@intentius/chant 0.53.0 → 0.54.0

package/dist/lifecycle/converge-ledger.d.ts

@@ -1,3 +1,5 @@
+import type { ComponentStatusRow } from "./status.js";
+export declare function sanitizeLedgerText(raw: string, maxLen?: number): string;
 /** One rule's outcome within a tick. */
 export interface ConvergeRuleOutcome {
     ruleId: string;
@@ -15,13 +17,70 @@ export interface ConvergeRuleOutcome {
     op?: string;
     /** The gate's signal name, for `action: "gated"`. */
     gateName?: string;
+    /**
+     * Where this gate's approval happens (#2028), for `action: "gated"` — the
+     * PR carrying the change in a gate-as-PR flow, or whatever review surface
+     * the dispatching environment knows about.
+     *
+     * The pending fact is the one a human has to act on, and it used to carry
+     * no link at all: `chant operator status`'s pending row was
+     * `{rule, op, gate}` and the only affordance it could print was a shell
+     * command. Absent when there genuinely is no address — a local tick with no
+     * PR behind it — never a synthesized one. See
+     * `./gate-ledger.ts`'s `resolveApprovalUrl` for where it comes from, and
+     * `GateResolutionRecord.url` for the resolved counterpart.
+     */
+    url?: string;
     /** The report reason, for `action: "reported"` (including a flap-damped rule's forced report) — and the human-readable explanation for `action: "gated"`. */
     reason?: string;
 }
+/**
+ * One component's verdict as the tick observed it (#2027) — the per-entity
+ * layer behind the tick's single aggregate `status`.
+ *
+ * A deliberate subset of `ComponentStatusRow`: the five verdict-bearing
+ * fields, joined on the same `component` key `chant components status --live
+ * --json` emits, and none of the heavy ones. `recorded`, `build` and
+ * `componentBom` are dropped on purpose — they are release/build-ledger
+ * content, already readable by that same key, and a tick record is one line
+ * of JSON appended every tick forever. `detail` goes through
+ * {@link sanitizeLedgerText} for the same reason.
+ */
+export interface ConvergeComponentVerdict {
+    component: string;
+    reconciliation: ComponentStatusRow["reconciliation"];
+    /** Human-readable detail backing the verdict, capped to one line. */
+    detail: string;
+    /** "Observed live", when live evidence was gathered. Absent means "did not look" or "could not look" — see `unobserved`. */
+    live?: boolean;
+    /** Why live state could not be read for this component (#1089). Mutually exclusive with `live`; this is the row that tripped an aggregate `status: "unknown"`. */
+    unobserved?: {
+        reason: string;
+        detail?: string;
+    };
+}
+/**
+ * Project the tick's `ComponentStatusRow[]` down to what the ledger keeps.
+ * Pure; row order is preserved, so a consumer sees components in the same
+ * order the status join produced them.
+ */
+export declare function componentVerdicts(rows: readonly ComponentStatusRow[]): ConvergeComponentVerdict[];
 /** One immutable converge-tick record. */
 export interface ConvergeTickRecord {
     /** Schema version, so an incompatible future shape is detected before being misread. */
     version: 1;
+    /**
+     * Stable tick id (#2027) — the one thing an outcome, a gate fact or a
+     * remediation can point at. Before this, a tick's identity was the
+     * `(op, env, timestamp)` triple, so two ticks landing in the same ISO
+     * second were indistinguishable and nothing could reference one.
+     *
+     * Minted by {@link appendConvergeRecord} with `randomUUID()` (the same
+     * mint `./lease.ts` uses for a lease token) when the caller doesn't supply
+     * one. Optional on the type because `version: 1` records written before
+     * #2027 have none — a reader must handle its absence, not assume it.
+     */
+    id?: string;
     /** The ConvergeOp's name (`OpConfig.name`). */
     op: string;
     env: string;
@@ -31,6 +90,18 @@ export interface ConvergeTickRecord {
     firedRuleIds: string[];
     /** Per-rule outcome, for every fired rule. */
     outcomes: ConvergeRuleOutcome[];
+    /**
+     * The per-component verdicts this tick observed (#2027), behind the
+     * aggregate counts in `summary`.
+     *
+     * The tick derives these to compute `summary.drifted` and the whole-tick
+     * `status`, and used to throw them away — so a reader could say "this
+     * environment drifted twice this hour" but could not colour the node that
+     * drifted, or name the single unobserved component whose `unknown` verdict
+     * refused remediation for everything else. Optional because `version: 1`
+     * records written before #2027 have none; absent is not "no components".
+     */
+    components?: ConvergeComponentVerdict[];
     /** Aggregate counts backing the tick's one log line. */
     summary: {
         drifted: number;
@@ -52,6 +123,13 @@ export type ConvergeTickRecordInput = Omit<ConvergeTickRecord, "version">;
  * `pushLifecycle` (./git.ts) afterward, same two-step shape every other
  * ledger write here uses.
  *
+ * Mints `record.id` (#2027) when the input doesn't carry one, so every tick
+ * written from here on is referenceable. Unlike `timestamp`, which stays
+ * caller-supplied because library code never calls `Date.now()` internally,
+ * an id has nothing for a caller to decide — the mint lives here so no
+ * writer can forget it. An explicit `input.id` still wins, which is what a
+ * test asserting an exact record uses.
+ *
  * Retries the whole read-modify-write cycle (#1485) on `RefCASConflictError`
  * — `writeBlobToPath`'s ref write is CAS-guarded, so a concurrent writer to
  * a *different* env's file on the same orphan branch (two operators ticking
@@ -71,7 +149,9 @@ export declare function appendConvergeRecord(input: ConvergeTickRecordInput, opt
     cwd?: string;
 }): Promise<{
     commit: string;
-    record: ConvergeTickRecord;
+    record: ConvergeTickRecord & {
+        id: string;
+    };
 }>;
 /** Read every tick record for `environment`, oldest first. Malformed lines are skipped, not thrown on — a corrupted or hand-edited ledger degrades gracefully, the same stance `readReleaseLedger` takes. */
 export declare function readConvergeLedger(environment: string, opts?: {

