@intentius/chant 0.124.28 → 0.124.30

package/src/op/runtime.ts

@@ -183,6 +183,48 @@ export interface OpRunRecord {
    * written before 0.124.28.
    */
   statement?: { payloadType: string; payload: string; signatures: { keyid: string; sig: string }[] };
+  /**
+   * Why a failed run failed (#4094), for a reader that acts on it without
+   * reading the log: a short `code`, a one-line `reason`, the phase that
+   * failed and the exit code of the command that failed. `chant ci run`
+   * writes it on every failed job, from the job's pull-request report when
+   * it wrote one (`not-a-reviewer`, `plan-failed`, `failed` and the other
+   * refusals and statuses), else `command-failed`, `setup-failed` or
+   * `build-failed`. Optional within contract 1, written by chant
+   * {@link OP_RUN_FAILURE_FLOOR} and newer; absent on a run that passed and
+   * on a run nothing explained.
+   */
+  failure?: OpRunFailureReason;
+}
+
+/** Why a run failed, on {@link OpRunRecord.failure} and on the run's `run-settle` event (#4094). */
+export interface OpRunFailureReason {
+  /** A short code: a pull-request report's refusal or status, or `command-failed`, `setup-failed`, `build-failed`. */
+  code: string;
+  /** One line a person reads. */
+  reason: string;
+  /** The phase that failed, when one did. */
+  phase?: string;
+  /** The exit code of the command that failed, when it exited with one. */
+  exitCode?: number;
+}
+
+/** The first chant that writes {@link OpRunRecord.failure} and `failure` on `run-settle` (#4094). */
+export const OP_RUN_FAILURE_FLOOR = "0.124.30";
+
+/** `value` as an {@link OpRunFailureReason}, or undefined when it is not one, so a reader drops a malformed field and keeps the record. */
+export function opRunFailureOf(value: unknown): OpRunFailureReason | undefined {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return undefined;
+  const v = value as Record<string, unknown>;
+  if (typeof v.code !== "string" || v.code === "" || typeof v.reason !== "string") return undefined;
+  if (v.phase !== undefined && typeof v.phase !== "string") return undefined;
+  if (v.exitCode !== undefined && !Number.isInteger(v.exitCode)) return undefined;
+  return {
+    code: v.code,
+    reason: v.reason,
+    ...(typeof v.phase === "string" ? { phase: v.phase } : {}),
+    ...(typeof v.exitCode === "number" ? { exitCode: v.exitCode } : {}),
+  };
 }
 
 /** An {@link OpRunRecord} before the ledger stamps its version and mints an id. */

package/src/plan-summary.test.ts

@@ -261,3 +261,23 @@ describe("addresses", () => {
     expect(escapeMarkerAddress('aws_s3_bucket.logs["a*b"]')).toBe("aws_s3_bucket.logs:a+00002Ab");
   });
 });
+
+describe("a no-change group with holes (#4084)", () => {
+  const part = (member: string, holes: ChangeSetPart["member"]["holes"] = []): ChangeSetPart => ({
+    member: { member, lexicon: "aws", planner: "chant", status: "planned", planDigest: `jcs1-sha256:${member}`, holes },
+    entries: [],
+  });
+  const hole = { address: "cluster-a", type: "AWS::CloudFormation::Stack", reason: "inputs from network; re-checked on apply" };
+
+  test("does not say no changes for a member whose plan has holes, and keeps the group and its id", () => {
+    const withHole = groupChangeSet(composeChangeSet([part("app-01"), part("app-02"), part("cluster-a", [hole])]));
+    const without = groupChangeSet(composeChangeSet([part("app-01"), part("app-02"), part("cluster-a")]));
+    expect(withHole.groups.map((g) => [g.id, g.units, g.noChanges])).toEqual(without.groups.map((g) => [g.id, g.units, g.noChanges]));
+    const id = withHole.groups[0].id;
+    const text = renderPlanSummaryText(withHole);
+    expect(text).toContain(`Group ${id}: 3 members, no changes known: 1 with holes, listed above:`);
+    expect(text).toContain("cluster-a: cluster-a: inputs from network; re-checked on apply");
+    expect(renderPlanSummaryMarkdown(withHole)).toContain(`#### Group ${id}: 3 members, no changes known: 1 with holes, listed above`);
+    expect(renderPlanSummaryText(without)).toContain(`Group ${id}: 3 members, no changes:`);
+  });
+});

