@intentius/chant 0.124.28 → 0.124.29

package/dist/lifecycle/retention.js

@@ -0,0 +1,400 @@
+/**
+ * Garbage collection of stored change sets, releases and run events by the
+ * retention policy (#4036). `chant lifecycle gc` runs it.
+ *
+ * What it prunes on `chant/lifecycle`, in every member's ledger at once:
+ *
+ *   _change-sets/<digest>.json          a stored change set (#4022)
+ *   _releases/<digest>.json             a release (#4026)
+ *   _releases/templates/<digest>.txt    template bytes no kept release names
+ *
+ * A prune is one new commit on the local branch that removes those files. It
+ * never rewrites or force-pushes history: other clones and tools read the
+ * branch, and every pruned file stays reachable in the commits before the
+ * prune. So a prune bounds the tree a reader walks at the tip, and the
+ * repository's history keeps growing by what is written. `git log -- <path>`
+ * on the branch still finds a pruned file.
+ *
+ * What it never touches: the ledgers. `_releases/cuts.jsonl`,
+ * `<env>/releases.jsonl`, `_gates/<op>.jsonl`, the run ledgers and every other
+ * `.jsonl` on the branch are append-only and are not edited (#4034), and a
+ * whole ledger file is not removed either: the latest deploy record of an
+ * environment, a gate's standing fact and a release's label all live in them,
+ * and they are small next to what they index (one line per fact). Nor does it
+ * touch snapshots, `_plans/`, `_builds/` or checkpoints, which have no policy
+ * yet. A cut line whose release was pruned stays, so its label keeps naming
+ * that digest and can't be given to another release.
+ *
+ * What is never pruned, whatever its age:
+ *
+ * 1. A release an environment runs: the release the latest deploy record of
+ *    each component in each environment names, by its `releaseDigest` or the
+ *    release gate resolution its admission names (`releaseOfDeploy`, #4043),
+ *    and that release's templates. A promotion picks up what the step before
+ *    runs (#4030), so this also keeps every release a promotion can take by
+ *    default.
+ * 2. What a pending gate binds: the change set (`planDigest`) and release
+ *    (`releaseDigest`) of every pending fact that has not expired.
+ * 3. A release still promotable: one whose commit has no `ci/revoked` tag and
+ *    that was cut within `releases.days`, or is among the newest
+ *    `releases.keep` releases of its member.
+ * 4. A change set a gate fact (an approval, an `empty` resolution or a
+ *    pending fact) names together with a release that is kept.
+ *
+ * Anything else is pruned once it is older than its kind's window: a change
+ * set `changeSets.days` after it was stored or last named by a gate fact,
+ * whichever is later. A file that can't be read as a release is kept.
+ *
+ * Run events are local files under `<git-common-dir>/chant/run-events/`
+ * (`../run-event-store.ts`) and are deleted outright.
+ */
+import { execFileSync } from "node:child_process";
+import { RefCASConflictError, writeLedgerFiles, pushLifecycleReport } from "./git.js";
+import { MEMBERS_DIR } from "./member-ledger.js";
+import { CHANGE_SETS_DIR } from "./change-set-store.js";
+import { CUTS_FILE, RELEASES_DIR, TEMPLATES_SUBDIR, parseCuts, parseRelease } from "./release-store.js";
+import { parseGateLedger } from "./gate-ledger.js";
+import { parseReleaseLedger, releaseLedgerLines } from "./release-read.js";
+import { latestPerComponent } from "./release-ledger.js";
+import { releaseOfDeploy } from "./release-join.js";
+import { RELEASE_GATE_OP } from "../op/gate-name.js";
+import { planRunEventPrune, pruneRunEvents } from "../run-event-store.js";
+const STATE_BRANCH = "chant/lifecycle";
+const DAY_MS = 86400000;
+function git(cwd, args, input) {
+    return execFileSync("git", args, { cwd, input, maxBuffer: 1024 * 1024 * 1024, stdio: ["pipe", "pipe", "pipe"] });
