@reventlessdev/reventless-spec 3.0.0-alpha.154 → 3.0.0-alpha.156

package/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.156 (2026-10-01)
+
+* feat!: roles a plugin declares, groups a platform provides ([43daace](https://github.com/ReventlessDev/reventless-core/commit/43daace6ca588afe22562d079af1e6f1da81942e))
+
+### BREAKING CHANGES
+
+* AllowGroups and AdminGroup are removed — write AllowRoles over
+the plugin's Roles.t, and use Role.admin / Platform.adminGroup(). Spec module
+types declare `type role`, and their rules are Authorization.rule<role>; a spec
+that writes its own rule declares `type role` (Reventless.Role.name for a rule
+over Authorization.permission). Role.name is a private string: make one from a
+string with Role.make.
+
+
+
+# 3.0.0-alpha.155 (2026-10-01)
+
+### Features
+
+* **spec, aws, core, local:** an app declares its environments, and every deployment records its commit ([c7cc925](https://github.com/ReventlessDev/reventless-core/commit/c7cc92573e97742b681a9000cea0bdfd6e9a33fc))
+* **spec, core, gwt, ppx:** a command acts only on what its caller owns ([2636f0e](https://github.com/ReventlessDev/reventless-core/commit/2636f0ee44797ee2c0b0c40a7107cf306113173f))
+
+
 # 3.0.0-alpha.154 (2026-09-29)
 
 **Note:** Version bump only for package @reventlessdev/reventless-spec

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-spec",
-  "version": "3.0.0-alpha.154",
+  "version": "3.0.0-alpha.156",
   "description": "Specifications for Reventless",
   "license": "Apache-2.0",
   "bin": {

package/src/components/Aggregate.res

@@ -55,12 +55,15 @@ module type Spec = {
       the npm specifier for runtime dynamic imports. */
   let moduleUrl: string
 
+  /** The roles this spec's rules name: its plugin's `Roles.t`, which the PPX
+      supplies; `Role.name` where the plugin declares none. */
+  type role
   /** Authorization rule evaluated at the GraphQL resolver entry before any
       command is dispatched. Auto-injected by `@@reventless.spec` and on
       structurally-detected inline spec modules — defaults to
       `AllowAuthenticated`; override at the file/module level with
       `@@reventless.authorize(<rule>)`. */
-  let commandAuthorization: command => Authorization.permission
+  let commandAuthorization: command => Authorization.rule<role>
 
   /** The lifecycle enum this component's commands move a row through — the
       linked view's own, e.g. `type lifecycleState = Customers.accountStatus`.

package/src/components/InboundTranslationSlice.res

@@ -56,11 +56,14 @@ module type Spec = {
       Auto-injected by `@@reventless.spec` defaulting to `None` — set it to name the box. */
   let externalSystem: option<string>
 
+  /** The roles this spec's rules name: its plugin's `Roles.t`, which the PPX
+      supplies; `Role.name` where the plugin declares none. */
+  type role
   /** Authorization rule evaluated at the GraphQL resolver entry before any
       external input is translated. Auto-injected by `@@reventless.spec` and
       on structurally-detected inline spec modules — defaults to
       `AllowAuthenticated`. */
-  let commandAuthorization: command => Authorization.permission
+  let commandAuthorization: command => Authorization.rule<role>
 
   /** The lifecycle enum this component's commands move a row through — the
       linked view's own, e.g. `type lifecycleState = Customers.accountStatus`.

package/src/components/Owner.res

@@ -138,3 +138,33 @@ let variantFieldNames = (schema: S.t<unknown>, ~variant: string): array<string>
   | _ => []
   }
 }
+
+/**
+The owner fields of every constructor that declares one, keyed by its tag.
+
+Read off a slice's consumed events, this says which recorded facts name the
+owner of the partition a command acts on. An empty dict means the union records
+no owner, and the handler then has nothing to enforce — so, as with every reader
+here, it must be handed the real schema: a permissive stand-in answers empty.
+*/
+let fieldNamesByVariant = (schema: S.t<unknown>): dict<array<string>> => {
+  let byVariant = Dict.make()
+  let visit = (properties: dict<S.t<unknown>>) =>
+    switch (properties->Dict.get("TAG"), fieldNamesOfProperties(properties)) {
+    | (_, []) => ()
+    | (Some(String({const: ?Some(name)})), fields) => byVariant->Dict.set(name, fields)
+    | _ => ()
+    }
+  switch schema {
+  | AnyOf({anyOf}) =>
+    anyOf->Array.forEach(v =>
+      switch v {
+      | Object({properties}) => visit(properties)
+      | _ => ()
+      }
+    )
+  | Object({properties}) => visit(properties)
+  | _ => ()
+  }
+  byVariant
+}

