@intentius/chant 0.124.28 → 0.124.30

package/src/cli/build-params-cli.ts

@@ -1,6 +1,6 @@
 import { readFileSync } from "fs";
 import { resolve } from "path";
-import { resolveBuildParams, type BuildParamsConfig } from "../build-params";
+import { resolveBuildParams, type BuildParamFlags, type BuildParamsConfig } from "../build-params";
 import type { BuildParamProvenance } from "../provenance";
 import { formatError, formatInfo } from "./format";
 
@@ -40,6 +40,10 @@ export interface CliBuildParamsArgs {
   paramsFile?: string;
   /** `--verbose` — list every resolved parameter one per line instead of the one-line count (#1424). */
   verbose?: boolean;
+  /** The workspace flags backing parameters in this build's environment (#4024), from `../flag-params.ts`. */
+  flags?: BuildParamFlags;
+  /** `false` to resolve without printing the summary line, for a caller that checks more before it prints ({@link echoBuildParams}). */
+  echo?: boolean;
 }
 
 export interface CliBuildParamsResolution {
@@ -94,6 +98,7 @@ export function resolveCliBuildParams(
     cli: args.cli,
     fromFile,
     env: process.env,
+    ...(args.flags ? { flags: args.flags } : {}),
   });
   for (const message of resolution.errors) {
     errors.push(formatError({ message }));
@@ -103,21 +108,25 @@ export function resolveCliBuildParams(
     return { success: false, provenance: [], errors };
   }
 
+  if (args.echo !== false) echoBuildParams(resolution.provenance, args.verbose);
+  return { success: true, provenance: resolution.provenance, errors: [] };
+}
+
+/** Print a successful resolution: the one-line summary, or every value under `--verbose` or `CHANT_PARAM_ECHO=all` (#1424). */
+export function echoBuildParams(provenance: readonly BuildParamProvenance[], verboseFlag?: boolean): void {
   // #1424 — one line by default. A project with two dozen declared
   // parameters printed two dozen grey lines on every build, ahead of the
   // warnings the reader actually needed. The count by source still answers
   // "did my override reach the build" (the failure mode
   // warnIfParamsCannotReachProject exists for); --verbose names every value.
-  const verbose = args.verbose === true || process.env.CHANT_PARAM_ECHO === "all";
+  const verbose = verboseFlag === true || process.env.CHANT_PARAM_ECHO === "all";
   if (verbose) {
-    for (const p of resolution.provenance) {
+    for (const p of provenance) {
       console.error(formatInfo(`[param] ${p.name} = ${JSON.stringify(p.value)} (${p.source})`));
     }
-  } else if (resolution.provenance.length > 0) {
-    console.error(formatInfo(summarizeBuildParams(resolution.provenance)));
+  } else if (provenance.length > 0) {
+    console.error(formatInfo(summarizeBuildParams(provenance)));
   }
-
-  return { success: true, provenance: resolution.provenance, errors: [] };
 }
 
 /**
@@ -127,8 +136,12 @@ export function resolveCliBuildParams(
  */
 export function summarizeBuildParams(provenance: readonly { source: string }[]): string {
   const counts = new Map<string, number>();
-  for (const p of provenance) counts.set(p.source, (counts.get(p.source) ?? 0) + 1);
-  const order = ["cli", "params-file", "env", "default"];
+  // Every flag source (`flag:<name>`, #4024) counts as one, "from flags".
+  for (const p of provenance) {
+    const source = p.source.startsWith("flag:") ? "flags" : p.source;
+    counts.set(source, (counts.get(source) ?? 0) + 1);
+  }
+  const order = ["cli", "params-file", "env", "flags", "default"];
   const rank = (s: string) => (order.includes(s) ? order.indexOf(s) : order.length);
   const parts = [...counts.keys()]
     .sort((a, b) => rank(a) - rank(b))

package/src/cli/commands/build.ts

@@ -12,7 +12,7 @@ import { resolveTelemetryAttribution } from "../../telemetry-attribution";
 import { loadOkfBundle } from "../../okf-read";
 import { unknownEnvError } from "../../env";
 import type { OwnershipMarker } from "../../ownership";
-import { resolveCliBuildParams } from "../build-params-cli";
+import { resolveFlaggedBuildParams } from "../../flag-params";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
 import { runPostSynthChecks, type PostSynthDiagnostic } from "../../lint/post-synth";
@@ -297,11 +297,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // project's own `params.ts` does before migrating to this mechanism). Also
   // logs a one-line count on success, or every resolved value (`[param] name =
   // value (source)`) under --verbose (#1424).
-  const paramsResolution = resolveCliBuildParams(config.buildParams, {
+  // #4024: in a workspace member, a build for an environment also reads the
+  // flag records that back its parameters, and refuses an override of one
+  // where the environment has a gate (../../flag-params.ts).
+  const paramsResolution = await resolveFlaggedBuildParams(configDir, config.buildParams, {
     cli: options.params,
     paramsFile: options.paramsFile,
     verbose: options.verbose,
-  });
+  }, options.env);
   if (!paramsResolution.success) {
     errors.push(...paramsResolution.errors);
     return { success: false, resourceCount: 0, fileCount: 0, errors, warnings };