package/dist/lifecycle/converge-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/converge-ledger.ts"],"names":[],"mappings":"AAmCA,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,MAAM,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,GAAG,cAAc,GAAG,OAAO,CAAC;IACzE,gEAAgE;IAChE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6JAA6J;IAC7J,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,6IAA6I;IAC7I,SAAS,EAAE,MAAM,CAAC;IAClB,oHAAoH;IACpH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,8CAA8C;IAC9C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,wDAAwD;IACxD,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,uNAAuN;QACvN,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,iHAAiH;IACjH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,uBAAuB,EAC9B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC,CAqBzD;AAED,6MAA6M;AAC7M,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAO1F"}
+{"version":3,"file":"converge-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/converge-ledger.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAcnD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAsB,GAAG,MAAM,CAKpF;AAcD,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,MAAM,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,GAAG,cAAc,GAAG,OAAO,CAAC;IACzE,gEAAgE;IAChE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6JAA6J;IAC7J,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACrD,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,4HAA4H;IAC5H,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kKAAkK;IAClK,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,kBAAkB,EAAE,GAAG,wBAAwB,EAAE,CAejG;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX;;;;;;;;;;OAUG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,6IAA6I;IAC7I,SAAS,EAAE,MAAM,CAAC;IAClB,oHAAoH;IACpH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,8CAA8C;IAC9C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACxC,wDAAwD;IACxD,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,uNAAuN;QACvN,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,iHAAiH;IACjH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,uBAAuB,EAC9B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAqB1E;AAED,6MAA6M;AAC7M,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAO1F"}

