@intentius/chant 0.105.1 → 0.106.3

package/src/change-set.ts

@@ -19,12 +19,19 @@
  * Every member carries the plan digest a gate on that member alone binds
  * (#2300): `terraformPlanDigest` for a terraform-family root, and here
  * `computePlanDigest("lifecycle-plan", …)` and `computePlanDigest(
- * "reconcile-plan", …)`. The document's digest is {@link changeSetDigest}
- * over the sorted `{ member, planDigest }` pairs, the set digest #3049
- * describes, so a wave's digest is the same function over the wave's
- * members. The entries and the summary are derived from the plans those
- * digests cover and are not hashed again: a change to how chant projects a
- * plan into entries does not expire an approval.
+ * "reconcile-plan", …)`. {@link changeSetDigest} over the sorted `{ member,
+ * planDigest }` pairs is the set digest #3049 describes, and a wave's digest
+ * is that function over the wave's members.
+ *
+ * The document's digest is {@link changeSetDocumentDigest}: the set digest,
+ * each member's status and holes, the entries and the side effects. An
+ * approval of the document binds what it says as well as the plans it came
+ * from, so a pull request's apply that resumes from a record (#3464) can
+ * check a re-planned member against the record's entries without trusting
+ * whoever wrote the record. The summary is computed from the entries and is
+ * not hashed. A change to how chant projects a plan into entries moves the
+ * document's digest, so an approval given under one chant does not carry to
+ * an apply under a chant that projects the same plan differently.
  *
  * ## The import graph
  *
@@ -192,6 +199,9 @@ function entryKey(e: ChangeSetEntry): string {
   return `${e.member}\u0000${e.address}\u0000${e.deposed ?? ""}\u0000${e.action}`;
 }
 
+const bySideEffect = (a: ChangeSetSideEffect, b: ChangeSetSideEffect): number =>
+  byString(a.member, b.member) || byString(a.address, b.address) || byString(a.trigger ?? "", b.trigger ?? "");
+
 /**
  * The set digest over members' plan digests: `computePlanDigest("change-set",
  * …)` over `{ member, planDigest }` sorted by member. Order-independent,
@@ -212,6 +222,27 @@ export function changeSetDigest(members: ReadonlyArray<Pick<ChangeSetMember, "me
   return computePlanDigest("change-set", pairs);
 }
 
+/**
+ * The document's digest: `computePlanDigest("change-set-document", …)` over
+ * the set digest ({@link changeSetDigest}), each member's name, status and
+ * holes, the entries and the side effects. Members are sorted by name and
+ * entries and side effects by the keys {@link composeChangeSet} sorts them by,
+ * so order makes no difference.
+ *
+ * A provisional member is left out, with its entries and side effects, as
+ * the set digest leaves it out: no approval of the document covers it.
+ */
+export function changeSetDocumentDigest(doc: Pick<ChangeSetDocument, "members" | "entries" | "sideEffects">): string {
+  const provisional = new Set(doc.members.filter((m) => m.provisional === true).map((m) => m.member));
+  const members = doc.members
+    .filter((m) => !provisional.has(m.member))
+    .map((m) => ({ member: m.member, status: m.status, holes: m.holes }))
+    .sort((a, b) => byString(a.member, b.member));
+  const entries = doc.entries.filter((e) => !provisional.has(e.member)).sort((a, b) => byString(entryKey(a), entryKey(b)));
+  const sideEffects = (doc.sideEffects ?? []).filter((s) => !provisional.has(s.member)).sort(bySideEffect);
+  return computePlanDigest("change-set-document", { set: changeSetDigest(doc.members), members, entries, sideEffects });
+}
+
 /** The summary of a set of members and entries. */
 export function summarizeChangeSet(members: ChangeSetMember[], entries: ChangeSetEntry[]): ChangeSetSummary {
   const actions = Object.fromEntries(CHANGE_SET_ACTIONS.map((a) => [a, 0])) as Record<ChangeSetAction, number>;
@@ -275,8 +306,8 @@ export function composeChangeSet(parts: ReadonlyArray<ChangeSetPart>, options: C
   entries.sort((a, b) => byString(entryKey(a), entryKey(b)));
   const sideEffects: ChangeSetSideEffect[] = parts
     .flatMap((p) => (p.sideEffects ?? []).map((s) => ({ member: p.member.member, ...s })))
-    .sort((a, b) => byString(a.member, b.member) || byString(a.address, b.address) || byString(a.trigger ?? "", b.trigger ?? ""));
-  const digest = changeSetDigest(members);
+    .sort(bySideEffect);
+  const digest = changeSetDocumentDigest({ members, entries, sideEffects });
   return {
     $schema: CHANGE_SET_SCHEMA_ID,
     contract: CHANGE_SET_CONTRACT,
@@ -289,9 +320,17 @@ export function composeChangeSet(parts: ReadonlyArray<ChangeSetPart>, options: C
   };
 }
 
