@intentius/chant 0.124.28 → 0.124.30

package/src/components/pr-run.test.ts

@@ -60,6 +60,8 @@ function world() {
     planned: [] as Array<{ root: string; vars?: Record<string, unknown> }>,
     outputsRead: [] as string[],
     applied: [] as string[],
+    /** The vars each root applied with, after wiring resolved. */
+    ranWith: {} as Record<string, Record<string, unknown> | undefined>,
     fromPlan: {} as Record<string, boolean>,
     failing: new Set<string>(),
     planFailing: new Set<string>(),
@@ -100,6 +102,7 @@ function world() {
     },
     async run(ctx: DeployContext, input: RootInput) {
       w.fromPlan[input.root] = ctx.plans?.[input.root] !== undefined;
+      w.ranWith[input.root] = input.vars;
       if (w.failing.has(input.root)) throw new Error(`${input.root} failed`);
       w.applied.push(input.root);
       if (input.root === "a") w.state.a = { id: `a-${w.versions.a ?? "v1"}` };
@@ -166,6 +169,130 @@ describe("planPrSet", () => {
   });
 });
 
+describe("a dependency outside the selection (#4104)", () => {
+  /** Two members: `up`, and `down` reading its `id`. The pull request changes `down` alone. */
+  const PAIR: DriverComponent[] = [root("up"), root("down", ["up"], { upstream: { stackOutput: { stack: "up", name: "id" } } })];
+
+  function pairWorld() {
+    const w = world();
+    w.state = { up: { id: "up-live", arn: "arn:up" } };
+    w.versions.down = "v2";
+    return w;
+  }
+
+  test("the dependent's plan resolves the upstream's outputs from its deployed outputs, and the report lists them", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    expect(plan.order).toEqual(["down"]);
+    expect(plan.seeds).toEqual(["up"]);
+
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    expect(w.outputsRead).toEqual(["up"]);
+    expect(w.planned).toEqual([{ root: "down", vars: { upstream: "up-live" } }]);
+    expect(set.outputs).toEqual({ up: { id: "up-live", arn: "arn:up" } });
+    expect(set.deployedOutputs).toEqual({ up: ["arn", "id"] });
+
+    const report = prReport({
+      stage: "plan",
+      pr: 12,
+      env: "prod",
+      base: "1".repeat(40),
+      head: "2".repeat(40),
+      op: "pr-12",
+      gate: "pr-apply",
+      plan,
+      signal: { changed: ["down"], indeterminate: [], unclaimed: [] },
+      set,
+      approval: { status: "pending" },
+      status: "planned",
+    });
+    expect(report.deployedOutputs).toEqual({ up: ["arn", "id"] });
+    expect(report.selection).toMatchObject({ changed: ["down"], dependents: [] });
+  });
+
+  test("the apply's plan reads the same outputs, gets the approved digest, and applies against them", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    const approved = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+
+    // pr-apply plans the members again before anything applies.
+    w.outputsRead.length = 0;
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    expect(w.outputsRead).toEqual(["up"]);
+    expect(set.doc.digest).toBe(approved.doc.digest);
+    const check = await decidePrGate(memoryGateLedgerPort({ resolutions: [approval(approved.doc.digest)] }), {
+      op: "pr-12",
+      gate: "pr-apply",
+      digest: set.doc.digest,
+      now: NOW,
+    });
+    expect(check.satisfied).toBe(true);
+
+    const { members, status } = await applyPrSet({ components: PAIR, plan, registry: w.registry, env: "prod", set });
+    expect(status).toBe("applied");
+    expect(w.applied).toEqual(["down"]);
+    expect(w.ranWith.down).toEqual({ upstream: "up-live" });
+    expect(members.map((m) => [m.member, m.status, m.inputsMoved])).toEqual([["down", "applied", undefined]]);
+  });
+
+  test("an upstream whose deployed output moved after approval moves the apply's digest", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    const approved = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    w.state.up = { id: "up-moved", arn: "arn:up" };
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    expect(set.doc.digest).not.toBe(approved.doc.digest);
+  });
+
+  test("--seed-outputs wins: a seeded upstream is not read and not listed", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod", seededOutputs: { up: { id: "up-seeded" } } });
+    expect(w.outputsRead).toEqual([]);
+    expect(w.planned).toEqual([{ root: "down", vars: { upstream: "up-seeded" } }]);
+    expect(set.deployedOutputs).toBeUndefined();
+  });
+
+  test("an upstream whose steps cannot say leaves the reference unresolved", async () => {
+    const w = pairWorld();
+    const silent: DriverComponent[] = [
+      { name: "up", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "no-outputs" }] }] },
+      PAIR[1]!,
+    ];
+    w.registry.register({ kind: "no-outputs", async run() { return {}; } } as never);
+    const plan = planFanOut({ components: silent, changed: ["down"] });
+    const set = await planPrSet({ components: silent, plan, registry: w.registry, env: "prod" });
+    expect(w.outputsRead).toEqual([]);
+    expect(set.outputs).toEqual({});
+    expect(set.deployedOutputs).toBeUndefined();
+    expect(w.planned).toHaveLength(1);
+    expect(w.planned[0]!.vars?.upstream).not.toBe("up-live");
+  });
+
+  test("the selection in place of the whole graph is refused, naming the dependency", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    await expect(planPrSet({ components: [PAIR[1]!], plan, registry: w.registry, env: "prod" })).rejects.toThrow(/up, a dependency of a planned member/);
+  });
+
+  test("a resume plans against the record's outputs and reads no dependency they cover", async () => {
+    const w = world();
+    w.versions.a = "v2";
+    const plan = planFanOut({ components: ESTATE, changed: ["a"] });
+    const { set, first, record } = await firstAttempt(w, plan, ["app"]);
+    expect(first.run.completed).toEqual(["a"]);
+    expect(set.deployedOutputs).toEqual({ a: ["id"], net: ["cidr"] });
+
+    w.outputsRead.length = 0;
+    w.state.net = { cidr: "10.9.0.0/16" };
+    const resumed = await resumePrSet({ components: ESTATE, plan, registry: w.registry, env: "prod", record, completed: ["a"] });
+    if (!resumed.ok) throw new Error(resumed.reasons.join("; "));
+    expect(w.outputsRead).toEqual([]);
+    expect(resumed.set.doc.digest).toBe(set.doc.digest);
+    expect(resumed.set.outputs).toBe(record.planOutputs);
+  });
+});
+
 describe("the gate", () => {
   test("pending with no approval, approved for the digest, changed for another one", async () => {
     const w = world();