package/src/components/Owner.res.mjs

@@ -90,6 +90,41 @@ function variantFieldNames(schema, variant) {
   }
 }
 
+function fieldNamesByVariant(schema) {
+  let byVariant = {};
+  let visit = properties => {
+    let match = properties["TAG"];
+    let match$1 = fieldNamesOfProperties(properties);
+    if (match$1.length === 0) {
+      return;
+    }
+    if (match === undefined) {
+      return;
+    }
+    if (match.type !== "string") {
+      return;
+    }
+    let name = match.const;
+    if (name !== undefined) {
+      byVariant[name] = match$1;
+      return;
+    }
+  };
+  switch (schema.type) {
+    case "object" :
+      visit(schema.properties);
+      break;
+    case "anyOf" :
+      schema.anyOf.forEach(v => {
+        if (v.type === "object") {
+          return visit(v.properties);
+        }
+      });
+      break;
+  }
+  return byVariant;
+}
+
 export {
   ownerId,
   mark,
@@ -100,5 +135,6 @@ export {
   fieldNamesOfProperties,
   fieldNames,
   variantFieldNames,
+  fieldNamesByVariant,
 }
 /* ownerId Not a pure module */

package/src/components/Plugin.res

@@ -194,6 +194,10 @@ type commandDef = {
   /** Access keys — any one of them — a caller needs to be *offered* this command.
       A hint derived from the server's rule, never the refusal itself. */
   requiredAccess: option<array<string>>,
+  /** The roles `requiredAccess` was mapped from, as the rule names them. Absent
+      where the rule names none; read by the deploy check that every role maps to
+      a group the platform provides. */
+  requiredRoles?: array<string>,
   /** The `@owner` command field the server stamps with the caller's identity; a
       client omits it from a form, since whatever it collects is discarded. */
   ownerField: option<string>,
@@ -249,6 +253,8 @@ type queryableDef = {
   /** Access keys — any one of them — a caller needs to be *offered* this view. A
       denied read comes back empty rather than erroring, hence the hint. */
   requiredAccess: option<array<string>>,
+  /** The roles `requiredAccess` was mapped from; see `commandDef`. */
+  requiredRoles?: array<string>,
 }
 
 /** One emitted event of a write side. `name` is the variant name, `schema` its
@@ -326,6 +332,8 @@ type inboundTranslationSliceDef = {
   externalSystem: option<string>,
   /** Chapter grouping band — see `queryableDef.chapter`. */
   chapter: option<string>,
+  /** The roles any of its commands' rules name; see `commandDef`. */
+  requiredRoles?: array<string>,
 }
 
 /** A published event of an extension point and the internal events producing it.

package/src/components/Plugin.res.mjs

@@ -102,6 +102,7 @@ let commandDefSchema = Sury.$schema(s => ({
   allowedStatesSource: s.m(Sury.$option(Sury.string)),
   apiExposed: s.m(Sury.$option(Sury.boolean)),
   requiredAccess: s.m(Sury.$option(Sury.array(Sury.string))),
+  requiredRoles: s.m(Sury.$option(Sury.array(Sury.string))),
   ownerField: s.m(Sury.$option(Sury.string))
 }));
 