package/dist/lifecycle/gate-ledger.d.ts

@@ -1,3 +1,34 @@
+/**
+ * The address of the approval surface for a gate, resolved from the CI
+ * environment (#2028).
+ *
+ * #1485's argument for gate-as-fact was that approval gets an address:
+ * "gate-as-PR gives approval a URL, a review surface, and CODEOWNERS as the
+ * authorization model." What shipped recorded the gate and not the address,
+ * so a pending-approval card had nothing to link to and gate-as-PR stayed a
+ * convention. This is the narrow, honest half of that: when a tick (or a
+ * `chant approve`) runs inside the PR/MR job that carries the change, the
+ * loop genuinely knows where approval happens, and says so. Anywhere else it
+ * returns `undefined` and the field is simply absent — never a guess, never a
+ * synthesized link.
+ *
+ * The env-var fallback chain is the same one `--actor` and `--run-id` already
+ * use (`../cli/handlers/components.ts`): GitHub Actions first, then GitLab CI.
+ *
+ * - GitHub Actions on a `pull_request` event: `GITHUB_SERVER_URL` +
+ *   `GITHUB_REPOSITORY` + the PR number, which `GITHUB_REF_NAME` carries as
+ *   `<n>/merge`. A push-event run has no PR, so it resolves to nothing.
+ * - GitLab CI on a merge-request pipeline: `CI_MERGE_REQUEST_PROJECT_URL` +
+ *   `CI_MERGE_REQUEST_IID`.
+ */
+export declare function resolveApprovalUrl(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Whether `raw` is an address worth recording as one: an absolute `http`/
+ * `https` URL. A gate's address is a link a reader is expected to follow, so
+ * a relative path or a `file:`/`javascript:` scheme is refused at the CLI
+ * boundary rather than written into an immutable record.
+ */
+export declare function isApprovalUrl(raw: string): boolean;
 /** One immutable gate-resolution record. */
 export interface GateResolutionRecord {
     /** Schema version, so an incompatible future shape is detected before being misread. */
@@ -10,8 +41,19 @@ export interface GateResolutionRecord {
     resolvedBy: string;
     /** ISO-8601 timestamp, caller-supplied (library code never calls `Date.now()` internally). */
     timestamp: string;
-    /** Optional free-text context (e.g. a PR URL — "or a merged PR" is the issue's other resolution path; recording its link here keeps both paths visible from one ledger). */
+    /** Optional free-text context. Before #2028 this was also where a PR link went by convention; put the link in {@link GateResolutionRecord.url} instead and leave this for prose. */
     note?: string;
+    /**
+     * The address this resolution happened at (#2028) — the PR that carried the
+     * change, the review thread, whatever the approval surface was. Typed, so
+     * "resolved by this PR" is machine-readable instead of a reader sniffing
+     * `note` for something that looks like a link.
+     *
+     * `chant approve --url` sets it; absent when the resolver genuinely had no
+     * address (a human at a terminal, no PR). Always an absolute `http`/`https`
+     * URL — see {@link isApprovalUrl}.
+     */
+    url?: string;
 }
 export type GateResolutionInput = Omit<GateResolutionRecord, "version">;
 /** Append one immutable gate-resolution record. Does not push to the remote — call `pushLifecycle` (./git.ts) afterward, same two-step shape every other ledger write here uses. Retries on `RefCASConflictError` the same way `appendConvergeRecord` does (./converge-ledger.ts) — a concurrent writer to a different op's/env's file on the same orphan branch is the ordinary case, not an edge case. The baseline read must be `readPathSha` + `readBlobBySha` rather than `readBlobFromPath`, so the exact sha `existing` came from can be passed as `expectPriorPathSha` — see `writeBlobToPath` (./git.ts) for the race that closes. */

package/dist/lifecycle/gate-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-ledger.ts"],"names":[],"mappings":"AA4CA,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,yHAAyH;IACzH,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,4KAA4K;IAC5K,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;AAMxE,+mBAA+mB;AAC/mB,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAqB3D;AAED,oPAAoP;AACpP,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BjE;AAED,uOAAuO;AACvO,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,oBAAoB,GAAG,SAAS,CASlC"}
+{"version":3,"file":"gate-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-ledger.ts"],"names":[],"mappings":"AA4CA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAY3F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,yHAAyH;IACzH,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,oLAAoL;IACpL,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;AAMxE,+mBAA+mB;AAC/mB,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAqB3D;AAED,oPAAoP;AACpP,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BjE;AAED,uOAAuO;AACvO,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,oBAAoB,GAAG,SAAS,CASlC"}

