@intentius/chant 0.100.0 → 0.102.0

package/src/cli/commands/onboard.test.ts

@@ -7,6 +7,7 @@ import {
   patchDockerfile,
   patchRootTsconfigPaths,
   insertPrepackAfterEach,
+  patchLexiconList,
 } from "./onboard";
 
 function makeTempDir(): string {
@@ -184,6 +185,8 @@ function writeFixtureRepo(root: string): void {
   writeFileSync(join(root, ".github/workflows/publish.yml"), publishContent);
   writeFileSync(join(root, "test/Dockerfile.smoke"), dockerLoopContent);
   writeFileSync(join(root, "test/Dockerfile.smoke-npm"), dockerNpmContent);
+  writeFileSync(join(root, "test/smoke-npm-lexicons.txt"), "aws\ngitlab\nk8s\n");
+  writeFileSync(join(root, "test/smoke-e2e-lexicons.txt"), "aws\nk8s\n");
 }
 
 const TRACKED = [
@@ -193,6 +196,8 @@ const TRACKED = [
   ".github/workflows/publish.yml",
   "test/Dockerfile.smoke",
   "test/Dockerfile.smoke-npm",
+  "test/smoke-npm-lexicons.txt",
+  "test/smoke-e2e-lexicons.txt",
 ];
 
 function snapshot(root: string): Record<string, string> {
@@ -223,8 +228,12 @@ describe("onboardCommand", () => {
       "publish.yml (prepack)",
       "Dockerfile.smoke (lexicon list)",
       "Dockerfile.smoke-npm (lexicon list)",
+      "smoke-npm-lexicons.txt (lexicon list)",
     ]);
-    expect(result.skipped).toEqual([]);
+    expect(result.skipped).toHaveLength(1);
+    expect(result.skipped[0]).toContain("smoke-e2e-lexicons.txt: not patched");
+    expect(readFileSync(join(root, "test/smoke-npm-lexicons.txt"), "utf-8")).toBe("aws\ngitlab\nk8s\nterraform\n");
+    expect(readFileSync(join(root, "test/smoke-e2e-lexicons.txt"), "utf-8")).toBe("aws\nk8s\n");
 
     const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf-8"));
     expect(pkg.dependencies["@intentius/chant-lexicon-terraform"]).toBe("workspace:*");
@@ -254,6 +263,8 @@ describe("onboardCommand", () => {
       "publish.yml: prepack for terraform already present",
       "Dockerfile.smoke: already covers terraform",
       "Dockerfile.smoke-npm: already covers terraform",
+      "smoke-npm-lexicons.txt: terraform already in test/smoke-npm-lexicons.txt",
+      expect.stringContaining("smoke-e2e-lexicons.txt: not patched"),
     ]);
   });
 
@@ -312,9 +323,9 @@ describe("root tsconfig.json paths (#1614)", () => {
 
     const cfg = JSON.parse(readFileSync(join(root, "tsconfig.json"), "utf-8"));
     expect(cfg.compilerOptions.paths["@intentius/chant-lexicon-terraform"]).toEqual([
-      "lexicons/terraform/src/index.ts",
+      "./lexicons/terraform/src/index.ts",
     ]);
-    expect(cfg.compilerOptions.paths["@intentius/chant-lexicon-terraform/*"]).toEqual(["lexicons/terraform/src/*"]);
+    expect(cfg.compilerOptions.paths["@intentius/chant-lexicon-terraform/*"]).toEqual(["./lexicons/terraform/src/*"]);
     // Existing entries untouched
     expect(cfg.compilerOptions.paths["@intentius/chant-lexicon-aws"]).toEqual(["lexicons/aws/src/index.ts"]);
     expect(cfg.compilerOptions.moduleResolution).toBe("node");
@@ -462,3 +473,42 @@ describe("insertPrepackAfterEach", () => {
     ]);
   });
 });
+
+describe("smoke lists and publish.yml reporting (#3227)", () => {
+  let root: string;
+
+  beforeEach(() => {
+    root = makeTempDir();
+    writeFixtureRepo(root);
+  });
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  test("patchLexiconList appends once and keeps the trailing newline", () => {
+    const file = join(root, "test/smoke-npm-lexicons.txt");
+    writeFileSync(file, "aws\nk8s");
+    expect(patchLexiconList(file, "sql").patched).toBe(true);
+    expect(readFileSync(file, "utf-8")).toBe("aws\nk8s\nsql\n");
+    expect(patchLexiconList(file, "sql").patched).toBe(false);
+    expect(readFileSync(file, "utf-8")).toBe("aws\nk8s\nsql\n");
+  });
+
+  test("a Dockerfile that reads the list file points at it instead of claiming coverage", () => {
+    const file = join(root, "test/Dockerfile.smoke-npm");
+    writeFileSync(file, "RUN LEXICONS=$(cat /app/test/smoke-npm-lexicons.txt) && \\\n    for lex in $LEXICONS; do :; done\n");
+    const result = patchDockerfile(file, "sql");
+    expect(result.patched).toBe(false);
+    expect(result.reason).toContain("test/smoke-npm-lexicons.txt");
+    expect(result.reason).not.toContain("already covers");
+  });
+
+  test("publish.yml with no per-lexicon prepack lines says nothing needs patching", () => {
+    writeFileSync(join(root, ".github/workflows/publish.yml"), "name: publish\njobs:\n  test:\n    steps:\n      - run: bash scripts/publish-verify-ci.sh\n");
+    const result = onboardCommand({ name: "sql", root });
+    const line = result.skipped.find((s) => s.startsWith("publish.yml:"));
+    expect(line).toContain("nothing to patch");
+    expect(line).toContain("scripts/ci-lexicon-artifacts.sh");
+  });
+});

