@intentius/sql-yodeler 0.2.0 → 0.4.0

package/README.md

@@ -22,7 +22,7 @@ npx yodel apply dev
 
 For Postgres, use `templates/postgres` with `--param name=app-schema --param schema=app`.
 
-Each template gives `chant.config.ts` with a profile per environment (`dev`, `prod`), `yodel.config.ts`, a migrate Op per environment (`yodel apply` behind a gate bound to the plan digest), a `WatchOp` per environment for drift on a schedule, and pipelines for GitHub Actions, GitLab CI and Forgejo Actions: `yodel lint` and the plan comment on pull requests with read-only credentials, `yodel apply` on a push to main with the writer, and the drift watch on its cron with the reader. `scripts/ci.ts` in the project renders the pipelines again after an environment is added (`npm run ci`). The parameters are in each template's `chant.template.json`; the template's README covers the credentials and each forge's setup.
+Each template gives `chant.config.ts` with a profile per environment (`dev`, `prod`), `yodel.config.ts`, a migrate Op per environment (`yodel apply` behind a gate bound to the plan digest), a `WatchOp` per environment for drift on a schedule, and pipelines for GitHub Actions, GitLab CI and Forgejo Actions: `yodel lint` and the plan comment on pull requests with read-only credentials, `yodel apply` on a push to main with the writer, and the drift watch on its cron with the reader. `yodel ci` (`npm run ci`) renders the pipelines from the installed package, so upgrading yodel and rendering again brings its pipeline fixes, and the project's own jobs, declared in a module `yodel.config.ts` `ci.jobs` names, are kept. The parameters are in each template's `chant.template.json`; the template's README covers the credentials and each forge's setup.
 
 ## Documentation
 
@@ -92,8 +92,8 @@ export const op = Op({
 `yodel lint` checks the migrations directory offline, with no server, so it runs in CI on every pull request. Every rule is free. Exit 0 when there is no error (warnings and silenced findings do not fail), 3 when there is at least one, 1 when lint cannot run; `--json` prints the findings.
 
 - Integrity, always errors: `fork` (two migrations follow the same parent; `yodel rebase`), `directory` (a bad name or file, a missing parent, a cycle, another dialect), `checksum` (a migration's files changed since it was written), `unreadable-object` (an object in a recorded schema, or a step, the sql lexicon cannot read or classify; never skipped).
-- From the classifier's classes: `destructive` (a drop), `pg-rewrite` (a rewrite or full scan under ACCESS EXCLUSIVE), `pg-lock` (writes blocked for a whole index build or scan: no `CONCURRENTLY`, a constraint validated in place), `ch-mutation` (a mutation rewriting parts), `ch-rebuild` (a `ClickHouseRebuildOp` step).
-- `refused-step` (a step `yodel apply` will not run), `migration-sql` (migration.sql does not hold a statement migration.json records), `silence` (a bad or unused `yodel:allow` line).
+- From the classifier's classes: `destructive` (a drop), `pg-rewrite` (a rewrite or full scan under ACCESS EXCLUSIVE), `pg-lock` (writes blocked for a whole index build or scan: no `CONCURRENTLY`, a constraint validated in place), `pg-signature` (a function or procedure dropped and created with another signature), `pg-access` (a privilege revoked, a policy dropped, row-level security turned off), `pg-rls-not-forced` (a warning: row-level security enabled but not forced), `ch-mutation` (a mutation rewriting parts), `ch-rebuild` (a `ClickHouseRebuildOp` step), `ch-access` (a privilege or role revoked).
+- `refused-step` (a step `yodel apply` will not run), `pg-routine-in-use` (a function dropped while a declared trigger still executes it), `migration-sql` (migration.sql does not hold a statement migration.json records), `silence` (a bad or unused `yodel:allow` line).
 