package/dist/lifecycle/release-ledger.d.ts

@@ -27,6 +27,24 @@
  * straightforward digest comparison over this ledger — never a guess through
  * CI logs.
  */
+/**
+ * The id space a `ReleaseRecord.runId` lives in, and how to reach the run
+ * (#2045).
+ */
+export interface RunOrigin {
+    /**
+     * Which id space minted `runId`: `github` (a GitHub Actions run id — also
+     * the spelling Forgejo Actions uses, since it implements the same env
+     * contract; `url` disambiguates the actual host), `gitlab` (a CI pipeline
+     * id), `op` (an orchestrator/Op run id), or `local` (minted on the machine
+     * that ran the deploy, resolvable nowhere).
+     */
+    forge: "github" | "gitlab" | "op" | "local";
+    /** Repo/project slug on the forge (`GITHUB_REPOSITORY` / `CI_PROJECT_PATH`), when the environment named one. */
+    repo?: string;
+    /** Resolved link to the run, when the environment provided enough to build one. */
+    url?: string;
+}
 /**
  * One immutable deploy record: `(component, env, artifact digest, git sha,
  * run id, timestamp, actor)`, referencing the build archive by digest — the
@@ -50,8 +68,19 @@ export interface ReleaseRecord {
     digest: string;
     /** Git commit SHA the deploy was built from. */
     gitSha: string;
-    /** Orchestrator run identifier (a `DriverRunResult`/Op run id, or a CI run id in generate mode) — the pointer back into the deploy event log. */
+    /** Orchestrator run identifier (a `DriverRunResult`/Op run id, or a CI run id in generate mode) — the pointer back into the deploy event log. Which id space it lives in, and how to follow it, is `runOrigin`'s job (#2045). */
     runId: string;
+    /**
+     * Where `runId` can be resolved (#2045). A bare `runId` names a run in one
+     * of several mutually incompatible id spaces — a GitHub Actions run id, a
+     * GitLab pipeline id, an Op run id, a locally minted id — and without this
+     * a reader can tell them apart only by inference from whoever wrote the
+     * record. Written at record time from the same environment the id came
+     * from, so the two cannot skew. Optional: records written before this
+     * field existed, and callers passing an id whose origin they did not
+     * declare, simply have none.
+     */
+    runOrigin?: RunOrigin;
     /**
      * When this record was written. The caller supplies this — the session
      * cannot call `Date.now()` reliably in every context, so the CLI resolves
@@ -104,6 +133,31 @@ export declare class InvalidReleaseRecordError extends Error {
 export declare function validateReleaseRecord(record: Partial<ReleaseRecord>): string[];
 /** Input a caller supplies to record one deploy — `version` is filled in, everything else is required (see `ReleaseRecord`). */
 export type ReleaseRecordInput = Omit<ReleaseRecord, "version">;
+/**
+ * Resolve a run id and its origin from the same environment, in one step, so
+ * the two cannot skew (#2045). Resolution order mirrors what
+ * `chant components release` always did — explicit id, then
+ * `GITHUB_RUN_ID`, then `CI_PIPELINE_ID`, then a locally minted
+ * `local-<ms>` — but now each source also names its id space:
+ *
+ *  - the GitHub path records `repo` (`GITHUB_REPOSITORY`) and builds the run
+ *    `url` from `GITHUB_SERVER_URL` — which also makes a Forgejo instance's
+ *    runs resolvable, since Forgejo Actions implements the same env contract;
+ *  - the GitLab path records `repo` (`CI_PROJECT_PATH`) and takes
+ *    `CI_PIPELINE_URL` verbatim;
+ *  - the local mint says `local` in a field instead of only in the id's
+ *    spelling.
+ *
+ * An explicit id still gets an origin when it matches the id the environment
+ * itself is advertising (a CI job passing `--run-id $GITHUB_RUN_ID`);
+ * otherwise the caller's id is recorded without one — guessing an origin the
+ * caller did not state would be exactly the inference this field exists to
+ * remove.
+ */
+export declare function resolveRunId(explicit?: string, env?: NodeJS.ProcessEnv): {
+    runId: string;
+    runOrigin?: RunOrigin;
+};
 /**
  * Append one immutable release record to the `<env>` ledger on the
  * `chant/lifecycle` orphan branch. Throws `InvalidReleaseRecordError` before

package/dist/lifecycle/release-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iJAAiJ;IACjJ,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAaD,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;gBAAjB,OAAO,EAAE,MAAM,EAAE;CAI9C;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,EAAE,CAO9E;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CAQpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB1D;AAED,4EAA4E;AAC5E,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}
+{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;OAMG;IACH,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;IAC5C,gHAAgH;IAChH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iOAAiO;IACjO,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAaD,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;gBAAjB,OAAO,EAAE,MAAM,EAAE;CAI9C;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,EAAE,CAO9E;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,CAsB1C;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CAQpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB1D;AAED,4EAA4E;AAC5E,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}