package/src/cli/commands/onboard.ts

@@ -117,6 +117,10 @@ function patchRootPackageJson(root: string, name: string): PatchResult {
  * The whole-repo typecheck runs with `moduleResolution: node`, which never
  * reads package exports maps, so every lexicon needs a bare + subpath
  * mapping here or an example importing the package fails to resolve.
+ *
+ * Entries are `./`-prefixed like every other entry (#3227): with no `baseUrl`
+ * (removed in #3205) a bare `lexicons/...` path is invalid and tsx's tsconfig
+ * loader throws on it for every run in the repo.
  */
 export function patchRootTsconfigPaths(root: string, name: string): PatchResult {
   const tsconfigPath = join(root, "tsconfig.json");
@@ -128,8 +132,8 @@ export function patchRootTsconfigPaths(root: string, name: string): PatchResult
 
   const bare = `@intentius/chant-lexicon-${name}`;
   const wanted: Record<string, string[]> = {
-    [bare]: [`lexicons/${name}/src/index.ts`],
-    [`${bare}/*`]: [`lexicons/${name}/src/*`],
+    [bare]: [`./lexicons/${name}/src/index.ts`],
+    [`${bare}/*`]: [`./lexicons/${name}/src/*`],
   };
 
   let changed = false;
@@ -297,7 +301,15 @@ function patchPublishWorkflow(root: string, name: string): PatchResult {
   }
 
   if (!insertPrepackAfterEach(lines, name)) {
-    return { patched: false, reason: "no prepack line found to anchor on" };
+    // #3227 — not a failure and not "covered by a prepack line": publish.yml
+    // carries no per-lexicon lines. The run builds every lexicon through
+    // scripts/ci-lexicon-artifacts.sh and publishes through
+    // scripts/publish-packages.sh, both of which enumerate the workspace.
+    return {
+      patched: false,
+      reason:
+        "nothing to patch: it has no per-lexicon prepack lines; scripts/ci-lexicon-artifacts.sh and scripts/publish-packages.sh enumerate the workspace",
+    };
   }
   writeFileSync(filePath, lines.join("\n"));
   return { patched: true };
@@ -321,6 +333,12 @@ export function patchDockerfile(filePath: string, name: string): PatchResult {
 
   const changed = addToLexiconLoops(lines, name) || insertPrepackAfterEach(lines, name);
   if (!changed) {
+    // #3227 — the smoke-npm and smoke-e2e images read their lexicon list from
+    // a file. Point at it instead of reporting a missing anchor.
+    const listFile = lines.join("\n").match(/test\/(smoke-[\w-]+-lexicons\.txt)/)?.[1];
+    if (listFile) {
+      return { patched: false, reason: `reads its lexicon list from test/${listFile}, not from the Dockerfile` };
+    }
     return { patched: false, reason: "no lexicon loop or prepack line found to anchor on" };
   }
 
