@intentius/chant 0.124.28 → 0.124.29

package/src/components/release-compile.ts

@@ -28,7 +28,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
 import { loadChantConfig, type ChantConfig } from "../config";
-import { resolveCliBuildParams } from "../cli/build-params-cli";
+import { resolveFlaggedBuildParams } from "../flag-params";
 import { discoverComponents } from "./discover";
 import { withoutDisabled } from "./cli-support";
 import { applyConfigDefaults } from "./config-defaults";
@@ -72,6 +72,13 @@ export interface CompiledTarget {
   components: string[];
   /** Each component's build-time steps, as declared for this environment, in composition order. */
   buildSteps: Record<string, unknown[]>;
+  /**
+   * Each component's publish steps (`PUBLISH_STEP_KINDS`), as declared for
+   * this environment, in composition order (#4027). The cut's dry run shows
+   * them as what each environment's deploy publishes. Absent from a compiler
+   * that does not report them.
+   */
+  publishSteps?: Record<string, unknown[]>;
   /** For each component, the files its build steps read, relative to the member's directory. Used to tell whether an artifact's source changed. */
   buildInputs: Record<string, string[]>;
   /** For each component, the file that declares it, relative to the member's directory. */
@@ -132,6 +139,11 @@ export function buildStepsOf(component: DriverComponent): DriverStep[] {
   return stepsOf(component.deploy).map((s) => s.step).filter((s) => BUILD_STEP_KINDS.includes(s.kind));
 }
 
+/** A component's publish steps ({@link PUBLISH_STEP_KINDS}), each as declared, in composition order. */
+export function publishStepsOf(component: DriverComponent): DriverStep[] {
+  return stepsOf(component.deploy).map((s) => s.step).filter((s) => PUBLISH_STEP_KINDS.includes(s.kind));
+}
+
 /** The literal paths a component's archive steps read: `docker-build`'s `context` and `dockerfile`, `zip-package`'s `source`, `jvm-build`'s `path`. */
 export function buildInputPaths(component: DriverComponent): string[] {
   const out: string[] = [];
@@ -201,10 +213,11 @@ async function loadComponents(
   env: string,
 ): Promise<{ config: ChantConfig; params: ReleaseParam[]; declared: number; components: Array<{ component: DriverComponent; file: string }> }> {
   const { config } = await loadChantConfig(inputs.projectDir).catch(() => ({ config: {} as ChantConfig }));
-  const resolved = resolveCliBuildParams(config.buildParams, {
+  // #4024: a workspace member's flag records back their parameters, so a flag's value is a param with source flag:<name>.
+  const resolved = await resolveFlaggedBuildParams(inputs.projectDir, config.buildParams, {
     ...(inputs.params ? { cli: inputs.params } : {}),
     ...(inputs.paramsFile ? { paramsFile: inputs.paramsFile.replaceAll("{env}", env) } : {}),
-  });
+  }, env);
   if (!resolved.success) throw new ReleaseCompileError(`build parameters for "${env}" did not resolve:\n${resolved.errors.join("\n")}`);
   const discovered = await discoverComponents(inputs.projectDir, { buildParams: resolved.provenance });
   if (discovered.errors.length > 0) throw new ReleaseCompileError(discovered.errors.map((e) => e.message).join("\n"));
@@ -267,6 +280,7 @@ export async function compileEnvironment(inputs: CompileInputs, env: string): Pr
     params,
     components: components.map((c) => c.component.name),
     buildSteps: Object.fromEntries(components.map(({ component }) => [component.name, buildStepsOf(component)])),
+    publishSteps: Object.fromEntries(components.map(({ component }) => [component.name, publishStepsOf(component)])),
     buildInputs: Object.fromEntries(components.map(({ component }) => [component.name, buildInputPaths(component)])),
     componentFiles: Object.fromEntries(components.map(({ component, file }) => [component.name, rel(file)])),
     templates,

package/src/components/release-gate.ts

@@ -47,14 +47,16 @@
  * environment has no deploy of the component). When they are all equal the
  * member has no entries. When the environment's deploy names no release, or
  * the release it names can't be read, the member has a hole: nothing says
- * what the environment runs, so the change can't be shown empty.
+ * what the environment runs, so the change can't be shown empty. So does a
+ * component a promote, rollback or redeploy left failed or gated with nothing
+ * recorded since (#4035): its record names what ran before that run.
  */
 