package/dist/op/activity-contract.d.ts

@@ -64,9 +64,23 @@ export interface ActivityContract<Args = unknown, Return = unknown> {
      * per #1290 — a later step's reference into this one's output.
      */
     returns?: z.ZodType<Return>;
+    /**
+     * Names of top-level args whose values identify what the activity's effect
+     * touches in the estate (#2022) — an entity id, a resource address, a
+     * target endpoint — as opposed to scope (`env`, a stack name) or mechanics
+     * (a timeout, a mode). op.json's IR resolves these per step into
+     * `OpIRActivityStep.entities`, so a renderer can join a step to the estate
+     * nodes it touches instead of inventing joins off scope fields. Optional
+     * and partial by design, like the contract itself: an activity whose
+     * touched set is not spelled in its args (e.g. an applier that derives
+     * stack members internally) simply declares none.
+     */
+    entities?: string[];
 }
 /** Declare an activity contract. */
-export declare function activityContract<ArgsSchema extends z.ZodTypeAny, ReturnSchema extends z.ZodTypeAny = never>(name: string, args: ArgsSchema, returns?: ReturnSchema): ActivityContract<z.infer<ArgsSchema>, ReturnSchema extends z.ZodTypeAny ? z.infer<ReturnSchema> : unknown>;
+export declare function activityContract<ArgsSchema extends z.ZodTypeAny, ReturnSchema extends z.ZodTypeAny = never>(name: string, args: ArgsSchema, returns?: ReturnSchema, opts?: {
+    entities?: string[];
+}): ActivityContract<z.infer<ArgsSchema>, ReturnSchema extends z.ZodTypeAny ? z.infer<ReturnSchema> : unknown>;
 /** Structural guard for a value produced by {@link activityContract}. */
 export declare function isActivityContract(value: unknown): value is ActivityContract;
 /**

package/dist/op/activity-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-contract.d.ts","sourceRoot":"","sources":["../../src/op/activity-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAiD,MAAM,SAAS,CAAC;AAEvF,2HAA2H;AAC3H,eAAO,MAAM,uBAAuB,6FAO1B,CAAC;AAEX,QAAA,MAAM,cAAc,eAA0C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB,CAAC,IAAI,GAAG,OAAO,EAAE,MAAM,GAAG,OAAO;IAChE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;IAChC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED,oCAAoC;AACpC,wBAAgB,gBAAgB,CAAC,UAAU,SAAS,CAAC,CAAC,UAAU,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,KAAK,EACzG,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE,YAAY,GACrB,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,CAO5G;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,IAAI,CAIhH;AAID,MAAM,WAAW,qBAAqB;IACpC,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;CACjB;AAmCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,SAAS,CASxG;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAQrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAC,EACvD,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC/C,qBAAqB,EAAE,CA+CzB"}
+{"version":3,"file":"activity-contract.d.ts","sourceRoot":"","sources":["../../src/op/activity-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAiD,MAAM,SAAS,CAAC;AAEvF,2HAA2H;AAC3H,eAAO,MAAM,uBAAuB,6FAO1B,CAAC;AAEX,QAAA,MAAM,cAAc,eAA0C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB,CAAC,IAAI,GAAG,OAAO,EAAE,MAAM,GAAG,OAAO;IAChE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;IAChC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,oCAAoC;AACpC,wBAAgB,gBAAgB,CAAC,UAAU,SAAS,CAAC,CAAC,UAAU,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,KAAK,EACzG,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE,YAAY,EACtB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7B,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,CAQ5G;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,IAAI,CAIhH;AAID,MAAM,WAAW,qBAAqB;IACpC,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;CACjB;AAmCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,SAAS,CASxG;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAQrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAC,EACvD,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC/C,qBAAqB,EAAE,CA+CzB"}