package/src/components/pr-run.ts

@@ -19,6 +19,16 @@
  * its dependents in one rollout is what gated waves are for (#3049): each
  * wave is planned after the one before it applied.
  *
+ * A dependency the change did not select is read the same way (#4104), so
+ * a change to one cluster plans it against the network it sits on. That is
+ * why `components` is every component in the project and not the selection.
+ * `--seed-outputs` wins over a read, and a dependency whose steps cannot say
+ * leaves its dependents' references unresolved. The apply stage's plan reads
+ * the same dependencies, so on the same estate it gets the digest the plan
+ * stage showed, and it applies against the outputs its plans read
+ * (`set.outputs`). A resume plans against the outputs the approved plans
+ * read, from the record (`planOutputs`), and reads nothing those cover.
+ *
  * ## Finishing an apply that failed partway
  *
  * {@link resumePrSet} (#3464) is fan-out's resume (#2417, #3049) for a pull
@@ -53,10 +63,10 @@ import type { PrApplyRecord } from "./fan-out-record";
 import type { CapabilityRegistry } from "./capability";
 import type { RunProgressEvent } from "./run-progress";
 import type { RunEventSink } from "../run-event-stream";
-import { planWaveComponent, readComponentOutputs } from "./wave-plan";
+import { planWaveComponent, readDeployedOutputs } from "./wave-plan";
 