package/src/cli/handlers/approve-release.test.ts

@@ -11,6 +11,7 @@ import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { appendPendingGate, readGateLedger } from "../../lifecycle/gate-ledger";
 import { resetGateOrigin } from "../../lifecycle/gate-origin";
+import { makeRelease, persistRelease } from "../../lifecycle/release-store";
 
 vi.mock("../../op/discover", () => ({ discoverOps: async () => ({ errors: [], ops: new Map() }) }));
 
@@ -20,7 +21,9 @@ function git(args: string[], cwd: string): void {
   spawnSync("git", args, { cwd, encoding: "utf-8" });
 }
 
-const RELEASE = `jcs1-sha256:${"a".repeat(64)}`;
+/** The release the gate binds. #4033: approve reads it to check its commit isn't revoked, so it is stored. */
+const STORED = makeRelease({ member: null, commit: "1".repeat(40), artifactDigests: [], targets: [{ env: "prod", templates: [], params: [] }] });
+const RELEASE = STORED.releaseDigest;
 const DOC = `jcs1-sha256:${"d".repeat(64)}`;
 
 async function repoWithReleaseGate(dir: string): Promise<void> {
@@ -30,6 +33,7 @@ async function repoWithReleaseGate(dir: string): Promise<void> {
   writeFileSync(join(dir, "README.md"), "x\n");
   git(["add", "."], dir);
   git(["commit", "-q", "-m", "init"], dir);
+  await persistRelease(STORED, [], { cwd: dir });
   await appendPendingGate(
     {
       op: "release",