 import type { CapabilityRegistry } from "./capability";
 import { deployContext, resolveComponentGraph, resolveStepInput, type DriverComponent, type DriverGate, type DriverPhase, type DriverStep } from "./driver";
 import { componentPlanDigest } from "./gate-plan";
 import { gateName, RELEASE_GATE_OP } from "../op/gate-name";
-import { capabilitySteps, readComponentOutputs } from "./wave-plan";
+import { capabilitySteps, planContext, readComponentOutputs } from "./wave-plan";
 import {
   composeChangeSet,
   isEmptyChangeSet,
@@ -111,6 +113,12 @@ export interface ReleaseChangeSetInput {
   registry: CapabilityRegistry;
   /** Per component, what `env` runs now. A component missing here has never been deployed to it. */
   current: ReadonlyMap<string, CurrentDeploy>;
+  /**
+   * Components a promote, rollback or redeploy left failed or gated in `env`
+   * with nothing recorded since (#4035), each with why. What they run is not
+   * known, so each is a hole whatever its ledger record says.
+   */
+  unsettled?: ReadonlyMap<string, string>;
   /** Outputs supplied by the caller (`--seed-outputs`). */
   seededOutputs?: Record<string, Record<string, unknown>>;
   /** The chant version to record in the document. */
@@ -151,6 +159,8 @@ export function chantComponentPart(input: {
   env: string;
   digest: string;
   current: CurrentDeploy | undefined;
+  /** Why the component is unsettled in `env` (#4035), when it is. */
+  unsettled?: string;
 }): ChangeSetPart {
   const { component, release, env, digest, current } = input;
   const name = component.name;
@@ -184,6 +194,10 @@ export function chantComponentPart(input: {
       },
     ],
   });
+  if (input.unsettled !== undefined) {
+    member.holes.push({ address: name, type: RELEASE_COMPONENT_ENTRY_TYPE, reason: input.unsettled });
+    return { member, entries: [] };
+  }
   if (!current) {
     return entry("create", [
       { path: "artifact", after: digest },
@@ -238,7 +252,7 @@ export async function planReleaseChangeSet(input: ReleaseChangeSetInput): Promis
     const digest = input.digests.get(name) ?? "";
     const plannable = capabilitySteps(component.deploy).filter((s) => registry.has(s.kind) && registry.resolve(s.kind).plan !== undefined);
     if (plannable.length === 0) {
-      parts.push(chantComponentPart({ component, release, env, digest, current: input.current.get(name) }));
+      parts.push(chantComponentPart({ component, release, env, digest, current: input.current.get(name), unsettled: input.unsettled?.get(name) }));
       continue;
     }
     const ctx = deployContext({ env }, name);
@@ -251,7 +265,7 @@ export async function planReleaseChangeSet(input: ReleaseChangeSetInput): Promis
       }
       for (const step of plannable) {
         const { kind, ...rest } = step;
-        const planned = await registry.resolve(kind).plan!(ctx, resolveStepInput(rest, {}, outputs) as never);
+        const planned = await registry.resolve(kind).plan!(planContext(ctx, rest, outputs), resolveStepInput(rest, {}, outputs) as never);
         parts.push(
           planned.changeSet ?? {
             member: {

package/src/components/wave-plan.ts

@@ -19,7 +19,7 @@
  * `@<component>.publish.*`) resolves.
  */
 
-import { resolveStepInput, type DriverComponent, type DriverPhase, type DriverStep } from "./driver";
+import { resolveStepInput, unresolvedWiringSources, type DriverComponent, type DriverPhase, type DriverStep } from "./driver";
 import { componentPlanDigest } from "./gate-plan";
 import type { CapabilityRegistry, DeployContext } from "./capability";
 import type { WaveMember } from "../gated-waves";
@@ -60,6 +60,19 @@ export function capabilitySteps(phases: readonly DriverPhase[]): DriverStep[] {
   return out;
 }
 