 export interface PrPlanSetOptions {
-  /** Every component in the project. */
+  /** Every component in the project, not the selection: a planned member's dependency outside it is read too (#4104). */
   components: DriverComponent[];
   /** The fan-out the change derives (`planFanOut`). Its `order` is what is planned. */
   plan: FanOutPlan;
@@ -85,6 +95,12 @@ export interface PrPlanSet {
   plans: Record<string, Record<string, unknown>>;
   /** The outputs the plans read: the seeds, and each dependency's outputs as they stood. */
   outputs: Record<string, Record<string, unknown>>;
+  /**
+   * Per dependency read from the deployed estate (#4104), the names of the
+   * outputs the read gave, sorted. The seeds are not here. Absent when
+   * nothing was read. The report's `deployedOutputs`.
+   */
+  deployedOutputs?: Record<string, string[]>;
   /** Whether any component failed to plan. */
   failed: boolean;
 }
@@ -101,12 +117,15 @@ function failedParts(component: DriverComponent, error: string): ChangeSetPart[]
 /**
  * Plan every component in `plan.order`, a wave at a time, each against the
  * outputs its dependencies have now. Never throws for a component that fails
- * to plan: it becomes a failed member, and `failed` is set.
+ * to plan: it becomes a failed member, and `failed` is set. Throws when a
+ * planned member's dependency is not among `components`, which means the
+ * caller passed the selection where the whole graph belongs.
  */
 export async function planPrSet(options: PrPlanSetOptions): Promise<PrPlanSet> {
   const byName = new Map(options.components.map((c) => [c.name, c]));
   const outputs: Record<string, Record<string, unknown>> = { ...(options.seededOutputs ?? {}) };
   const read = new Set(Object.keys(outputs));
+  const deployed: Record<string, string[]> = {};
   const parts: ChangeSetPart[] = [];
   const componentOf = new Map<string, string>();
   const plans: Record<string, Record<string, unknown>> = {};
@@ -117,15 +136,14 @@ export async function planPrSet(options: PrPlanSetOptions): Promise<PrPlanSet> {
   for (const wave of options.plan.waves) {
     // The dependencies' outputs first, each read once. A dependency that
     // cannot say leaves its references unresolved, which its dependent's
-    // plan reports if it needs them.
-    for (const name of wave) {
-      for (const dep of byName.get(name)?.dependsOn ?? []) {
-        if (read.has(dep) || !byName.has(dep)) continue;
-        read.add(dep);
-        const found = await readComponentOutputs(byName.get(dep)!, options.registry, deployContext(options, dep), outputs);
-        if (found) outputs[dep] = found;
-      }
+    // plan reports if it needs them. A dependency outside the selection is
+    // read the same way (#4104).
+    const deps = [...new Set(wave.flatMap((name) => byName.get(name)?.dependsOn ?? []))].filter((dep) => !read.has(dep));
+    for (const dep of deps) {
+      read.add(dep);
+      if (!byName.has(dep)) throw new Error(`planPrSet: ${dep}, a dependency of a planned member, is not among the components; pass every component in the project`);
     }
+    Object.assign(deployed, await readDeployedOutputs(deps, byName, options.registry, (dep) => deployContext(options, dep), outputs));
     const planned = await Promise.all(
       wave.map(async (name) => {
         const at = { component: name, phase: PR_PLAN_PHASE, step: "plan" };
@@ -170,7 +188,8 @@ export async function planPrSet(options: PrPlanSetOptions): Promise<PrPlanSet> {
     counts: memberCounts(doc, m.member),
     ...(m.error ? { error: m.error } : {}),
   }));
-  return { doc, members, plans, outputs, failed };
+  const deployedOutputs = Object.fromEntries(Object.entries(deployed).sort(([a], [b]) => a.localeCompare(b)));
+  return { doc, members, plans, outputs, failed, ...(Object.keys(deployedOutputs).length > 0 ? { deployedOutputs } : {}) };
 }
 
 /**
@@ -488,6 +507,7 @@ export function prReport(input: PrReportInput): PrReport {
     ...(input.refusal ? { refusal: input.refusal } : {}),
     ...(input.message ? { message: input.message } : {}),
     ...(input.resumed ? { resumed: { applied: [...input.resumed].sort() } } : {}),
+    ...(input.set.deployedOutputs ? { deployedOutputs: input.set.deployedOutputs } : {}),
     approval: input.approval,
     selection: {
       changed: input.plan.order.filter((c) => changed.has(c)),

package/src/components/promote.ts

@@ -53,6 +53,7 @@ import {
   type DriverStep,
 } from "./driver";
 import type { GateLedgerPort } from "../op/gate";
+import type { Release } from "../lifecycle/release-store";
 import type { RunProgressEvent } from "./run-progress";
 import type { RunEventSink } from "../run-event-stream";
 
