<S>`, where
+ * `S` is this interface, so a rule whose predicate names a field outside
+ * this shape fails TypeScript at the author's call site (the "symptom field
+ * nothing produces" build-time refusal).
+ */
+export interface ConvergeSymptom {
+    env: string;
+    /** The worst reconciliation verdict across every component row this tick observed (see {@link worstStatus}). */
+    status: ComponentStatusRow["reconciliation"];
+    /** Per-component detail behind `status`, for reporting — never read by a rule predicate directly (rules read the flat counts below). */
+    components: ComponentStatusRow[];
+    /** Change-set action counts for the tick (./change-set.ts's `summarize`). */
+    createCount: number;
+    updateCount: number;
+    deleteCount: number;
+    /** Live but undeclared, ownership unestablished — a candidate to adopt into source. Never auto-claimed; see the issue's "adopt is reported, never auto-claimed" honesty requirement. */
+    adoptCount: number;
+    runtimeCount: number;
+    effectCount: number;
+    /** Declared, but the lexicon could not observe it (#1089) — the count backing `status: "unknown"`. */
+    unobservedCount: number;
+    /** Every distinct reason behind `unobservedCount`, for a report action's detail. */
+    unobservedReasons: UnobservedReason[];
+    /** Total resource count under change-set evidence for this tick (sum of the six counts above). */
+    totalCount: number;
+}
+/**
+ * Join a `ChangeSet` and `ComponentStatusRow[]` for one tick into a
+ * `ConvergeSymptom`. Pure — no I/O.
+ */
+export declare function deriveSymptoms(env: string, cs: ChangeSet, statusRows: ComponentStatusRow[]): ConvergeSymptom;
+/** Every field name a `ConvergeSymptom` produces — the runtime whitelist `TMP014` (lexicons/temporal) re-validates a serialized rule table's predicates against. Kept in sync with {@link ConvergeSymptom} by hand (deliberately small, changes rarely). */
+export declare const CONVERGE_SYMPTOM_FIELDS: ReadonlySet<string>;
+//# sourceMappingURL=symptoms.d.ts.map

package/dist/lifecycle/symptoms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"symptoms.d.ts","sourceRoot":"","sources":["../../src/lifecycle/symptoms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAkB7E,qKAAqK;AACrK,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAM5F;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,gHAAgH;IAChH,MAAM,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC7C,wIAAwI;IACxI,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,wLAAwL;IACxL,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,sGAAsG;IACtG,eAAe,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACtC,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAwB5G;AAED,4PAA4P;AAC5P,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAatD,CAAC"}

package/dist/lifecycle/teardown.d.ts

@@ -86,11 +86,13 @@ export declare function planTeardown(opts: PlanTeardownOptions): Promise<Teardow
 export interface TeardownOutcomeEntry extends TeardownPlanEntry {
     /**
      * `skipped` is core's verdict for a candidate whose lexicon implements no
-     * `executeTeardown` yet; the other three come from the lexicon (see
-     * {@link TeardownOutcome}).
+     * `executeTeardown` yet; the others come from the lexicon (see
+     * {@link TeardownOutcome}). `retained` is the loud keep (#1365 decision 5):
+     * owned, no longer declared, deliberately not deleted — a `generated-once`
+     * secret survives every sweep and says so with a row.
      */
-    outcome: "deleted" | "failed" | "not-prunable" | "skipped";
-    /** The error for `failed`, the reason for `not-prunable`/`skipped`. */
+    outcome: "deleted" | "failed" | "not-prunable" | "retained" | "skipped";
+    /** The error for `failed`, the reason for `not-prunable`/`retained`/`skipped`. */
     detail?: string;
     /** True when this final outcome came from the bounded retry pass. */
     retried?: boolean;

package/dist/lifecycle/teardown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../../src/lifecycle/teardown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAGvG,0EAA0E;AAC1E,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,kFAAkF;IAClF,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D;AAOD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CA8FnF;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D;;;;OAIG;IACH,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAC;IAC3D,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,EAAE,YAAY,CAAC;IACnB,wEAAwE;IACxE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,+EAA+E;IAC/E,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE;;;OAGG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAkDD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAwE3F"}
+{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../../src/lifecycle/teardown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAGvG,0EAA0E;AAC1E,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,kFAAkF;IAClF,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D;AAOD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CA8FnF;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D;;;;;;OAMG;IACH,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,cAAc,GAAG,UAAU,GAAG,SAAS,CAAC;IACxE,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,EAAE,YAAY,CAAC;IACnB,wEAAwE;IACxE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,+EAA+E;IAC/E,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE;;;OAGG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAkDD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAwE3F"}