package/src/plan-summary.ts

@@ -689,7 +689,14 @@ function groupTitle(s: PlanSummary, g: PlanSummaryGroup): string {
   if (g.resource) t += ` of ${g.resource}`;
   if (g.outlier) t += " (outlier)";
   if (g.provisional) t += " (provisional)";
-  if (g.noChanges) t += ", no changes";
+  if (g.noChanges) {
+    // A member with holes planned no entries, but its plan says nothing about
+    // what the holes cover, so the group cannot say "no changes" for it
+    // (#4084). Only the heading says so: the group and its id are unchanged.
+    const holed = s.unit === "member" ? new Set(s.holes.map((h) => h.member)) : new Set<string>();
+    const unknown = g.units.filter((u) => holed.has(u)).length;
+    t += unknown > 0 ? `, no changes known: ${unknown} with holes, listed above` : ", no changes";
+  }
   else if (g.extends) t += `, group ${g.extends}'s change plus`;
   else if (g.units.length > 1) t += ", identical change";
   else t += ", change";

package/src/pr-forge.test.ts

@@ -782,6 +782,31 @@ describe("pull requests over REST (#3798)", () => {
     expect((calls[1].body as { target_branch: string }).target_branch).toBe("main");
   });
 
+  test("openPullRequests lists the heads into a base and marks forks; branchHead reads a branch's commit (#4095)", async () => {
+    const f = fakeFetch({
+      "GET /api/v1/repos/acme/infra/pulls": [
+        { number: 12, head: { ref: "x", sha: "c".repeat(40), repo: { full_name: "mallory/infra" } }, base: { ref: "main", sha: "b".repeat(40) }, user: { login: "mallory" } },
+        { number: 4, head: { ref: "y", sha: "d".repeat(40), repo: { full_name: "acme/infra" } }, base: { ref: "main", sha: "b".repeat(40) }, user: { login: "driver" } },
+        { number: 5, head: { ref: "z", sha: "e".repeat(40) }, base: { ref: "release" } },
+      ],
+      "GET /api/v1/repos/acme/infra/branches/main": { name: "main", commit: { id: "f".repeat(40) } },
+    });
+    const forge = forgejoForge({ ...fjOpts, fetch: f.fetch });
+    expect(await forge.openPullRequests!("main")).toEqual([
+      { number: 4, head: "y", headSha: "d".repeat(40), base: "main", baseSha: "b".repeat(40), author: "driver", fork: false },
+      { number: 12, head: "x", headSha: "c".repeat(40), base: "main", baseSha: "b".repeat(40), author: "mallory", fork: true },
+    ]);
+    expect(f.calls[0].url).toBe("https://forge.example/api/v1/repos/acme/infra/pulls?state=open&limit=50&page=1");
+    expect(await forge.branchHead!("main")).toBe("f".repeat(40));
+    expect(await forge.branchHead!("gone")).toBeUndefined();
+
+    const g = fakeFetch({ "GET /repos/acme/infra/pulls": [], "GET /repos/acme/infra/branches/main": { commit: { sha: SHA } } });
+    const github = githubForge({ ...gh, fetch: g.fetch });
+    expect(await github.openPullRequests!("main")).toEqual([]);
+    expect(g.calls[0].url).toBe("https://api.github.com/repos/acme/infra/pulls?state=open&base=main&per_page=100&page=1");
+    expect(await github.branchHead!("main")).toBe(SHA);
+  });
+
   test("findPullRequest takes the oldest open one from this repository, not a fork's", async () => {
     const f = fakeFetch({
       "GET /api/v1/repos/acme/infra/pulls": [

package/src/pr-forge.ts

@@ -212,6 +212,23 @@ export interface PullRequest {
   base?: string;
 }
 
+/** An open pull request as `chant ci serve` polls it (#4095). */
+export interface OpenPullRequest {
+  number: number;
+  /** Its head branch. */
+  head: string;
+  /** The commit its head branch points at. */
+  headSha: string;
+  /** The branch it merges into. */
+  base: string;
+  /** The base branch's commit as the forge last measured the pull request against it. */
+  baseSha?: string;
+  /** Who opened it. */
+  author?: string;
+  /** Its head branch lives in another repository, a fork. */
+  fork: boolean;
+}
+
 /** What {@link PrForge.mergePullRequest} merges, and how. */
 export interface MergeOptions {
   /** The head commit the caller reviewed. The merge happens only while the pull request's head is still this commit. */
@@ -339,6 +356,13 @@ export interface PrForge {
    * still throw.
    */
   mergePullRequest(pr: number, opts: MergeOptions): Promise<MergeResult>;
+  /**
+   * GitHub and Forgejo (#4095): every open pull request into `base`, with
+   * its head commit, oldest first. `chant ci serve` polls it.
+   */
+  openPullRequests?(base: string): Promise<OpenPullRequest[]>;
+  /** GitHub and Forgejo (#4095): the commit `branch` points at, or undefined when there is no such branch. */
+  branchHead?(branch: string): Promise<string | undefined>;
 }
 