package/src/cli/handlers/approve-revoked.test.ts

@@ -0,0 +1,155 @@
+/**
+ * #4033 (ws-105): when a commit is revoked, the release cut from it is
+ * revoked, and its pending release gate refuses approval. Against temp repos;
+ * nothing is pushed.
+ */
+
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { withTestDir } from "@intentius/chant-test-utils";
+import { spawnSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { appendPendingGate, readGateLedger } from "../../lifecycle/gate-ledger";
+import { resetGateOrigin } from "../../lifecycle/gate-origin";
+import { appendCut, makeRelease, persistRelease, type Release } from "../../lifecycle/release-store";
+
+vi.mock("../../op/discover", () => ({ discoverOps: async () => ({ errors: [], ops: new Map() }) }));
+
+const { recordGateApproval } = await import("./approve");
+
+function git(cwd: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout.trim();
+}
+
+const DOC = `jcs1-sha256:${"d".repeat(64)}`;
+const GREEN = { branch: "main", phases: { test: ["test"] }, require: ["test"] };
+
+function declaration(dir: string, green: Record<string, unknown>): void {
+  writeFileSync(
+    join(dir, "chant.workspace.json"),
+    JSON.stringify({ name: "acme", schema: 1, members: [{ name: "root", dir: ".", kind: "other", because: "the release fixture" }], ci: { green } }, null, 2),
+  );
+}
+
+/** A green commit, a release cut from it as v1.0.0, and a release gate pending for it in prod. */
+async function releaseWaitingAtGate(dir: string): Promise<{ sha: string; release: Release }> {
+  git(dir, "init", "-q", "-b", "main");
+  git(dir, "config", "user.email", "t@chant.dev");
+  git(dir, "config", "user.name", "T");
+  declaration(dir, GREEN);
+  git(dir, "add", ".");
+  git(dir, "commit", "-q", "-m", "init");
+  const sha = git(dir, "rev-parse", "HEAD");
+  git(dir, "tag", "-a", "-m", "ci: green", `ci/green/${sha}`, sha);
+  const release = makeRelease({
+    member: null,
+    commit: sha,
+    artifactDigests: [],
+    targets: [{ env: "prod", templates: [{ component: "api", path: "t.json", digest: `sha256:${"c".repeat(64)}` }], params: [] }],
+  });
+  await persistRelease(release, [], { cwd: dir });
+  await appendCut({ releaseDigest: release.releaseDigest, label: "v1.0.0", actor: "alice", timestamp: "2026-10-16T10:00:00.000Z", runOrigin: null }, { cwd: dir });
+  await appendPendingGate(
+    {
+      op: "release",
+      gate: "prod-release",
+      timestamp: "2026-10-16T11:00:00.000Z",
+      expiresAt: "2999-01-01T00:00:00.000Z",
+      planDigest: DOC,
+      environment: "prod",
+      releaseDigest: release.releaseDigest,
+      gitSha: sha,
+    },
+    { cwd: dir },
+  );
+  return { sha, release };
+}
+
+/** ci tick's revoked tag for a run from chant runs (#4044): the run's id is null and the Op run is named in opRun. */
+function revoke(dir: string, sha: string): void {
+  const record = {
+    schema: 1,
+    tag: "revoked",
+    commit: sha,
+    branch: "main",
+    at: "2026-10-16T12:00:00.000Z",
+    source: "runs",
+    phase: "test",
+    run: { name: "smoke", id: null, conclusion: "failure", url: null, opRun: { id: "r-12", env: "staging", signer: "runner:ci", statement: null } },
+  };
+  git(dir, "tag", "-a", "-m", `ci: phase test failed in smoke (failure)\n\n${JSON.stringify(record, null, 2)}\n`, `ci/revoked/${sha}`, sha);
+}
+
+describe("chant approve on the gate of a revoked release (#4033)", () => {
+  const cwd = process.cwd();
+  afterEach(() => {
+    process.chdir(cwd);
+    resetGateOrigin();
+    vi.restoreAllMocks();
+  });
+
+  test("revoke a commit, and its release's pending gate refuses approval with release-revoked and the fix line", async () => {
+    const errors: string[] = [];
+    vi.spyOn(console, "error").mockImplementation((...m: unknown[]) => { errors.push(m.join(" ")); });
+    await withTestDir(async (dir) => {
+      const { sha } = await releaseWaitingAtGate(dir);
+      process.chdir(dir);
+      revoke(dir, sha);
+      const outcome = await recordGateApproval("release", "prod-release", { origin: "cli", actor: "alice", cwd: dir, environment: "prod" });
+      expect(outcome.ok).toBe(false);
+      const said = errors.join("\n");
+      expect(said).toContain(`release v1.0.0 was cut from commit ${sha.slice(0, 12)}, which ci/revoked/${sha} revokes (phase test failed in smoke (Op run r-12 in staging))`);
+      expect(said).toContain("[release-revoked]");
+      expect(said).toContain("chant approve release prod-release --expire");
+      expect((await readGateLedger("release", { cwd: dir })).resolutions).toEqual([]);
+
+      // Naming the plan outright doesn't get round it.
+      const named = await recordGateApproval("release", "prod-release", { origin: "cli", actor: "alice", cwd: dir, environment: "prod", plan: DOC });
+      expect(named.ok).toBe(false);
+      expect((await readGateLedger("release", { cwd: dir })).resolutions).toEqual([]);
+    });
+  });
+
+  test("before the commit is revoked, the same gate takes the approval", async () => {
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    await withTestDir(async (dir) => {
+      const { release } = await releaseWaitingAtGate(dir);
+      process.chdir(dir);
+      const outcome = await recordGateApproval("release", "prod-release", { origin: "cli", actor: "alice", cwd: dir, environment: "prod" });
+      expect(outcome.ok).toBe(true);
+      expect((await readGateLedger("release", { cwd: dir })).resolutions).toEqual([expect.objectContaining({ releaseDigest: release.releaseDigest })]);
+    });
+  });
+
+  test("with ci.green.signedSince, a hand-pushed revoked tag is ignored and revokes nothing", async () => {
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    await withTestDir(async (dir) => {
+      const { sha } = await releaseWaitingAtGate(dir);
+      // The release's own commit is the pivot, so a tag on it needs a statement; this one has none.
+      declaration(dir, { ...GREEN, signedSince: sha });
+      git(dir, "commit", "-q", "-am", "require signed ci tags");
+      revoke(dir, sha);
+      process.chdir(dir);
+      const outcome = await recordGateApproval("release", "prod-release", { origin: "cli", actor: "alice", cwd: dir, environment: "prod" });
+      expect(outcome.ok).toBe(true);
+    });
+  });
+
+  test("a gate whose release can't be read refuses, since whether it is revoked is unknown", async () => {
+    const errors: string[] = [];
+    vi.spyOn(console, "error").mockImplementation((...m: unknown[]) => { errors.push(m.join(" ")); });
+    await withTestDir(async (dir) => {
+      await releaseWaitingAtGate(dir);
+      await appendPendingGate(
+        { op: "release", gate: "prod-release", timestamp: "2026-10-16T13:00:00.000Z", expiresAt: "2999-01-01T00:00:00.000Z", planDigest: DOC, environment: "prod", releaseDigest: `jcs1-sha256:${"e".repeat(64)}` },
+        { cwd: dir },
+      );
+      process.chdir(dir);
+      const outcome = await recordGateApproval("release", "prod-release", { origin: "cli", actor: "alice", cwd: dir, environment: "prod" });
+      expect(outcome.ok).toBe(false);
+      expect(errors.join("\n")).toContain("[release-unreadable]");
+    });
+  });
+});

