@sanoma-ai/workflows 0.1.0 → 0.4.0

package/dist/direct.js

@@ -0,0 +1,11 @@
+import { isResourceOp } from "./resource.js";
+import { DATA_VENDOR } from "./shared.js";
+/**
+ * Whether an operation may be called directly, outside a run (`SanomaClient.call`), as the
+ * person: a collection's (`data.<name>.<op>`), or a `read` that is neither the runtime's own
+ * (the vendor `sanoma`) nor a resource type's (`isResourceOp`), which only drift and apply call.
+ * Anything else (an effect at a vendor) is a workflow's. The one rule: the built-in `call`
+ * workflow, the SDK and the app read it, from here or from `OpEntry.direct`, and never derive it.
+ */
+export const isDirect = (op, types) => op.vendor === DATA_VENDOR || (op.effect === "read" && op.vendor !== "sanoma" && !isResourceOp(op, types));
+//# sourceMappingURL=direct.js.map

package/dist/direct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct.js","sourceRoot":"","sources":["../src/direct.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAA8C,EAC9C,KAAmC,EAC1B,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC"}

package/dist/drift.d.ts

@@ -3,14 +3,16 @@ import { type WorkflowDefinition } from "./define.ts";
 import type { Op } from "./op.ts";
 import { type DriftField, type Resource } from "./resource.ts";
 import type { DeclaredResource, ResourceProblem } from "./resources.ts";
+import { type sourceOps } from "./source.ts";
 export type { DriftField } from "./resource.ts";
 export { DRIFT_WORKFLOW } from "./shared.ts";
 /**
- * How a declared resource compares: `clean` when every declared field holds its declared value,
- * `drifted` when one does not, `gone` when the vendor has no such object, and `error` when it
- * could not be read (the vendor's error, a policy denial, or no driver for its type).
+ * How a declared resource compares: `clean` when every declared field of its bound object holds
+ * its declared value, `drifted` when one does not, `gone` when the vendor no longer has its bound
+ * object, `absent` when it is bound to none (whether or not its identity finds one: `found`), and
+ * `error` when it could not be read (the vendor's error, a policy denial, or no driver for its type).
  */
-export type DriftStatus = "clean" | "drifted" | "gone" | "error";
+export type DriftStatus = "clean" | "drifted" | "gone" | "absent" | "error";
 /** One declared resource in a drift report. */
 export interface DriftResult {
     /** The resource's id, `<file>#<export>`: `resources/identity/github.ts#website`. */
@@ -18,9 +20,13 @@ export interface DriftResult {
     /** Its type within the vendor, such as `repository`. */
     type: string;
     vendor: string;
-    /** Its import id. */
+    /** What people call it: its identity, else its export's name. */
     name: string;
     status: DriftStatus;
+    /** The vendor's id of the object the lockfile binds it to; absent when unbound. */
+    binding?: string;
+    /** For `absent`: the binding id of the object its identity found, which apply may bind it to. */
+    found?: string;
     /** The declared fields that differ; empty unless `drifted`. */
     fields: DriftField[];
     /** Why it could not be read, for `error`. */
@@ -47,7 +53,7 @@ export declare const DriftInput: z.ZodObject<{}, z.core.$strict>;
  * write-only values, and the problems.
  */
 export interface DriftDeclared {
-    resources: Pick<DeclaredResource, "id" | "vendor" | "type" | "name" | "desired" | "refs">[];
+    resources: Pick<DeclaredResource, "id" | "vendor" | "type" | "name" | "identity" | "binding" | "desired" | "refs">[];
     problems: ResourceProblem[];
 }
 type State = Record<string, unknown>;
@@ -58,18 +64,64 @@ type ImportOp = Op<string, string, "import", {
     gone: boolean;
     state?: State;
 }>;
+export type ResolveOp = typeof sourceOps.source.resolve;
+/** What one import found: the object's state, that it is gone, or why it could not be read. */
+export type Found = {
+    state: State;
+} | {
+    gone: true;
+} | {
+    error: string;
+};
+/** What a host's ref names now, or why it could not be resolved. */
+export type Revision = {
+    revision: string;
+} | {
