@xoxoai/checkmate 0.6.7 → 0.7.0

package/plugin/src/store.ts

@@ -0,0 +1,384 @@
+import type { SQLInputValue } from 'node:sqlite'
+import { DatabaseSync } from 'node:sqlite'
+import { createHash, randomBytes } from 'node:crypto'
+import { mkdirSync, rmdirSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+
+export type Status =
+	'completed' | 'needs_decision' | 'interrupted' | 'operational_error' | 'rejected' | 'invalid_request'
+export type Reply = { status: Status; subject: string; reasons: string[]; data: Record<string, unknown> }
+export type Change = { reply: Reply; subjects: string[] }
+export type Store = { db: DatabaseSync; workspace: string; path: string }
+export type Operation = { actor: string | undefined; command: string; subject: string; input: unknown }
+
+export const contractVersion = 'toolkit-2'
+const schemaVersion = '2'
+
+const operationReference = 'REFERENCES operations(id) DEFERRABLE INITIALLY DEFERRED'
+const tables = `
+CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL) STRICT;
+CREATE TABLE operations (
+	id TEXT PRIMARY KEY,
+	at TEXT NOT NULL,
+	actor TEXT NOT NULL,
+	command TEXT NOT NULL,
+	arguments TEXT NOT NULL,
+	status TEXT NOT NULL,
+	response TEXT NOT NULL,
+	subjects TEXT NOT NULL
+) STRICT;
+CREATE TABLE blobs (sha256 TEXT PRIMARY KEY, size INTEGER NOT NULL, bytes BLOB NOT NULL) STRICT;
+CREATE TABLE target_requests (
+	target_id TEXT PRIMARY KEY,
+	body TEXT NOT NULL,
+	operation_id TEXT NOT NULL ${operationReference}
+) STRICT;
+CREATE TABLE profiles (
+	target_id TEXT NOT NULL REFERENCES target_requests(target_id),
+	revision INTEGER NOT NULL,
+	sha256 TEXT NOT NULL,
+	body TEXT NOT NULL,
+	operation_id TEXT NOT NULL ${operationReference},
+	PRIMARY KEY (target_id, revision)
+) STRICT;
+CREATE TABLE plan_requests (
+	plan_id TEXT PRIMARY KEY,
+	target_id TEXT NOT NULL,
+	target_revision INTEGER NOT NULL,
+	body TEXT NOT NULL,
+	operation_id TEXT NOT NULL ${operationReference},
+	FOREIGN KEY (target_id, target_revision) REFERENCES profiles(target_id, revision)
+) STRICT;
+CREATE TABLE plan_revisions (
+	plan_id TEXT NOT NULL REFERENCES plan_requests(plan_id),
+	revision INTEGER NOT NULL,
+	previous_revision INTEGER,
+	sha256 TEXT NOT NULL,
+	body TEXT NOT NULL,
+	operation_id TEXT NOT NULL ${operationReference},
+	PRIMARY KEY (plan_id, revision),
+	CHECK ((revision = 1 AND previous_revision IS NULL) OR previous_revision = revision - 1)
+) STRICT;
+CREATE TABLE decisions (
+	id TEXT PRIMARY KEY,
+	plan_id TEXT NOT NULL,
+	base_revision INTEGER NOT NULL,
+	gap_id TEXT NOT NULL,
+	kind TEXT NOT NULL,
+	value TEXT NOT NULL,
+	source TEXT,
+	rationale TEXT NOT NULL,
+	actor TEXT NOT NULL,
+	applied_revision INTEGER,
+	operation_id TEXT NOT NULL ${operationReference},
+	FOREIGN KEY (plan_id, base_revision) REFERENCES plan_revisions(plan_id, revision),
+	UNIQUE (plan_id, base_revision, gap_id)
+) STRICT;
+CREATE TABLE approvals (
+	id TEXT PRIMARY KEY,
+	subject_kind TEXT NOT NULL,
+	subject_id TEXT NOT NULL,
+	subject_sha256 TEXT NOT NULL,