 A line above a statement in its `migration.sql` silences one of the classifier rules for that statement:
 

package/dist/apply-steps/index.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Steps around apply (#64): per environment, `yodel.config.ts`
+ * `environments.<env>.steps.before` and `.after`, SQL checks or commands
+ * run around the versioned apply.
+ *
+ * - Read at the base commit (`../config/base.ts`), as the plan policy is:
+ *   a pull request that adds, removes or loosens a step is run under the
+ *   steps the branch had. A checkout with no base to read runs none.
+ * - `before` steps run under the lock before the first migration. SQL
+ *   checks also run when the run is planned (the wave plan, or `yodel apply`
+ *   before the gate), since they only read; a command, which may have side
+ *   effects, runs once per apply, under the lock, and the plan only shows
+ *   that it will (#107). One that fails refuses the run (exit 4) unless its
+ *   `onFailure` is `approve`: then the wave is held for a person, whatever
+ *   its gate, and the plan they approve says which steps failed.
+ * - `after` steps run under the lock once the last migration's statements
+ *   succeeded. One that fails fails the run (exit 1); the migrations stay
+ *   applied.
+ * - Every outcome is in the history: the `before` steps' on each
+ *   migration's `started` row, the `after` steps' on the last migration's
+ *   `succeeded` row (`note.steps`), and `yodel report` lists them.
+ */
+import type { ApplyStep, ApplySteps } from "../config/define.js";
+import { YodelError, type Project } from "../project.js";
+import type { VersionedDriver } from "../versioned/driver.js";
+export type StepWhen = "before" | "after";
+/** One step's outcome, as the history records it. */
+export interface StepOutcome {
+    name: string;
+    when: StepWhen;
+    kind: "sql" | "command";
+    passed: boolean;
+    /** What the query returned, or how the command exited, in a few words. */
+    detail: string;
+    onFailure: "fail" | "approve";
+    /** A command not run because the run was only planned: it runs under the lock. */
+    deferred?: true;
+}
+/** The steps that apply to `env`: the base commit's, and a note when the working tree's differ. */
+export interface StepsAtBase {
+    steps: ApplySteps | undefined;
+    sha?: string;
+    note?: string;
+}
+/** `env`'s steps from yodel.config.ts at the base commit. */
+export declare function stepsAtBase(project: Pick<Project, "dir" | "yodel">, env: string, processEnv?: NodeJS.ProcessEnv): Promise<StepsAtBase>;
+/**
+ * Runs `list` in order and returns each outcome; a failing step does not
+ * stop the ones after it. With `commands: "plan"` (a run being planned, not
+ * applied) a command is not run: its outcome says it runs under the lock.
+ */
+export declare function runApplySteps(driver: Pick<VersionedDriver, "readCheck">, list: readonly ApplyStep[], when: StepWhen, ctx: {
+    dir: string;
+    env: string;
+    processEnv?: NodeJS.ProcessEnv;
+    commands?: "run" | "plan";
+}): Promise<StepOutcome[]>;
+/** One line for an outcome. */
+export declare const describeStep: (o: StepOutcome) => string;
+/** The `before` steps that failed with `onFailure: "approve"`: the run waits for a person. */
+export declare const heldSteps: (outcomes: readonly StepOutcome[]) => string[];
+/** The refusal for a step that failed with `onFailure: "fail"`, or undefined. */
+export declare function stepsRefusal(env: string, outcomes: readonly StepOutcome[], when: string): YodelError | undefined;
+/** The steps a history row's note records, if any. */
+export declare function stepsOfNote(note: string): StepOutcome[];