@@ -328,6 +346,22 @@ export function patchDockerfile(filePath: string, name: string): PatchResult {
   return { patched: true };
 }
 
+/**
+ * Append a lexicon to a one-name-per-line list file (test/smoke-npm-lexicons.txt).
+ * Idempotent; keeps the file's trailing newline.
+ */
+export function patchLexiconList(filePath: string, name: string): PatchResult {
+  const rel = filePath.split("/").slice(-2).join("/");
+  if (!existsSync(filePath)) return { patched: false, reason: `${rel} not found` };
+  const content = readFileSync(filePath, "utf-8");
+  if (content.split("\n").some((l) => l.trim() === name)) {
+    return { patched: false, reason: `${name} already in ${rel}` };
+  }
+  const sep = content === "" || content.endsWith("\n") ? "" : "\n";
+  writeFileSync(filePath, `${content}${sep}${name}\n`);
+  return { patched: true };
+}
+
 /**
  * Execute the onboard command — patches monorepo infrastructure for a new lexicon.
  */
@@ -375,6 +409,20 @@ export function onboardCommand(options: OnboardOptions): OnboardResult {
     patchDockerfile(join(root, "test/Dockerfile.smoke-npm"), options.name),
   );
 
+  // 6. Smoke image lexicon lists (#3227). The npm smoke packs every lexicon.
+  //    The e2e list is opt-in: it names the lexicons an example uses plus
+  //    their dependencies, so onboard leaves it alone and says so.
+  record(
+    "smoke-npm-lexicons.txt",
+    "lexicon list",
+    patchLexiconList(join(root, "test/smoke-npm-lexicons.txt"), options.name),
+  );
+  if (existsSync(join(root, "test/smoke-e2e-lexicons.txt"))) {
+    skipped.push(
+      `smoke-e2e-lexicons.txt: not patched; it lists only lexicons an e2e example uses (and their dependencies). Add ${options.name} to test/smoke-e2e-lexicons.txt when an example needs it`,
+    );
+  }
+
   return { success: true, patched, skipped, verbose: options.verbose };
 }
 
@@ -396,7 +444,7 @@ export async function printOnboardResult(result: OnboardResult, name: string): P
 
   if (result.skipped.length > 0) {
     console.log("");
-    console.log("Skipped (already covered):");
+    console.log("Not patched (already covered, or nothing to patch):");
     for (const s of result.skipped) {
       console.log(`  ${s}`);
     }

package/src/cli/commands/pinned-upgrade.ts

@@ -1,7 +1,7 @@
 /**
  * `chant dev pinned-upgrade <lexicon-dir>` command implementation.
  *
- * Detects whether a pinned-version lexicon (k8s, gcp, docker, gitlab) has a
+ * Detects whether a lexicon that declares `upstreamPin` has a
  * newer stable upstream release. When it does, it dry-run bumps the pinned
  * version constant, regenerates + surface-diffs (via #524's regenLexicon), then
  * reverts the bump — leaving the working tree unchanged.
@@ -10,20 +10,21 @@
  */
 
 import { existsSync } from "fs";
-import { basename, resolve } from "path";
+import { resolve } from "path";
 import {
-  checkPinnedUpgrade,
+  checkPinnedUpgrades,
+  lexiconNameOf,
   type LexiconId,
   type UpgradeCheckResult,
 } from "../../codegen/pinned-upgrade";
 
-const PINNED_LEXICONS: readonly LexiconId[] = ["k8s", "gcp", "docker", "gitlab"];
-
 export interface PinnedUpgradeOptions {
   /** Resolved path to the lexicon directory. */
   lexiconDir: string;
   /** Explicit lexicon id; inferred from the directory name when omitted. */
   lexicon?: LexiconId;
+  /** Label of one pin to check, for a lexicon that declares several. Omitted: all of them. */
+  pin?: string;
   /** Force re-fetch of the upstream spec during regen. */
   force?: boolean;
   /** Print subprocess output while running. */
@@ -31,12 +32,13 @@ export interface PinnedUpgradeOptions {
 }
 