+    error: string;
+};
+/** The `import` ops of the types among `ops` with a driver, by type, sorted: what observing them uses. */
+export declare function importsOf(types: ReadonlyMap<string, Resource>, ops: ReadonlyMap<string, Op>, drivers: ReadonlyMap<string, unknown>): ImportOp[];
+/**
+ * What a declared resource is observed by: the import id (`by`, default its binding, else its
+ * identity), or without one what it is found to be: `gone` for none, `error` when its type is
+ * not the connectors' or has no import among `imports`.
+ */
+export declare function observeBy({ vendor, type, binding, identity }: Pick<DeclaredResource, "vendor" | "type" | "binding" | "identity">, types: ReadonlyMap<string, Resource>, imports: readonly Pick<Op, "id">[], by?: string | undefined): {
+    id: string;
+} | Found;
+/** What an import's answer found. */
+export declare const observed: (out: {
+    gone: boolean;
+    state?: State;
+}) => Found;
+/**
+ * Each declared resource against what its import `found`: `error`, `absent` (unbound, with the
+ * binding id of what its identity found as `found`), `gone`, else the state and the declared
+ * fields compared by `diffDeclared`, a reference against the state of the resource it names
+ * (so GitHub's node id for a repository counts as its name). A host with a `revisions` entry
+ * also compares its revision against the commit its ref names now (or is that entry's `error`).
+ */
+export declare function compare(types: ReadonlyMap<string, Resource>, resources: DriftDeclared["resources"], found: ReadonlyMap<string, Found>, revisions?: ReadonlyMap<string, Revision>): DriftResult[];
 /**
  * The drift workflow for a config: it `uses` the `import` of every resource type the connectors
  * declare (`types`) that has a driver, so its version changes with them, not with the data
  * files. `resolveConfig` adds it to a config whose connectors declare resource types, with
  * `declared`, the step that reads the data files.
  *
- * A run reads the data files (`declared`, recorded as a step, so a replay checks the same list),
- * then imports each resource by its import id (its `name`), in the files' order: one vendor call
- * each. An import that says gone is `gone`. Else the state and the declared fields are compared
- * by `diffDeclared`, a reference against the state of the resource it names, read in the same run
- * (so GitHub's node id for a repository counts as its name). A failed call is that resource's
+ * A run reads the data files and the lockfile (`declared`, recorded as a step, so a replay checks
+ * the same list), then imports each resource by its binding, else by its identity, in the files'
+ * order: one vendor call each, none for a resource with neither. A bound resource whose import
+ * says gone is `gone`; an unbound one is `absent`, with the binding id of what its identity found
+ * as `found`. Else the state and the declared fields are compared by `diffDeclared`, a reference
+ * against the state of the resource it names, read in the same run (so GitHub's node id for a
+ * repository counts as its name). A failed call is that resource's
  * `error`, and the run goes on to the next; a failure that ends the run (`isRunControlError`)
  * ends it.
  */
-export declare function driftWorkflow(types: ReadonlyMap<string, Resource>, ops: ReadonlyMap<string, Op>, drivers: ReadonlyMap<string, unknown>, declared: () => Promise<DriftDeclared>): WorkflowDefinition<readonly ImportOp[], typeof DriftInput>;
+export declare function driftWorkflow(types: ReadonlyMap<string, Resource>, ops: ReadonlyMap<string, Op>, drivers: ReadonlyMap<string, unknown>, declared: () => Promise<DriftDeclared>): WorkflowDefinition<readonly (ImportOp | ResolveOp)[], typeof DriftInput>;
+/**
+ * A host's source: the clone URL its data file gives, or, when it names a declared repository
+ * (`target`), the first of the reference's `by` fields that holds one in that repository's state,
+ * read in this run.
+ */
+export declare function sourceUrl(desired: State, target: string | undefined, { host, fields }: Resource, found: ReadonlyMap<string, Found>): string | undefined;