+}
+function branchTip(cwd) {
+    try {
+        return git(cwd, ["rev-parse", "--verify", "--quiet", `refs/heads/${STATE_BRANCH}`]).toString().trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+function listTree(cwd, tip) {
+    const out = [];
+    for (const line of git(cwd, ["ls-tree", "-r", "-l", "--full-tree", tip]).toString().split("\n")) {
+        const m = line.match(/^\d+ blob ([0-9a-f]+)\s+(\d+)\t(.+)$/);
+        if (m)
+            out.push({ sha: m[1], bytes: Number(m[2]), path: m[3] });
+    }
+    return out;
+}
+/** The text of each blob, read in one `git cat-file --batch`. */
+function readBlobs(cwd, shas) {
+    const out = new Map();
+    const unique = [...new Set(shas)];
+    if (unique.length === 0)
+        return out;
+    const buf = git(cwd, ["cat-file", "--batch"], `${unique.join("\n")}\n`);
+    let at = 0;
+    while (at < buf.length) {
+        const nl = buf.indexOf(0x0a, at);
+        if (nl < 0)
+            break;
+        const header = buf.subarray(at, nl).toString().split(" ");
+        at = nl + 1;
+        if (header[1] === "missing" || header.length < 3)
+            continue;
+        const size = Number(header[2]);
+        out.set(header[0], buf.subarray(at, at + size).toString("utf8"));
+        at += size + 1;
+    }
+    return out;
+}
+/** When each change set and release file was last added on the branch, newest add first, in one `git log`. */
+function storedTimes(cwd, tip) {
+    const out = new Map();
+    const text = git(cwd, [
+        "log", "--format=%x00%cI", "--name-only", "--diff-filter=A", tip, "--",
+        `:(top,glob)**/${CHANGE_SETS_DIR}/*.json`, `:(top,glob)**/${RELEASES_DIR}/*.json`,
+    ]).toString();
+    for (const chunk of text.split("\0")) {
+        const lines = chunk.split("\n").filter(Boolean);
+        const when = lines.shift();
+        if (!when)
+            continue;
+        for (const path of lines)
+            if (!out.has(path))
+                out.set(path, when);
+    }
+    return out;
+}
+/** Split a branch path into the member prefix (`_members/<a>/_members/<b>/`) and the rest. */
+export function splitLedgerPath(path) {
+    const segs = path.split("/");
+    const names = [];
+    let i = 0;
+    while (segs[i] === MEMBERS_DIR && i + 2 < segs.length) {
+        names.push(segs[i + 1]);
+        i += 2;
+    }
+    return { prefix: segs.slice(0, i).map((s) => `${s}/`).join(""), member: names.length > 0 ? names.join("/") : null, rest: segs.slice(i).join("/") };
+}
+/**
+ * The key a digest is matched by: its hex. A plan digest written `sha256:<hex>`
+ * names the same plan as `jcs1-sha256:<hex>` (`samePlanDigest`), and a file
+ * name writes `:` as `_`, so both sides are reduced to the hex.
+ */
+export function digestKey(digestOrStem) {
+    const hex = digestOrStem.match(/[0-9a-f]{64}$/);
+    return hex ? hex[0] : digestOrStem.replace(/:/g, "_");
+}
+const stemOf = (name, ext) => name.slice(0, -ext.length);
+const fileDigest = (name, ext) => stemOf(name, ext).replace(/_/g, ":");
+function emptySize() {
+    const z = () => ({ files: 0, bytes: 0 });
+    return { files: 0, bytes: 0, changeSets: z(), releases: z(), templates: z(), ledgers: z(), other: z() };
+}
+function sizeOf(files, kinds) {
+    const s = emptySize();
+    for (const f of files) {
+        s.files++;
+        s.bytes += f.bytes;
+        const kind = kinds.get(f.path);
+        const slot = kind === "change-set" ? s.changeSets : kind === "release" ? s.releases : kind === "template" ? s.templates : f.path.endsWith(".jsonl") ? s.ledgers : s.other;
+        slot.files++;
+        slot.bytes += f.bytes;
+    }
+    return s;
+}
+/**
+ * Decide what a prune of `chant/lifecycle` removes and keeps, by the rules at
+ * the top of this file. Reads the branch at its local tip and writes nothing.