+	verdict TEXT NOT NULL,
+	rationale TEXT NOT NULL,
+	actor TEXT NOT NULL,
+	operation_id TEXT NOT NULL ${operationReference}
+) STRICT;
+CREATE TABLE runs (
+	run_id TEXT PRIMARY KEY,
+	plan_id TEXT NOT NULL,
+	plan_revision INTEGER NOT NULL,
+	plan_sha256 TEXT NOT NULL,
+	target_id TEXT NOT NULL,
+	target_revision INTEGER NOT NULL,
+	application_build TEXT NOT NULL,
+	request TEXT NOT NULL,
+	started_at TEXT NOT NULL,
+	browser_session TEXT NOT NULL,
+	deadline_seconds INTEGER NOT NULL,
+	operation_id TEXT NOT NULL ${operationReference},
+	FOREIGN KEY (plan_id, plan_revision) REFERENCES plan_revisions(plan_id, revision),
+	FOREIGN KEY (target_id, target_revision) REFERENCES profiles(target_id, revision)
+) STRICT;
+CREATE TABLE run_attempts (
+	run_id TEXT NOT NULL REFERENCES runs(run_id),
+	attempt INTEGER NOT NULL,
+	started_at TEXT NOT NULL,
+	actor TEXT NOT NULL,
+	PRIMARY KEY (run_id, attempt)
+) STRICT;
+CREATE TABLE assertion_results (
+	run_id TEXT NOT NULL REFERENCES runs(run_id),
+	test_id TEXT NOT NULL,
+	assertion_id TEXT NOT NULL,
+	attempt INTEGER NOT NULL,
+	result TEXT NOT NULL,
+	observed TEXT,
+	reason TEXT,
+	recorded_at TEXT NOT NULL,
+	operation_id TEXT NOT NULL ${operationReference},
+	PRIMARY KEY (run_id, test_id, assertion_id),
+	FOREIGN KEY (run_id, attempt) REFERENCES run_attempts(run_id, attempt)
+) STRICT;
+CREATE TABLE outcomes (
+	run_id TEXT NOT NULL REFERENCES runs(run_id),
+	test_id TEXT NOT NULL,
+	attempt INTEGER NOT NULL,
+	outcome TEXT NOT NULL,
+	reason TEXT,
+	recorded_at TEXT NOT NULL,
+	operation_id TEXT NOT NULL ${operationReference},
+	PRIMARY KEY (run_id, test_id),
+	FOREIGN KEY (run_id, attempt) REFERENCES run_attempts(run_id, attempt)
+) STRICT;
+CREATE TABLE evidence (
+	id TEXT PRIMARY KEY,
+	run_id TEXT NOT NULL REFERENCES runs(run_id),
+	test_id TEXT NOT NULL,
+	assertion_id TEXT,
+	kind TEXT NOT NULL,
+	name TEXT NOT NULL,
+	media_type TEXT NOT NULL,
+	sha256 TEXT NOT NULL REFERENCES blobs(sha256),
+	operation_id TEXT NOT NULL ${operationReference}
+) STRICT;
+CREATE TABLE findings (
+	id TEXT NOT NULL,
+	run_id TEXT NOT NULL REFERENCES runs(run_id),
+	body TEXT NOT NULL,
+	operation_id TEXT NOT NULL ${operationReference},
+	PRIMARY KEY (run_id, id)
+) STRICT;
+CREATE TABLE run_gaps (
+	id TEXT NOT NULL,
+	run_id TEXT NOT NULL REFERENCES runs(run_id),
+	body TEXT NOT NULL,
+	operation_id TEXT NOT NULL ${operationReference},
+	PRIMARY KEY (run_id, id)
+) STRICT;
+CREATE TABLE results (
+	run_id TEXT PRIMARY KEY REFERENCES runs(run_id),
+	completion TEXT NOT NULL,
+	coverage TEXT NOT NULL,
+	finished_at TEXT NOT NULL,
+	sha256 TEXT NOT NULL,
+	body TEXT NOT NULL,
+	operation_id TEXT NOT NULL ${operationReference}
+) STRICT;
+CREATE VIEW latest_plans AS
+	SELECT p.* FROM plan_revisions p
+	WHERE p.revision = (SELECT max(revision) FROM plan_revisions WHERE plan_id = p.plan_id);
+CREATE VIEW plan_tests AS
+	SELECT p.plan_id, p.revision, t.value ->> '$.id' AS test_id, t.value AS test
+	FROM plan_revisions p, json_each(p.body, '$.tests') t;