 /** A GitHub or Forgejo client. */
@@ -667,6 +691,44 @@ function githubShaped(kind: "github" | "forgejo", opts: GithubForgeOptions): Git
       const open = listed.filter((p) => fromHere(p, head));
       return open.map(pull).filter((p): p is PullRequest => p !== undefined).sort((a, b) => a.number - b.number)[0];
     },
+    async openPullRequests(base) {
+      // GitHub filters by base server-side; Forgejo's list is matched here.
+      const query = kind === "github" ? `?state=open&base=${encodeURIComponent(base)}` : "?state=open";
+      let listed: unknown[];
+      try {
+        listed = await api.list(`${repo}/pulls${query}`, pageParams, pageSize);
+      } catch (err) {
+        // Forgejo answers 404 while it counts the repository as empty, as findPullRequest notes.
+        if (kind !== "forgejo" || !(err instanceof ForgeApiError) || err.status !== 404) throw err;
+        await api.call("GET", repo);
+        return [];
+      }
+      const out: OpenPullRequest[] = [];
+      for (const v of listed) {
+        if (!isObject(v) || !isObject(v.head) || !isObject(v.base)) continue;
+        const number = num(v.number);
+        const head = str(v.head.ref);
+        const headSha = str(v.head.sha);
+        const into = str(v.base.ref);
+        if (number === undefined || !head || !headSha || into !== base) continue;
+        const baseSha = str(v.base.sha);
+        const author = isObject(v.user) ? str(v.user.login) : undefined;
+        out.push({ number, head, headSha, base: into, ...(baseSha ? { baseSha } : {}), ...(author ? { author } : {}), fork: !fromHere(v, head) });
+      }
+      return out.sort((a, b) => a.number - b.number);
+    },
+    async branchHead(branch) {
+      let b: unknown;
+      try {
+        b = await api.call("GET", `${repo}/branches/${branch.split("/").map(encodeURIComponent).join("/")}`);
+      } catch (err) {
+        if (err instanceof ForgeApiError && err.status === 404) return undefined;
+        throw err;
+      }
+      // GitHub names the commit `sha`, Forgejo `id`.
+      const commit = isObject(b) && isObject(b.commit) ? b.commit : undefined;
+      return commit ? str(commit.sha) ?? str(commit.id) : undefined;
+    },
     async editPullRequest(pr, change) {
       return pull(await api.call("PATCH", `${repo}/pulls/${pr}`, { ...(change.title !== undefined ? { title: change.title } : {}), ...(change.body !== undefined ? { body: change.body } : {}) }));
     },

package/src/pr-loop.test.ts

@@ -13,6 +13,7 @@ import { composeChangeSet, type ChangeSetPart } from "./change-set";
 import {
   describePlanChanged,
   memberCounts,
+  PR_REPORT_DEPLOYED_OUTPUTS_FLOOR,
   PR_REPORT_SCHEMA_ID,
   prApproveCommand,
   prNoteMarker,
@@ -109,6 +110,9 @@ const resumedReport: PrReport = {
   resumed: { applied: ["a"] },
 };
 
+/** A plan whose members read `net` and `a` from the deployed estate (#4104). */
+const deployedReport: PrReport = { ...planReport, deployedOutputs: { a: ["id"], net: ["cidr"], dns: [] } };
+
 describe("the pr-report schema", () => {
   test("is a valid schema and names this module's id", () => {
     expect(validSchema(schema)).toBe(true);
@@ -116,7 +120,7 @@ describe("the pr-report schema", () => {
   });
 
   test("every stage's report validates, and its change set validates against the change-set schema", () => {
-    for (const report of [planReport, refusedReport, appliedReport, resumedReport]) {
+    for (const report of [planReport, refusedReport, appliedReport, resumedReport, deployedReport]) {
       expectValid(report);
       expectValidChangeSet(report.changeSet);
       expect(report.changeSet.digest).toBe(report.digest);
@@ -158,6 +162,14 @@ describe("the note", () => {
     expect(renderPrNote(appliedReport)).not.toContain("Resumed");
   });
 