+/**
+ * The context a step is planned with: `ctx`, plus the components whose
+ * outputs the step reads and could not read yet (`unresolvedInputs`, #4084).
+ */
+export function planContext(
+  ctx: DeployContext,
+  stepInput: Record<string, unknown>,
+  componentOutputs: Record<string, Record<string, unknown>>,
+): DeployContext {
+  const unresolved = unresolvedWiringSources(stepInput, componentOutputs);
+  return unresolved.length > 0 ? { ...ctx, unresolvedInputs: unresolved } : ctx;
+}
+
 /** Plan one component against the outputs earlier waves produced. Never throws: a failure comes back as `error`. */
 export async function planWaveComponent(
   component: DriverComponent,
@@ -76,7 +89,7 @@ export async function planWaveComponent(
       if (!capability.plan) continue;
       const { kind: _kind, ...rest } = step;
       const input = resolveStepInput(rest, {}, componentOutputs);
-      const planned = await capability.plan(ctx, input as never);
+      const planned = await capability.plan(planContext(ctx, rest, componentOutputs), input as never);
       const member = { member: planned.member, planDigest: planned.planDigest };
       members.push(member);
       parts.push(planned.changeSet ?? emptyPart(member));

package/src/config.ts

@@ -12,6 +12,7 @@ import { findProjectConfig } from "./project-root";
 import { evaluateProjectConfig } from "./config-sandbox";
 import { lexiconNames, pathLexiconRoot, registerLexiconDeclarations, type LexiconDeclaration } from "./lexicon-module";
 import { decideConfigSchema, type DecideConfig } from "./op/decide-config";
+import { PublishDeclarationSchema, type PublishDeclaration } from "./lifecycle/publish-declaration";
 
 /**
  * One project-declared environment (chant #1166). Historically always a bare
@@ -169,6 +170,7 @@ export const ChantConfigSchema = z.object({
   ).optional(),
   release: z.object({
     autoRecord: z.boolean().optional(),
+    publish: z.array(PublishDeclarationSchema).optional(),
   }).optional(),
   // Strict: a misspelt key here would leave Ops on the local runtime with
   // nothing said (#2523).
@@ -382,6 +384,12 @@ export interface ChantConfig {
   release?: {
     /** Set false to disable auto-emitting a release record after a successful component deploy project-wide. The `--no-release-record` CLI flag overrides this per-invocation. */
     autoRecord?: boolean;
+    /**
+     * Where `chant release publish` publishes a cut release (#4047): npm
+     * packages, an image in an OCI registry, release assets on a forge. Run in
+     * the order given. See ./lifecycle/publish-declaration.ts.
+     */
+    publish?: PublishDeclaration[];
   };
 