+CREATE VIEW plan_gaps AS
+	SELECT p.plan_id, p.revision, g.value ->> '$.id' AS gap_id,
+		g.value ->> '$.status' AS status, g.value ->> '$.severity' AS severity, g.value AS gap
+	FROM plan_revisions p, json_each(p.body, '$.gaps') g;
+`
+const tableNames = [...tables.matchAll(/CREATE TABLE (\w+)/g)].map((match) => match[1])
+const decisionColumns = [
+	'id',
+	'plan_id',
+	'base_revision',
+	'gap_id',
+	'kind',
+	'value',
+	'source',
+	'rationale',
+	'actor',
+	'operation_id',
+]
+function updateTrigger(table: string) {
+	if (table === 'decisions')
+		return `CREATE TRIGGER decisions_update BEFORE UPDATE ON decisions
+	WHEN OLD.applied_revision IS NOT NULL OR NEW.applied_revision IS NULL OR ${decisionColumns
+		.map((column) => `NEW.${column} IS NOT OLD.${column}`)
+		.join(' OR ')}
+	BEGIN SELECT RAISE(ABORT, 'Decisions are immutable. Only applied_revision can change, once, from NULL'); END;`
+	if (table === 'plan_revisions')
+		return `CREATE TRIGGER plan_revisions_update BEFORE UPDATE ON plan_revisions
+	WHEN NEW.plan_id IS NOT OLD.plan_id OR NEW.revision IS NOT OLD.revision
+		OR NEW.previous_revision IS NOT OLD.previous_revision
+		OR EXISTS (SELECT 1 FROM approvals WHERE subject_kind = 'plan'
+			AND subject_id = OLD.plan_id || '@' || OLD.revision AND verdict = 'approved')
+		OR EXISTS (SELECT 1 FROM runs WHERE plan_id = OLD.plan_id AND plan_revision = OLD.revision)
+		OR EXISTS (SELECT 1 FROM plan_revisions WHERE plan_id = OLD.plan_id AND revision > OLD.revision)
+	BEGIN SELECT RAISE(ABORT, 'Rows of plan_revisions are immutable once approved, run, or revised'); END;`
+	return `CREATE TRIGGER ${table}_update BEFORE UPDATE ON ${table}
+	BEGIN SELECT RAISE(ABORT, 'Rows of ${table} are immutable'); END;`
+}
+const triggers = tableNames
+	.map(
+		(table) => `${updateTrigger(table)}
+CREATE TRIGGER ${table}_delete BEFORE DELETE ON ${table}
+	BEGIN SELECT RAISE(ABORT, 'Rows of ${table} are immutable'); END;`
+	)
+	.join('\n')
+
+export function completed(subject: string, data: Record<string, unknown> = {}): Reply {
+	return { status: 'completed', subject, reasons: [], data }
+}
+
+export function databasePath(workspace: string) {
+	return join(workspace, '.checkmate', 'checkmate.db')
+}
+
+export function removeTemporaryDirectory(store: Store, name: string) {
+	const temporary = join(store.workspace, '.checkmate', 'tmp')
+	rmSync(join(temporary, name), { recursive: true, force: true })
+	try {
+		rmdirSync(temporary)
+	} catch {}
+}
+
+export function openStore(workspace: string): Store {
+	const path = databasePath(workspace)
+	mkdirSync(join(workspace, '.checkmate'), { recursive: true })
+	const db = new DatabaseSync(path)
+	db.exec('PRAGMA journal_mode = WAL')
+	db.exec('PRAGMA busy_timeout = 5000')
+	db.exec('PRAGMA foreign_keys = ON')
+	db.exec('BEGIN IMMEDIATE')
+	try {
+		if (!db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'meta'").get()) {
+			db.exec(tables)
+			db.exec(triggers)
+			const insert = db.prepare('INSERT INTO meta (key, value) VALUES (?, ?)')