 /**
- * Infer the lexicon id from a directory name. Returns null when the directory
- * basename is not one of the pinned lexicons.
+ * Infer the lexicon id from a directory: its package name
+ * (`@intentius/chant-lexicon-<name>`), else the directory name. Whether the
+ * lexicon is pinned is the plugin's `upstreamPin`, checked by
+ * `checkPinnedUpgrade`, not a list here.
  */
-export function inferLexicon(lexiconDir: string): LexiconId | null {
-  const name = basename(lexiconDir);
-  return (PINNED_LEXICONS as readonly string[]).includes(name) ? (name as LexiconId) : null;
+export function inferLexicon(lexiconDir: string): LexiconId {
+  return lexiconNameOf(lexiconDir);
 }
 
 /**
@@ -52,37 +54,38 @@ export function semverLabel(result: UpgradeCheckResult): "minor" | "major" | "no
 
 /**
  * Run the pinned-upgrade check and return the structured result.
- * Never throws — a missing dir or an unrecognised lexicon becomes a fetchError.
+ * Never throws — a missing dir or a lexicon with no `upstreamPin` becomes a fetchError.
  */
 export async function runPinnedUpgrade(opts: PinnedUpgradeOptions): Promise<UpgradeCheckResult> {
+  return (await runPinnedUpgrades(opts))[0]!;
+}
+
+/**
+ * Run the check for every pin the plugin declares (or the one in `opts.pin`),
+ * one result each. A lexicon with one pin gives one result.
+ */
+export async function runPinnedUpgrades(opts: PinnedUpgradeOptions): Promise<UpgradeCheckResult[]> {
   const dir = resolve(opts.lexiconDir);
 
   const lexicon = opts.lexicon ?? inferLexicon(dir);
-  if (!lexicon) {
-    return {
-      lexicon: "k8s",
-      hasUpgrade: false,
-      from: "(unknown)",
-      to: null,
-      validation: null,
-      fetchError: `Not a pinned lexicon directory: ${dir}. Expected one of: ${PINNED_LEXICONS.join(", ")}.`,
-    };
-  }
 
   if (!existsSync(dir)) {
-    return {
-      lexicon,
-      hasUpgrade: false,
-      from: "(unknown)",
-      to: null,
-      validation: null,
-      fetchError: `Lexicon directory not found: ${dir}`,
-    };
+    return [
+      {
+        lexicon,
+        hasUpgrade: false,
+        from: "(unknown)",
+        to: null,
+        validation: null,
+        fetchError: `Lexicon directory not found: ${dir}`,
+      },
+    ];
   }
 
-  return checkPinnedUpgrade({
+  return checkPinnedUpgrades({
     lexiconDir: dir,
     lexicon,
+    pin: opts.pin,
     force: opts.force,
     verbose: opts.verbose,
   });
@@ -112,12 +115,14 @@ function c(text: string, code: string): string {
  */
 export function printPinnedUpgradeResult(result: UpgradeCheckResult, json: boolean): void {
   const label = semverLabel(result);
+  const name = result.pin ? `${result.lexicon}/${result.pin}` : result.lexicon;
 
   if (json) {
     console.log(
       JSON.stringify(
         {
           lexicon: result.lexicon,
+          ...(result.pin ? { pin: result.pin } : {}),
           hasUpgrade: result.hasUpgrade,
           from: result.from,
           to: result.to,
@@ -128,6 +133,7 @@ export function printPinnedUpgradeResult(result: UpgradeCheckResult, json: boole
           validationOk: result.validation?.ok ?? null,
           failures: result.validation?.failures ?? [],
           fetchError: result.fetchError,
+          manualPin: result.manualPin ?? null,
         },
         null,
         2,
@@ -137,22 +143,31 @@ export function printPinnedUpgradeResult(result: UpgradeCheckResult, json: boole
   }
 
   if (result.fetchError) {
-    console.log(c(`[${result.lexicon}] error: ${result.fetchError}`, COLORS.red));
+    console.log(c(`[${name}] error: ${result.fetchError}`, COLORS.red));
     return;
   }
 
   if (!result.hasUpgrade) {
     console.log(
-      c(`[${result.lexicon}] up to date`, COLORS.green) +
+      c(`[${name}] up to date`, COLORS.green) +
         `  pinned=${result.from}` +
         (result.to ? ` latest=${result.to}` : ""),
     );
     return;
   }
 