+  test("a plan that read dependencies from the deployed estate names each and its outputs (#4104)", () => {
+    const note = renderPrNote(deployedReport);
+    expect(note).toContain("Planned against outputs read from the deployed estate: `a` (`id`); `net` (`cidr`); `dns` (none yet).");
+    expect(renderPrNote(planReport)).not.toContain("deployed estate");
+    expect(PR_REPORT_DEPLOYED_OUTPUTS_FLOOR).toBe("0.124.30");
+    expect(schema.required).not.toContain("deployedOutputs");
+  });
+
   test("a small limit leaves the summary out rather than cutting the table", () => {
     const note = renderPrNote(planReport, { limit: 800 });
     expect(note).toContain("| `app` |");

package/src/pr-loop.ts

@@ -46,6 +46,9 @@ export const PR_REPORT_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace
 /** The read-contract version the report follows. */
 export const PR_REPORT_CONTRACT = 1;
 
+/** The first chant whose report can carry `deployedOutputs` (#4104). */
+export const PR_REPORT_DEPLOYED_OUTPUTS_FLOOR = "0.124.30";
+
 /** The gate a pull request's apply waits on, unless the pipeline names another. */
 export const PR_APPLY_GATE = "pr-apply";
 
@@ -183,6 +186,14 @@ export interface PrReport {
    * the rest under the same approval and did not run them again.
    */
   resumed?: { applied: string[] };
+  /**
+   * Per dependency a member was planned against, the names of the outputs
+   * read from the deployed estate (#4104), sorted. A dependency outside the
+   * change is here too. Seeded outputs (`--seed-outputs`, a resume record)
+   * are not. Absent when nothing was read. Added within contract 1 by chant
+   * {@link PR_REPORT_DEPLOYED_OUTPUTS_FLOOR}.
+   */
+  deployedOutputs?: Record<string, string[]>;
   approval: PrApproval;
   /** Component names: which changed, which run because they depend on one, and what the change touched that no component deploys. */
   selection: {
@@ -204,6 +215,17 @@ export function memberCounts(doc: Pick<ChangeSetDocument, "summary">, member: st
   return { create: n("create"), update: n("update"), replace: n("replace"), delete: n("delete") };
 }
 