+			insert.run('contractVersion', contractVersion)
+			insert.run('schemaVersion', schemaVersion)
+		}
+		db.exec('COMMIT')
+	} catch (error) {
+		db.exec('ROLLBACK')
+		db.close()
+		throw error
+	}
+	return checkedStore(db, workspace, path)
+}
+
+export function openReadOnlyStore(workspace: string): Store {
+	const path = databasePath(workspace)
+	closeStore(openStore(workspace))
+	const db = new DatabaseSync(path, { readOnly: true })
+	db.exec('PRAGMA busy_timeout = 5000')
+	return checkedStore(db, workspace, path)
+}
+
+function checkedStore(db: DatabaseSync, workspace: string, path: string): Store {
+	const row = db.prepare("SELECT value FROM meta WHERE key = 'schemaVersion'").get()
+	if (row?.value !== schemaVersion) {
+		db.close()
+		throw new Error(`Database ${path} has schema version ${row?.value ?? 'none'}. Expected ${schemaVersion}.`)
+	}
+	return { db, workspace, path }
+}
+
+export function closeStore(store: Store) {
+	store.db.close()
+}
+
+export function one<T>(store: Store, sql: string, ...parameters: SQLInputValue[]): T | undefined {
+	return store.db.prepare(sql).get(...parameters) as T | undefined
+}
+
+export function all<T>(store: Store, sql: string, ...parameters: SQLInputValue[]): T[] {
+	return store.db.prepare(sql).all(...parameters) as T[]
+}
+
+export function execute(store: Store, sql: string, ...parameters: SQLInputValue[]) {
+	store.db.prepare(sql).run(...parameters)
+}
+
+export function write(
+	store: Store,
+	operation: Operation,
+	change: (operationId: string, at: string, actor: string) => Change
+) {
+	const actor = operation.actor?.trim()
+	if (!actor) throw new Error('A write needs an actor. Use --actor <name> or set CHECKMATE_ACTOR.')
+	const id = ulid()
+	const at = new Date().toISOString()
+	store.db.exec('BEGIN IMMEDIATE')
+	try {
+		const { reply, subjects } = change(id, at, actor)
+		recordOperation(store, { ...operation, id, at, actor }, reply, subjects)
+		store.db.exec('COMMIT')
+		return reply
+	} catch (error) {
+		if (store.db.isTransaction) store.db.exec('ROLLBACK')
+		const reason = error instanceof Error ? error.message : String(error)
+		store.db.exec('BEGIN IMMEDIATE')
+		recordOperation(
+			store,
+			{ ...operation, id: ulid(), at: new Date().toISOString(), actor },
+			{ status: 'rejected', subject: operation.subject, reasons: [reason], data: {} },
+			[]
+		)
+		store.db.exec('COMMIT')
+		throw error
+	}
+}
+
+function recordOperation(
+	store: Store,
+	operation: Operation & { id: string; at: string; actor: string },
+	reply: Reply,
+	subjects: string[]
+) {
+	execute(
+		store,
+		'INSERT INTO operations (id, at, actor, command, arguments, status, response, subjects) VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
+		operation.id,
+		operation.at,
+		operation.actor,
+		operation.command,
+		canonical(operation.input ?? null),
+		reply.status,
+		canonical(reply),
+		canonical(subjects)
+	)
+}
+
+export function canonical(value: unknown): string {
+	return JSON.stringify(sorted(value))
+}
+
+function sorted(value: unknown): unknown {
+	if (Array.isArray(value)) return value.map(sorted)
+	if (value && typeof value === 'object')
+		return Object.fromEntries(
+			Object.keys(value)
+				.sort()
+				.map((key) => [key, sorted((value as Record<string, unknown>)[key])])
+		)
+	return value
+}
+
+export function digest(content: string | Uint8Array) {
+	return createHash('sha256').update(content).digest('hex')
+}
+
+const crockford = '0123456789ABCDEFGHJKMNPQRSTVWXYZ'
+let lastTime = 0
+let lastRandom = 0n
+
+export function ulid(now = Date.now()) {
+	if (now > lastTime) {
+		lastTime = now
+		lastRandom = BigInt(`0x${randomBytes(10).toString('hex')}`)
+	} else {
+		lastRandom += 1n
+		if (lastRandom >= 1n << 80n) throw new Error('ULID random part overflowed in one millisecond')
+	}
+	return base32(BigInt(lastTime), 10) + base32(lastRandom, 16)
+}
+
+function base32(value: bigint, length: number) {
+	let text = ''
+	for (let i = 0; i < length; i++) {
+		text = crockford[Number(value % 32n)] + text
+		value /= 32n