   /** Defaults for `chant run` and its subcommands (#2523). */

package/src/flag-params.test.ts

@@ -0,0 +1,144 @@
+/**
+ * Build-time parameters from workspace flags (#4024): what a build for an
+ * environment resolves in a member with flags, and the precedence rule that a
+ * flag-backed parameter can't be overridden where the environment has a gate.
+ * On the fixture in `workspace/__fixtures__/flag-workspace.ts`, where member
+ * `shop`'s component declares a gate and member `blog`'s does not.
+ */
+
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, test, vi } from "vitest";
+import { buildCommand } from "./cli/commands/build";
+import type { Serializer } from "./serializer";
+import type { BuildParamsConfig } from "./build-params";
+import { loadBuildParamFlags, resolveFlaggedBuildParams } from "./flag-params";
+import { cleanScratch, scratchDir } from "./workspace/__fixtures__/contract-repo";
+import { flagWorkspace } from "./workspace/__fixtures__/flag-workspace";
+
+const SHOP: BuildParamsConfig = { newCheckout: { type: "boolean", default: false }, tier: { type: "string", default: "small" } };
+const BLOG: BuildParamsConfig = { banner: { type: "boolean", default: false } };
+
+let root: string;
+beforeAll(() => {
+  root = flagWorkspace();
+});
+afterAll(cleanScratch);
+
+const quiet = { echo: false } as const;
+
+describe("loadBuildParamFlags", () => {
+  test("outside a workspace, and without an environment, there are no flags", async () => {
+    const plain = scratchDir("chant-flags-plain-");
+    expect(await loadBuildParamFlags(plain, "prod")).toEqual({ flags: undefined, errors: [] });
+    expect(await loadBuildParamFlags(join(root, "shop"), undefined)).toEqual({ flags: undefined, errors: [] });
+  });
+
+  test("in a member, each flag-backed parameter with the flag's value for the environment", async () => {
+    expect(await loadBuildParamFlags(join(root, "shop"), "dev")).toEqual({
+      flags: { env: "dev", byParam: { newCheckout: { flag: "new-checkout", value: true } } },
+      errors: [],
+    });
+  });
+
+  test("a flag kind that can't be read stops the build rather than building without its flags", async () => {
+    const dir = flagWorkspace({ "flags/flag.schema.json": "{ not json" });
+    const loaded = await loadBuildParamFlags(join(dir, "shop"), "prod");
+    expect(loaded.flags).toBeUndefined();
+    expect(loaded.errors[0]).toMatch(/the workspace's flag records can't be read/);
+  });
+});
+
+describe("resolveFlaggedBuildParams", () => {
+  test("records the flag as the parameter's source, per environment", async () => {
+    const prod = await resolveFlaggedBuildParams(join(root, "shop"), SHOP, quiet, "prod");
+    expect(prod).toEqual({
+      success: true,
+      errors: [],
+      provenance: [
+        { name: "newCheckout", value: false, source: "flag:new-checkout" },
+        { name: "tier", value: "small", source: "default" },
+      ],
+    });
+    const dev = await resolveFlaggedBuildParams(join(root, "shop"), SHOP, quiet, "dev");
+    expect(dev.provenance[0]).toEqual({ name: "newCheckout", value: true, source: "flag:new-checkout" });
+    // staging: the record gives no value, so the declared default applies.
+    expect((await resolveFlaggedBuildParams(join(root, "shop"), SHOP, quiet, "staging")).provenance[0]).toEqual({ name: "newCheckout", value: false, source: "default" });
+  });
+
+  test("--param can't override a flag in an environment with a gate: the build refuses", async () => {
+    const refused = await resolveFlaggedBuildParams(join(root, "shop"), SHOP, { ...quiet, cli: { newCheckout: "true" } }, "prod");
+    expect(refused.success).toBe(false);
+    expect(refused.provenance).toEqual([]);
+    expect(refused.errors).toHaveLength(1);
+    expect(refused.errors[0]).toMatch(/build parameter "newCheckout" is backed by the flag "new-checkout", and "prod" has a gate, so --param can't set it/);