package/dist/apply-steps/index.js

@@ -0,0 +1,106 @@
+/**
+ * Steps around apply (#64): per environment, `yodel.config.ts`
+ * `environments.<env>.steps.before` and `.after`, SQL checks or commands
+ * run around the versioned apply.
+ *
+ * - Read at the base commit (`../config/base.ts`), as the plan policy is:
+ *   a pull request that adds, removes or loosens a step is run under the
+ *   steps the branch had. A checkout with no base to read runs none.
+ * - `before` steps run under the lock before the first migration. SQL
+ *   checks also run when the run is planned (the wave plan, or `yodel apply`
+ *   before the gate), since they only read; a command, which may have side
+ *   effects, runs once per apply, under the lock, and the plan only shows
+ *   that it will (#107). One that fails refuses the run (exit 4) unless its
+ *   `onFailure` is `approve`: then the wave is held for a person, whatever
+ *   its gate, and the plan they approve says which steps failed.
+ * - `after` steps run under the lock once the last migration's statements
+ *   succeeded. One that fails fails the run (exit 1); the migrations stay
+ *   applied.
+ * - Every outcome is in the history: the `before` steps' on each
+ *   migration's `started` row, the `after` steps' on the last migration's
+ *   `succeeded` row (`note.steps`), and `yodel report` lists them.
+ */
+import { spawnSync } from "node:child_process";
+import { loadYodelConfigAtBase } from "../config/base.js";
+import { EXIT_REFUSED } from "../exit.js";
+import { judgeCheck } from "../migrations/checks.js";
+import { YodelError } from "../project.js";
+/** `env`'s steps from yodel.config.ts at the base commit. */
+export async function stepsAtBase(project, env, processEnv = process.env) {
+    const tree = project.yodel?.config.environments?.[env]?.steps;
+    let at;
+    try {
+        at = await loadYodelConfigAtBase(project.dir, processEnv);
+    }
+    catch (e) {
+        const why = e instanceof Error ? (e.message.split("\n")[0] ?? "") : String(e);
+        return { steps: undefined, ...(tree ? { note: `steps: yodel.config.ts could not be read at the base commit (${why}), so no step runs; the working tree's are not used` } : {}) };
+    }
+    const steps = at.config?.environments?.[env]?.steps;
+    const differs = JSON.stringify(tree ?? null) !== JSON.stringify(steps ?? null);
+    return { steps, sha: at.sha, ...(differs ? { note: `steps: ${env}'s steps are read at the base commit ${at.sha.slice(0, 12)}, not from this change` } : {}) };
+}
+const lastLine = (text) => text.trim().split("\n").at(-1)?.slice(0, 200) ?? "";
+/**
+ * Runs `list` in order and returns each outcome; a failing step does not
+ * stop the ones after it. With `commands: "plan"` (a run being planned, not
+ * applied) a command is not run: its outcome says it runs under the lock.
+ */
+export async function runApplySteps(driver, list, when, ctx) {
+    const out = [];
+    for (const step of list) {
+        const onFailure = step.onFailure ?? "fail";
+        if (step.sql !== undefined) {
+            try {
+                const judged = judgeCheck({ name: step.name, sql: step.sql, ...(step.expect !== undefined ? { expect: step.expect } : {}) }, await driver.readCheck(step.sql, {}));
+                out.push({ name: step.name, when, kind: "sql", passed: judged.passed, detail: judged.detail, onFailure });
+            }
+            catch (e) {
+                out.push({ name: step.name, when, kind: "sql", passed: false, detail: `the query failed: ${(e instanceof Error ? e.message : String(e)).split("\n")[0] ?? ""}`, onFailure });
+            }
+            continue;
+        }
+        if (ctx.commands === "plan") {
+            out.push({ name: step.name, when, kind: "command", passed: true, detail: "a command: it runs under the lock, not when the run is planned", onFailure, deferred: true });
+            continue;
+        }
+        const ran = spawnSync("sh", ["-c", step.command ?? ""], {
+            cwd: ctx.dir,
+            encoding: "utf8",
+            env: { ...(ctx.processEnv ?? process.env), YODEL_ENV: ctx.env, YODEL_STEP: when },
+            timeout: 10 * 60_000,
+        });
+        const said = lastLine(`${ran.stdout}\n${ran.stderr}`);
+        const code = ran.status ?? 1;
+        out.push({ name: step.name, when, kind: "command", passed: code === 0 && !ran.error, detail: `exit ${ran.error ? "(did not run)" : String(code)}${said ? `: ${said}` : ""}`, onFailure });