+  if (result.manualPin) {
+    console.log(
+      c(`[${name}] upgrade available`, COLORS.bold) + `  ${result.from} -> ${result.to}`,
+    );
+    console.log(`  The pin in ${result.manualPin.file} cannot be rewritten generically, so nothing was edited or regenerated.`);
+    console.log(`  ${result.manualPin.instructions}`);
+    return;
+  }
+
   // Upgrade available
   console.log(
-    c(`[${result.lexicon}] upgrade available`, COLORS.bold) +
+    c(`[${name}] upgrade available`, COLORS.bold) +
       `  ${result.from} -> ${result.to}`,
   );
 
@@ -202,3 +217,28 @@ export function printPinnedUpgradeResult(result: UpgradeCheckResult, json: boole
     `Validation: ${validationLabel}  Semver: ${c(label, labelColor)}  ${result.from} -> ${result.to}`,
   );
 }
+
+/**
+ * Print one result per pin. One result prints exactly as `printPinnedUpgradeResult`;
+ * several print in turn, and `json` emits an array of the same objects.
+ */
+export function printPinnedUpgradeResults(results: UpgradeCheckResult[], json: boolean): void {
+  if (results.length === 1) {
+    printPinnedUpgradeResult(results[0]!, json);
+    return;
+  }
+  if (json) {
+    // Each result prints as its own JSON object; collect them into one array.
+    const lines: string[] = [];
+    const log = console.log;
+    console.log = (...a: unknown[]) => void lines.push(a.join(" "));
+    try {
+      for (const r of results) printPinnedUpgradeResult(r, true);
+    } finally {
+      console.log = log;
+    }
+    console.log(`[${lines.join(",\n")}]`);
+    return;
+  }
+  for (const r of results) printPinnedUpgradeResult(r, false);
+}

package/src/cli/handlers/__snapshots__/build-member.test.ts.snap

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     container: node:22-slim
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: chant run --components shared-alb --env staging --dump-outputs shared-alb.outputs.json
       - name: Upload shared-alb outputs
         uses: actions/upload-artifact@v4
@@ -27,7 +27,7 @@ jobs:
       - shared-alb
     container: node:22-slim
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Download shared-alb outputs
         uses: actions/download-artifact@v4
         with:

package/src/cli/handlers/components.ts

@@ -48,7 +48,7 @@ import type { ComponentBomSummary } from "../../lifecycle/build-ledger";
 import type { BuildArchiveManifest } from "../../components/verbs/build-archive";
 import { loadChantConfig } from "../../config";
 import { applyLiveEndpoint } from "../../live-endpoint";
-import { isResourceDeclarable } from "../../declarable";
+import { isObservableDeclarable } from "../../declarable";
 import { build } from "../../build";
 import { discoverComponents } from "../../components/discover";
 import { formatError, formatWarning, formatSuccess, formatBold } from "../format";
@@ -643,7 +643,7 @@ export async function runComponentsStatus(ctx: CommandContext): Promise<number>
           const entities = new Map<string, { entityType: string; props: Record<string, unknown> }>();
           for (const [name, entity] of buildResult.entities) {
             // Resource declarables only (see lifecycle/observe.ts).
-            if (entity.lexicon === plugin.name && isResourceDeclarable(entity)) {
+            if (entity.lexicon === plugin.name && isObservableDeclarable(entity)) {
               declared.add(name);
               entities.set(name, {
                 entityType: entity.entityType,

package/src/cli/handlers/dev.ts

@@ -85,16 +85,18 @@ export async function runDevSurfaceDiff(ctx: CommandContext): Promise<number> {
 
 export async function runDevPinnedUpgrade(ctx: CommandContext): Promise<number> {
   const dir = ctx.args.extraPositional ?? ".";
-  const { runPinnedUpgrade, printPinnedUpgradeResult } = await import("../commands/pinned-upgrade");
-  const result = await runPinnedUpgrade({
+  const { runPinnedUpgrades, printPinnedUpgradeResults } = await import("../commands/pinned-upgrade");
+  // The optional second positional is a pin label, for a lexicon that declares several pins.
+  const results = await runPinnedUpgrades({
     lexiconDir: resolve(dir),
+    pin: ctx.args.extraPositional2,
     force: ctx.args.force,
     verbose: ctx.args.verbose,
   });
-  printPinnedUpgradeResult(result, ctx.args.format === "json");
-  // Exit non-zero when the upstream query failed or the regen validation broke.
-  if (result.fetchError) return 1;
-  if (result.validation && !result.validation.ok) return 1;
+  printPinnedUpgradeResults(results, ctx.args.format === "json");
+  // Exit non-zero when an upstream query failed or a regen validation broke.
+  if (results.some((r) => r.fetchError)) return 1;
+  if (results.some((r) => r.validation && !r.validation.ok)) return 1;
   return 0;
 }
 