-/** Whether a document's digest is the one its members' plan digests give. */
-export function verifyChangeSetDigest(doc: Pick<ChangeSetDocument, "digest" | "members">): boolean {
-  return changeSetDigest(doc.members) === doc.digest;
+/**
+ * Whether a document's digest is the one its members, entries and side
+ * effects give ({@link changeSetDocumentDigest}). A document that names a
+ * member twice has no digest and is not verified.
+ */
+export function verifyChangeSetDigest(doc: Pick<ChangeSetDocument, "digest" | "members" | "entries" | "sideEffects">): boolean {
+  try {
+    return changeSetDocumentDigest(doc) === doc.digest;
+  } catch {
+    return false;
+  }
 }
 
 // ── chant lifecycle plan ───────────────────────────────────────────────────────

package/src/cli/commands/build.ts

@@ -109,6 +109,14 @@ export interface BuildOptions {
    * any flame/icicle viewer with no chant-specific tooling.
    */
   foldRankCollapsedFile?: string;
+
+  /**
+   * `--lexicon-output` runs `buildCommand` once per output file. The first call
+   * runs the build with `serializers` (every serializer the project lists) and
+   * keeps the promise here; the later calls reuse it and each takes only the
+   * outputs of its own `serializers`, so the sources are evaluated once.
+   */
+  sharedBuild?: { serializers: Serializer[]; result?: ReturnType<typeof build> };
 }
 
 /**
@@ -311,20 +319,31 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // (../build-options.ts), which `evaluateProjectPolicies` calls too, so the
   // `policyGate` step decides on the same project this command builds.
   const telemetry = await resolveTelemetryAttribution(configDir, config as unknown as Record<string, unknown>, env);
-  const result = await build(
-    infraPath,
-    options.serializers,
-    undefined,
-    resolveProjectBuildOptions({
-      config,
-      configDir,
-      plugins: options.plugins,
-      modes,
-      ownership,
-      buildParams: paramsResolution.provenance,
-      telemetry,
-    }),
-  );
+  const runBuild = (serializers: Serializer[]) =>
+    build(
+      infraPath,
+      serializers,
+      undefined,
+      resolveProjectBuildOptions({
+        config,
+        configDir,
+        plugins: options.plugins,
+        modes,
+        ownership,
+        buildParams: paramsResolution.provenance,
+        telemetry,
+      }),
+    );
+  let result;
+  if (options.sharedBuild) {
+    const shared = options.sharedBuild;
+    shared.result ??= runBuild(shared.serializers);
+    const full = await shared.result;
+    const own = new Set(options.serializers.map((x) => x.name));
+    result = { ...full, outputs: new Map([...full.outputs].filter(([name]) => own.has(name))) };
+  } else {
+    result = await runBuild(options.serializers);
+  }
 
   // #1022 — report per-file fold vs run so it's visible what still runs.
   // #1424 — one line by default; the per-file lines and their reasons are

package/src/cli/commands/lint.ts

@@ -4,7 +4,8 @@ import { readFileSync, writeFileSync, readdirSync } from "fs";
 import { runLint, parseDisableComments } from "../../lint/engine";
 import type { LintRule, LintDiagnostic, LintFix } from "../../lint/rule";
 import type { IntrinsicDef, LexiconPlugin } from "../../lexicon";
-import { loadPlugins, resolveProjectLexicons } from "../plugins";
+import { loadPlugin, loadPlugins, resolveProjectLexicons } from "../plugins";
+import { findInfraFiles, detectLexicons } from "../../index";
 import { formatStylish, formatJson, formatSarif } from "../reporters/stylish";
 import { loadLocalRules } from "../../lint/rule-loader";
 import { loadCoreRules } from "../../lint/rules/index";
@@ -129,6 +130,29 @@ function lexiconResolutionDiagnostic(projectRoot: string, error: Error): LintDia
   };
 }
 