@@ -124,7 +125,8 @@ let queryableDefSchema = Sury.$schema(s => ({
   singleQueryField: s.m(Sury.$option(Sury.string)),
   idField: s.m(Sury.$option(Sury.string)),
   idFieldSource: s.m(Sury.$option(Sury.string)),
-  requiredAccess: s.m(Sury.$option(Sury.array(Sury.string)))
+  requiredAccess: s.m(Sury.$option(Sury.array(Sury.string))),
+  requiredRoles: s.m(Sury.$option(Sury.array(Sury.string)))
 }));
 
 let eventDefSchema = Sury.$schema(s => ({
@@ -174,7 +176,8 @@ let inboundTranslationSliceDefSchema = Sury.$schema(s => ({
   commandTypes: s.m(Sury.array(Sury.string)),
   targetName: s.m(Sury.string),
   externalSystem: s.m(Sury.$option(Sury.string)),
-  chapter: s.m(Sury.$option(Sury.string))
+  chapter: s.m(Sury.$option(Sury.string)),
+  requiredRoles: s.m(Sury.$option(Sury.array(Sury.string)))
 }));
 
 let publishedEventDefSchema = Sury.$schema(s => ({

package/src/components/ReadModel.res

@@ -190,12 +190,15 @@ module type Spec = {
   /** Optional composite-key configuration. `None` for single-key tables. */
   let subIdConfig: option<subIdConfig<state>>
 
+  /** The roles this spec's rules name: its plugin's `Roles.t`, which the PPX
+      supplies; `Role.name` where the plugin declares none. */
+  type role
   /** Authorization rule evaluated at the GraphQL resolver entry before any
       query is resolved. Auto-injected by `@@reventless.spec` and on
       structurally-detected inline spec modules — defaults to
       `AllowAuthenticated`; override at the file/module level with
       `@@reventless.authorize(<rule>)`. */
-  let authorization: Authorization.permission
+  let authorization: Authorization.rule<role>
 
   /** AutoUI visibility hint. Auto-injected by `@@reventless.spec` and on
       structurally-detected inline spec modules — defaults to

package/src/components/StateChangeSlice.res

@@ -75,12 +75,15 @@ module type Spec = {
   /** Schema for the command type — used to extract DCB tags for the conditional read. */
   let commandSchema: S.t<command>
 
+  /** The roles this spec's rules name: its plugin's `Roles.t`, which the PPX
+      supplies; `Role.name` where the plugin declares none. */
+  type role
   /** Authorization rule evaluated at the GraphQL resolver entry before any
       command is dispatched. Auto-injected by `@@reventless.spec` and on
       structurally-detected inline spec modules — defaults to
       `AllowAuthenticated`; override at the file/module level with
       `@@reventless.authorize(<rule>)`. */
-  let commandAuthorization: command => Authorization.permission
+  let commandAuthorization: command => Authorization.rule<role>
 
   /** The lifecycle enum this component's commands move a row through — the
       linked view's own, e.g. `type lifecycleState = Customers.accountStatus`.

package/src/components/StateViewSlice.res

@@ -73,11 +73,14 @@ module type Spec = {
   /** Optional composite-key configuration. `None` for single-key tables. */
   let subIdConfig: option<ReadModel.subIdConfig<state>>
 
+  /** The roles this spec's rules name: its plugin's `Roles.t`, which the PPX
+      supplies; `Role.name` where the plugin declares none. */
+  type role
   /** Authorization rule evaluated at the GraphQL resolver entry before any
       query is resolved. Auto-injected by `@@reventless.spec` and on
       structurally-detected inline spec modules — defaults to
       `AllowAuthenticated`. */
-  let authorization: Authorization.permission
+  let authorization: Authorization.rule<role>
 
   /** AutoUI visibility hint. Auto-injected by `@@reventless.spec` and on
       structurally-detected inline spec modules — defaults to

package/src/lifecycle/CheckLifecycleModel.res

@@ -687,6 +687,9 @@ let observe = (
 
   scenarios->Array.filterMap(s =>
     switch s.whenElements->Array.get(0) {
+    // `thenRefused`: the caller did not own the row, which says nothing about
+    // the states the command is legal in.
+    | Some(_) if s.thenKind == "forbidden" => None
     | Some(command) if s.whenKind == "command" =>
       let idField = idFieldFor(command.name)
       let idValue = idField->Option.flatMap(field => command.values->valueOf(~field))

package/src/lifecycle/CheckLifecycleModel.res.mjs

@@ -503,6 +503,9 @@ function observe(scenarios, map, idFieldFor) {
     if (command === undefined) {
       return;
     }
+    if (s.thenKind === "forbidden") {
+      return;
+    }
     if (s.whenKind !== "command") {
       return;
     }

package/src/types/AccountsManifest.res

@@ -8,7 +8,7 @@ reads it and writes back into it.
 