@@ -249,6 +250,66 @@ export function planRollback(input: {
   return { from: env, to: env, items: [{ component, digest: target.digest, source: target }], notPromoted: [] };
 }
 
+/**
+ * Decide what a rollback to a release restores (#4035): every component of
+ * `release`, each at the newest record in `env`'s ledger that names the
+ * release, so the digest restored is the one the environment ran from it. A
+ * component of the release this checkout does not declare is reported and
+ * left alone. One the environment never ran from the release has no recorded
+ * digest, and is refused. So is a release the environment already runs,
+ * unless one of its components is `unsettled` (a run left it failed or gated):
+ * then the rollback is what puts that component back too.
+ */
+export function planReleaseRollback(input: {
+  env: string;
+  records: ReleaseRecord[];
+  declared: string[];
+  release: Pick<Release, "releaseDigest" | "artifactDigests" | "targets">;
+  /** The release's label, or null; used in messages. */
+  label: string | null;
+  /** Components a run left failed or gated in `env` (../lifecycle/mixed-environment.ts). */
+  unsettled?: ReadonlySet<string>;
+}): PromotionPlan | { error: string } {
+  const { env, records, declared, release } = input;
+  const name = input.label ?? release.releaseDigest;
+  const target = release.targets.find((t) => t.env === env);
+  const inRelease = new Set<string>();
+  for (const t of target?.templates ?? []) if (t.component !== null) inRelease.add(t.component);
+  for (const a of release.artifactDigests) inRelease.add(a.component);
+  const items: PromotionItem[] = [];
+  const notPromoted: PromotionPlan["notPromoted"] = [];
+  const neverRan: string[] = [];
+  for (const component of [...inRelease].sort()) {
+    if (!declared.includes(component)) {
+      notPromoted.push({ component, reason: `in release ${name} but not declared in this checkout` });
+      continue;
+    }
+    const ran = records.filter((r) => r.component === component && r.releaseDigest === release.releaseDigest);
+    if (ran.length === 0) {
+      neverRan.push(component);
+      continue;
+    }
+    const record = latestPerComponent(ran).get(component)!;
+    items.push({ component, digest: record.digest, source: record });
+  }
+  if (neverRan.length > 0) {
+    return {
+      error: `release ${name} never deployed ${neverRan.map((c) => `"${c}"`).join(", ")} to "${env}", so no recorded digest can be restored; ` +
+        `promote it instead: chant components promote --to ${env} --release ${name}`,
+    };
+  }
+  if (items.length === 0) return { error: `release ${name} has no component declared in this checkout` };
+  const current = latestPerComponent(records);
+  const already = items.every((i) => {
+    const now = current.get(i.component);
+    return now !== undefined && now.releaseDigest === release.releaseDigest && now.digest === i.digest && !input.unsettled?.has(i.component);
+  });
+  if (already) {
+    return { error: `"${env}" already runs release ${name}; nothing to roll back. After a deploy that failed partway, chant components redeploy puts a component's release back` };
+  }
+  return { from: env, to: env, items, notPromoted };
+}
+
 /**
  * Decide what a redeploy deploys: the release of `component` the ledger in
  * `env` records as current. A deploy that fails partway records nothing, so
@@ -641,6 +702,11 @@ function refTo(record: ReleaseRecord) {
   return { env: record.env, runId: record.runId, timestamp: record.timestamp };
 }
 
+/** A rollback and a redeploy put an earlier deploy back, so they name the release it came from (#4043). */
+function releaseOf(source: ReleaseRecord): { releaseDigest?: string } {
+  return source.releaseDigest !== undefined ? { releaseDigest: source.releaseDigest } : {};
+}
+
 /**
  * The release record a successful promotion appends to the target ledger.
  * The digest, git sha and archive identities are the source release's own,
@@ -657,7 +723,7 @@ export function promotionRecord(item: PromotionItem, to: string, run: DeployRunI
  * release.
  */
 export function rollbackRecord(item: PromotionItem, env: string, run: DeployRunInfo): ReleaseRecordInput {
-  return { ...sharedRecord(item, env, run), restores: refTo(item.source) };
+  return { ...sharedRecord(item, env, run), restores: refTo(item.source), ...releaseOf(item.source) };
 }
 