+/**
+ * The plugins of lexicons that the project's source imports from and that are not in `configured`, for their
+ * property-kind class names (#3184). A package that is not installed, or that fails to load, is skipped.
+ */
+async function loadImportedPropertyPlugins(projectPath: string, configured: readonly string[]): Promise<LexiconPlugin[]> {
+  let imported: string[];
+  try {
+    imported = await detectLexicons(await findInfraFiles(projectPath));
+  } catch {
+    return [];
+  }
+  const plugins: LexiconPlugin[] = [];
+  for (const name of imported) {
+    if (configured.includes(name)) continue;
+    try {
+      plugins.push(await loadPlugin(name));
+    } catch {
+      // Not installed here; the import is the build's problem to report, not lint's.
+    }
+  }
+  return plugins;
+}
+
 /**
  * Load all lint rules: core COR/EVL rules, then lexicon plugin rules.
  *
@@ -210,6 +234,15 @@ async function loadAllPluginRules(
   // them as resources.
   const propertyClasses = new Set(plugins.flatMap((plugin) => plugin.propertyClassNames?.() ?? []));
 
+  // chant #3184: a lexicon the source imports from but the config does not list (grafana in a k8s project that
+  // holds a dashboard ConfigMap, after `chant import`) still declares which of its classes are property-kind. Only
+  // those names are taken from it; its rules and intrinsics stay out, since the project did not ask for them.
+  if (!lexiconError) {
+    for (const plugin of await loadImportedPropertyPlugins(projectPath, lexiconNames)) {
+      for (const name of plugin.propertyClassNames?.() ?? []) propertyClasses.add(name);
+    }
+  }
+
   for (const plugin of plugins) {
     if (plugin.lintRules) {
       for (const r of plugin.lintRules()) {