+    expect(refused.errors[0]).toMatch(/gates: prod-release/);
+  });
+
+  test("--params-file can't either, and a parameter no flag backs still can", async () => {
+    const file = join(scratchDir("chant-flags-file-"), "params.json");
+    writeFileSync(file, JSON.stringify({ newCheckout: true }));
+    const refused = await resolveFlaggedBuildParams(join(root, "shop"), SHOP, { ...quiet, paramsFile: file }, "prod");
+    expect(refused.success).toBe(false);
+    expect(refused.errors[0]).toMatch(/so --params-file can't set it/);
+    const tier = await resolveFlaggedBuildParams(join(root, "shop"), SHOP, { ...quiet, cli: { tier: "large" } }, "prod");
+    expect(tier.success).toBe(true);
+    expect(tier.provenance).toContainEqual({ name: "tier", value: "large", source: "cli" });
+  });
+
+  test("where no component declares a gate, --param still overrides the flag", async () => {
+    const r = await resolveFlaggedBuildParams(join(root, "blog"), BLOG, { ...quiet, cli: { banner: "false" } }, "prod");
+    expect(r.success).toBe(true);
+    expect(r.provenance).toEqual([{ name: "banner", value: false, source: "cli" }]);
+  });
+
+  test("components that can't be read refuse an override, since the gate can't be ruled out", async () => {
+    const dir = flagWorkspace({ "shop/broken.component.ts": "export const = ;\n" });
+    const r = await resolveFlaggedBuildParams(join(dir, "shop"), SHOP, { ...quiet, cli: { newCheckout: "true" } }, "prod");
+    expect(r.success).toBe(false);
+    expect(r.errors[0]).toMatch(/whether "prod" has a gate can't be told/);
+  });
+});
+
+describe("chant build --env in a member with flags", () => {
+  const runtime = join(import.meta.dirname, "runtime");
+  const paramsModule = join(import.meta.dirname, "params");
+  const serializer: Serializer = {
+    name: "aws",
+    rulePrefix: "TEST",
+    serialize: (entities) => JSON.stringify([...entities.values()].map((e) => (e as unknown as { props: unknown }).props)),
+  };
+  const shopFiles = {
+    "shop/chant.config.ts": `export default { environments: ["dev", "staging", "prod"], buildParams: { newCheckout: { type: "boolean", default: false } } };\n`,
+    "shop/main.ts":
+      `import { createResource } from ${JSON.stringify(runtime)};\n` +
+      `import { params } from ${JSON.stringify(paramsModule)};\n` +
+      `const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });\n` +
+      `export const bucket = new Bucket({ checkout: params.newCheckout ? "new" : "old" });\n`,
+  };
+
+  test("records the flag on BuildResult.buildParams and builds with its value", async () => {
+    const dir = flagWorkspace(shopFiles);
+    const spy = vi.spyOn(console, "error").mockImplementation(() => {});
+    try {
+      const result = await buildCommand({ path: join(dir, "shop"), format: "json", serializers: [serializer], env: "dev" });
+      expect(result.errors).toEqual([]);
+      expect(result.buildParams).toEqual([{ name: "newCheckout", value: true, source: "flag:new-checkout" }]);
+      expect(spy.mock.calls.map((c) => String(c[0])).some((l) => l.includes("1 build parameter resolved (1 from flags)"))).toBe(true);
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
+  test("refuses --param for a flag-backed parameter in an environment with a gate", async () => {
+    const dir = flagWorkspace(shopFiles);
+    const spy = vi.spyOn(console, "error").mockImplementation(() => {});
+    try {
+      const result = await buildCommand({ path: join(dir, "shop"), format: "json", serializers: [serializer], env: "prod", params: { newCheckout: "true" } });
+      expect(result.success).toBe(false);
+      expect(result.errors.join("\n")).toMatch(/"newCheckout" is backed by the flag "new-checkout", and "prod" has a gate, so --param can't set it/);
+    } finally {
+      spy.mockRestore();
+    }
+  });
+});