 /**
@@ -667,5 +733,5 @@ export function rollbackRecord(item: PromotionItem, env: string, run: DeployRunI
  * change, and the record says when it was last put back.
  */
 export function redeployRecord(item: PromotionItem, env: string, run: DeployRunInfo): ReleaseRecordInput {
-  return { ...sharedRecord(item, env, run), redeploys: refTo(item.source) };
+  return { ...sharedRecord(item, env, run), redeploys: refTo(item.source), ...releaseOf(item.source) };
 }

package/src/components/release-compile.ts

@@ -28,7 +28,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
 import { loadChantConfig, type ChantConfig } from "../config";
-import { resolveCliBuildParams } from "../cli/build-params-cli";
+import { resolveFlaggedBuildParams } from "../flag-params";
 import { discoverComponents } from "./discover";
 import { withoutDisabled } from "./cli-support";
 import { applyConfigDefaults } from "./config-defaults";
@@ -72,6 +72,13 @@ export interface CompiledTarget {
   components: string[];
   /** Each component's build-time steps, as declared for this environment, in composition order. */
   buildSteps: Record<string, unknown[]>;
+  /**
+   * Each component's publish steps (`PUBLISH_STEP_KINDS`), as declared for
+   * this environment, in composition order (#4027). The cut's dry run shows
+   * them as what each environment's deploy publishes. Absent from a compiler
+   * that does not report them.
+   */
+  publishSteps?: Record<string, unknown[]>;
   /** For each component, the files its build steps read, relative to the member's directory. Used to tell whether an artifact's source changed. */
   buildInputs: Record<string, string[]>;
   /** For each component, the file that declares it, relative to the member's directory. */
@@ -132,6 +139,11 @@ export function buildStepsOf(component: DriverComponent): DriverStep[] {
   return stepsOf(component.deploy).map((s) => s.step).filter((s) => BUILD_STEP_KINDS.includes(s.kind));
 }
 
+/** A component's publish steps ({@link PUBLISH_STEP_KINDS}), each as declared, in composition order. */
+export function publishStepsOf(component: DriverComponent): DriverStep[] {
+  return stepsOf(component.deploy).map((s) => s.step).filter((s) => PUBLISH_STEP_KINDS.includes(s.kind));
+}
+
 /** The literal paths a component's archive steps read: `docker-build`'s `context` and `dockerfile`, `zip-package`'s `source`, `jvm-build`'s `path`. */
 export function buildInputPaths(component: DriverComponent): string[] {
   const out: string[] = [];
@@ -201,10 +213,11 @@ async function loadComponents(
   env: string,
 ): Promise<{ config: ChantConfig; params: ReleaseParam[]; declared: number; components: Array<{ component: DriverComponent; file: string }> }> {
   const { config } = await loadChantConfig(inputs.projectDir).catch(() => ({ config: {} as ChantConfig }));
-  const resolved = resolveCliBuildParams(config.buildParams, {
+  // #4024: a workspace member's flag records back their parameters, so a flag's value is a param with source flag:<name>.
+  const resolved = await resolveFlaggedBuildParams(inputs.projectDir, config.buildParams, {
     ...(inputs.params ? { cli: inputs.params } : {}),
     ...(inputs.paramsFile ? { paramsFile: inputs.paramsFile.replaceAll("{env}", env) } : {}),
-  });
+  }, env);
   if (!resolved.success) throw new ReleaseCompileError(`build parameters for "${env}" did not resolve:\n${resolved.errors.join("\n")}`);
   const discovered = await discoverComponents(inputs.projectDir, { buildParams: resolved.provenance });
   if (discovered.errors.length > 0) throw new ReleaseCompileError(discovered.errors.map((e) => e.message).join("\n"));
@@ -267,6 +280,7 @@ export async function compileEnvironment(inputs: CompileInputs, env: string): Pr
     params,
     components: components.map((c) => c.component.name),
     buildSteps: Object.fromEntries(components.map(({ component }) => [component.name, buildStepsOf(component)])),
+    publishSteps: Object.fromEntries(components.map(({ component }) => [component.name, publishStepsOf(component)])),
     buildInputs: Object.fromEntries(components.map(({ component }) => [component.name, buildInputPaths(component)])),
     componentFiles: Object.fromEntries(components.map(({ component, file }) => [component.name, rel(file)])),
     templates,