package/src/cli/handlers/build-lexicon-output.test.ts

@@ -0,0 +1,102 @@
+/**
+ * `chant build --lexicon-output <lexicon>=<path>`: each named lexicon is built
+ * into its own file, so one project can declare otel and prometheus. The build
+ * itself is mocked; this checks how the handler splits the serializers and
+ * the output paths.
+ */
+import { describe, test, expect, vi, beforeEach } from "vitest";
+import type { ParsedArgs, CommandContext } from "../registry";
+import type { Serializer } from "../../serializer";
+
+const buildCommandMock = vi.fn();
+
+vi.mock("../commands/build", async () => {
+  const actual = await vi.importActual<typeof import("../commands/build")>("../commands/build");
+  return { ...actual, buildCommand: (...args: unknown[]) => buildCommandMock(...args) };
+});
+
+const { runBuild } = await import("./build");
+
+const ser = (name: string) => ({ name }) as unknown as Serializer;
+
+function ctx(overrides: Partial<ParsedArgs>, names = ["otel", "prometheus", "grafana"]): CommandContext {
+  const args = {
+    command: "build",
+    path: ".",
+    format: "",
+    fix: false,
+    watch: false,
+    verbose: false,
+    help: false,
+    live: false,
+    ...overrides,
+  } as ParsedArgs;
+  return { args, plugins: [], serializers: names.map(ser) } as unknown as CommandContext;
+}
+
+describe("runBuild --lexicon-output", () => {
+  beforeEach(() => {
+    buildCommandMock.mockReset().mockResolvedValue({ success: true, errors: [], warnings: [], resourceCount: 1, fileCount: 1 });
+    vi.spyOn(console, "error").mockImplementation(() => {});
+  });
+
+  test("builds each named lexicon into its own file", async () => {
+    const code = await runBuild(ctx({ lexiconOutput: ["otel=out/collector.yml", "prometheus=out/prometheus.yml"] }));
+    expect(code).toBe(0);
+    expect(buildCommandMock).toHaveBeenCalledTimes(2);
+    const calls = buildCommandMock.mock.calls.map(([o]) => [o.serializers.map((s: Serializer) => s.name), o.output, o.format]);
+    expect(calls).toEqual([
+      [["otel"], "out/collector.yml", "yaml"],
+      [["prometheus"], "out/prometheus.yml", "yaml"],
+    ]);
+  });
+
+  test("every file shares one build over all the serializers", async () => {
+    await runBuild(ctx({ lexiconOutput: ["otel=a.yml", "prometheus=b.yml"] }));
+    const shared = buildCommandMock.mock.calls.map(([o]) => o.sharedBuild);
+    expect(shared).toHaveLength(2);
+    expect(shared[0]).toBe(shared[1]);
+    expect(shared[0].serializers.map((s: Serializer) => s.name)).toEqual(["otel", "prometheus", "grafana"]);
+  });
+
+  test("lexicons not named go to --output when given, and are skipped otherwise", async () => {
+    await runBuild(ctx({ lexiconOutput: ["otel=a.yml"], output: "rest.json" }));
+    expect(buildCommandMock.mock.calls.map(([o]) => [o.serializers.map((s: Serializer) => s.name), o.output])).toEqual([
+      [["otel"], "a.yml"],
+      [["prometheus", "grafana"], "rest.json"],
+    ]);
+    buildCommandMock.mockClear();
+    await runBuild(ctx({ lexiconOutput: ["otel=a.yml"] }));
+    expect(buildCommandMock).toHaveBeenCalledTimes(1);
+  });
+
+  test("drops the 'No serializer found' warning for lexicons another file carries, and repeats nothing", async () => {
+    const warn = "No serializer found for lexicon \"grafana\"";
+    buildCommandMock.mockResolvedValue({ success: true, errors: [], warnings: [warn, "something else"], resourceCount: 1, fileCount: 1 });
+    const err = vi.spyOn(console, "error").mockImplementation(() => {});
+    await runBuild(ctx({ lexiconOutput: ["otel=a.yml", "prometheus=b.yml"] }));
+    const printed = err.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(printed).not.toContain("No serializer found");
+    expect(printed.match(/something else/g)).toHaveLength(1);
+  });
+
+  test("a failed build fails the command, and the other files are still written", async () => {
+    buildCommandMock.mockResolvedValueOnce({ success: false, errors: ["boom"], warnings: [], resourceCount: 0, fileCount: 0 });
+    const code = await runBuild(ctx({ lexiconOutput: ["otel=a.yml", "prometheus=b.yml"] }));
+    expect(code).toBe(1);
+    expect(buildCommandMock).toHaveBeenCalledTimes(2);
+  });
+
+  test("refuses a malformed spec, an unknown lexicon, a repeat, and --lexicon", async () => {
+    for (const a of [
+      { lexiconOutput: ["otel"] },
+      { lexiconOutput: ["otel="] },
+      { lexiconOutput: ["nope=a.yml"] },
+      { lexiconOutput: ["otel=a.yml", "otel=b.yml"] },
+      { lexiconOutput: ["otel=a.yml"], lexicon: "otel" },
+    ]) {
+      expect(await runBuild(ctx(a))).toBe(1);
+    }
+    expect(buildCommandMock).not.toHaveBeenCalled();
+  });
+});

package/src/cli/handlers/build.ts

@@ -65,6 +65,8 @@ async function runGenerateComponents(ctx: CommandContext): Promise<number> {
         output: args.output,
         params: args.param,
         paramsFile: args.paramsFile,
+        ...(args.waveGate ? { waveGate: { gate: args.waveGate, ...(args.canary?.length ? { canary: args.canary } : {}), ...(args.base ? { base: args.base } : {}) } } : {}),
+        ...(args.prLoop ? { prLoop: { ...(args.gate ? { gate: args.gate } : {}), ...(args.branch ? { branch: args.branch } : {}) } } : {}),
       });
     } catch (err) {
       console.error(formatError({ message: memberPipeline.describeError(err) }));
@@ -177,6 +179,72 @@ export async function runBuild(ctx: CommandContext): Promise<number> {
   // #1064 — `--param name=value`, repeated, into a flat { name: value } record.
   const params = parseParamFlags(args.param);
 