+    }
+    return out;
+}
+/** One line for an outcome. */
+export const describeStep = (o) => o.deferred ? `${o.when} step ${o.name} will run under the lock (${o.detail})` : `${o.when} step ${o.name} ${o.passed ? "passed" : o.onFailure === "approve" ? "failed, held for approval" : "failed"} (${o.detail})`;
+/** The `before` steps that failed with `onFailure: "approve"`: the run waits for a person. */
+export const heldSteps = (outcomes) => outcomes.filter((o) => !o.passed && o.when === "before" && o.onFailure === "approve").map((o) => o.name);
+/** The refusal for a step that failed with `onFailure: "fail"`, or undefined. */
+export function stepsRefusal(env, outcomes, when) {
+    const failed = outcomes.filter((o) => !o.passed && (o.when === "after" || o.onFailure === "fail"));
+    if (failed.length === 0)
+        return undefined;
+    const after = failed.every((o) => o.when === "after");
+    return new YodelError(after
+        ? `${env}: the migrations are applied, and an after step failed ${when}:\n${failed.map((o) => `  ${describeStep(o)}`).join("\n")}`
+        : `refused: a before step of ${env} failed ${when}; nothing was applied:\n${failed.map((o) => `  ${describeStep(o)}`).join("\n")}\n` +
+            `Fix the cause and run again, or, for a check a person may wave through, give the step onFailure: "approve" (at the base commit).`, after ? 1 : EXIT_REFUSED);
+}
+/** The steps a history row's note records, if any. */
+export function stepsOfNote(note) {
+    if (!note.includes('"steps"'))
+        return [];
+    try {
+        const steps = JSON.parse(note).steps;
+        return Array.isArray(steps) ? steps : [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/apply-steps/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/apply-steps/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAgB,MAAM,eAAe,CAAC;AAyBzD,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAuC,EAAE,GAAW,EAAE,aAAgC,OAAO,CAAC,GAAG;IACjI,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;IAC9D,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gEAAgE,GAAG,qDAAqD,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnL,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC/E,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,GAAG,wCAAwC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChK,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AAE/F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA0C,EAC1C,IAA0B,EAC1B,IAAc,EACd,GAA4F;IAE5F,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QAC3C,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;gBACnK,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5G,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/K,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,gEAAgE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACxK,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;YACtD,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;YACjF,OAAO,EAAE,EAAE,GAAG,MAAM;SACrB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5L,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+BAA+B;AAC/B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAc,EAAU,EAAE,CACrD,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;AAEvN,8FAA8F;AAC9F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgC,EAAY,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAElL,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAAgC,EAAE,IAAY;IACtF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC;IACnG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACtD,OAAO,IAAI,UAAU,CACnB,KAAK;QACH,CAAC,CAAC,GAAG,GAAG,0DAA0D,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAClI,CAAC,CAAC,6BAA6B,GAAG,WAAW,IAAI,2BAA2B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChI,kIAAkI,EACxI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CACzB,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC,KAAK,CAAC;QAC9D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/approval-mode/index.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Approval modes (#48): which approvals of a gate's plan digest count.
+ *
+ * - `ledger` (the default): any `chant approve` of the digest on
+ *   `chant/lifecycle`. Anyone who can push to that branch can approve, in
+ *   anyone's name.