package/dist/drift.js

@@ -1,39 +1,106 @@
 import { z } from "zod";
 import { defineWorkflow } from "./define.js";
 import { isRunControlError } from "./errors.js";
-import { diffDeclared } from "./resource.js";
+import { diffDeclared, fieldPathOf, valueAt } from "./resource.js";
 import { errorMessage } from "./shared.js";
+import { SOURCE_RESOLVE } from "./source.js";
 export { DRIFT_WORKFLOW } from "./shared.js";
 /**
  * The drift workflow's input: nothing. The run reads the data files itself, so a run says what
  * they declared when it ran, and no caller can hand it other resources to check.
  */
 export const DriftInput = z.object({}).strict();
+/** A clone URL (a scheme's, or scp-like `user@host:path`): what a `by` field of a host's source holds, told from an id. */
+const CLONE_URL = /^((https?|ssh|git|file):\/\/|[\w.-]+@[\w.-]+:)/;
+// What drift and apply share. Observing a resource is one `ctx` call, which a workflow makes in
+// its own `run` (the outline draws only those): `observeBy` says what each import is called with,
+// `observed` reads its answer, and `compare` turns what every import found into drift's results.
+/** The `import` ops of the types among `ops` with a driver, by type, sorted: what observing them uses. */
+export function importsOf(types, ops, drivers) {
+    return [...types.keys()].toSorted().flatMap((type) => {
+        const op = ops.get(`${type}.import`);
+        return op && drivers.has(op.id) ? [op] : [];
+    });
+}
+/**
+ * What a declared resource is observed by: the import id (`by`, default its binding, else its
+ * identity), or without one what it is found to be: `gone` for none, `error` when its type is
+ * not the connectors' or has no import among `imports`.
+ */
+export function observeBy({ vendor, type, binding, identity }, types, imports, by = binding ?? identity) {
+    const key = `${vendor}.${type}`;
+    if (!types.has(key))
+        return { error: `the config's connectors declare no resource type ${key}` };
+    if (!imports.some((op) => op.id === `${key}.import`))
+        return { error: `no driver for ${key}.import` };
+    return by === undefined ? { gone: true } : { id: by };
+}
+/** What an import's answer found. */
+export const observed = (out) => out.gone || !out.state ? { gone: true } : { state: out.state };
+/**
+ * Each declared resource against what its import `found`: `error`, `absent` (unbound, with the
+ * binding id of what its identity found as `found`), `gone`, else the state and the declared
+ * fields compared by `diffDeclared`, a reference against the state of the resource it names
+ * (so GitHub's node id for a repository counts as its name). A host with a `revisions` entry
+ * also compares its revision against the commit its ref names now (or is that entry's `error`).
+ */
+export function compare(types, resources, found, revisions = new Map()) {
+    return resources.map(({ id, vendor, type, name, binding, desired, refs }) => {
+        const row = { id, type, vendor, name, ...(binding !== undefined && { binding }) };
+        const now = found.get(id);
+        if ("error" in now)
+            return { ...row, status: "error", fields: [], error: now.error };
+        const resource = types.get(`${vendor}.${type}`);
+        if (binding === undefined) {
+            return {
+                ...row,
+                status: "absent",
+                fields: [],
+                ...("state" in now && { found: resource.bindingId(now.state) }),
+            };
+        }
+        if ("gone" in now)
+            return { ...row, status: "gone", fields: [] };
+        // Each reference, by where it is: the values the vendor may hold there for its resource.
+        const accept = {};
+        for (const [at, target] of Object.entries(refs)) {
+            const by = resource.fields.references?.[fieldPathOf(at)]?.by ?? [];
+            const named = found.get(target);
+            if (named && "state" in named)
+                accept[at] = by.map((field) => named.state[field]).filter((v) => v != null);
+        }
+        const fields = diffDeclared(resource, now.state, desired, accept);
+        const resolved = revisions.get(id);
+        if (resolved && "error" in resolved)
+            return { ...row, status: "error", fields: [], error: resolved.error };
+        // A host whose state does not say which commit it runs is not compared.
+        const actual = resource.host?.outputs(now.state).revision;
+        if (resolved && actual !== undefined && actual !== resolved.revision) {
+            fields.push({ path: resource.host.revision, desired: resolved.revision, actual });
+        }
+        return { ...row, status: fields.length ? "drifted" : "clean", fields };
+    });
+}
 /**
  * The drift workflow for a config: it `uses` the `import` of every resource type the connectors
  * declare (`types`) that has a driver, so its version changes with them, not with the data
  * files. `resolveConfig` adds it to a config whose connectors declare resource types, with
  * `declared`, the step that reads the data files.
  *
- * A run reads the data files (`declared`, recorded as a step, so a replay checks the same list),
- * then imports each resource by its import id (its `name`), in the files' order: one vendor call
- * each. An import that says gone is `gone`. Else the state and the declared fields are compared
- * by `diffDeclared`, a reference against the state of the resource it names, read in the same run
- * (so GitHub's node id for a repository counts as its name). A failed call is that resource's
+ * A run reads the data files and the lockfile (`declared`, recorded as a step, so a replay checks
+ * the same list), then imports each resource by its binding, else by its identity, in the files'
+ * order: one vendor call each, none for a resource with neither. A bound resource whose import
+ * says gone is `gone`; an unbound one is `absent`, with the binding id of what its identity found
