@intentius/terragucci 0.4.49 → 0.4.54

package/dist/terragucci.schema.json

@@ -306,6 +306,10 @@
         "relay": {
           "type": "string",
           "pattern": "^[A-Za-z0-9][A-Za-z0-9 ._-]{0,63}$"
+        },
+        "relay_key": {
+          "type": "string",
+          "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
         }
       },
       "additionalProperties": false,
@@ -316,6 +320,12 @@
         ],
         "webhook_key": [
           "webhook"
+        ],
+        "relay": [
+          "relay_key"
+        ],
+        "relay_key": [
+          "relay"
         ]
       },
       "if": {
@@ -337,7 +347,7 @@
           }
         ]
       },
-      "description": "The secrets holding Slack, Teams or webhook addresses, and the relay's name."
+      "description": "The secrets holding Slack, Teams or webhook addresses, the relay's name, and the secret holding the key its buttons are signed with."
     },
     "cost": {
       "anyOf": [
@@ -2259,6 +2269,10 @@
             "relay": {
               "type": "string",
               "pattern": "^[A-Za-z0-9][A-Za-z0-9 ._-]{0,63}$"
+            },
+            "relay_key": {
+              "type": "string",
+              "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
             }
           },
           "additionalProperties": false,
@@ -2269,6 +2283,12 @@
             ],
             "webhook_key": [
               "webhook"
+            ],
+            "relay": [
+              "relay_key"
+            ],
+            "relay_key": [
+              "relay"
             ]
           },
           "if": {
@@ -2290,7 +2310,7 @@
               }
             ]
           },
-          "description": "The secrets holding Slack, Teams or webhook addresses, and the relay's name."
+          "description": "The secrets holding Slack, Teams or webhook addresses, the relay's name, and the secret holding the key its buttons are signed with."
         },
         "cost": {
           "anyOf": [

package/dist/types.d.ts

@@ -1,3 +1,4 @@
+import { type GatePolicySource } from "@intentius/chant/policy-source";
 import { type GenerateSettings } from "./generate-config";
 export { ROOTS_NOT_ATMOS, ROOTS_NOT_TERRAGRUNT, SYNTH_DRIFT_PR, SYNTH_DRIFT_PR_SHORT, SYNTH_GENERATE, SYNTH_ROLLOUTS } from "./refusals";
 export declare const BINARIES: readonly ["terraform", "tofu", "choudoufu"];
@@ -543,9 +544,11 @@ export interface ProjectSettings {
      * incoming webhook, and a generic webhook's address with the key that
      * signs its body. An apply job whose wave waits, is refused or fails posts
      * to each (notify.ts), and the drift job posts drift to Slack and Teams.
-     * `relay` names the customer's relay (relay.ts): a waiting wave's Slack
-     * message gets Approve and Decline buttons, its Teams card the reply
-     * `@<relay> approve wave-<k> <digest>`.
+     * `relay` names the customer's relay (relay-host.ts) and `relay_key` the
+     * secret holding the key it checks buttons with: a waiting wave's Slack
+     * message gets chant's Approve and Decline buttons, its Teams card the
+     * reply `@<relay> approve <reference>`, each signed with that key
+     * (chant#4611).
      */
     notify?: {
         slack?: string;
@@ -553,6 +556,7 @@ export interface ProjectSettings {
         webhook?: string;
         webhook_key?: string;
         relay?: string;
+        relay_key?: string;
     };
     /**
      * Cost estimates per root in the plan note: Infracost on the customer's
@@ -1122,19 +1126,20 @@ export declare const TRUST_ROLE: RegExp;
 export declare const LEDGER_PROVES_NOBODY = "approval: ledger does not prove who wrote an approval, so it cannot tell a role or the author; set approval to sealed or pr-review";
 /** Why an override's role needs `approval: sealed`. */
 export declare const OVERRIDE_ROLE_NEEDS_SEALED = "an override names whoever wrote it, and only approval: sealed proves who that was, so a role cannot be checked; set approval to sealed, or name the people in who";
-/** Where a shared policy is fetched from: the git URL and the ref. */
-export interface PolicySource {
-    url: string;
-    ref: string;
-}
 /**
- * Split `git+<scheme>://<host>/<path>@<ref>` into the URL git fetches and
- * the ref. The ref is what follows the last `@` after the host, so a user
- * name in the URL (`git+https://ci@host/...`) stays in the URL. https and
- * http (a forge on a private network) and file (a repo on the job's disk).
- * Undefined when it is not that shape.
+ * `policy.source` and `policy.path` as chant's `ci.policy.source`
+ * (`@intentius/chant/policy-source`, chant#4613), which fetches it. terragucci
+ * writes the source as `git+<scheme>://<host>/<path>@<ref>`, with https, http
+ * (a forge on a private network) or file (a repo on the job's disk); the ref
+ * is what follows the last `@` after the host, so a user name in the URL
+ * (`git+https://ci@host/...`) stays in the URL. chant's settings check decides
+ * whether the repo and the ref are valid. Undefined when `policy.source` is
+ * unset or not that shape.
  */
-export declare function parsePolicySource(source: string): PolicySource | undefined;
+export declare function policySourceOf(policy: {
+    source?: string;
+    path?: string;
+}): GatePolicySource | undefined;
 export declare const SECRET_NAME: RegExp;
 export declare const DECIDE_KEYS: string[];
 export declare const DURATION: RegExp;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@intentius/terragucci",
-  "version": "0.4.49",
-  "description": "The whole Terraform lifecycle, handled: one config file, generated pipelines for GitHub, GitLab and Forgejo.",
+  "version": "0.4.54",
+  "description": "Terraform ops and governance.",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
@@ -36,7 +36,7 @@
     "build": "node ../../scripts/build-cli.mjs"
   },
   "dependencies": {
-    "@intentius/chant": "0.124.58"
+    "@intentius/chant": "0.124.79"
   },
   "peerDependencies": {
     "@intentius/tsad-reference": "2.x",
@@ -52,10 +52,10 @@
   },
   "devDependencies": {
     "@cdktn/hcl2json": "0.24.0",
-    "@intentius/chant-lexicon-forgejo": "0.124.58",
-    "@intentius/chant-lexicon-github": "0.124.58",
-    "@intentius/chant-lexicon-gitlab": "0.124.58",
-    "@intentius/chant-lexicon-terraform": "0.124.58",
+    "@intentius/chant-lexicon-forgejo": "0.124.79",
+    "@intentius/chant-lexicon-github": "0.124.79",
+    "@intentius/chant-lexicon-gitlab": "0.124.79",
+    "@intentius/chant-lexicon-terraform": "0.124.79",
     "@intentius/tsad-reference": "2.1.0",
     "@modelcontextprotocol/sdk": "1.30.1"
   }