 Here rather than in either platform package because a manifest that works on one
 platform and silently fails on the other is the whole cost being avoided. It sits
-beside [Identity] and [AdminGroup] for the same reason those do: the vocabulary
+beside [Identity] and [Role] for the same reason those do: the vocabulary
 the two platforms share about who is signed in.
 
 🚨 **The password field is a bootstrap credential, not a stored secret.** The file
@@ -237,6 +237,28 @@ let locate = (~given: option<string>=?, ()): result<located, string> =>
     }
   }
 
+/**
+The groups the accounts here belong to: the manifest's, else the template's, else
+none. What a platform provides beyond its administrator group, for the check that
+every role a plugin needs has a group.
+
+Read, never seeded — this runs in a deploy or a start, which must not write the
+file `locate` would. The template counts because it is the cast a fresh clone
+provisions; a deploy from CI has no manifest and the same accounts to come.
+*/
+let declaredGroups = (): array<string> => {
+  let template = NodePath.join([NodeProcess.cwd(), templateName])
+  let file = NodeFs.existsSync(defaultPath())
+    ? Some(defaultPath())
+    : NodeFs.existsSync(template)
+    ? Some(template)
+    : None
+  switch file->Option.map(parseFile) {
+  | Some(Ok(entries)) => entries->Array.flatMap(e => e.groups)
+  | Some(Error(_)) | None => []
+  }
+}
+
 // ── Preparing ────────────────────────────────────────────────────────────────
 
 /** One account after preparation: what the file now declares, and whether this

package/src/types/AccountsManifest.res.mjs

@@ -246,6 +246,23 @@ function locate(given, param) {
   }
 }
 
+function declaredGroups() {
+  let template = Nodepath.join(process.cwd(), templateName);
+  let file = Nodefs.existsSync(defaultPath()) ? defaultPath() : (
+      Nodefs.existsSync(template) ? template : undefined
+    );
+  let match = Stdlib_Option.map(file, parseFile);
+  if (match !== undefined) {
+    if (match.TAG === "Ok") {
+      return match._0.flatMap(e => e.groups);
+    } else {
+      return [];
+    }
+  } else {
+    return [];
+  }
+}
+
 function prepare(file) {
   let e = parseFile(file);
   if (e.TAG !== "Ok") {
@@ -306,6 +323,7 @@ export {
   templateName,
   pathOf,
   locate,
+  declaredGroups,
   prepare,
 }
 /* entrySchema Not a pure module */

package/src/types/Authorization.res

@@ -1,22 +1,49 @@
 // Provider-agnostic authorization rules. Evaluated against the
 // `Identity.t` resolved by an `Auth_Adapter.Provider.authenticate` call.
 //
-// `array<string>` for groups (not a parameterised variant) keeps the
-// framework decoupled from any application's specific group set —
-// applications can define their own typed `group` variant and convert via
-// a thin helper, see docs/analysis/authentication-authorization.md §4.2.
+// A spec writes its rules over its plugin's own roles, `rule<Roles.t>`, so a
+// misspelled role does not compile. The framework reads them as `permission`,
+// the same rule over role names, which `Role.groupOf` maps to the group that
+// stands for each role in this deployment.
 
-@schema
-type permission =
-  | AllowGroups(array<string>)
+type rule<'role> =
+  | AllowRoles(array<'role>)
   | AllowAuthenticated
   | AllowAnonymous
   | DenyAll
 
-let isAllowed = (rule: permission, identity: Identity.t): bool =>
+/** A rule over role names: what the framework compares, maps and publishes. */
+type permission = rule<Role.name>
+
+/** A spec's rule as the framework reads it. Each role must be a case without a
+    payload, which is its name at run time; anything else is refused. */
+@module("./authorizationNamed.mjs")
+external named: rule<'role> => permission = "named"
+
+/** The roles a rule names, before mapping. */
+let rolesOf = (rule: permission): array<Role.name> =>
+  switch rule {
+  | AllowRoles(roles) => roles
+  | AllowAuthenticated | AllowAnonymous | DenyAll => []
+  }
+
+/** The groups a rule admits, mapped. */
+let groupsOf = (rule: permission): array<string> => rule->rolesOf->Array.map(Role.groupOf)
+
+/**
+Whether a rule admits a caller, given whether they are signed in and which roles
+they hold. The one decision both `isAllowed` and a GWT scenario make, so the two
+cannot read a rule differently.
+*/
+let admits = (rule: permission, ~signedIn: bool, ~holds: Role.name => bool): bool =>
   switch rule {
   | DenyAll => false
   | AllowAnonymous => true
-  | AllowAuthenticated => identity.userId !== "anonymous"
-  | AllowGroups(groups) => groups->Array.some(group => identity.groups->Array.includes(group))
+  | AllowAuthenticated => signedIn
+  | AllowRoles(roles) => roles->Array.some(holds)
   }
+
+let isAllowed = (rule: permission, identity: Identity.t): bool =>
+  admits(rule, ~signedIn=identity.userId !== "anonymous", ~holds=role =>
+    identity.groups->Array.includes(Role.groupOf(role))
+  )