+ * as `found`. Else the state and the declared fields are compared by `diffDeclared`, a reference
+ * against the state of the resource it names, read in the same run (so GitHub's node id for a
+ * repository counts as its name). A failed call is that resource's
  * `error`, and the run goes on to the next; a failure that ends the run (`isRunControlError`)
  * ends it.
  */
 export function driftWorkflow(types, ops, drivers, declared) {
-    const uses = [...types.keys()].toSorted().flatMap((type) => {
-        const op = ops.get(`${type}.import`);
-        return op && drivers.has(op.id) ? [op] : [];
-    });
-    // Why a resource of each type cannot be read, if it cannot.
-    const unreadable = new Map();
-    for (const type of types.keys()) {
-        if (!uses.some((op) => op.id === `${type}.import`))
-            unreadable.set(type, `no driver for ${type}.import`);
-    }
+    const imports = importsOf(types, ops, drivers);
+    const resolve = ops.get(SOURCE_RESOLVE);
+    const uses = [...imports, ...(resolve ? [resolve] : [])];
     return defineWorkflow({
         // The literal, held to the one name: the outline finds a workflow by a string, or a const of its own file.
         name: "drift",
@@ -46,45 +113,55 @@ export function driftWorkflow(types, ops, drivers, declared) {
             const { resources, problems } = await declared();
             // Every import first, so a reference compares against what its resource holds now.
             const found = new Map();
-            for (const { id, vendor, type, name } of resources) {
-                const key = `${vendor}.${type}`;
-                const why = types.has(key) ? unreadable.get(key) : `the config's connectors declare no resource type ${key}`;
+            for (const resource of resources) {
+                const by = observeBy(resource, types, imports);
                 // An if/else, not a `continue`: the outline draws the import as the way past the error.
-                if (why !== undefined)
-                    found.set(id, { error: why });
+                if (!("id" in by))
+                    found.set(resource.id, by);
                 else {
                     try {
-                        const out = await ctx[vendor][type].import({ id: name });
-                        found.set(id, out.gone || !out.state ? { gone: true } : { state: out.state });
+                        found.set(resource.id, observed(await ctx[resource.vendor][resource.type].import({ id: by.id })));
                     }
                     catch (err) {
                         if (isRunControlError(err))
                             throw err;
-                        found.set(id, { error: errorMessage(err) });
+                        found.set(resource.id, { error: errorMessage(err) });
                     }
                 }
             }
-            const results = resources.map(({ id, vendor, type, name, desired, refs }) => {
-                const row = { id, type, vendor, name };
-                const now = found.get(id);
-                if ("error" in now)
-                    return { ...row, status: "error", fields: [], error: now.error };
-                if ("gone" in now)
-                    return { ...row, status: "gone", fields: [] };
+            // A host's revision against the commit its ref names now: a merge is drift on the host.
+            const revisions = new Map();
+            for (const { id, vendor, type, desired, refs } of resources) {
                 const resource = types.get(`${vendor}.${type}`);
-                // Each reference, by where it is: the values the vendor may hold there for its resource.
-                const accept = {};
-                for (const [at, target] of Object.entries(refs)) {
-                    const by = resource.fields.references?.[at.replaceAll(/\.\d+(?=\.|$)/g, "")]?.by ?? [];
-                    const named = found.get(target);
-                    if (named && "state" in named)
-                        accept[at] = by.map((field) => named.state[field]).filter((v) => v != null);
+                const host = resource?.host;
+                const source = host && sourceUrl(desired, refs[host.inputs.source], resource, found);
+                const ref = host && valueAt(desired, host.inputs.ref);
+                if (host && "state" in found.get(id) && source !== undefined && typeof ref === "string" && ref) {
+                    try {
+                        revisions.set(id, await ctx.sanoma.source.resolve({ url: source, ref }));
+                    }
+                    catch (err) {
+                        if (isRunControlError(err))
+                            throw err;
+                        revisions.set(id, { error: errorMessage(err) });
+                    }
                 }
-                const fields = diffDeclared(resource, now.state, desired, accept);
-                return { ...row, status: fields.length ? "drifted" : "clean", fields };
-            });
+            }
+            const results = compare(types, resources, found, revisions);
             return { startedAt, finishedAt: await ctx.now(), problems, resources: results };
         },
     });
 }
+/**
+ * A host's source: the clone URL its data file gives, or, when it names a declared repository
+ * (`target`), the first of the reference's `by` fields that holds one in that repository's state,
+ * read in this run.
+ */
+export function sourceUrl(desired, target, { host, fields }, found) {
+    const path = host.inputs.source;
+    const named = target === undefined ? undefined : found.get(target);
+    const by = fields.references?.[path]?.by ?? [];
+    const values = target === undefined ? [valueAt(desired, path)] : named && "state" in named ? by.map((f) => named.state[f]) : [];
+    return values.find((v) => typeof v === "string" && CLONE_URL.test(v));
+}
 //# sourceMappingURL=drift.js.map