+	}
+	return text
+}

package/plugin/src/targets.ts

@@ -0,0 +1,205 @@
+import type { Profile } from './types.ts'
+import type { Store } from './store.ts'
+import { canonical, completed, digest, execute, one, removeTemporaryDirectory, write } from './store.ts'
+import {
+	profileCheck,
+	requireChoice,
+	requireCondition,
+	requireIdentifier,
+	requireText,
+	revisionReference,
+	same,
+	approvalPolicy,
+} from './contracts.ts'
+
+export type ToolKind = Profile['tools'][number]['kind']
+export type RequestedTool = { name: string; kind: ToolKind; purpose: string }
+export type TargetRequest = {
+	targetId: string
+	baseUrl: string
+	capabilities: string[]
+	allowedOperations: string[]
+	tools: RequestedTool[]
+}
+
+export const toolKinds = ['cli', 'mcp', 'skill'] as const
+export type TargetRevision = { profile: Profile; revision: number; sha256: string }
+
+export function openTarget(
+	store: Store,
+	actor: string | undefined,
+	input: Omit<TargetRequest, 'tools'> & { tools?: RequestedTool[] }
+) {
+	return write(store, { actor, command: 'target open', subject: input.targetId, input }, (operationId) => {
+		const request = targetRequestCheck(input)
+		const existing = one<{ body: string }>(
+			store,
+			'SELECT body FROM target_requests WHERE target_id = ?',
+			request.targetId
+		)
+		if (existing) {
+			requireCondition(
+				existing.body === canonical(request),
+				`Target ${request.targetId} is open with other values. Use a new target ID for a different scope.`
+			)
+			return { reply: completed(request.targetId, { request, recorded: false }), subjects: [] }
+		}
+		execute(
+			store,
+			'INSERT INTO target_requests (target_id, body, operation_id) VALUES (?, ?, ?)',
+			request.targetId,
+			canonical(request),
+			operationId
+		)
+		return {
+			reply: completed(request.targetId, { request, recorded: true }),
+			subjects: [`target:${request.targetId}`],
+		}
+	})
+}
+
+function targetRequestCheck(input: Omit<TargetRequest, 'tools'> & { tools?: RequestedTool[] }): TargetRequest {
+	requireIdentifier(input.targetId, 'target ID')
+	let url: URL
+	try {
+		url = new URL(input.baseUrl)
+	} catch {
+		throw new Error(`Invalid base URL: ${input.baseUrl}`)
+	}
+	requireCondition(['http:', 'https:'].includes(url.protocol), 'Target must use HTTP or HTTPS')
+	for (const [name, list] of [
+		['capabilities', input.capabilities],
+		['operations', input.allowedOperations],
+	] as const) {
+		requireCondition(Array.isArray(list) && list.length > 0, `Missing ${name}`)
+		list.forEach((item) => requireIdentifier(item, name))
+		requireCondition(new Set(list).size === list.length, `Duplicate item in ${name}`)
+	}
+	const tools = (input.tools ?? []).map((tool) => toolCheck(tool))
+	requireCondition(new Set(tools.map((tool) => tool.name)).size === tools.length, 'Duplicate tool name')
+	return {
+		targetId: input.targetId,
+		baseUrl: input.baseUrl,
+		capabilities: input.capabilities,
+		allowedOperations: input.allowedOperations,
+		tools,
+	}
+}
+
+export function toolCheck(tool: RequestedTool): RequestedTool {
+	return {
+		name: requireText(tool.name, 'tool name').trim(),
+		kind: requireChoice(tool.kind, toolKinds, `kind of tool ${tool.name}`),
+		purpose: requireText(tool.purpose, `purpose of tool ${tool.name}`),
+	}
+}
+
+export function targetRequest(store: Store, targetId: string): TargetRequest {
+	const row = one<{ body: string }>(store, 'SELECT body FROM target_requests WHERE target_id = ?', targetId)
+	requireCondition(row, `Unknown target: ${targetId}. Run target open first.`)
+	return JSON.parse(row.body)
+}
+
+export function showTargetRequest(store: Store, targetId: string) {
+	return completed(targetId, { request: targetRequest(store, targetId) })
+}
+
+export function saveTarget(store: Store, actor: string | undefined, input: { targetId: string; profile: unknown }) {
+	const reply = save(store, actor, input)
+	removeTemporaryDirectory(store, `setup-${input.targetId}`)
+	return reply
+}
+
+function save(store: Store, actor: string | undefined, input: { targetId: string; profile: unknown }) {