package/src/types/Authorization.res.mjs

@@ -1,24 +1,31 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as Sury from "sury";
+import * as Role$Reventless from "./Role.res.mjs";
+import * as AuthorizationNamedMjs from "./authorizationNamed.mjs";
 
-let permissionSchema = Sury.union([
-  Sury.$schema(s => ({
-    TAG: "AllowGroups",
-    _0: s.m(Sury.array(Sury.string))
-  })),
-  Sury.literal("AllowAuthenticated"),
-  Sury.literal("AllowAnonymous"),
-  Sury.literal("DenyAll")
-]);
+function named(prim) {
+  return AuthorizationNamedMjs.named(prim);
+}
 
-function isAllowed(rule, identity) {
+function rolesOf(rule) {
+  if (typeof rule !== "object") {
+    return [];
+  } else {
+    return rule._0;
+  }
+}
+
+function groupsOf(rule) {
+  return rolesOf(rule).map(Role$Reventless.groupOf);
+}
+
+function admits(rule, signedIn, holds) {
   if (typeof rule === "object") {
-    return rule._0.some(group => identity.groups.includes(group));
+    return rule._0.some(holds);
   }
   switch (rule) {
     case "AllowAuthenticated" :
-      return identity.userId !== "anonymous";
+      return signedIn;
     case "AllowAnonymous" :
       return true;
     case "DenyAll" :
@@ -26,8 +33,15 @@ function isAllowed(rule, identity) {
   }
 }
 
+function isAllowed(rule, identity) {
+  return admits(rule, identity.userId !== "anonymous", role => identity.groups.includes(Role$Reventless.groupOf(role)));
+}
+
 export {
-  permissionSchema,
+  named,
+  rolesOf,
+  groupsOf,
+  admits,
   isAllowed,
 }
-/* permissionSchema Not a pure module */
+/* Role-Reventless Not a pure module */