+ */
+export function planLifecycleGc(input) {
+    const { cwd, policy, now } = input;
+    const revoked = input.revokedCommits ?? new Set();
+    const tip = branchTip(cwd);
+    if (!tip)
+        return { tip: null, remove: [], keep: [], before: emptySize(), after: emptySize() };
+    const files = listTree(cwd, tip);
+    const stored = storedTimes(cwd, tip);
+    const members = new Map();
+    const kinds = new Map();
+    const ledgerOf = (prefix, member) => {
+        let m = members.get(prefix);
+        if (!m) {
+            m = { prefix, member, changeSets: new Map(), releases: new Map(), templates: new Map(), cuts: null, gates: [], deploys: [] };
+            members.set(prefix, m);
+        }
+        return m;
+    };
+    for (const f of files) {
+        const { prefix, member, rest } = splitLedgerPath(f.path);
+        const segs = rest.split("/");
+        const name = segs.at(-1);
+        const entry = (kind, digest) => {
+            kinds.set(f.path, kind);
+            return { kind, member, path: f.path, digest, bytes: f.bytes, sha: f.sha, storedAt: stored.get(f.path) ?? null };
+        };
+        if (segs.length === 2 && segs[0] === CHANGE_SETS_DIR && name.endsWith(".json")) {
+            const e = entry("change-set", fileDigest(name, ".json"));
+            ledgerOf(prefix, member).changeSets.set(digestKey(stemOf(name, ".json")), e);
+        }
+        else if (segs.length === 2 && segs[0] === RELEASES_DIR && name.endsWith(".json")) {
+            const e = entry("release", fileDigest(name, ".json"));
+            ledgerOf(prefix, member).releases.set(digestKey(stemOf(name, ".json")), e);
+        }
+        else if (segs.length === 3 && segs[0] === RELEASES_DIR && segs[1] === TEMPLATES_SUBDIR && name.endsWith(".txt")) {
+            const e = entry("template", fileDigest(name, ".txt"));
+            ledgerOf(prefix, member).templates.set(digestKey(stemOf(name, ".txt")), e);
+        }
+        else if (segs.length === 2 && segs[0] === RELEASES_DIR && name === CUTS_FILE) {
+            ledgerOf(prefix, member).cuts = f;
+        }
+        else if (segs.length === 2 && segs[0] === "_gates" && name.endsWith(".jsonl")) {
+            ledgerOf(prefix, member).gates.push(f);
+        }
+        else if (segs.length === 2 && name === "releases.jsonl" && !segs[0].startsWith("_")) {
+            ledgerOf(prefix, member).deploys.push({ env: segs[0], file: f });
+        }
+    }
+    const blobs = readBlobs(cwd, [...members.values()].flatMap((m) => [...m.releases.values()].map((r) => r.sha).concat(m.cuts ? [m.cuts.sha] : [], m.gates.map((g) => g.sha), m.deploys.map((d) => d.file.sha))));
+    const keep = [];
+    const remove = [];
+    const nowMs = now.getTime();
+    for (const m of members.values()) {
+        const reasons = new Map();
+        const keepFile = (f, reason) => {
+            if (!f)
+                return;
+            reasons.set(f, [...(reasons.get(f) ?? []), reason]);
+        };
+        // The gate facts of every op in the member.
+        const pending = [];
+        const resolutions = [];
+        let releaseGateResolutions = [];
+        for (const g of m.gates) {
+            const parsed = parseGateLedger(blobs.get(g.sha) ?? "");
+            pending.push(...parsed.pending);
+            resolutions.push(...parsed.resolutions);
+            if (g.path.endsWith(`/${RELEASE_GATE_OP}.jsonl`) || g.path === `_gates/${RELEASE_GATE_OP}.jsonl`)
+                releaseGateResolutions = parsed.resolutions;
+        }
+        // Releases, parsed.
+        const parsed = new Map();
+        for (const r of m.releases.values()) {
+            const release = parseRelease(blobs.get(r.sha) ?? "");
+            parsed.set(r, release && digestKey(release.releaseDigest) === digestKey(r.digest) ? release : null);
+        }
+        // Rule 1: what each environment runs.
+        for (const { env, file } of m.deploys) {
+            const { records } = parseReleaseLedger(releaseLedgerLines(blobs.get(file.sha) ?? null));
+            for (const record of latestPerComponent(records).values()) {
+                const digest = releaseOfDeploy(record, releaseGateResolutions);
+                if (digest !== undefined)
+                    keepFile(m.releases.get(digestKey(digest)), { code: "deployed", detail: `${env}/${record.component}` });
+            }
+        }
+        // Rule 2: what a pending gate binds, until its fact expires.
+        for (const p of pending) {
+            if (new Date(p.expiresAt).getTime() <= nowMs)
+                continue;
+            const detail = `${p.op}/${p.gate}${p.environment ? ` in ${p.environment}` : ""}`;
+            if (p.planDigest)
+                keepFile(m.changeSets.get(digestKey(p.planDigest)), { code: "pending-gate", detail });
+            if (p.releaseDigest)
+                keepFile(m.releases.get(digestKey(p.releaseDigest)), { code: "pending-gate", detail });
+        }
+        // Rule 3: a release still promotable.