package/dist/terraform/manifest.d.ts

@@ -10,8 +10,16 @@
 import type { CarveReport } from "./carve.js";
 import type { OwnershipMarker } from "../ownership.js";
 export declare const CARVE_MANIFEST_SUFFIX = ".carve.json";
+/**
+ * Version 2 (#2039): `emit.files`, `bridge.written`, `bridge.patch` and
+ * `apply.stampedFiles` are recorded relative to the manifest's own directory,
+ * so the manifest stays true when the tree is copied, moved, or checked out
+ * elsewhere. Version-1 manifests recorded them absolute; readers resolve
+ * either through `resolveManifestFilePath`.
+ */
+export declare const CARVE_MANIFEST_VERSION = 2;
 export interface CarveManifest {
-    version: 1;
+    version: 1 | 2;
     /** Terraform address of the carved resource, e.g. `aws_s3_bucket.assets`. */
     target: string;
     /** Terraform resource type, when known. */
@@ -25,7 +33,13 @@ export interface CarveManifest {
     /** Recorded by `carve emit`. */
     emit?: {
         source: "tfstate" | "live";
-        /** Emitted chant source file path(s). */
+        /**
+         * Emitted chant source file path(s), relative to the manifest's directory
+         * (absolute in version-1 manifests). The manifest sits at the scaffolded
+         * project's root, so these are also project-root-relative — the same base
+         * `chant graph --format ir` uses for `sourceLoc.file`, which is the join
+         * from a carved Terraform address to the chant entity it became (#2040).
+         */
         files: string[];
         /**
          * Deferred outbound inputs declared as build parameters in the emitted
@@ -45,9 +59,10 @@ export interface CarveManifest {
     };
     /** Recorded by `carve bridge`. */
     bridge?: {
+        /** Files written, relative to the manifest's directory (absolute in version-1 manifests). */
         written: string[];
         appliedInPlace: boolean;
-        /** The git-applyable `.patch` carrying the whole survivor edit. */
+        /** The git-applyable `.patch` carrying the whole survivor edit, relative to the manifest's directory (absolute in version-1 manifests). */
         patch?: string;
         /** Carved addresses whose own `.tf` block the rewrites remove (#998). */
         excised?: string[];
@@ -57,7 +72,7 @@ export interface CarveManifest {
     apply?: {
         marker: OwnershipMarker;
         ownershipTags: Record<string, string>;
-        /** Emitted files the marker was stamped into (`--write-source`). */
+        /** Emitted files the marker was stamped into (`--write-source`), relative to the manifest's directory (absolute in version-1 manifests). */
         stampedFiles?: string[];
         at: string;
     };
@@ -66,9 +81,15 @@ export interface CarveManifest {
 export declare function carveSlug(target: string): string;
 /** Where the manifest for `target` lives inside an output dir. */
 export declare function carveManifestPath(outDir: string, target: string): string;
+/**
+ * Resolve a manifest-recorded file path against the manifest's directory.
+ * Absolute paths (version-1 manifests) pass through untouched, so both
+ * on-disk spellings read the same.
+ */
+export declare function resolveManifestFilePath(manifestDir: string, p: string): string;
 /** Write (or overwrite) a manifest into the output dir. Returns the path. */
 export declare function writeCarveManifest(outDir: string, manifest: CarveManifest): string;
-/** Read a manifest, or null when absent/unreadable/not a v1 manifest. */
+/** Read a manifest, or null when absent/unreadable/not a known-version manifest. */
 export declare function readCarveManifest(path: string): CarveManifest | null;
 /** All carve manifest paths in an output dir. */
 export declare function listCarveManifests(outDir: string): string[];
@@ -84,6 +105,10 @@ export interface ResolvedManifest {
  * several is an error naming what is (or is not) there.
  */
 export declare function resolveCarveManifest(outDir: string, select?: string): ResolvedManifest;
-/** Read-modify-write a section of an existing manifest. No-op when absent. */
+/**
+ * Read-modify-write a section of an existing manifest. No-op when absent.
+ * The whole manifest is re-normalized on write, so updating a version-1
+ * manifest also migrates its recorded paths to the relative contract.
+ */
 export declare function updateCarveManifest(outDir: string, target: string, patch: Partial<Pick<CarveManifest, "boundary" | "emit" | "bridge" | "apply">>): string | undefined;
 //# sourceMappingURL=manifest.d.ts.map