+ * - `pr-review` (a wave's only): also the review of the pull request that
+ *   merged the commit being applied: an approving review of its head by a
+ *   writer other than its author approves the digest that head planned,
+ *   which the pull request's pipeline records (`chant run wave
+ *   --record-plans`). chant judges it, in `chant run wave`, and writes the
+ *   approval it makes of the review to the ledger.
+ * - `sealed`: only an approval sealed with `chant approve --sign` (`yodel
+ *   approve --sign`) by a key the signers file lists for its approver. The
+ *   file is `.chant/allowed_signers` at the repository's root (or the path
+ *   `.chant/trust.json` names), read at the base commit, so a key the change
+ *   itself adds does not count for it.
+ *
+ * A wave's mode is `waves[].approval`, which yodel ci writes into the waves
+ * spec, where chant reads it at the base commit with the gate policy. The
+ * migrations Op's gate (yodel apply <env> outside the waves) takes
+ * `environments.<env>.approval`, read from yodel.config.ts at the base
+ * commit; without it, `sealed` when the environment's wave is sealed, else
+ * `ledger`. yodel checks it itself where it checks an approval
+ * (`--execute`, `--wave-apply`), so an unsealed approval chant's gate step
+ * let through still applies nothing.
+ */
+import type { GateLedgerPort } from "@intentius/chant/op/gate";
+import type { ApprovalMode, EnvironmentApprovalMode, YodelConfig } from "../config/define.js";
+export type { ApprovalMode, EnvironmentApprovalMode };
+/**
+ * Set (to `1`) by `yodel ci` on the pull request job that records the plans
+ * each head makes for a `pr-review` wave, `chant run wave --record-plans`:
+ * `yodel apply <env> --wave-plan` then plans the wave as it will be after the
+ * merge, once the environments it requires have applied what is pending.
+ * `--wave-apply` never reads it.
+ */
+export declare const RECORD_PLANS_ENV = "YODEL_WAVE_RECORD_PLANS";
+/** Where chant reads the signers when `.chant/trust.json` names no other path. */
+export declare const SIGNERS_FILE = ".chant/allowed_signers";
+/** `env`'s wave's mode in `config`; `ledger` when no wave names it or the wave sets none. */
+export declare function waveApproval(config: YodelConfig | undefined, env: string): ApprovalMode;
+/** The migrations Op's mode for `env` in `config`: the environment's, else `sealed` when its wave is, else `ledger`. */
+export declare function migrationsApproval(config: YodelConfig | undefined, env: string): EnvironmentApprovalMode;
+/** The migrations Op's mode as the base commit has it. */
+export interface ApprovalAtBase {
+    mode: EnvironmentApprovalMode;
+    /** The commit the signers file is read at, when the base could be read. */
+    base?: string;
+    /** Why the working tree's mode is not the one that applies, when they differ. */
+    note?: string;
+}
+/**
+ * `env`'s migrations Op mode from yodel.config.ts at the base commit, so a
+ * change cannot loosen the mode that gates its own merge. A checkout with no
+ * base to read (no git, a repository's first commit) takes the working
+ * tree's, and a sealed one then has no signers file at base to verify
+ * against, so nothing counts.
+ */
+export declare function migrationsApprovalAtBase(project: {
+    dir: string;
+    yodel?: {
+        config: YodelConfig;
+    } | undefined;
+}, env: string, processEnv?: NodeJS.ProcessEnv): Promise<ApprovalAtBase>;
+/**
+ * `port`, with every gate it is asked for also sealed: an approval counts
+ * only when its seal verifies, for the approver it names, against the
+ * signers file at `base` (and the workspace's own rule, when it has one,
+ * accepts it too). No signers file at base, nothing counts.
+ */
+export declare function sealedPort(port: GateLedgerPort, cwd: string, base: string | undefined): Promise<GateLedgerPort>;
+/** `port` as `mode` judges approvals: sealed at `base`, or as it is. */
+export declare function portFor(port: GateLedgerPort, mode: ApprovalMode, cwd: string, base: string | undefined): Promise<GateLedgerPort>;
+/** What a printed approve command needs for `mode`: `--sign` under sealed. */
+export declare const signFlag: (mode: ApprovalMode) => string;
+/** One sentence on which approvals count under `mode`, for the plan and the pull request comment. */
+export declare function describeApprovalMode(mode: ApprovalMode, code?: (s: string) => string): string;