package/src/cli/handlers/fan-out.test.ts

@@ -204,8 +204,8 @@ describe("proof: a plan-only invocation prints the derivation and dispatches not
     expect(out).toContain("wave 1: cluster-a");
     expect(out).toContain("seeded from an earlier run: net");
     expect(out).toMatch(/billing +unaffected/);
-    expect(out).toMatch(/plan: sha256:[0-9a-f]{64}/);
-    expect(out).toMatch(/approve: chant approve fan-out release --plan sha256:[0-9a-f]{64}/);
+    expect(out).toMatch(/plan: jcs1-sha256:[0-9a-f]{64}/);
+    expect(out).toMatch(/approve: chant approve fan-out release --plan jcs1-sha256:[0-9a-f]{64}/);
   });
 
   test("--dry-run with --resume shows what is left, at the digest that approves it", async () => {
@@ -214,7 +214,7 @@ describe("proof: a plan-only invocation prints the derivation and dispatches not
       const resume = join(dir, "attempt.json");
       failing = ["cluster-a"];
       await runComponentsFanOut(ctx({ base: "main", env: "test", resume }));
-      const digest = /plan: (sha256:[0-9a-f]{64})/.exec(stderr())?.[1];
+      const digest = /plan: (jcs1-sha256:[0-9a-f]{64})/.exec(stderr())?.[1];
 
       ran = [];
       stderrLines = [];
@@ -236,7 +236,7 @@ describe("proof: a plan-only invocation prints the derivation and dispatches not
     expect(exit).toBe(0);
     const parsed = JSON.parse(stdout());
     expect(parsed.order).toEqual(["net", "cluster-a", "cluster-b", "app-one", "app-three", "app-two"]);
-    expect(parsed.digest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(parsed.digest).toMatch(/^jcs1-sha256:[0-9a-f]{64}$/);
   });
 });
 
@@ -334,10 +334,10 @@ describe("proof: one approval covers the set, and the printed digest is what app
     expect(ran).toEqual([]);
     const out = stderr();
     expect(out).toContain("gated: nothing ran.");
-    expect(out).toMatch(/approve : chant approve fan-out release --plan sha256:[0-9a-f]{64}/);
+    expect(out).toMatch(/approve : chant approve fan-out release --plan jcs1-sha256:[0-9a-f]{64}/);
     // One pending fact for the whole set, not one per component.
     expect(gateLedger.appended).toHaveLength(1);
-    expect(gateLedger.appended[0].planDigest).toBe(/plan: (sha256:[0-9a-f]{64})/.exec(out)?.[1]);
+    expect(gateLedger.appended[0].planDigest).toBe(/plan: (jcs1-sha256:[0-9a-f]{64})/.exec(out)?.[1]);
   });
 
   test("the resolution for that digest lets the whole set through", async () => {

package/src/cli/handlers/fan-out.ts

@@ -38,6 +38,7 @@
 import { resolve, dirname } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { loadChantConfig, resolveAutoReleaseDisabled, type ChantConfig } from "../../config";
+import { samePlanDigest } from "../../lifecycle/plan-digest";
 import { affectedStacks } from "../../lifecycle/affected";
 import { deriveFanOut, fanOutRegistry } from "../../components/fan-out-support";
 import { runFanOut } from "../../components/fan-out-run";
@@ -242,7 +243,7 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
       console.error(formatError({ message: `--resume: could not read "${args.resume}": ${err instanceof Error ? err.message : String(err)}` }));
       return 1;
     }
-    if (attempt && attempt.digest !== derived.plan.digest) {
+    if (attempt && !samePlanDigest(attempt.digest, derived.plan.digest)) {
       console.error(formatWarning({
         message: `--resume: "${args.resume}" records a different fan-out (${attempt.digest || "no digest"}), so its progress does not apply here`,
         hint: "The derivation changed, which makes this a different change. Everything selected will run.",

package/src/cli/handlers/graph.test.ts

@@ -161,6 +161,7 @@ describe("runGraph", () => {
     observeMock.mockReset();
     buildMock.mockReset();
     loadPluginsMock.mockReset();
+    loadPluginsMock.mockResolvedValue([]);
     resolveLexMock.mockReset();
     loadChantConfigMock.mockReset();
     loadChantConfigMock.mockResolvedValue({ config: {} });
@@ -228,6 +229,47 @@ describe("runGraph", () => {
       expect(ir.edges).toContainEqual({ from: "subnet", to: "vpc", kind: "ref", viaAttr: "network" });
     });
 