package/src/types/DeploymentProvenance.res

@@ -0,0 +1,84 @@
+/***
+Where a deployment came from: the commit it was built from, whether the tree had
+uncommitted changes, and the environment it was made for.
+
+Read by the deploy while it runs, and recorded with the deployment, so a reader
+can say which commit runs in which environment without asking whoever deployed.
+A deployment from CI knows its commit from the CI's variables; one from a laptop
+asks git. Neither gives up a timestamp in place of a commit: a timestamp is not
+an answer to *which commit*, and a reader cannot tell it from one.
+*/
+
+type t = {
+  commit: option<string>,
+  /** True only when the commit came from git and the working tree had changes:
+    what was deployed is not what the commit says. */
+  dirty: bool,
+  environment: option<string>,
+  purpose: option<string>,
+  tag: option<string>,
+  pullRequest: option<int>,
+}
+
+/** What git can say about the checkout the deploy runs in. */
+type git = {
+  head: unit => option<string>,
+  dirty: unit => bool,
+}
+
+let nonEmpty = (value: option<string>): option<string> =>
+  value->Option.flatMap(v => v->String.trim == "" ? None : Some(v->String.trim))
+
+/**
+The provenance of a deployment from the process's variables, asking git only when
+no CI variable names the commit.
+
+`REVENTLESS_COMMIT` comes first because on a pull request `GITHUB_SHA` is the merge
+commit GitHub made, not the head the review environment runs.
+*/
+let fromEnv = (env: dict<string>, ~git: git): t => {
+  let get = name => env->Dict.get(name)->nonEmpty
+  let fromCi =
+    get("REVENTLESS_COMMIT")
+    ->Option.orElse(get("GITHUB_SHA"))
+    ->Option.orElse(get("CI_COMMIT_SHA"))
+  let (commit, dirty) = switch fromCi {
+  | Some(_) => (fromCi, false)
+  | None =>
+    switch git.head() {
+    | Some(_) as head => (head, git.dirty())
+    | None => (None, false)
+    }
+  }
+  {
+    commit,
+    dirty,
+    environment: get("REVENTLESS_ENVIRONMENT"),
+    purpose: get("REVENTLESS_ENVIRONMENT_PURPOSE"),
+    tag: get("GITHUB_REF_TYPE") == Some("tag") ? get("GITHUB_REF_NAME") : None,
+    pullRequest: get("REVENTLESS_PULL_REQUEST")->Option.flatMap(n => Int.fromString(n)),
+  }
+}
+
+let run = (~cwd: string, args: array<string>): option<string> =>
+  try {
+    Some(
+      NodeChildProcess.execFileSync(
+        "git",
+        args,
+        {cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"]},
+      )->String.trim,
+    )
+  } catch {
+  | _ => None
+  }
+
+/** Git in `cwd`. A directory that is not a checkout, or a machine with no git,
+  answers *no commit* and *not dirty*. */
+let gitAt = (~cwd: string): git => {
+  head: () => run(~cwd, ["rev-parse", "HEAD"])->nonEmpty,
+  dirty: () => run(~cwd, ["status", "--porcelain"])->nonEmpty->Option.isSome,
+}
+
+/** The provenance of the deployment this process is making, in its working directory. */
+let current = (): t => fromEnv(NodeProcess.env, ~git=gitAt(~cwd=NodeProcess.cwd()))

package/src/types/DeploymentProvenance.res.mjs

@@ -0,0 +1,86 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Nodechild_process from "node:child_process";
+
+function nonEmpty(value) {
+  return Stdlib_Option.flatMap(value, v => {
+    if (v.trim() === "") {
+      return;
+    } else {
+      return v.trim();
+    }
+  });
+}
+
+function fromEnv(env, git) {
+  let fromCi = Stdlib_Option.orElse(Stdlib_Option.orElse(nonEmpty(env["REVENTLESS_COMMIT"]), nonEmpty(env["GITHUB_SHA"])), nonEmpty(env["CI_COMMIT_SHA"]));
+  let match;
+  if (fromCi !== undefined) {
+    match = [
+      fromCi,
+      false
+    ];
+  } else {
+    let head = git.head();
+    match = head !== undefined ? [
+        head,
+        git.dirty()
+      ] : [
+        undefined,
+        false
+      ];
+  }
+  return {
+    commit: match[0],
+    dirty: match[1],
+    environment: nonEmpty(env["REVENTLESS_ENVIRONMENT"]),
+    purpose: nonEmpty(env["REVENTLESS_ENVIRONMENT_PURPOSE"]),
+    tag: Primitive_object.equal(nonEmpty(env["GITHUB_REF_TYPE"]), "tag") ? nonEmpty(env["GITHUB_REF_NAME"]) : undefined,
+    pullRequest: Stdlib_Option.flatMap(nonEmpty(env["REVENTLESS_PULL_REQUEST"]), n => Stdlib_Int.fromString(n, undefined))
+  };
+}
+
+function run(cwd, args) {
+  try {
+    return Nodechild_process.execFileSync("git", args, {
+      cwd: cwd,
+      encoding: "utf8",
+      stdio: [
+        "ignore",
+        "pipe",
+        "ignore"
+      ]
+    }).trim();
+  } catch (exn) {
+    return;
+  }
+}
+
+function gitAt(cwd) {
+  return {
+    head: () => nonEmpty(run(cwd, [
+      "rev-parse",
+      "HEAD"
+    ])),
+    dirty: () => Stdlib_Option.isSome(nonEmpty(run(cwd, [
+      "status",
+      "--porcelain"
+    ])))
+  };
+}
+
+function current() {
+  return fromEnv(process.env, gitAt(process.cwd()));
+}
+
+export {
+  nonEmpty,
+  fromEnv,
+  run,
+  gitAt,
+  current,
+}
+/* node:child_process Not a pure module */