package/src/components/release-gate.ts

@@ -47,14 +47,16 @@
  * environment has no deploy of the component). When they are all equal the
  * member has no entries. When the environment's deploy names no release, or
  * the release it names can't be read, the member has a hole: nothing says
- * what the environment runs, so the change can't be shown empty.
+ * what the environment runs, so the change can't be shown empty. So does a
+ * component a promote, rollback or redeploy left failed or gated with nothing
+ * recorded since (#4035): its record names what ran before that run.
  */
 
 import type { CapabilityRegistry } from "./capability";
 import { deployContext, resolveComponentGraph, resolveStepInput, type DriverComponent, type DriverGate, type DriverPhase, type DriverStep } from "./driver";
 import { componentPlanDigest } from "./gate-plan";
 import { gateName, RELEASE_GATE_OP } from "../op/gate-name";
-import { capabilitySteps, readComponentOutputs } from "./wave-plan";
+import { capabilitySteps, planContext, readComponentOutputs } from "./wave-plan";
 import {
   composeChangeSet,
   isEmptyChangeSet,
@@ -111,6 +113,12 @@ export interface ReleaseChangeSetInput {
   registry: CapabilityRegistry;
   /** Per component, what `env` runs now. A component missing here has never been deployed to it. */
   current: ReadonlyMap<string, CurrentDeploy>;
+  /**
+   * Components a promote, rollback or redeploy left failed or gated in `env`
+   * with nothing recorded since (#4035), each with why. What they run is not
+   * known, so each is a hole whatever its ledger record says.
+   */
+  unsettled?: ReadonlyMap<string, string>;
   /** Outputs supplied by the caller (`--seed-outputs`). */
   seededOutputs?: Record<string, Record<string, unknown>>;
   /** The chant version to record in the document. */
@@ -151,6 +159,8 @@ export function chantComponentPart(input: {
   env: string;
   digest: string;
   current: CurrentDeploy | undefined;
+  /** Why the component is unsettled in `env` (#4035), when it is. */
+  unsettled?: string;
 }): ChangeSetPart {
   const { component, release, env, digest, current } = input;
   const name = component.name;
@@ -184,6 +194,10 @@ export function chantComponentPart(input: {
       },
     ],
   });
+  if (input.unsettled !== undefined) {
+    member.holes.push({ address: name, type: RELEASE_COMPONENT_ENTRY_TYPE, reason: input.unsettled });
+    return { member, entries: [] };
+  }
   if (!current) {
     return entry("create", [
       { path: "artifact", after: digest },
@@ -238,7 +252,7 @@ export async function planReleaseChangeSet(input: ReleaseChangeSetInput): Promis
     const digest = input.digests.get(name) ?? "";
     const plannable = capabilitySteps(component.deploy).filter((s) => registry.has(s.kind) && registry.resolve(s.kind).plan !== undefined);
     if (plannable.length === 0) {
-      parts.push(chantComponentPart({ component, release, env, digest, current: input.current.get(name) }));
+      parts.push(chantComponentPart({ component, release, env, digest, current: input.current.get(name), unsettled: input.unsettled?.get(name) }));
       continue;
     }
     const ctx = deployContext({ env }, name);
@@ -251,7 +265,7 @@ export async function planReleaseChangeSet(input: ReleaseChangeSetInput): Promis
       }
       for (const step of plannable) {
         const { kind, ...rest } = step;
-        const planned = await registry.resolve(kind).plan!(ctx, resolveStepInput(rest, {}, outputs) as never);
+        const planned = await registry.resolve(kind).plan!(planContext(ctx, rest, outputs), resolveStepInput(rest, {}, outputs) as never);
         parts.push(
           planned.changeSet ?? {
             member: {

package/src/components/wave-plan.ts

@@ -19,7 +19,7 @@
  * `@<component>.publish.*`) resolves.
  */
 
-import { resolveStepInput, type DriverComponent, type DriverPhase, type DriverStep } from "./driver";
+import { resolveStepInput, unresolvedWiringSources, type DriverComponent, type DriverPhase, type DriverStep } from "./driver";
 import { componentPlanDigest } from "./gate-plan";
 import type { CapabilityRegistry, DeployContext } from "./capability";
 import type { WaveMember } from "../gated-waves";
@@ -60,6 +60,19 @@ export function capabilitySteps(phases: readonly DriverPhase[]): DriverStep[] {
   return out;
 }
 