+    // #2559 — a lexicon's graphMeta answer lands in the IR meta, so the
+    // workspace graph can list collector pipelines without core importing otel.
+    test("--format ir carries what a lexicon's graphMeta reports under meta", async () => {
+      lintClean(); discovered();
+      const seen: string[][] = [];
+      loadPluginsMock.mockResolvedValue([{
+        name: "gcp",
+        serializer: {},
+        graphMeta: (entities: Map<string, unknown>) => {
+          seen.push([...entities.keys()].sort());
+          return { collector: { pipelines: [] } };
+        },
+      }]);
+      resolveLexMock.mockResolvedValue(["gcp"]);
+      const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+      expect(exit).toBe(0);
+      expect(seen).toEqual([["pod", "subnet", "vpc"]]);
+      expect(JSON.parse(stdoutBuf.join("\n")).meta).toEqual({ collector: { pipelines: [] } });
+    });
+
+    test("--format ir has no meta when no lexicon reports anything", async () => {
+      lintClean(); discovered();
+      loadPluginsMock.mockResolvedValue([{ name: "gcp", serializer: {}, graphMeta: () => undefined }, { name: "k8s", serializer: {} }]);
+      resolveLexMock.mockResolvedValue(["gcp", "k8s"]);
+      const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+      expect(exit).toBe(0);
+      expect("meta" in JSON.parse(stdoutBuf.join("\n"))).toBe(false);
+    });
+
+    test("--format ir keeps the first answer when two lexicons report one key", async () => {
+      lintClean(); discovered();
+      loadPluginsMock.mockResolvedValue([
+        { name: "a", serializer: {}, graphMeta: () => ({ collector: 1 }) },
+        { name: "b", serializer: {}, graphMeta: () => ({ collector: 2 }) },
+      ]);
+      resolveLexMock.mockResolvedValue(["a", "b"]);
+      const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+      expect(exit).toBe(0);
+      expect(JSON.parse(stdoutBuf.join("\n")).meta).toEqual({ collector: 1 });
+    });
+
     // #2529 — the IR carries its version, as the first key, so a reader can
     // decide how to read the rest before it reads anything else.
     test("--format ir leads with the IR version", async () => {

package/src/cli/handlers/graph.ts

@@ -702,6 +702,27 @@ async function buildPipelineProjection(
  * Lint-gated: the IR represents valid infra, so we refuse to emit for source that
  * does not pass lint. Non-zero on discovery errors or a layout-engine failure.
  */
+/**
+ * Add what the lexicons' `graphMeta` hooks report to `ir.meta` (#2559). A
+ * lexicon with nothing to report leaves the IR as it was, so a project that
+ * declares none of their entities prints what it did before. Two lexicons
+ * that answer the same key keep the first and say so on stderr.
+ */
+function withGraphMeta(ir: GraphIR, plugins: LexiconPlugin[], entities: Map<string, import("../../declarable").Declarable>): GraphIR {
+  const added: Record<string, unknown> = {};
+  for (const p of plugins) {
+    if (!p.graphMeta) continue;
+    for (const [key, value] of Object.entries(p.graphMeta(entities) ?? {})) {
+      if (key in added || (ir.meta && key in ir.meta)) {
+        console.error(formatWarning({ message: `the ${p.name} lexicon reports graph meta "${key}", which another source already set; its value is dropped` }));
+        continue;
+      }
+      added[key] = value;
+    }
+  }
+  return Object.keys(added).length === 0 ? ir : { ...ir, meta: { ...(ir.meta ?? {}), ...added } };
+}
+
 /** Returned instead of a graph when the prediction cannot be attempted honestly. */
 const REFUSED = Symbol("behaviour-refused");
 
@@ -855,6 +876,7 @@ async function runGraphView(
     });
     if (predicted === REFUSED) return 1;
     ir = predicted;
+    ir = withGraphMeta(ir, plugins as LexiconPlugin[], result.entities);
   }
 
   if (ctx.args.lens) {