package/dist/drift.js.map

@@ -1 +1 @@
-{"version":3,"file":"drift.js","sourceRoot":"","sources":["../src/drift.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA2B,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAmB,YAAY,EAAiB,MAAM,eAAe,CAAC;AAE7E,OAAO,EAAuB,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAyC7C;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAmBhD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAoC,EACpC,GAA4B,EAC5B,OAAqC,EACrC,QAAsC;IAEtC,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACzD,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC;QACrC,OAAO,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,4DAA4D;IAC5D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,SAAS,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,IAAI,SAAS,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,2GAA2G;QAC3G,IAAI,EAAE,OAAuC;QAC7C,KAAK,EAAE,2BAA2B;QAClC,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,UAAU;QACjB,IAAI;QACJ,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjD,mFAAmF;YACnF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;YACvC,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;gBACnD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oDAAoD,GAAG,EAAE,CAAC;gBAC7G,wFAAwF;gBACxF,IAAI,GAAG,KAAK,SAAS;oBAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;qBAChD,CAAC;oBACJ,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAE,CAAC,IAAI,CAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC3D,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;oBAChF,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,iBAAiB,CAAC,GAAG,CAAC;4BAAE,MAAM,GAAG,CAAC;wBACtC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAe,EAAE;gBACvF,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACvC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;gBAC3B,IAAI,OAAO,IAAI,GAAG;oBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;gBACrF,IAAI,MAAM,IAAI,GAAG;oBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;gBACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAE,CAAC;gBACjD,yFAAyF;gBACzF,MAAM,MAAM,GAA8B,EAAE,CAAC;gBAC7C,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;oBACvF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAChC,IAAI,KAAK,IAAI,OAAO,IAAI,KAAK;wBAAE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;gBAC7G,CAAC;gBACD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAClE,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACzE,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAwB,CAAC;QACxG,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"drift.js","sourceRoot":"","sources":["../src/drift.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA2B,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAmB,YAAY,EAAE,WAAW,EAAiB,OAAO,EAAE,MAAM,eAAe,CAAC;AAEnG,OAAO,EAAuB,YAAY,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,cAAc,EAAkB,MAAM,aAAa,CAAC;AAG7D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA8C7C;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAkBhD,2HAA2H;AAC3H,MAAM,SAAS,GAAG,gDAAgD,CAAC;AAOnE,gGAAgG;AAChG,kGAAkG;AAClG,iGAAiG;AAEjG,0GAA0G;AAC1G,MAAM,UAAU,SAAS,CACvB,KAAoC,EACpC,GAA4B,EAC5B,OAAqC;IAErC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACnD,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC;QACrC,OAAO,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAsE,EACvG,KAAoC,EACpC,OAAkC,EAClC,EAAE,GAAG,OAAO,IAAI,QAAQ;IAExB,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,oDAAoD,GAAG,EAAE,EAAE,CAAC;IACjG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,GAAG,SAAS,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,GAAG,SAAS,EAAE,CAAC;IACtG,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,qCAAqC;AACrC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAqC,EAAS,EAAE,CACvE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CACrB,KAAoC,EACpC,SAAqC,EACrC,KAAiC,EACjC,SAAS,GAAkC,IAAI,GAAG,EAAE;IAEpD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAe,EAAE;QACvF,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAClF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;QAC3B,IAAI,OAAO,IAAI,GAAG;YAAE,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QACrF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAE,CAAC;QACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO;gBACL,GAAG,GAAG;gBACN,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,EAAE;gBACV,GAAG,CAAC,OAAO,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjE,yFAAyF;QACzF,MAAM,MAAM,GAA8B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,KAAK,IAAI,OAAO,IAAI,KAAK;gBAAE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,QAAQ,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC3G,wEAAwE;QACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;QAC1D,IAAI,QAAQ,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAoC,EACpC,GAA4B,EAC5B,OAAqC,EACrC,QAAsC;IAEtC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,cAAc,CAA0B,CAAC;IACjE,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,cAAc,CAAC;QACpB,2GAA2G;QAC3G,IAAI,EAAE,OAAuC;QAC7C,KAAK,EAAE,2BAA2B;QAClC,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,UAAU;QACjB,IAAI;QACJ,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjD,mFAAmF;YACnF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;YACvC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC/C,wFAAwF;gBACxF,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;qBACzC,CAAC;oBACJ,IAAI,CAAC;wBACH,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAE,CAAC,QAAQ,CAAC,IAAI,CAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;oBACtG,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,iBAAiB,CAAC,GAAG,CAAC;4BAAE,MAAM,GAAG,CAAC;wBACtC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,wFAAwF;YACxF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC9C,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;gBAChD,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC;gBAC5B,MAAM,MAAM,GAAG,IAAI,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACrF,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAE,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,EAAE,CAAC;oBAChG,IAAI,CAAC;wBACH,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,MAAO,CAAC,MAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC7E,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,iBAAiB,CAAC,GAAG,CAAC;4BAAE,MAAM,GAAG,CAAC;wBACtC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAC5D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAwB,CAAC;QACxG,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,OAAc,EACd,MAA0B,EAC1B,EAAE,IAAI,EAAE,MAAM,EAAY,EAC1B,KAAiC;IAEjC,MAAM,IAAI,GAAG,IAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,MAAM,GACV,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC"}

package/dist/errors.d.ts

@@ -1,6 +1,6 @@
 import type { z } from "zod";
 import type { Principal } from "./define.ts";
-declare const CODES: readonly ["policy_denied", "approval_rejected", "not_approver", "no_pending_approval", "already_decided", "run_not_found", "driver_failed", "invalid_input", "run_ended", "run_running", "call_not_in_outline"];
+declare const CODES: readonly ["policy_denied", "approval_rejected", "not_approver", "no_pending_approval", "already_decided", "run_not_found", "driver_failed", "invalid_input", "run_ended", "run_running", "call_not_in_outline", "approval_pending", "not_admitted"];
 /**
  * Why something failed, as a stable string a caller can branch on. Messages are for people
  * and may change; codes are the contract.
@@ -37,6 +37,21 @@ export declare const isRunControlError: (err: unknown) => boolean;
 export declare class PolicyDeniedError extends SanomaError {
     constructor(op: string, reason: string);
 }
+/**
+ * Thrown by a direct call (`SanomaClient.call`) the policy holds for an approval: the call is now
+ * run `runId` of the built-in `call` workflow, which makes it once approved.
+ */
+export declare class ApprovalPendingError extends SanomaError {
+    constructor(op: string, runId: string);
+}
+/**
+ * Thrown when the data files declare people (`sanoma.person`, in `resources/people.ts` by
+ * convention) and not this principal's id: nothing is started, called or decided.
+ */
+export declare class NotAdmittedError extends SanomaError {
+    /** `problems`: what is wrong in the people's files, while nobody is admitted. */
+    constructor(id: string, problems?: readonly string[]);
+}
 /** Thrown into the run when an approver rejects. The run fails with it. */
 export declare class RejectedError extends SanomaError {
     /**