package/dist/approval-mode/index.js

@@ -0,0 +1,105 @@
+/**
+ * Approval modes (#48): which approvals of a gate's plan digest count.
+ *
+ * - `ledger` (the default): any `chant approve` of the digest on
+ *   `chant/lifecycle`. Anyone who can push to that branch can approve, in
+ *   anyone's name.
+ * - `pr-review` (a wave's only): also the review of the pull request that
+ *   merged the commit being applied: an approving review of its head by a
+ *   writer other than its author approves the digest that head planned,
+ *   which the pull request's pipeline records (`chant run wave
+ *   --record-plans`). chant judges it, in `chant run wave`, and writes the
+ *   approval it makes of the review to the ledger.
+ * - `sealed`: only an approval sealed with `chant approve --sign` (`yodel
+ *   approve --sign`) by a key the signers file lists for its approver. The
+ *   file is `.chant/allowed_signers` at the repository's root (or the path
+ *   `.chant/trust.json` names), read at the base commit, so a key the change
+ *   itself adds does not count for it.
+ *
+ * A wave's mode is `waves[].approval`, which yodel ci writes into the waves
+ * spec, where chant reads it at the base commit with the gate policy. The
+ * migrations Op's gate (yodel apply <env> outside the waves) takes
+ * `environments.<env>.approval`, read from yodel.config.ts at the base
+ * commit; without it, `sealed` when the environment's wave is sealed, else
+ * `ledger`. yodel checks it itself where it checks an approval
+ * (`--execute`, `--wave-apply`), so an unsealed approval chant's gate step
+ * let through still applies nothing.
+ */
+import { loadYodelConfigAtBase } from "../config/base.js";
+import { baseEnvironment } from "../tenants/target.js";
+/**
+ * Set (to `1`) by `yodel ci` on the pull request job that records the plans
+ * each head makes for a `pr-review` wave, `chant run wave --record-plans`:
+ * `yodel apply <env> --wave-plan` then plans the wave as it will be after the
+ * merge, once the environments it requires have applied what is pending.
+ * `--wave-apply` never reads it.
+ */
+export const RECORD_PLANS_ENV = "YODEL_WAVE_RECORD_PLANS";
+/** Where chant reads the signers when `.chant/trust.json` names no other path. */
+export const SIGNERS_FILE = ".chant/allowed_signers";
+/** `env`'s wave's mode in `config`; `ledger` when no wave names it or the wave sets none. */
+export function waveApproval(config, env) {
+    return config?.waves?.find((w) => w.env === baseEnvironment(env))?.approval ?? "ledger";
+}
+/** The migrations Op's mode for `env` in `config`: the environment's, else `sealed` when its wave is, else `ledger`. */
+export function migrationsApproval(config, env) {
+    const own = config?.environments?.[baseEnvironment(env)]?.approval;
+    if (own)
+        return own;
+    return waveApproval(config, env) === "sealed" ? "sealed" : "ledger";
+}
+/**
+ * `env`'s migrations Op mode from yodel.config.ts at the base commit, so a
+ * change cannot loosen the mode that gates its own merge. A checkout with no
+ * base to read (no git, a repository's first commit) takes the working
+ * tree's, and a sealed one then has no signers file at base to verify
+ * against, so nothing counts.
+ */
+export async function migrationsApprovalAtBase(project, env, processEnv = process.env) {
+    const tree = migrationsApproval(project.yodel?.config, env);
+    let at;
+    try {
+        at = await loadYodelConfigAtBase(project.dir, processEnv);
+    }
+    catch (e) {
+        const why = e instanceof Error ? (e.message.split("\n")[0] ?? "") : String(e);
+        return { mode: tree, ...(tree !== "ledger" ? { note: `approval: yodel.config.ts could not be read at the base commit (${why}), so ${env}'s approval mode is the working tree's, ${tree}` } : {}) };
+    }
+    const mode = migrationsApproval(at.config, env);
+    return { mode, base: at.sha, ...(mode !== tree ? { note: `approval: ${env}'s approvals count as ${mode}, as yodel.config.ts has it at the base commit ${at.sha.slice(0, 12)}, not ${tree} as this change has it` } : {}) };
+}
+/**
+ * `port`, with every gate it is asked for also sealed: an approval counts
+ * only when its seal verifies, for the approver it names, against the
+ * signers file at `base` (and the workspace's own rule, when it has one,
+ * accepts it too). No signers file at base, nothing counts.
+ */
+export async function sealedPort(port, cwd, base) {
+    const review = await import("@intentius/chant/op/gate-review");
+    const sealed = (gate) => base === undefined
+        ? { requirement: { gate, class: null }, refuses: () => `the gate is sealed, and there is no base commit to read the signers file (${SIGNERS_FILE}) at` }
+        : review.sealedApprovalRule(gate, review.trustPolicyAt(cwd, base));
+    return {
+        ...port,
+        read: (op) => port.read(op),
+        async approvalRule(gate) {
+            const own = (await port.approvalRule?.(gate)) ?? null;
+            return review.bothRules(own, sealed(gate));
+        },
+    };
+}
+/** `port` as `mode` judges approvals: sealed at `base`, or as it is. */
+export async function portFor(port, mode, cwd, base) {
+    return mode === "sealed" ? sealedPort(port, cwd, base) : port;
+}
+/** What a printed approve command needs for `mode`: `--sign` under sealed. */
+export const signFlag = (mode) => (mode === "sealed" ? " --sign" : "");
+/** One sentence on which approvals count under `mode`, for the plan and the pull request comment. */
+export function describeApprovalMode(mode, code = (s) => s) {
+    if (mode === "sealed")
+        return `Approvals count only sealed (approval ${code("sealed")}): ${code("chant approve --sign")} or ${code("yodel approve --sign")}, with a key ${code(SIGNERS_FILE)} at the base commit lists for the approver.`;
+    if (mode === "pr-review")
+        return `Approval ${code("pr-review")}: an approving review of this pull request's head, by a writer other than its author, approves the plan that head records; ${code("chant approve")} of the digest counts too.`;
+    return `Approval ${code("ledger")}: any ${code("chant approve")} of the digest counts.`;
+}
+//# sourceMappingURL=index.js.map