+/**
+ * Why a member's plan cannot say everything it will change: its holes'
+ * reasons, each once, in order (#4084). A `cfn-deploy` member whose inputs
+ * come from a stack the same run applies first says `inputs from <stack>;
+ * re-checked on apply`.
+ */
+export function memberHoleReasons(report: Pick<PrReport, "changeSet">, member: string): string[] {
+  const m = report.changeSet.members.find((x) => x.member === member);
+  return [...new Set((m?.holes ?? []).map((h) => h.reason))];
+}
+
 /** The approve command a reviewer runs for this report's digest. */
 export function prApproveCommand(report: Pick<PrReport, "op" | "gate" | "digest">, approver = "<you>"): string {
   return `chant approve ${report.op} ${report.gate} --plan ${report.digest} --approver ${approver} --sign`;
@@ -295,8 +317,16 @@ export function renderPrNote(report: PrReport, options: { limit?: number; approv
   if (report.members.length > 0) {
     out.push("", "| Member | Component | Status | Create | Update | Replace | Delete |", "|---|---|---|---:|---:|---:|---:|");
     for (const m of report.members) {
-      const status = STATUS_WORDS[m.status] + (m.inputsMoved?.length ? `, inputs from ${m.inputsMoved.join(", ")} moved` : "");
-      out.push(`| ${code(m.member)} | ${m.component} | ${status} | ${m.counts.create} | ${m.counts.update} | ${m.counts.replace} | ${m.counts.delete} |`);
+      const holes = memberHoleReasons(report, m.member);
+      const status =
+        STATUS_WORDS[m.status] +
+        (m.inputsMoved?.length ? `, inputs from ${m.inputsMoved.join(", ")} moved` : "") +
+        (holes.length > 0 ? `; ${holes.length > 2 ? `${holes[0]}; and ${holes.length - 1} more, listed under Holes` : holes.join("; ")}` : "");
+      // A member whose plan has holes and no entries says nothing about what
+      // it changes, so its counts are unknown, not zero (#4084).
+      const unknown = holes.length > 0 && !report.changeSet.entries.some((e) => e.member === m.member);
+      const n = (k: keyof PrMemberCounts): string => (unknown ? "?" : String(m.counts[k]));
+      out.push(`| ${code(m.member)} | ${m.component} | ${status} | ${n("create")} | ${n("update")} | ${n("replace")} | ${n("delete")} |`);
     }
     if (report.members.some((m) => m.inputsMoved?.length)) {
       out.push("", "A member whose inputs moved applied the plan it was approved with. The next run plans it against the new values.");
@@ -305,6 +335,11 @@ export function renderPrNote(report: PrReport, options: { limit?: number; approv
   if (report.selection.unclaimed.length > 0) {
     out.push("", `Changed, and deployed by no component: ${report.selection.unclaimed.map(code).join(", ")}.`);
   }
+  const deployed = Object.entries(report.deployedOutputs ?? {});
+  if (deployed.length > 0) {
+    const each = deployed.map(([dep, names]) => `${code(dep)} (${names.length > 0 ? names.map(code).join(", ") : "none yet"})`);
+    out.push("", `Planned against outputs read from the deployed estate: ${each.join("; ")}.`);
+  }
   if (report.status !== "nothing") {
     out.push("", `Plan digest: ${code(report.digest)}`, "", ...approvalLines(report, options.approver ?? "<you>"));
   }
@@ -328,9 +363,11 @@ export function prStatusDescription(report: PrReport): string {
     case "nothing":
       text = "nothing to plan";
       break;
-    case "planned":
-      text = `${n} member${n === 1 ? "" : "s"}: ${sum.change} to change, ${sum.destroy} to destroy or replace${digest}`;
+    case "planned": {
+      const unknown = report.members.filter((m) => memberHoleReasons(report, m.member).length > 0).length;
+      text = `${n} member${n === 1 ? "" : "s"}: ${sum.change} to change, ${sum.destroy} to destroy or replace${unknown > 0 ? `, ${unknown} with holes` : ""}${digest}`;
       break;
+    }
     case "plan-failed":
       text = `a member failed to plan${digest}`;
       break;