package/dist/errors.js

@@ -1,5 +1,5 @@
 import { Error as DBOSErrors } from "@dbos-inc/dbos-sdk";
-import { errorMessage } from "./shared.js";
+import { CALL_WORKFLOW, errorMessage } from "./shared.js";
 const CODES = [
     "policy_denied",
     "approval_rejected",
@@ -12,6 +12,8 @@ const CODES = [
     "run_ended",
     "run_running",
     "call_not_in_outline",
+    "approval_pending",
+    "not_admitted",
 ];
 const KNOWN = new Set(CODES);
 /**
@@ -61,6 +63,33 @@ export class PolicyDeniedError extends SanomaError {
         this.name = "PolicyDeniedError";
     }
 }
+/**
+ * Thrown by a direct call (`SanomaClient.call`) the policy holds for an approval: the call is now
+ * run `runId` of the built-in `call` workflow, which makes it once approved.
+ */
+export class ApprovalPendingError extends SanomaError {
+    constructor(op, runId) {
+        super("approval_pending", `${op} needs an approval: it waits in run ${runId}`, {
+            runId,
+            workflow: CALL_WORKFLOW,
+            op,
+        });
+        this.name = "ApprovalPendingError";
+    }
+}
+/**
+ * Thrown when the data files declare people (`sanoma.person`, in `resources/people.ts` by
+ * convention) and not this principal's id: nothing is started, called or decided.
+ */
+export class NotAdmittedError extends SanomaError {
+    /** `problems`: what is wrong in the people's files, while nobody is admitted. */
+    constructor(id, problems = []) {
+        super("not_admitted", problems.length
+            ? `${id} cannot be admitted while the people's files have problems: ${problems.join("; ")}`
+            : `${id} is not declared in resources/people.ts`, { principal: id, ...(problems.length && { problems }) });
+        this.name = "NotAdmittedError";
+    }
+}
 /** Thrown into the run when an approver rejects. The run fails with it. */
 export class RejectedError extends SanomaError {
     /**