package/src/flag-params.ts

@@ -0,0 +1,134 @@
+/**
+ * Build-time parameters from workspace flags (#4024, decided in #4016).
+ *
+ * A member of a workspace may have flag records: records of a kind with a
+ * `flag` block, each naming the member, one of its declared build
+ * parameters and a value per environment (`workspace/flags.ts`). A build
+ * for an environment (`chant build --env <env>`, `chant run --components
+ * --env <env>`, and each environment a release cut compiles) reads them, and
+ * a flag-backed parameter takes the flag's value for that environment,
+ * recorded as `source: "flag:<name>"` on `BuildResult.buildParams` and on the
+ * release target's `params`.
+ *
+ * The precedence rule: where the environment has a gate, `--param`,
+ * `--params-file` and the parameter's env var can't set a flag-backed
+ * parameter, and the build refuses. An environment has a gate when a
+ * component enabled in it declares a gate step, the same test `components
+ * promote --release` uses to bind a release gate. The test runs only when one
+ * of those sources did set a flag-backed parameter, since it imports the
+ * member's components; a project with no components has no gate.
+ *
+ * Level 0 pays one upward `existsSync` walk here and nothing more. Workspace
+ * code is imported only once a declaration is found (#2525 rule 5, pinned by
+ * #2526's goldens).
+ */
+
+import { findWorkspaceRoot } from "./project-root";
+import { flagGateRefusal, type BuildParamFlags, type BuildParamsConfig } from "./build-params";
+import type { BuildParamProvenance } from "./provenance";
+import { echoBuildParams, resolveCliBuildParams, type CliBuildParamsArgs, type CliBuildParamsResolution } from "./cli/build-params-cli";
+import { formatError } from "./cli/format";
+
+/** The flags backing parameters of the member at `projectDir` in `env`, or why they can't be read. `flags` is undefined outside a workspace, without an environment, or when no flag names the member. */
+export async function loadBuildParamFlags(projectDir: string, env: string | undefined): Promise<{ flags: BuildParamFlags | undefined; errors: string[] }> {
+  if (!env) return { flags: undefined, errors: [] };
+  const found = findWorkspaceRoot(projectDir);
+  if (!found) return { flags: undefined, errors: [] };
+  const { memberFlagBindings } = await import("./workspace/flags-read");
+  try {
+    const bindings = await memberFlagBindings(found.dir, projectDir, env);
+    if (!bindings) return { flags: undefined, errors: [] };
+    if (bindings.errors.length > 0) return { flags: undefined, errors: bindings.errors };
+    if (Object.keys(bindings.byParam).length === 0) return { flags: undefined, errors: [] };
+    return { flags: { env, byParam: bindings.byParam }, errors: [] };
+  } catch (err) {
+    const { WorkspaceReadError } = await import("./workspace/declaration");
+    const { RecordReadError } = await import("./workspace/records");
+    if (err instanceof WorkspaceReadError || err instanceof RecordReadError) {
+      return { flags: undefined, errors: [`the workspace's flag records can't be read, so this build can't tell which parameters they set: ${err.message}`] };
+    }
+    throw err;
+  }
+}
+
+/** The parameters a flag backs that `--param`, `--params-file` or an env var set instead. */
+export function overriddenFlagParams(provenance: readonly BuildParamProvenance[], flags: BuildParamFlags | undefined): BuildParamProvenance[] {
+  if (!flags) return [];
+  return provenance.filter((p) => flags.byParam[p.name] !== undefined && (p.source === "cli" || p.source === "params-file" || p.source === "env"));
+}
+
+/**
+ * The gates the member's components declare in the environment the process
+ * builds for (`CHANT_ENV`), with the parameters as resolved, or why the
+ * components can't be read. Only components enabled under those parameters
+ * count.
+ */
+export async function environmentGates(projectDir: string, provenance: BuildParamProvenance[]): Promise<{ gates: string[] } | { error: string }> {
+  const { discoverComponents } = await import("./components/discover");
+  const { withoutDisabled } = await import("./components/cli-support");
+  const { gateNamesOf } = await import("./components/release-gate");
+  try {
+    const discovered = await discoverComponents(projectDir, { buildParams: provenance });
+    if (discovered.errors.length > 0) return { error: discovered.errors.map((e) => e.message).join("; ") };
+    const all = [...discovered.components.values()].map((d) => d.component);
+    const plain = all.map((c) => ({ name: c.name, dependsOn: c.dependsOn, deploy: c.deploy as never }));
+    return { gates: gateNamesOf(withoutDisabled(all, plain)) };
+  } catch (err) {
+    return { error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+/**
+ * Resolve the build parameters of the project at `projectDir` for `env`,
+ * with the workspace's flags, as `resolveCliBuildParams` does without them.
+ * Refuses when a flag record can't be read, and when `--param`,
+ * `--params-file` or an env var sets a flag-backed parameter in an
+ * environment with a gate. Prints the summary line only on success.
+ */
+export async function resolveFlaggedBuildParams(
+  projectDir: string,
+  buildParamsConfig: BuildParamsConfig | undefined,
+  args: CliBuildParamsArgs,
+  env: string | undefined,
+): Promise<CliBuildParamsResolution> {
+  const loaded = await loadBuildParamFlags(projectDir, env);
+  if (loaded.errors.length > 0) {
+    return { success: false, provenance: [], errors: loaded.errors.map((message) => formatError({ message })) };
+  }
+  const { flags } = loaded;
+  const resolution = resolveCliBuildParams(buildParamsConfig, { ...args, ...(flags ? { flags } : {}), echo: false });
+  if (!resolution.success || !flags) {
+    if (resolution.success && args.echo !== false) echoBuildParams(resolution.provenance, args.verbose);
+    return resolution;
+  }
+  const overridden = overriddenFlagParams(resolution.provenance, flags);
+  if (overridden.length > 0) {
+    const found = await environmentGates(projectDir, resolution.provenance);
+    if ("error" in found) {
+      return {
+        success: false,
+        provenance: [],
+        errors: [
+          formatError({
+            message:
+              `${overridden.map((p) => `"${p.name}"`).join(", ")} ${overridden.length === 1 ? "is" : "are"} backed by a flag and set by ${[...new Set(overridden.map((p) => p.source))].join(", ")}, ` +
+              `and whether "${flags.env}" has a gate can't be told, because its components can't be read: ${found.error}`,
+          }),
+        ],
+      };
+    }
+    if (found.gates.length > 0) {
+      const around = (p: BuildParamProvenance): string =>
+        p.source === "cli" ? "--param" : p.source === "params-file" ? "--params-file" : `the env var ${buildParamsConfig?.[p.name]?.env ?? "(unknown)"}`;
+      return {
+        success: false,
+        provenance: [],
+        errors: overridden.map((p) =>
+          formatError({ message: `${flagGateRefusal(p.name, flags.byParam[p.name].flag, flags.env, around(p))} (gates: ${found.gates.join(", ")})` }),
+        ),
+      };
+    }
+  }
+  if (args.echo !== false) echoBuildParams(resolution.provenance, args.verbose);
+  return resolution;
+}