+  // `--lexicon-output <lexicon>=<path>`: each named lexicon builds into its own
+  // file. One build per file, over the same project, so every write, check and
+  // diagnostic path is the one a single-lexicon `--lexicon` build already takes.
+  if (args.lexiconOutput?.length) {
+    if (args.watch || args.lexicon) {
+      console.error(formatError({ message: "--lexicon-output cannot be combined with --watch or --lexicon" }));
+      return 1;
+    }
+    const targets = new Map<string, string>();
+    for (const spec of args.lexiconOutput) {
+      const eq = (spec ?? "").indexOf("=");
+      if (eq <= 0 || eq === spec.length - 1) {
+        console.error(formatError({ message: `Invalid --lexicon-output "${spec}". Expected <lexicon>=<path>.` }));
+        return 1;
+      }
+      const name = spec.slice(0, eq);
+      if (targets.has(name)) {
+        console.error(formatError({ message: `--lexicon-output names lexicon "${name}" twice.` }));
+        return 1;
+      }
+      if (!serializers.some((s) => s.name === name)) {
+        console.error(formatError({ message: `No serializer found for lexicon "${name}". Available: ${serializers.map((s) => s.name).join(", ")}. List the lexicon in chant.config.ts.` }));
+        return 1;
+      }
+      targets.set(name, spec.slice(eq + 1));
+    }
+    const groups: { serializers: typeof serializers; output: string }[] = [...targets].map(([name, output]) => ({
+      serializers: serializers.filter((s) => s.name === name),
+      output,
+    }));
+    const rest = serializers.filter((s) => !targets.has(s.name));
+    if (args.output && rest.length > 0) groups.push({ serializers: rest, output: args.output });
+
+    const seenWarnings = new Set<string>();
+    let failed = false;
+    // One build for every file: each group takes its own lexicons' outputs.
+    const sharedBuild = { serializers };
+    for (const group of groups) {
+      const { format, warning } = resolveBuildFormat(args.format, group.output);
+      if (warning) console.error(formatInfo(warning));
+      const result = await buildCommand({
+        path: args.path,
+        output: group.output,
+        format,
+        serializers: group.serializers,
+        sharedBuild,
+        plugins,
+        verbose: args.verbose,
+        env: args.env,
+        fold: args.fold,
+        sandbox: args.sandbox,
+        foldRank: args.foldRank,
+        foldRankCollapsedFile: args.foldRankCollapsedFile,
+        params: parseParamFlags(args.param),
+        paramsFile: args.paramsFile,
+      });
+      // The lexicons built by another group are not missing serializers.
+      const own = result.warnings.filter((w) => !w.includes("No serializer found for lexicon") && !seenWarnings.has(w));
+      for (const w of own) seenWarnings.add(w);
+      printWarnings(own);
+      printErrors(result.errors);
+      if (!result.success) failed = true;
+    }
+    return failed ? 1 : 0;
+  }
+
   if (args.watch) {
     const cleanup = buildCommandWatch({
       path: args.path,

package/src/cli/handlers/fan-out.test.ts

@@ -45,8 +45,9 @@ vi.mock("../../components/capability-plugin-loader", () => ({
  */
 vi.mock("../../op/gate", async () => {
   const actual = await vi.importActual<typeof import("../../op/gate")>("../../op/gate");
-  return { ...actual, gitGateLedgerPort: () => gateLedger };
+  return { ...actual, gitGateLedgerPort: () => gateLedger, gateIsSealed: async (gate: string) => sealedGates.has(gate) };
 });
+const sealedGates = new Set<string>();
 
 const { CapabilityRegistry } = await import("../../components/capability");
 const { memoryGateLedgerPort } = await import("../../op/gate");
@@ -105,6 +106,7 @@ let errSpy: ReturnType<typeof vi.spyOn>;
 let outSpy: ReturnType<typeof vi.spyOn>;
 
 beforeEach(() => {
+  sealedGates.clear();
   vi.clearAllMocks();
   ran = [];
   failing = [];
@@ -409,6 +411,14 @@ describe("proof: killed mid-fan-out, a re-run finishes without hand repair", ()
 });
 