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGzD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,KAAK,GAAG;IACZ,eAAe;IACf,mBAAmB;IACnB,cAAc;IACd,qBAAqB;IACrB,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,eAAe;IACf,WAAW;IACX,aAAa;IACb,qBAAqB;CACb,CAAC;AAQX,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAC;AAErC;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,CAAY;IAChB,IAAI,CAA0B;IAEvC,YAAY,IAAe,EAAE,OAAe,EAAE,IAAI,GAA4B,EAAE,EAAE,OAAsB;QACtG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,UAAU,SAAS,CAAC,CAAU;IAClC,MAAM,IAAI,GAAG,GAAG,CAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAY,EAAW,EAAE,CAAE,GAAsC,EAAE,SAAS,KAAK,KAAK,CAAC;AAE/G,2DAA2D;AAC3D,MAAM,UAAU,MAAM,CAAC,GAAY;IACjC,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,YAAY,KAAK,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAAW,EAAE,CACzD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,UAAU,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC;AAE7F,2FAA2F;AAC3F,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IAChD,YAAY,EAAU,EAAE,MAAc;QACpC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,0BAA0B,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,aAAc,SAAQ,WAAW;IAC5C;;;;OAIG;IACH,YAAY,KAAa,EAAE,EAAa,EAAE,IAAwB,EAAE,UAAkB;QACpF,KAAK,CAAC,mBAAmB,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YAC1F,KAAK;YACL,EAAE;YACF,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAkB,OAAU,EAAE,QAAiB;IACrE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,CAA0B,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AASD,qGAAqG;AACrG,MAAM,UAAU,YAAY,CAC1B,MAAS,EACT,KAAc,EACd,IAAY,EACZ,IAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,SAA4E,EAC5E,IAAI,GAA4B,EAAE;IAElC,MAAM,MAAM,GAAiB,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrE,OAAO;QACP,IAAI;KACL,CAAC,CAAC,CAAC;IACJ,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7G,OAAO,IAAI,WAAW,CAAC,eAAe,EAAE,GAAG,IAAI,KAAK,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACnF,CAAC;AAqBD,oHAAoH;AACpH,SAAS,GAAG,CAAI,GAAY,EAAE,GAAW,EAAE,IAAgD;IACzF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,KAAK,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAA2B,EAAE,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC;AAC7E,MAAM,WAAW,GAAG,CAAC,IAA2B,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;AACxE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,IAAI,GAAG;IACX,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC;IAChC,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC;IACpC,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC;IACjC,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC;CACvB,CAAC;AAEX,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAc;QACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QAC/C,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC;KAC3B,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGzD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,KAAK,GAAG;IACZ,eAAe;IACf,mBAAmB;IACnB,cAAc;IACd,qBAAqB;IACrB,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,eAAe;IACf,WAAW;IACX,aAAa;IACb,qBAAqB;IACrB,kBAAkB;IAClB,cAAc;CACN,CAAC;AAQX,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAC;AAErC;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,CAAY;IAChB,IAAI,CAA0B;IAEvC,YAAY,IAAe,EAAE,OAAe,EAAE,IAAI,GAA4B,EAAE,EAAE,OAAsB;QACtG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,UAAU,SAAS,CAAC,CAAU;IAClC,MAAM,IAAI,GAAG,GAAG,CAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAY,EAAW,EAAE,CAAE,GAAsC,EAAE,SAAS,KAAK,KAAK,CAAC;AAE/G,2DAA2D;AAC3D,MAAM,UAAU,MAAM,CAAC,GAAY;IACjC,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,YAAY,KAAK,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAAW,EAAE,CACzD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,UAAU,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC;AAE7F,2FAA2F;AAC3F,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IAChD,YAAY,EAAU,EAAE,MAAc;QACpC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,0BAA0B,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,WAAW;IACnD,YAAY,EAAU,EAAE,KAAa;QACnC,KAAK,CAAC,kBAAkB,EAAE,GAAG,EAAE,uCAAuC,KAAK,EAAE,EAAE;YAC7E,KAAK;YACL,QAAQ,EAAE,aAAa;YACvB,EAAE;SACH,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,WAAW;IAC/C,iFAAiF;IACjF,YAAY,EAAU,EAAE,QAAQ,GAAsB,EAAE;QACtD,KAAK,CACH,cAAc,EACd,QAAQ,CAAC,MAAM;YACb,CAAC,CAAC,GAAG,EAAE,+DAA+D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC3F,CAAC,CAAC,GAAG,EAAE,yCAAyC,EAClD,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CACxD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,aAAc,SAAQ,WAAW;IAC5C;;;;OAIG;IACH,YAAY,KAAa,EAAE,EAAa,EAAE,IAAwB,EAAE,UAAkB;QACpF,KAAK,CAAC,mBAAmB,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YAC1F,KAAK;YACL,EAAE;YACF,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAkB,OAAU,EAAE,QAAiB;IACrE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,CAA0B,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AASD,qGAAqG;AACrG,MAAM,UAAU,YAAY,CAC1B,MAAS,EACT,KAAc,EACd,IAAY,EACZ,IAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,SAA4E,EAC5E,IAAI,GAA4B,EAAE;IAElC,MAAM,MAAM,GAAiB,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrE,OAAO;QACP,IAAI;KACL,CAAC,CAAC,CAAC;IACJ,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7G,OAAO,IAAI,WAAW,CAAC,eAAe,EAAE,GAAG,IAAI,KAAK,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACnF,CAAC;AAqBD,oHAAoH;AACpH,SAAS,GAAG,CAAI,GAAY,EAAE,GAAW,EAAE,IAAgD;IACzF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,KAAK,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAA2B,EAAE,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC;AAC7E,MAAM,WAAW,GAAG,CAAC,IAA2B,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;AACxE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,IAAI,GAAG;IACX,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC;IAChC,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC;IACpC,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC;IACjC,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC;CACvB,CAAC;AAEX,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAc;QACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QAC/C,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC;KAC3B,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/expectations.d.ts

@@ -16,10 +16,10 @@ type Unstepped<T> = T extends unknown ? Omit<T, "step"> : never;
  * Why an expectation of the generic steps does not hold against a run's ledger records, or
  * undefined when it does. A call is an `op.called` record without an `error`; one with an error
  * (a policy denial, a rejected approval, a vendor's final failure) was attempted, not made. An
- * operation `was denied` when the policy's decision on some call to it is `deny`, and `was held
- * for` an approver when an approval for that approver holds it: one the policy asked for on its
- * call, or one that `covers` it. A drift expectation reads the report a finished drift run
- * returned. A step named in the workflow's outline is read by the `name` its records carry
+ * operation `was denied` when the policy's decision on some call to it is `deny` (for the `reason`
+ * expected, when there is one), and `was held for` an approver (a group alone, as `{ group }`) when
+ * an approval for that approver holds it: one the policy asked for on its call, or one that `covers` it. A drift or apply expectation reads the report a finished run
+ * of it returned. A step named in the workflow's outline is read by the `name` its records carry
  * (its calls made, and `waitsOf`); a record written before steps had names has none.
  */
 export declare function detailOf(e: CoreExpectation, records: readonly LedgerRecord[]): string | undefined;