package/src/cli/handlers/approve.ts

@@ -255,6 +255,46 @@ export type GateApprovalOutcome =
   | { ok: true; record: GateResolutionRecord; pushed: boolean }
   | { ok: false };
 
+/**
+ * Refuse the approval of a release gate whose release is revoked (#4033,
+ * ws-105): its commit carries a `ci/revoked/<sha>` tag that counts, read from
+ * local tags as `release cut` reads them. Prints the refusal and returns true
+ * when it refuses. A release file that can't be read, or tags that can't be
+ * judged, refuse too, since whether the release is revoked is then unknown.
+ */
+async function refuseRevokedRelease(opName: string, gate: string, releaseDigest: string, cwd: string): Promise<boolean> {
+  const { readRelease, readCuts, labelsByDigest } = await import("../../lifecycle/release-store");
+  const { readRevokedCommits, revocationOf, revokedRefusal } = await import("../../lifecycle/release-revocation");
+  const release = await readRelease(releaseDigest, { cwd }).catch(() => null);
+  if (!release) {
+    console.error(formatError({
+      message: `Gate "${gate}" on "${opName}" binds release ${releaseDigest}, which can't be read from ${LIFECYCLE_BRANCH}, so whether it is revoked is unknown [release-unreadable]`,
+      hint: `Fetch the ledger branch (git fetch origin ${LIFECYCLE_BRANCH}:${LIFECYCLE_BRANCH}) and approve again from the member's directory.`,
+    }));
+    return true;
+  }
+  let revoked: Awaited<ReturnType<typeof readRevokedCommits>>;
+  try {
+    revoked = await readRevokedCommits(cwd);
+  } catch (err) {
+    console.error(formatError({
+      message: `Gate "${gate}" on "${opName}" binds release ${releaseDigest}, and the ci tags can't be judged: ${err instanceof Error ? err.message : String(err)} [declaration-invalid]`,
+      hint: "Fix ci.green in chant.workspace.json at base; chant workspace check names the problem.",
+    }));
+    return true;
+  }
+  const r = revocationOf(release, revoked);
+  if (!r) return false;
+  const label = labelsByDigest((await readCuts({ cwd }).catch(() => ({ cuts: [] }))).cuts).get(releaseDigest) ?? null;
+  console.error(formatError(revokedRefusal(
+    { releaseDigest, label },
+    r,
+    `Clear the pending gate with \`chant approve ${opName} ${gate} --expire\`, then promote a release cut from a green commit: ` +
+      "`chant ci last-green` names the newest, and `chant release list` marks the revoked releases.",
+  )));
+  return true;
+}
+
 /**
  * The ledger write behind `chant approve` — extracted so `chant run approve`
  * (#2121) records the identical fact before waking the runtime that hosts the
@@ -400,6 +440,13 @@ export async function recordGateApproval(
   // approval of another plan names none, and no release gate counts it.
   const releaseDigest =
     standing?.releaseDigest !== undefined && samePlanDigest(planDigest, standing.planDigest) ? standing.releaseDigest : undefined;
+  // #4033 (ws-105): a release gate whose release was cut from a revoked
+  // commit is superseded. Its promote refuses the release, so an approval of
+  // it would count for nothing; refuse it here, whatever plan is named.
+  if (standing?.releaseDigest !== undefined) {
+    const refused = await refuseRevokedRelease(opName, gate, standing.releaseDigest, opts.cwd ?? process.cwd());
+    if (refused) return { ok: false };
+  }
 
   // chant#2384 — the gate's whole value is that its two halves have different
   // authors. At a shell they do: a person runs, reads the plan, and approves.

package/src/cli/handlers/build.test.ts

@@ -133,6 +133,36 @@ describe("runBuild --components --generate (chant #1108 build-time parameters)",
     vi.restoreAllMocks();
   });
 