+        const { cuts } = parseCuts(m.cuts ? (blobs.get(m.cuts.sha) ?? null) : null);
+        const cutAt = new Map();
+        for (const c of cuts) {
+            const k = digestKey(c.releaseDigest);
+            if (!cutAt.has(k) || c.timestamp > cutAt.get(k))
+                cutAt.set(k, c.timestamp);
+        }
+        const releaseCutoff = nowMs - policy.releases.days * DAY_MS;
+        const promotable = [];
+        for (const [k, file] of m.releases) {
+            const release = parsed.get(file);
+            if (!release) {
+                keepFile(file, { code: "unreadable" });
+                continue;
+            }
+            if (revoked.has(release.commit))
+                continue;
+            const when = cutAt.get(k) ?? file.storedAt;
+            promotable.push({ file, at: when ? new Date(when).getTime() : Number.POSITIVE_INFINITY });
+        }
+        promotable.sort((a, b) => b.at - a.at || (a.file.path < b.file.path ? -1 : 1));
+        promotable.forEach(({ file, at }, i) => {
+            if (i < policy.releases.keep)
+                keepFile(file, { code: "newest" });
+            if (at >= releaseCutoff)
+                keepFile(file, { code: "within-window" });
+        });
+        const keptReleases = new Set([...m.releases.values()].filter((r) => reasons.has(r)));
+        const keptKeys = new Set([...keptReleases].map((r) => digestKey(r.digest)));
+        // Templates follow the releases that name them.
+        const unreadableKept = [...keptReleases].some((r) => parsed.get(r) === null);
+        for (const r of keptReleases) {
+            const release = parsed.get(r);
+            if (!release)
+                continue;
+            for (const t of release.targets)
+                for (const tpl of t.templates)
+                    keepFile(m.templates.get(digestKey(tpl.digest)), { code: "kept-release", detail: r.digest });
+        }
+        if (unreadableKept)
+            for (const t of m.templates.values())
+                keepFile(t, { code: "unreadable", detail: "a release file of this member can't be read" });
+        // Rule 4, and the change-set window.
+        const lastNamed = new Map();
+        for (const fact of [...pending, ...resolutions]) {
+            if (!fact.planDigest)
+                continue;
+            const k = digestKey(fact.planDigest);
+            const t = new Date(fact.timestamp).getTime();
+            if (!lastNamed.has(k) || t > lastNamed.get(k))
+                lastNamed.set(k, t);
+            if (fact.releaseDigest && keptKeys.has(digestKey(fact.releaseDigest)))
+                keepFile(m.changeSets.get(k), { code: "kept-release", detail: fact.releaseDigest });
+        }
+        const changeSetCutoff = nowMs - policy.changeSets.days * DAY_MS;
+        for (const [k, file] of m.changeSets) {
+            const storedMs = file.storedAt ? new Date(file.storedAt).getTime() : Number.POSITIVE_INFINITY;
+            const last = Math.max(storedMs, lastNamed.get(k) ?? Number.NEGATIVE_INFINITY);
+            if (last >= changeSetCutoff)
+                keepFile(file, { code: "within-window" });
+        }
+        for (const f of [...m.changeSets.values(), ...m.releases.values(), ...m.templates.values()]) {
+            const why = reasons.get(f);
+            if (why)
+                keep.push({ ...f, reasons: dedupe(why) });
+            else
+                remove.push(f);
+        }
+    }
+    const byPath = (a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    remove.sort(byPath);
+    keep.sort(byPath);
+    const removed = new Set(remove.map((f) => f.path));
+    return { tip, remove, keep, before: sizeOf(files, kinds), after: sizeOf(files.filter((f) => !removed.has(f.path)), kinds) };
+}
+function dedupe(reasons) {
+    const seen = new Set();
+    return reasons.filter((r) => {
+        const k = `${r.code}\0${r.detail ?? ""}`;
+        if (seen.has(k))
+            return false;
+        seen.add(k);
+        return true;
+    });
+}
+/** The commit message of a prune. */
+export function pruneMessage(remove) {
+    const n = (kind) => remove.filter((f) => f.kind === kind).length;
+    return `Retention: remove ${n("change-set")} change set(s), ${n("release")} release(s) and ${n("template")} template(s)`;
+}
+const PRUNE_ATTEMPTS = 5;
+/**
+ * Plan and, unless `dryRun`, carry out a prune: one commit on the local
+ * `chant/lifecycle` that removes what the plan lets go, and the run event
+ * files it lets go deleted. The commit is planned against the tip it is
+ * written on: if the branch moved in between, the plan is made again. It is
+ * pushed only when `push` is set.