+	return write(store, { actor, command: 'target save', subject: input.targetId, input }, (operationId) => {
+		const request = targetRequest(store, input.targetId)
+		const profile = profileCheck(input.profile)
+		requireCondition(
+			profile.targetId === request.targetId,
+			`Profile targetId ${profile.targetId} differs from ${request.targetId}`
+		)
+		requireCondition(profile.baseUrl === request.baseUrl, `Profile baseUrl differs from the setup request`)
+		requireCondition(
+			same(profile.capabilities, request.capabilities),
+			'Profile capabilities differ from the setup request'
+		)
+		requireCondition(
+			same(profile.allowedOperations, request.allowedOperations),
+			'Profile allowedOperations differ from the setup request'
+		)
+		for (const requested of request.tools) {
+			const tool = profile.tools.find((tool) => tool.name === requested.name)
+			requireCondition(tool, `Profile has no entry for the requested tool ${requested.name}`)
+			requireCondition(
+				tool.kind === requested.kind,
+				`Tool ${tool.name} is ${tool.kind} in the profile, not ${requested.kind}`
+			)
+		}
+		const unreachable = profile.tools
+			.filter((tool) => !tool.reachable && request.tools.some((requested) => requested.name === tool.name))
+			.map((tool) => `Requested tool ${tool.name} (${tool.kind}) is not reachable`)
+		requireCondition(
+			!unreachable.length || !profile.readyForLiveExecution,
+			`${unreachable.join('. ')}. Set readyForLiveExecution to false.`
+		)
+		const body = canonical(profile)
+		const latest = one<{ revision: number; body: string }>(
+			store,
+			'SELECT revision, body FROM profiles WHERE target_id = ? ORDER BY revision DESC LIMIT 1',
+			profile.targetId
+		)
+		const subject = `${profile.targetId}@${profile.revision}`
+		const reasons = profile.readyForLiveExecution
+			? []
+			: [...unreachable, 'Target prerequisites are not ready. Inspect the profile.']
+		const status = profile.readyForLiveExecution ? ('completed' as const) : ('needs_decision' as const)
+		const data = { targetId: profile.targetId, revision: profile.revision, sha256: digest(body) }
+		if (latest && latest.revision === profile.revision) {
+			requireCondition(
+				latest.body === body,
+				`Profile ${subject} exists with other content. Save revision ${latest.revision + 1} for changes.`
+			)
+			return { reply: { status, subject, reasons, data: { ...data, recorded: false } }, subjects: [] }
+		}
+		const next = (latest?.revision ?? 0) + 1
+		requireCondition(profile.revision === next, `Profile revision must be ${next}, not ${profile.revision}`)
+		execute(
+			store,
+			'INSERT INTO profiles (target_id, revision, sha256, body, operation_id) VALUES (?, ?, ?, ?, ?)',
+			profile.targetId,
+			profile.revision,
+			data.sha256,
+			body,
+			operationId
+		)
+		return {
+			reply: { status, subject, reasons, data: { ...data, recorded: true } },
+			subjects: [`target:${profile.targetId}`],
+		}
+	})
+}
+
+export function targetRevision(store: Store, targetId: string, revision: number | null = null): TargetRevision {
+	const row = one<{ revision: number; sha256: string; body: string }>(
+		store,
+		revision === null
+			? 'SELECT revision, sha256, body FROM profiles WHERE target_id = ? ORDER BY revision DESC LIMIT 1'
+			: 'SELECT revision, sha256, body FROM profiles WHERE target_id = ? AND revision = ?',
+		targetId,
+		...(revision === null ? [] : [revision])
+	)
+	requireCondition(row, `Unknown target profile: ${targetId}${revision === null ? '' : `@${revision}`}`)
+	return { profile: JSON.parse(row.body), revision: row.revision, sha256: row.sha256 }
+}
+
+export function showTarget(store: Store, reference: string) {
+	const { id, revision } = revisionReference(reference, 'target reference')
+	const target = targetRevision(store, id, revision)
+	return completed(`${id}@${target.revision}`, {
+		targetId: id,
+		revision: target.revision,
+		sha256: target.sha256,
+		approvals: approvalPolicy(target.profile),
+		profile: target.profile,
+	})
+}