package/dist/approval-mode/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/approval-mode/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAIvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAE1D,kFAAkF;AAClF,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAErD,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,MAA+B,EAAE,GAAW;IACvE,OAAO,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,IAAI,QAAQ,CAAC;AAC1F,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,kBAAkB,CAAC,MAA+B,EAAE,GAAW;IAC7E,MAAM,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC;IACnE,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtE,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAqE,EAAE,GAAW,EAAE,aAAgC,OAAO,CAAC,GAAG;IAC5K,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mEAAmE,GAAG,SAAS,GAAG,2CAA2C,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACrM,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,GAAG,yBAAyB,IAAI,kDAAkD,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,IAAI,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7N,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAoB,EAAE,GAAW,EAAE,IAAwB;IAC1F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,CAAC,IAAY,EAAoB,EAAE,CAChD,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,6EAA6E,YAAY,MAAM,EAAE;QACxJ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,YAAY,CAAC,IAAY;YAC7B,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;YACtD,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB,EAAE,IAAkB,EAAE,GAAW,EAAE,IAAwB;IAC3G,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAkB,EAAU,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE7F,qGAAqG;AACrG,MAAM,UAAU,oBAAoB,CAAC,IAAkB,EAAE,OAA8B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7F,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,yCAAyC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,IAAI,CAAC,YAAY,CAAC,6CAA6C,CAAC;IAC1O,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,YAAY,IAAI,CAAC,WAAW,CAAC,8HAA8H,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAAC;IAC9O,OAAO,YAAY,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,eAAe,CAAC,wBAAwB,CAAC;AAC1F,CAAC"}