+ */
+export async function runLifecycleGc(input) {
+    let plan = planLifecycleGc(input);
+    let commit = null;
+    if (!input.dryRun && plan.tip && plan.remove.length > 0) {
+        for (let attempt = 1;; attempt++) {
+            const removals = plan.remove.map((f) => ({ path: f.path, remove: true, expectPriorSha: f.sha }));
+            try {
+                commit = await writeLedgerFiles(removals, pruneMessage(plan.remove), { cwd: input.cwd, expectTip: plan.tip });
+                break;
+            }
+            catch (err) {
+                if (!(err instanceof RefCASConflictError) || attempt >= PRUNE_ATTEMPTS)
+                    throw err;
+                plan = planLifecycleGc(input);
+                if (!plan.tip || plan.remove.length === 0)
+                    break;
+            }
+        }
+    }
+    let pushed = false;
+    let pushWarning;
+    if (commit && input.push) {
+        const r = await pushLifecycleReport({ cwd: input.cwd });
+        pushed = r.pushed;
+        pushWarning = r.pushWarning;
+    }
+    const events = await planRunEventPrune(input.cwd, input.policy.runEvents, input.now);
+    const deleted = input.dryRun ? 0 : pruneRunEvents(events);
+    return {
+        now: input.now.toISOString(),
+        policy: input.policy,
+        dryRun: input.dryRun,
+        lifecycle: { ...plan, commit, pushed, ...(pushWarning ? { pushWarning } : {}) },
+        runEvents: {
+            dir: events.dir,
+            remove: events.remove,
+            kept: { files: events.keep.length, bytes: events.keep.reduce((n, f) => n + f.bytes, 0) },
+            deleted,
+        },
+    };
+}

package/dist/plan-summary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan-summary.d.ts","sourceRoot":"","sources":["../src/plan-summary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAsB,iBAAiB,EAAmC,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEjJ,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,0FAA0F,CAAC;AAE9H,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAE3C,+EAA+E;AAC/E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEpD,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,kGAAkG;IAClG,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,iHAAiH;IACjH,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,qHAAqH;AACrH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,kFAAkF;AAClF,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAExD,MAAM,WAAW,gBAAgB;IAC/B,gHAAgH;IAChH,EAAE,EAAE,MAAM,CAAC;IACX,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,yDAAyD;IACzD,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACrC,qGAAqG;IACrG,WAAW,CAAC,EAAE,IAAI,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,sBAAsB,CAAC;IACvC,QAAQ,EAAE,OAAO,qBAAqB,CAAC;IACvC,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,6GAA6G;IAC7G,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,+FAA+F;IAC/F,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,mGAAmG;IACnG,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACrC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,6IAA6I;IAC7I,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AA6ED,+HAA+H;AAC/H,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA6BnF;AA2BD,6DAA6D;AAC7D,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAoSD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,GAAE,qBAA0B,GAAG,WAAW,CA2BvG;AAUD,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAW1D;AAqCD,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAmC5D;AAED,MAAM,WAAW,qBAAqB;IACpC,iGAAiG;IACjG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,CA2DrG"}
+{"version":3,"file":"plan-summary.d.ts","sourceRoot":"","sources":["../src/plan-summary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAsB,iBAAiB,EAAmC,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEjJ,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,0FAA0F,CAAC;AAE9H,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAE3C,+EAA+E;AAC/E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEpD,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,kGAAkG;IAClG,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,iHAAiH;IACjH,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,qHAAqH;AACrH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,kFAAkF;AAClF,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAExD,MAAM,WAAW,gBAAgB;IAC/B,gHAAgH;IAChH,EAAE,EAAE,MAAM,CAAC;IACX,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,yDAAyD;IACzD,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACrC,qGAAqG;IACrG,WAAW,CAAC,EAAE,IAAI,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,sBAAsB,CAAC;IACvC,QAAQ,EAAE,OAAO,qBAAqB,CAAC;IACvC,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,6GAA6G;IAC7G,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,+FAA+F;IAC/F,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,mGAAmG;IACnG,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACrC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,6IAA6I;IAC7I,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AA6ED,+HAA+H;AAC/H,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA6BnF;AA2BD,6DAA6D;AAC7D,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAoSD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,GAAE,qBAA0B,GAAG,WAAW,CA2BvG;AAUD,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAW1D;AA4CD,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAmC5D;AAED,MAAM,WAAW,qBAAqB;IACpC,iGAAiG;IACjG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,CA2DrG"}

package/dist/plan-summary.js

@@ -542,8 +542,14 @@ function groupTitle(s, g) {
         t += " (outlier)";
     if (g.provisional)
         t += " (provisional)";
-    if (g.noChanges)
-        t += ", no changes";
+    if (g.noChanges) {
+        // A member with holes planned no entries, but its plan says nothing about
+        // what the holes cover, so the group cannot say "no changes" for it
+        // (#4084). Only the heading says so: the group and its id are unchanged.
+        const holed = s.unit === "member" ? new Set(s.holes.map((h) => h.member)) : new Set();
+        const unknown = g.units.filter((u) => holed.has(u)).length;
+        t += unknown > 0 ? `, no changes known: ${unknown} with holes, listed above` : ", no changes";
+    }
     else if (g.extends)
         t += `, group ${g.extends}'s change plus`;
     else if (g.units.length > 1)

package/dist/pr-loop.d.ts

@@ -180,6 +180,13 @@ export interface PrReport {
 }
 /** The counts a member's entries add up to. */
 export declare function memberCounts(doc: Pick<ChangeSetDocument, "summary">, member: string): PrMemberCounts;
+/**
+ * Why a member's plan cannot say everything it will change: its holes'
+ * reasons, each once, in order (#4084). A `cfn-deploy` member whose inputs
+ * come from a stack the same run applies first says `inputs from <stack>;
+ * re-checked on apply`.