package/dist/expectations.js

@@ -54,8 +54,12 @@ const inputs = (list) => list.map((r) => JSON.stringify(r.input)).join(", ");
 const words = (d) => d.kind === "allow" ? "allowed" : d.kind === "deny" ? "denied" : `held for ${approverLabel(d.approver)}`;
 /** What the policy decided for the calls, each decision once: `allowed and held for finance`. */
 const decisions = (calls) => [...new Set(calls.map((r) => words(r.decision)))].join(" and ");
-/** True when `who` names the approver: a person by id, or a group by its name. */
-const isApprover = (approver, who) => typeof approver === "string" ? approver === who : approver.group === who;
+/** True when `who` names the approver: a person by id, or a group by its name; `{ group }` the group alone. */
+const isApprover = (approver, who) => typeof who !== "string"
+    ? typeof approver !== "string" && approver.group === who.group
+    : typeof approver === "string"
+        ? approver === who
+        : approver.group === who;
 /** How a drift report found a resource, as words: `clean`, `gone`, `drifted in has_wiki, topics`. */
 const found = (r) => r.status === "drifted" ? `drifted in ${r.fields.map((f) => f.path).join(", ")}` : r.status;
 /**
@@ -77,14 +81,37 @@ function driftDetail(e, end) {
         return undefined;
     return `${e.declared} is ${found(resource)}, not ${e.status === "drifted" ? `drifted in ${e.field}` : e.status}`;
 }
+/**
+ * Why an apply expectation fails against the report a finished apply run returned as its output:
+ * the resource `created` (a step that created it, done), or `bound` to an object in the lockfile it ended with.
+ */
+function applyDetail(e, end) {
+    const report = end.output;
+    if (!Array.isArray(report?.results) || !report.lockfile)
+        return "the run's output is not an apply report";
+    if ("bound" in e) {
+        const binding = report.lockfile.bindings[e.declared];
+        if (binding?.id === e.bound)
+            return undefined;
+        return binding ? `${e.declared} is bound to ${binding.id}, not ${e.bound}` : `${e.declared} is not bound`;
+    }
+    const result = report.results.find((r) => r.id === e.declared);
+    // A gone object recreated is bound again; one forgotten is not.
+    const created = result?.status === "done" && (result.action === "create" || (result.action === "gone" && !!result.binding));
+    if (created)
+        return undefined;
+    if (!result)
+        return `apply did nothing with ${e.declared}`;
+    return `apply's ${result.action} of ${e.declared} ${result.status === "failed" ? `failed: ${result.error}` : `was ${result.status}`}`;
+}
 /**
  * Why an expectation of the generic steps does not hold against a run's ledger records, or
  * undefined when it does. A call is an `op.called` record without an `error`; one with an error
  * (a policy denial, a rejected approval, a vendor's final failure) was attempted, not made. An
- * operation `was denied` when the policy's decision on some call to it is `deny`, and `was held
- * for` an approver when an approval for that approver holds it: one the policy asked for on its
- * call, or one that `covers` it. A drift expectation reads the report a finished drift run
- * returned. A step named in the workflow's outline is read by the `name` its records carry
+ * operation `was denied` when the policy's decision on some call to it is `deny` (for the `reason`
+ * expected, when there is one), and `was held for` an approver (a group alone, as `{ group }`) when
+ * an approval for that approver holds it: one the policy asked for on its call, or one that `covers` it. A drift or apply expectation reads the report a finished run
+ * of it returned. A step named in the workflow's outline is read by the `name` its records carry
  * (its calls made, and `waitsOf`); a record written before steps had names has none.
  */
 export function detailOf(e, records) {
@@ -96,15 +123,20 @@ export function detailOf(e, records) {
     if ("decision" in e) {
         const tries = callsTo(e.op);
         if (e.decision === "denied") {
-            if (tries.some((r) => r.decision.kind === "deny"))
+            const denials = tries.flatMap(({ decision: d }) => (d.kind === "deny" ? [d.reason] : []));
+            if (denials.some((reason) => e.reason === undefined || reason === e.reason))
                 return undefined;
+            if (denials.length) {
+                const said = [...new Set(denials)].map((reason) => JSON.stringify(reason)).join(" and ");
+                return `${e.op} was denied with ${said}, not ${JSON.stringify(e.reason)}`;
+            }
             return tries.length ? `${e.op} was ${decisions(tries)}, not denied` : `no call to ${e.op}`;
         }
         const holds = records.filter(isRequest).filter((r) => r.op === e.op || r.covers.includes(e.op));
         if (holds.some((r) => isApprover(r.approver, e.approver)))
             return undefined;
         return holds.length
-            ? `${e.op} was held for ${[...new Set(holds.map((r) => approverLabel(r.approver)))].join(" and ")}, not ${e.approver}`
+            ? `${e.op} was held for ${[...new Set(holds.map((r) => approverLabel(r.approver)))].join(" and ")}, not ${approverLabel(e.approver)}`
             : tries.length
                 ? `${e.op} was ${decisions(tries)}, not held`
                 : `no call to ${e.op}`;
@@ -132,6 +164,8 @@ export function detailOf(e, records) {
     // A finished run: what `the run succeeds` expects, and what a drift expectation reads its report from.
     if (end.type === "run.failed")
         return `the run failed: ${end.error.message}`;
-    return "declared" in e ? driftDetail(e, end) : undefined;
+    if (!("declared" in e))
+        return undefined;
+    return "status" in e ? driftDetail(e, end) : applyDetail(e, end);
 }
 //# sourceMappingURL=expectations.js.map