+  test("--pr-loop with --events-json and --report-url asks the generated jobs for both (#4007)", async () => {
+    generateComponentsPipelineMock.mockResolvedValue({ success: true, yaml: "stages: []", stages: [], jobs: [] });
+    vi.spyOn(console, "log").mockImplementation(() => {});
+
+    const exit = await runBuild({
+      args: makeArgs({ generate: "github", prLoop: true, eventsJson: true, reportUrl: "s3://reports/acme" }),
+      plugins: [],
+      serializers: [],
+    });
+
+    expect(exit).toBe(0);
+    expect(generateComponentsPipelineMock).toHaveBeenCalledWith(".", "github", { env: undefined, prLoop: { events: true, reportUrl: "s3://reports/acme" } }, undefined, []);
+    vi.restoreAllMocks();
+  });
+
+  test("--pr-build and --pr-build-command become the prLoop build options (#4088)", async () => {
+    generateComponentsPipelineMock.mockResolvedValue({ success: true, yaml: "jobs: {}", stages: [], jobs: [] });
+    vi.spyOn(console, "log").mockImplementation(() => {});
+
+    const exit = await runBuild({
+      args: makeArgs({ generate: "github", prLoop: true, prBuild: true, prBuildCommand: "npm run build" }),
+      plugins: [],
+      serializers: [],
+    });
+
+    expect(exit).toBe(0);
+    expect(generateComponentsPipelineMock).toHaveBeenCalledWith(".", "github", { env: undefined, prLoop: { build: true, buildCommand: "npm run build" } }, undefined, []);
+    vi.restoreAllMocks();
+  });
+
   test("chant.config.ts's declared buildParams resolve, log, and are forwarded to generateComponentsPipeline", async () => {
     loadChantConfigUpwardMock.mockResolvedValue({
       config: { buildParams: { tier: { type: "string", default: "light" } } },

package/src/cli/handlers/build.ts

@@ -8,6 +8,24 @@ import { loadChantConfigUpward, type ChantConfig } from "../../config";
 import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli";
 import { findWorkspaceRoot } from "../../project-root";
 import { resolvePromotionSource } from "../../components/promote-order";
+import type { PrLoopPipelineOptions } from "../../components/pr-pipeline";
+
+/**
+ * The `prLoop` generator option from `--pr-loop`'s flags (#3183): the gate
+ * and the branch, and with `--events-json` and `--report-url` (#4007) the
+ * flags the generated jobs pass to pr-plan and pr-apply. `--pr-build` and
+ * `--pr-build-command` (#4088) add the build and lint steps before both.
+ */
+function prLoopOption(args: CommandContext["args"]): PrLoopPipelineOptions {
+  return {
+    ...(args.gate ? { gate: args.gate } : {}),
+    ...(args.branch ? { branch: args.branch } : {}),
+    ...(args.eventsJson ? { events: true } : {}),
+    ...(args.reportUrl ? { reportUrl: args.reportUrl } : {}),
+    ...(args.prBuild ? { build: true } : {}),
+    ...(args.prBuildCommand ? { buildCommand: args.prBuildCommand } : {}),
+  };
+}
 
 /**
  * `chant build --components --generate <lexicon>` — generate mode (#563,
@@ -86,7 +104,7 @@ async function runGenerateComponents(ctx: CommandContext): Promise<number> {
         params: args.param,
         paramsFile: args.paramsFile,
         ...(args.waveGate ? { waveGate: { gate: args.waveGate, ...(args.canary?.length ? { canary: args.canary } : {}), ...(args.base ? { base: args.base } : {}) } } : {}),
-        ...(args.prLoop ? { prLoop: { ...(args.gate ? { gate: args.gate } : {}), ...(args.branch ? { branch: args.branch } : {}) } } : {}),
+        ...(args.prLoop ? { prLoop: prLoopOption(args) } : {}),
         ...(args.image ? { image: args.image } : {}),
         ...(args.beforeScript?.length ? { beforeScript: args.beforeScript } : {}),
       });
@@ -116,9 +134,7 @@ async function runGenerateComponents(ctx: CommandContext): Promise<number> {
         ? { gatedWaves: { gate: args.waveGate, ...(args.canary?.length ? { canary: args.canary } : {}), ...(args.base ? { base: args.base } : {}) } }
         : {}),
       // #3183: a plan job per pull request and an apply job per merge.
-      ...(args.prLoop
-        ? { prLoop: { ...(args.gate ? { gate: args.gate } : {}), ...(args.branch ? { branch: args.branch } : {}) } }
-        : {}),
+      ...(args.prLoop ? { prLoop: prLoopOption(args) } : {}),
       // #4002: the job image and the lines that install what it lacks, chant itself included.
       ...(args.image ? { image: args.image } : {}),
       ...(args.beforeScript?.length ? { beforeScript: args.beforeScript } : {}),