+ */
+export declare function memberHoleReasons(report: Pick<PrReport, "changeSet">, member: string): string[];
 /** The approve command a reviewer runs for this report's digest. */
 export declare function prApproveCommand(report: Pick<PrReport, "op" | "gate" | "digest">, approver?: string): string;
 /**

package/dist/pr-loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-loop.d.ts","sourceRoot":"","sources":["../src/pr-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAmB,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGvE,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,oFAAoF,CAAC;AAErH,oDAAoD;AACpD,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,mFAAmF;AACnF,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC;;;GAGG;AACH,wBAAgB,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8HAA8H;AAC9H,eAAO,MAAM,UAAU,QAAqC,CAAC;AAE7D,+GAA+G;AAC/G,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB;aAAK,IAAI,EAAE,YAAY;aAAE,KAAK,EAAE,aAAa;CAAW,CAAC;AAExF,0GAA0G;AAC1G,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+BAA+B;AAC/B,MAAM,MAAM,cAAc;AACxB,2EAA2E;AACzE,SAAS;AACX,uBAAuB;GACrB,aAAa;AACf,iCAAiC;GAC/B,SAAS;AACX,wBAAwB;GACtB,QAAQ;AACV,yDAAyD;GACvD,SAAS,CAAC;AAEd,MAAM,WAAW,QAAQ;IACvB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3C,gCAAgC;IAChC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yBAAyB;AACzB,MAAM,MAAM,QAAQ;AAClB,wCAAwC;AACtC,SAAS;AACX,sFAAsF;GACpF,aAAa;AACf,6DAA6D;GAC3D,SAAS;AACX,yCAAyC;GACvC,SAAS;AACX,yEAAyE;GACvE,QAAQ;AACV,mDAAmD;GACjD,SAAS,CAAC;AAEd,4BAA4B;AAC5B,MAAM,MAAM,SAAS;AACnB,4DAA4D;AAC1D,cAAc;AAChB,6EAA6E;GAC3E,cAAc;AAChB,qFAAqF;GACnF,gBAAgB;AAClB,2EAA2E;GACzE,iBAAiB,CAAC;AAEtB;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,OAAO,mBAAmB,CAAC;IACpC,QAAQ,EAAE,OAAO,kBAAkB,CAAC;IACpC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,oDAAoD;IACpD,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChC,QAAQ,EAAE,UAAU,CAAC;IACrB,mIAAmI;IACnI,SAAS,EAAE;QACT,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,4DAA4D;QAC5D,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;KACnB,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,iBAAiB,CAAC;CAC9B;AAED,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAIpG;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,QAAQ,CAAC,EAAE,QAAQ,SAAU,GAAG,MAAM,CAE7G;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC,GAAG,MAAM,CAMzG;AAuDD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAiC1G;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CA6B5D;AAED,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAIjF"}
+{"version":3,"file":"pr-loop.d.ts","sourceRoot":"","sources":["../src/pr-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAmB,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGvE,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,oFAAoF,CAAC;AAErH,oDAAoD;AACpD,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,mFAAmF;AACnF,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC;;;GAGG;AACH,wBAAgB,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8HAA8H;AAC9H,eAAO,MAAM,UAAU,QAAqC,CAAC;AAE7D,+GAA+G;AAC/G,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB;aAAK,IAAI,EAAE,YAAY;aAAE,KAAK,EAAE,aAAa;CAAW,CAAC;AAExF,0GAA0G;AAC1G,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+BAA+B;AAC/B,MAAM,MAAM,cAAc;AACxB,2EAA2E;AACzE,SAAS;AACX,uBAAuB;GACrB,aAAa;AACf,iCAAiC;GAC/B,SAAS;AACX,wBAAwB;GACtB,QAAQ;AACV,yDAAyD;GACvD,SAAS,CAAC;AAEd,MAAM,WAAW,QAAQ;IACvB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3C,gCAAgC;IAChC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yBAAyB;AACzB,MAAM,MAAM,QAAQ;AAClB,wCAAwC;AACtC,SAAS;AACX,sFAAsF;GACpF,aAAa;AACf,6DAA6D;GAC3D,SAAS;AACX,yCAAyC;GACvC,SAAS;AACX,yEAAyE;GACvE,QAAQ;AACV,mDAAmD;GACjD,SAAS,CAAC;AAEd,4BAA4B;AAC5B,MAAM,MAAM,SAAS;AACnB,4DAA4D;AAC1D,cAAc;AAChB,6EAA6E;GAC3E,cAAc;AAChB,qFAAqF;GACnF,gBAAgB;AAClB,2EAA2E;GACzE,iBAAiB,CAAC;AAEtB;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,OAAO,mBAAmB,CAAC;IACpC,QAAQ,EAAE,OAAO,kBAAkB,CAAC;IACpC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,oDAAoD;IACpD,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChC,QAAQ,EAAE,UAAU,CAAC;IACrB,mIAAmI;IACnI,SAAS,EAAE;QACT,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,4DAA4D;QAC5D,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;KACnB,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,iBAAiB,CAAC;CAC9B;AAED,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAIpG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAG/F;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,QAAQ,CAAC,EAAE,QAAQ,SAAU,GAAG,MAAM,CAE7G;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC,GAAG,MAAM,CAMzG;AAuDD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAyC1G;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CA+B5D;AAED,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAIjF"}