 describe("proof: one approval covers the set, and the printed digest is what approves it", () => {
+  test("a sealed gate's approve line carries --sign after --plan (#3521)", async () => {
+    sealedGates.add("release");
+    const exit = await runComponentsFanOut(ctx({ base: "main", env: "test", gate: "release" }));
+
+    expect(exit).toBe(3);
+    expect(stderr()).toMatch(/approve : chant approve fan-out release --plan jcs1-sha256:[0-9a-f]{64} --sign/);
+  });
+
   test("an unapproved gate stops the whole fan-out before anything runs", async () => {
     const exit = await runComponentsFanOut(ctx({ base: "main", env: "test", gate: "release" }));
 
@@ -417,6 +427,7 @@ describe("proof: one approval covers the set, and the printed digest is what app
     const out = stderr();
     expect(out).toContain("gated: nothing ran.");
     expect(out).toMatch(/approve : chant approve fan-out release --plan jcs1-sha256:[0-9a-f]{64}/);
+    expect(out).not.toContain("--sign");
     // One pending fact for the whole set, not one per component.
     expect(gateLedger.appended).toHaveLength(1);
     expect(gateLedger.appended[0].planDigest).toBe(/plan: (jcs1-sha256:[0-9a-f]{64})/.exec(out)?.[1]);

package/src/cli/handlers/fan-out.ts

@@ -53,7 +53,7 @@ import { describeChangedWave, withWaveRecord, type WaveRecord } from "../../gate
 import { renderFanOutHuman, renderFanOutJson, renderFanOutPlan } from "../../components/fan-out-output";
 import { ndjsonProgressSink } from "../../components/run-progress";
 import { summaryLedgerPrefix, writeGatedRunSummary } from "../../op/gate-summary";
-import { approveCommand } from "../../op/gate";
+import { approveCommand, gateIsSealed } from "../../op/gate";
 import { getHeadCommit } from "../../lifecycle/git";
 import { remainingFanOut, type ChangedUnits, type FanOutProgress } from "../../components/fan-out";
 import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli";
@@ -405,7 +405,9 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
   // (#3049), the #2300 refusal on a set. Printed on stderr even under --json,
   // since it is the line a CI log reader is looking for.
   for (const wave of result.waves ?? []) {
-    if (wave.status === "gated" && wave.approved) console.error(formatWarning({ message: describeChangedWave(wave) }));
+    if (wave.status === "gated" && wave.approved) {
+      console.error(formatWarning({ message: describeChangedWave(wave, await gateIsSealed(wave.gate)) }));
+    }
   }
 
   // The same durable trace `chant run --components` leaves (#597), for the
@@ -429,10 +431,12 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
     const pending = result.gate;
     // The pending fact's own plan: the fan-out's digest for the gate over the
     // set, or a component's plan and environment for a gate inside one (#2574).
+    const sealed = await gateIsSealed(pending.gate);
     console.error(formatInfo(
-      `approve : ${approveCommand(pending.op, pending.gate, pending.environment)} --plan ${pending.planDigest ?? result.plan.digest}`,
+      `approve : ${approveCommand(pending.op, pending.gate, pending.environment, pending.planDigest ?? result.plan.digest, sealed)}`,
     ));
     writeGatedRunSummary({
+      sealed,
       op: pending.op,
       gate: pending.gate,
       ...(pending.description ? { description: pending.description } : {}),

package/src/cli/handlers/operator.ts

@@ -49,6 +49,7 @@ import {
 } from "../../op/gate-approval";
 import { approverOf, tallyGateApprovals } from "../../op/gate";
 import { FAN_OUT_GATE_OP, WORKSPACE_UPGRADE_GATE_OP } from "../../op/gate-name";
+import { PR_GATE_OP } from "../../pr-loop";
 import { pushLifecycle, requireLifecycleLedger } from "../../lifecycle/git";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
 import type { CommandContext } from "../registry";
@@ -134,8 +135,6 @@ async function collectOperatorSubscribers(
   }
 }
 
-/** A pull request's gate op, `pr-<number>` (#3183, `prOp` in ../../pr-loop.ts). */
-const PR_GATE_OP = /^pr-\d+$/;
 
 // ── chant operator ──────────────────────────────────────────────────────────