package/dist/terraform/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/terraform/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,EAAE,WAAW,CAAC;IACtB,gCAAgC;IAChC,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;QAC3B,yCAAyC;QACzC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CACb,MAAM,EACN;YACE,8EAA8E;YAC9E,MAAM,EAAE,MAAM,CAAC;YACf,mEAAmE;YACnE,QAAQ,EAAE,MAAM,CAAC;YACjB,kCAAkC;YAClC,KAAK,EAAE,MAAM,EAAE,CAAC;YAChB,2CAA2C;YAC3C,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;SACrC,CACF,CAAC;QACF,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,kCAAkC;IAClC,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,cAAc,EAAE,OAAO,CAAC;QACxB,mEAAmE;QACnE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,yEAAyE;QACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,iCAAiC;IACjC,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,eAAe,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,oEAAoE;QACpE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;CACH;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,CAKlF;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAUpE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAsBtF;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,GAC5E,MAAM,GAAG,SAAS,CAOpB"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/terraform/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,EAAE,WAAW,CAAC;IACtB,gCAAgC;IAChC,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;QAC3B;;;;;;WAMG;QACH,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CACb,MAAM,EACN;YACE,8EAA8E;YAC9E,MAAM,EAAE,MAAM,CAAC;YACf,mEAAmE;YACnE,QAAQ,EAAE,MAAM,CAAC;YACjB,kCAAkC;YAClC,KAAK,EAAE,MAAM,EAAE,CAAC;YAChB,2CAA2C;YAC3C,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;SACrC,CACF,CAAC;QACF,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,kCAAkC;IAClC,MAAM,CAAC,EAAE;QACP,6FAA6F;QAC7F,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,cAAc,EAAE,OAAO,CAAC;QACxB,2IAA2I;QAC3I,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,yEAAyE;QACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,iCAAiC;IACjC,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,eAAe,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,4IAA4I;QAC5I,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;CACH;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAmCD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,CAKlF;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAUpE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAsBtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,GAC5E,MAAM,GAAG,SAAS,CAOpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/catalog.ts

@@ -127,6 +127,22 @@ export const CF_STATIC_ASSETS: Authority = {
   name: "Cloudflare Workers — Static assets",
   url: "https://developers.cloudflare.com/workers/static-assets/",
 };
+export const MOZILLA_TLS: Authority = {
+  name: "Mozilla — Server Side TLS",
+  url: "https://wiki.mozilla.org/Security/Server_Side_TLS",
+};
+export const CWE_DIR_LISTING: Authority = {
+  name: "CWE-548 — Exposure of Information Through Directory Listing",
+  url: "https://cwe.mitre.org/data/definitions/548.html",
+};
+export const GIXY_ALIAS: Authority = {
+  name: "Gixy — alias traversal",
+  url: "https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md",
+};
+export const NGINX_STUB_STATUS: Authority = {
+  name: "nginx — ngx_http_stub_status_module",
+  url: "https://nginx.org/en/docs/http/ngx_http_stub_status_module.html",
+};
 export const CWE_HARDCODED_CREDS: Authority = {
   name: "CWE-798 — Use of Hard-coded Credentials",
   url: "https://cwe.mitre.org/data/definitions/798.html",
@@ -197,6 +213,14 @@ export const RULE_CATEGORY: Record<string, Category> = {
   WRG004: "security",
   WRG005: "security",
   WRG006: "security",
+  // NGX — nginx config audit (#1979), lexicon-independent like SEC/WRG.
+  NGX001: "security",
+  NGX002: "security",
+  NGX003: "security",
+  NGX004: "security",
+  NGX005: "security",
+  NGX006: "best-practice",
+  NGX007: "best-practice",
   // AGT — agent configuration (`chant audit --agents`). Core-owned like COR/EXT:
   // these run against the machine's own agent config, not against any one
   // lexicon's emitted output, so no lexicon ships them.
@@ -247,6 +271,17 @@ export const RULE_CATALOG: Record<string, RuleMeta> = {
   WRG005: meta("WRG005", M, G, "Non-production environment shares a data store with production", "Give the non-production environment its own KV namespace/R2 bucket/D1 database id instead of reusing production's.", [CF_ENVIRONMENTS]),
   WRG006: meta("WRG006", M, G, "Static assets served from the project root", "Point [site].bucket / [assets].directory at a dedicated public output folder, not the project root, so non-public files (config, source maps, .git) aren't served.", [CF_STATIC_ASSETS]),
 