package/dist/pr-loop.js

@@ -68,6 +68,16 @@ export function memberCounts(doc, member) {
     const n = (a) => by[a] ?? 0;
     return { create: n("create"), update: n("update"), replace: n("replace"), delete: n("delete") };
 }
+/**
+ * Why a member's plan cannot say everything it will change: its holes'
+ * reasons, each once, in order (#4084). A `cfn-deploy` member whose inputs
+ * come from a stack the same run applies first says `inputs from <stack>;
+ * re-checked on apply`.
+ */
+export function memberHoleReasons(report, member) {
+    const m = report.changeSet.members.find((x) => x.member === member);
+    return [...new Set((m?.holes ?? []).map((h) => h.reason))];
+}
 /** The approve command a reviewer runs for this report's digest. */
 export function prApproveCommand(report, approver = "<you>") {
     return `chant approve ${report.op} ${report.gate} --plan ${report.digest} --approver ${approver} --sign`;
@@ -144,8 +154,15 @@ export function renderPrNote(report, options = {}) {
     if (report.members.length > 0) {
         out.push("", "| Member | Component | Status | Create | Update | Replace | Delete |", "|---|---|---|---:|---:|---:|---:|");
         for (const m of report.members) {
-            const status = STATUS_WORDS[m.status] + (m.inputsMoved?.length ? `, inputs from ${m.inputsMoved.join(", ")} moved` : "");
-            out.push(`| ${code(m.member)} | ${m.component} | ${status} | ${m.counts.create} | ${m.counts.update} | ${m.counts.replace} | ${m.counts.delete} |`);
+            const holes = memberHoleReasons(report, m.member);
+            const status = STATUS_WORDS[m.status] +
+                (m.inputsMoved?.length ? `, inputs from ${m.inputsMoved.join(", ")} moved` : "") +
+                (holes.length > 0 ? `; ${holes.length > 2 ? `${holes[0]}; and ${holes.length - 1} more, listed under Holes` : holes.join("; ")}` : "");
+            // A member whose plan has holes and no entries says nothing about what
+            // it changes, so its counts are unknown, not zero (#4084).
+            const unknown = holes.length > 0 && !report.changeSet.entries.some((e) => e.member === m.member);
+            const n = (k) => (unknown ? "?" : String(m.counts[k]));
+            out.push(`| ${code(m.member)} | ${m.component} | ${status} | ${n("create")} | ${n("update")} | ${n("replace")} | ${n("delete")} |`);
         }
         if (report.members.some((m) => m.inputsMoved?.length)) {
             out.push("", "A member whose inputs moved applied the plan it was approved with. The next run plans it against the new values.");
@@ -175,9 +192,11 @@ export function prStatusDescription(report) {
         case "nothing":
             text = "nothing to plan";
             break;
-        case "planned":
-            text = `${n} member${n === 1 ? "" : "s"}: ${sum.change} to change, ${sum.destroy} to destroy or replace${digest}`;
+        case "planned": {
+            const unknown = report.members.filter((m) => memberHoleReasons(report, m.member).length > 0).length;
+            text = `${n} member${n === 1 ? "" : "s"}: ${sum.change} to change, ${sum.destroy} to destroy or replace${unknown > 0 ? `, ${unknown} with holes` : ""}${digest}`;
             break;
+        }
         case "plan-failed":
             text = `a member failed to plan${digest}`;
             break;

package/dist/pr-report-url.d.ts

@@ -0,0 +1,82 @@
+/**
+ * `pr-plan --report-url` and `pr-apply --report-url` (#4007): copy a stage's
+ * report, its change set and its run events where a reader outside CI can
+ * fetch them, keyed by pull request and commit.