package/dist/chant/access.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Access control under review. On Postgres (#45): row-level security,
+ * policies, the roles a schema declares, grants and default privileges, as
+ * chant's sql lexicon plans and applies them where `sql.profiles.<env>.access`
+ * is on (yodel.config.ts's `environments.<env>.access` sets it per
+ * environment). On ClickHouse (#46): users, roles, row policies and grants,
+ * which chant plans whenever the build declares them; yodel refuses the
+ * declarative path where the environment does not manage access
+ * ({@link clickhouseAccessRefusal}).
+ *
+ * The plan already lists each access change with its rule and class. This
+ * module picks them out so `yodel plan`, `yodel new`, lint and the pull
+ * request comment can show them together, and names the changes that take
+ * access away: a privilege revoked (SQLPG297), a policy dropped (SQLPG292),
+ * row-level security turned off or no longer forced (SQLPG293), and on
+ * ClickHouse a privilege or role revoked (SQLCH274). A revoke no `REVOKE`
+ * declaration asks for takes away a privilege granted by hand (or one whose
+ * declaration was deleted) from the role that holds it, so it is called out
+ * on its own. ClickHouse takes no `REVOKE` declaration: a grantee's grant
+ * declarations are all it holds, so every revoke there is one of these.
+ */
+import type { ClassifiedChange } from "@intentius/chant-lexicon-sql/core/classifier";
+import type { MigrationStep } from "@intentius/chant-lexicon-sql/migration-statements";
+import type { BuildOutput } from "./build.js";
+import { YodelError, type Project } from "../project.js";
+/** chant's access rules: policies, row-level security, roles, grants, revokes, default privileges; on ClickHouse role settings, user clauses, row policies, grants and revokes. */
+export declare const ACCESS_RULES: ReadonlySet<string>;
+/** The entity types of ClickHouse's access declarations: `user`, `role`, `policy` and `grant`. */
+export declare const CH_ACCESS_TYPES: ReadonlySet<string>;
+/** The entity types of access declarations. */
+export declare const ACCESS_TYPES: ReadonlySet<string>;
+/** A plan change that is about access control. */
+export declare const isAccessChange: (c: Pick<ClassifiedChange, "rule" | "field" | "object">) => boolean;
+/** A migration step that is about access control. */
+export declare function isAccessStep(s: MigrationStep): boolean;
+/** Why a statement takes access away, or `undefined`. */
+export declare function takesAccessAway(s: {
+    rule: string;
+    sql?: string;
+}): string | undefined;
+/** One access change in a declarative plan. */
+export interface AccessItem {
+    object: string;
+    rule: string;
+    class: string;
+    field: string;
+    before?: unknown;
+    after?: unknown;
+    /** A revoke no declaration asks for: the server holds a privilege nothing declares (granted by hand, or its declaration deleted), and the apply takes it away. */
+    byHand?: true;
+}
+/** What `yodel plan --json` adds on Postgres: whether access is managed here, and the access changes. */
+export interface AccessReview {
+    managed: boolean;
+    /** Where {@link managed} came from: `yodel.config.ts`, `sql.profiles.<env>.access` or `default`. */
+    source: string;
+    changes: AccessItem[];
+}
+/** The access changes of a plan, a revoke of what nothing declares marked {@link AccessItem.byHand}. */
+export declare function accessItems(changes: readonly ClassifiedChange[], build: BuildOutput): Promise<AccessItem[]>;
+/** A plan's access section: whether access is managed in environment `name` (and where that is set), and the plan's access changes. */
+export declare function accessReview(project: Pick<Project, "yodel" | "profileAccess">, name: string, changes: readonly ClassifiedChange[], build: BuildOutput): Promise<AccessReview>;
+/** The privileges a revoke takes away: what the role held before and does not after. */
+export declare const removed: (c: Pick<AccessItem, "before" | "after">) => string[];
+/** What a revoke takes away, from whom: `relation app.t FROM reader: insert` (Postgres), `INSERT ON db.t FROM reader` (ClickHouse, whose plan names the grantee as `grants <grantee>`). */
+export declare function revokeLine(c: Pick<AccessItem, "object" | "before" | "after">): string;
+/** The plan's access section, as text: every change with its rule and class, then the revokes of privileges granted by hand. */
+export declare function renderAccessReview(review: AccessReview, environment: string): string[];
+/** The access steps of a migration, each with why it takes access away when it does. */
+export declare function accessSteps(steps: readonly MigrationStep[]): Array<{
+    index: number;
+    step: MigrationStep;
+    away?: string;
+    undeclared?: true;
+}>;
+/** A migration's access steps as lines: how many, and each one that takes access away. */
+export declare function describeAccessSteps(steps: readonly MigrationStep[], md?: boolean): string[];
+/**
+ * ClickHouse: the declarative path's refusal where environment `name` does
+ * not manage access and the build declares users, roles, row policies or
+ * grants. chant's ClickHouse apply (the project's ApplyOp) and `chant
+ * lifecycle diff` plan every access declaration they find, with no switch of
+ * their own, so yodel cannot leave them out there: rather than plan without
+ * them and apply with them, it refuses. `undefined` when access is managed,
+ * or nothing is declared.
+ */
+export declare function clickhouseAccessRefusal(project: Pick<Project, "yodel" | "profileAccess">, name: string, build: Pick<BuildOutput, "objects">, what?: string): YodelError | undefined;