+/**
+ * The context a step is planned with: `ctx`, plus the components whose
+ * outputs the step reads and could not read yet (`unresolvedInputs`, #4084).
+ */
+export function planContext(
+  ctx: DeployContext,
+  stepInput: Record<string, unknown>,
+  componentOutputs: Record<string, Record<string, unknown>>,
+): DeployContext {
+  const unresolved = unresolvedWiringSources(stepInput, componentOutputs);
+  return unresolved.length > 0 ? { ...ctx, unresolvedInputs: unresolved } : ctx;
+}
+
 /** Plan one component against the outputs earlier waves produced. Never throws: a failure comes back as `error`. */
 export async function planWaveComponent(
   component: DriverComponent,
@@ -76,7 +89,7 @@ export async function planWaveComponent(
       if (!capability.plan) continue;
       const { kind: _kind, ...rest } = step;
       const input = resolveStepInput(rest, {}, componentOutputs);
-      const planned = await capability.plan(ctx, input as never);
+      const planned = await capability.plan(planContext(ctx, rest, componentOutputs), input as never);
       const member = { member: planned.member, planDigest: planned.planDigest };
       members.push(member);
       parts.push(planned.changeSet ?? emptyPart(member));
@@ -122,3 +135,33 @@ export async function readComponentOutputs(
   }
   return found;
 }
+
+/**
+ * Read the deployed outputs of each of `names` that `outputs` holds nothing
+ * for yet (#4104), through {@link readComponentOutputs}, and add them to
+ * `outputs`. A name that is not among `components`, or whose steps cannot
+ * say, is left out, so its dependents' references stay unresolved. Returns,
+ * per component read, the names of the outputs the read gave, sorted.
+ *
+ * `components` must be the whole graph, not the selection: the dependency a
+ * selected member reads is often one the change did not select.
+ */
+export async function readDeployedOutputs(
+  names: readonly string[],
+  components: ReadonlyMap<string, DriverComponent>,
+  registry: CapabilityRegistry,
+  ctxOf: (component: string) => DeployContext,
+  outputs: Record<string, Record<string, unknown>>,
+): Promise<Record<string, string[]>> {
+  const read: Record<string, string[]> = {};
+  for (const name of names) {
+    if (name in outputs || name in read) continue;
+    const component = components.get(name);
+    if (!component) continue;
+    const found = await readComponentOutputs(component, registry, ctxOf(name), outputs);
+    if (!found) continue;
+    outputs[name] = found;
+    read[name] = Object.keys(found).sort();
+  }
+  return read;
+}

package/src/config.ts

@@ -12,6 +12,7 @@ import { findProjectConfig } from "./project-root";
 import { evaluateProjectConfig } from "./config-sandbox";
 import { lexiconNames, pathLexiconRoot, registerLexiconDeclarations, type LexiconDeclaration } from "./lexicon-module";
 import { decideConfigSchema, type DecideConfig } from "./op/decide-config";
+import { PublishDeclarationSchema, type PublishDeclaration } from "./lifecycle/publish-declaration";
 
 /**
  * One project-declared environment (chant #1166). Historically always a bare
@@ -169,6 +170,7 @@ export const ChantConfigSchema = z.object({
   ).optional(),
   release: z.object({
     autoRecord: z.boolean().optional(),
+    publish: z.array(PublishDeclarationSchema).optional(),
   }).optional(),
   // Strict: a misspelt key here would leave Ops on the local runtime with
   // nothing said (#2523).
@@ -382,6 +384,12 @@ export interface ChantConfig {
   release?: {
     /** Set false to disable auto-emitting a release record after a successful component deploy project-wide. The `--no-release-record` CLI flag overrides this per-invocation. */
     autoRecord?: boolean;
+    /**
+     * Where `chant release publish` publishes a cut release (#4047): npm
+     * packages, an image in an OCI registry, release assets on a forge. Run in
+     * the order given. See ./lifecycle/publish-declaration.ts.
+     */
+    publish?: PublishDeclaration[];
   };
 
   /** Defaults for `chant run` and its subcommands (#2523). */