+ *
+ * ```
+ * <url>/<pr>/<commit>/pr-<stage>.json
+ * <url>/<pr>/<commit>/change-set.json
+ * <url>/<pr>/<commit>/pr-<stage>.events.jsonl   (with --events-json)
+ * ```
+ *
+ * `<pr>` is the pull or merge request number, or `unknown` when pr-apply
+ * found none, and `<commit>` is the full sha the stage ran on: the pull
+ * request's head for pr-plan, the pushed commit for pr-apply. A workspace
+ * member's loop (`--member`) adds `/<member>` after the commit. There is no
+ * index: a reader that knows the pull request and the commit knows the key.
+ * The events file is named for its stage because pr-plan and pr-apply run on
+ * the same commit when a pull request merges by fast-forward.
+ *
+ * The events file is uploaded again, whole, each time a wave, a component or
+ * the run settles, so a reader polling the URL sees each wave as it applies.
+ * One upload of it is in flight at a time: a settle while one is in flight
+ * asks for one more after it, with everything written by then. A failed
+ * upload is a warning and the run goes on. The last upload, after the run
+ * settles, carries the whole stream, and the report and the change set go
+ * with it.
+ *
+ * Two schemes. `file://<dir>` writes under a directory, each file through a
+ * temporary name and a rename, so a reader never sees half a file. `s3://
+ * <bucket>/<prefix>` runs the AWS CLI (`aws s3 cp - <s3 url>`, the body on
+ * its stdin), which reads its credentials, region and endpoint from the
+ * environment the job gives it, the way the aws lexicon's `s3-sync` does.
+ * chant passes it no credential and prints none: a failed upload prints the
+ * CLI's own error line.
+ */
+/** Where `--report-url` points. */
+export type ReportTarget = {
+    scheme: "file";
+    url: string;
+    dir: string;
+} | {
+    scheme: "s3";
+    url: string;
+    bucket: string;
+    prefix: string;
+};
+/** `--report-url` read, or why it can't be. */
+export declare function parseReportUrl(raw: string): ReportTarget | {
+    error: string;
+};
+/** The key a stage's files are kept under, below the URL: `<pr>/<commit>[/<member>]`. */
+export declare function reportKey(pr: number | null, commit: string, member?: string): string;
+/** The events file of a stage. */
+export declare const reportEventsFile: (stage: "plan" | "apply") => string;
+/** Puts one object: `key` below the URL. Rejects with a line a person can read. */
+export type ReportPut = (key: string, body: string, contentType: string) => Promise<void>;
+/** Runs the AWS CLI with `args` and `stdin`, rejecting with its error line on a non-zero exit. */
+export type AwsCli = (args: string[], stdin: string) => Promise<void>;
+/** The AWS CLI on PATH. */
+export declare const realAwsCli: AwsCli;
+/** A put for `target`. `aws` replaces the AWS CLI in a test. */
+export declare function reportPut(target: ReportTarget, aws?: AwsCli): ReportPut;
+/** A stage's upload: its events as they are written, and its files at the end. */
+export interface PrReportUpload {
+    /** The folder the stage's files go to: `<url>/<key>`. */
+    readonly where: string;
+    /** One line of the stage's run-event stream. A wave, component or run settle uploads the events. */
+    line(line: string): void;
+    /** A file to upload when the stage closes, replacing one of the same name. */
+    file(name: string, body: string): void;
+    /** Wait for the upload in flight, then upload the whole stream and the files. Never throws. */
+    close(): Promise<void>;
+}
+/** Open a stage's upload to `target` under `key`. `warn` prints a warning line. */
+export declare function openPrReportUpload(input: {
+    target: ReportTarget;
+    key: string;
+    stage: "plan" | "apply";
+    warn: (message: string) => void;
+    put?: ReportPut;
+}): PrReportUpload;
+//# sourceMappingURL=pr-report-url.d.ts.map

package/dist/pr-report-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-report-url.d.ts","sourceRoot":"","sources":["../src/pr-report-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAOH,mCAAmC;AACnC,MAAM,MAAM,YAAY,GACpB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAkB5E;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,kCAAkC;AAClC,eAAO,MAAM,gBAAgB,UAAW,MAAM,GAAG,OAAO,KAAG,MAAoC,CAAC;AAEhG,mFAAmF;AACnF,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1F,kGAAkG;AAClG,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAItE,2BAA2B;AAC3B,eAAO,MAAM,UAAU,EAAE,MAmBrB,CAAC;AAEL,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,GAAE,MAAmB,GAAG,SAAS,CAcnF;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oGAAoG;IACpG,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,8EAA8E;IAC9E,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,+FAA+F;IAC/F,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAQD,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB,GAAG,cAAc,CA6DjB"}