+  // nginx config audit (#1979, the #446 follow-up) — lexicon-independent,
+  // same shape as SEC/WRG: `nginx.ts` scans every nginx config it detects
+  // regardless of which (if any) audit lexicons are installed.
+  NGX001: meta("NGX001", M, G, "Deprecated TLS protocol enabled", "Remove SSLv2/SSLv3/TLSv1/TLSv1.1 from ssl_protocols and serve TLSv1.2 and TLSv1.3 only.", [MOZILLA_TLS]),
+  NGX002: meta("NGX002", M, G, "Weak cipher suite enabled", "Remove the RC4/DES/MD5/NULL/EXPORT-class entries from ssl_ciphers and use a modern cipher list (e.g. Mozilla's intermediate configuration).", [MOZILLA_TLS]),
+  NGX003: meta("NGX003", M, G, "Directory listing enabled", "Remove `autoindex on` (or scope it to a directory that is genuinely meant to be enumerated) so file listings aren't served to anyone who asks.", [CWE_DIR_LISTING]),
+  NGX004: meta("NGX004", M, G, "alias path traversal", "End the location prefix with \"/\" so it matches the trailing slash of the alias target — without it, a request for \"<prefix>../\" escapes the aliased directory.", [GIXY_ALIAS]),
+  NGX005: meta("NGX005", M, G, "Status endpoint with no access restriction", "Restrict the stub_status location with allow/deny (or auth_basic/auth_request) so connection metrics aren't public reconnaissance.", [NGINX_STUB_STATUS]),
+  NGX006: meta("NGX006", R, G, "Server version disclosure", "Add `server_tokens off;` in the http block so nginx stops advertising its exact version in the Server header and error pages."),
+  NGX007: meta("NGX007", R, G, "Access logging disabled at server scope", "Re-enable access_log at http/server scope (silencing a single noisy location is fine) so requests are recorded for incident investigation."),
+
   // ── Agent configuration (`chant audit --agents`) ──────────────────
   AGT001: agentMeta(
     "AGT001",

package/src/audit/edge-init-safety.test.ts

@@ -54,8 +54,8 @@ function resolveRelative(from: string, spec: string): string | undefined {
   return undefined;
 }
 
-/** Static (non-type-only) imports and re-exports of a file, resolved to paths. */
-function staticImports(sf: ts.SourceFile): string[] {
+/** Static (non-type-only) import/re-export specifiers of a file. */
+function staticSpecifiers(sf: ts.SourceFile): string[] {
   const out: string[] = [];
   for (const stmt of sf.statements) {
     let spec: string | undefined;
@@ -66,7 +66,16 @@ function staticImports(sf: ts.SourceFile): string[] {
       if (stmt.isTypeOnly) continue;
       spec = (stmt.moduleSpecifier as ts.StringLiteral).text;
     }
-    if (!spec || !spec.startsWith(".")) continue;
+    if (spec) out.push(spec);
+  }
+  return out;
+}
+
+/** Static (non-type-only) imports and re-exports of a file, resolved to paths. */
+function staticImports(sf: ts.SourceFile): string[] {
+  const out: string[] = [];
+  for (const spec of staticSpecifiers(sf)) {
+    if (!spec.startsWith(".")) continue;
     const resolved = resolveRelative(sf.fileName, spec);
     if (resolved) out.push(resolved);
   }
@@ -171,4 +180,28 @@ describe("edge-imported lexicon modules are init-safe", () => {
     for (const sf of transitiveClosure(barrels()).values()) offenders.push(...moduleScopeOffenses(sf));
     expect(offenders, "move these into a function (lazy) — they crash edge bundles").toEqual([]);
   });
+
+  test("no static import of the full @intentius/chant barrel in the transitive import graph", () => {
+    // The relative-import walk above stops at package specifiers, and the bare
+    // core barrel is exactly the package import that must never appear: its
+    // static graph reaches build() → discovery/fold-import → the TypeScript
+    // compiler, whose own module init touches __filename and crashes workerd
+    // at startup. This is how WHM503's `../../render` import (whose render.ts
+    // imports `@intentius/chant` for Composite) broke the hosted audit's
+    // 0.53.1 bump. Subpath imports (`@intentius/chant/lint/post-synth`,
+    // `@intentius/chant/effect-receipt`, …) are the deliberately edge-clean
+    // seams and stay allowed.
+    const offenders: string[] = [];
+    for (const sf of transitiveClosure(barrels()).values()) {
+      for (const spec of staticSpecifiers(sf)) {
+        if (spec === "@intentius/chant") {
+          offenders.push(sf.fileName.replace(lexiconsDir, "lexicons"));
+        }
+      }
+    }
+    expect(
+      offenders,
+      "these edge-reachable modules import the full core barrel — import the specific subpath (or split the needed piece into a light module) instead",
+    ).toEqual([]);
+  });
 });