package/src/pr-report-url.test.ts

@@ -0,0 +1,131 @@
+/**
+ * `--report-url` (#4007): the URL forms, the key, and the upload of a run's
+ * events as it goes: one upload in flight at a time, a failure that warns
+ * and never stops the run, and a last upload that carries everything. The
+ * s3 scheme runs a fake AWS CLI; nothing here reaches a network.
+ */
+
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { openPrReportUpload, parseReportUrl, reportKey, reportPut, type ReportPut } from "./pr-report-url";
+
+const line = (type: string, extra: Record<string, unknown> = {}): string => JSON.stringify({ type, ...extra }) + "\n";
+
+let dir: string;
+beforeEach(async () => {
+  dir = await mkdtemp(join(tmpdir(), "pr-report-url-"));
+});
+afterEach(async () => {
+  await rm(dir, { recursive: true, force: true });
+});
+
+describe("parseReportUrl", () => {
+  test("reads s3 and file URLs and refuses anything else", () => {
+    expect(parseReportUrl("s3://bucket/a/b/")).toEqual({ scheme: "s3", url: "s3://bucket/a/b", bucket: "bucket", prefix: "a/b" });
+    expect(parseReportUrl("s3://bucket")).toEqual({ scheme: "s3", url: "s3://bucket", bucket: "bucket", prefix: "" });
+    expect(parseReportUrl(pathToFileURL(dir).href)).toMatchObject({ scheme: "file", dir });
+    expect(parseReportUrl("https://example.invalid/x")).toHaveProperty("error");
+  });
+
+  test("keys by pull request and commit, and by member after them", () => {
+    expect(reportKey(12, "abc")).toBe("12/abc");
+    expect(reportKey(null, "abc")).toBe("unknown/abc");
+    expect(reportKey(12, "abc", "api")).toBe("12/abc/api");
+  });
+});
+
+describe("openPrReportUpload", () => {
+  /** A put whose uploads finish only when the test says, recording what each carried. */
+  function heldPut() {
+    const calls: Array<{ key: string; body: string; finish: (err?: Error) => void }> = [];
+    let inFlight = 0;
+    let most = 0;
+    const put: ReportPut = (key, body) =>
+      new Promise<void>((resolve, reject) => {
+        inFlight++;
+        most = Math.max(most, inFlight);
+        calls.push({ key, body, finish: (err) => { inFlight--; if (err) reject(err); else resolve(); } });
+      });
+    return { put, calls, most: () => most };
+  }
+
+  test("uploads the events on each settle, never two at once, and the settles that came meanwhile in one more", async () => {
+    const held = heldPut();
+    const upload = openPrReportUpload({ target: { scheme: "s3", url: "s3://b", bucket: "b", prefix: "" }, key: "12/abc", stage: "apply", warn: () => {}, put: held.put });
+    upload.line(line("run-start"));
+    expect(held.calls).toHaveLength(0);
+    upload.line(line("wave-start", { wave: 1 }));
+    upload.line(line("component-settle", { wave: 1 }));
+    expect(held.calls).toHaveLength(1);
+    upload.line(line("wave-settle", { wave: 1 }));
+    upload.line(line("wave-start", { wave: 2 }));
+    upload.line(line("component-settle", { wave: 2 }));
+    // Both settles wait behind the one in flight, and go up as one.
+    expect(held.calls).toHaveLength(1);
+    held.calls[0]!.finish();
+    await new Promise((r) => setImmediate(r));
+    expect(held.calls).toHaveLength(2);
+    expect(held.calls[1]!.body.split("\n").filter(Boolean)).toHaveLength(6);
+    expect(held.calls[1]!.key).toBe("12/abc/pr-apply.events.jsonl");
+
+    upload.file("pr-apply.json", "{}\n");
+    const closing = upload.close();
+    await new Promise((r) => setImmediate(r));
+    // The last upload waits for the one in flight.
+    expect(held.calls).toHaveLength(2);
+    held.calls[1]!.finish();
+    await new Promise((r) => setImmediate(r));
+    held.calls[2]!.finish();
+    await new Promise((r) => setImmediate(r));
+    held.calls[3]!.finish();
+    await closing;
+    expect(held.calls.map((c) => c.key)).toEqual(["12/abc/pr-apply.events.jsonl", "12/abc/pr-apply.events.jsonl", "12/abc/pr-apply.events.jsonl", "12/abc/pr-apply.json"]);
+    expect(held.most()).toBe(1);
+  });
+
+  test("a failed upload as the run goes warns once and the run goes on; the last one is tried again", async () => {
+    const warnings: string[] = [];
+    let fail = true;
+    const put: ReportPut = async (key) => {
+      if (fail) throw new Error(`no bucket for ${key}`);
+    };
+    const upload = openPrReportUpload({ target: { scheme: "s3", url: "s3://b", bucket: "b", prefix: "" }, key: "12/abc", stage: "apply", warn: (m) => warnings.push(m), put });
+    upload.line(line("component-settle"));
+    await new Promise((r) => setImmediate(r));
+    upload.line(line("wave-settle"));
+    await new Promise((r) => setImmediate(r));
+    expect(warnings).toHaveLength(1);
+    expect(warnings[0]).toMatch(/as the run went: no bucket .*The run goes on/);
+    fail = false;
+    await upload.close();
+    expect(warnings).toHaveLength(1);
+  });
+
+  test("file://: each settle replaces the events file whole, so it holds a wave's settle before the next wave starts", async () => {
+    const target = parseReportUrl(pathToFileURL(dir).href);
+    if ("error" in target) throw new Error(target.error);
+    const upload = openPrReportUpload({ target, key: "12/abc", stage: "apply", warn: () => {} });
+    upload.line(line("run-start"));
+    upload.line(line("wave-settle", { wave: 1 }));
+    await new Promise((r) => setImmediate(r));
+    const events = join(dir, "12", "abc", "pr-apply.events.jsonl");
+    expect(await readFile(events, "utf8")).toBe(line("run-start") + line("wave-settle", { wave: 1 }));
+    upload.line(line("run-settle"));
+    upload.file("change-set.json", "{}\n");
+    await upload.close();
+    expect((await readFile(events, "utf8")).split("\n").filter(Boolean)).toHaveLength(3);
+    expect(await readFile(join(dir, "12", "abc", "change-set.json"), "utf8")).toBe("{}\n");
+  });
+
+  test("s3://: the AWS CLI copies each object from its stdin, with the content type, and chant hands it no credential", async () => {
+    const runs: Array<{ args: string[]; stdin: string }> = [];
+    const put = reportPut({ scheme: "s3", url: "s3://b/p", bucket: "b", prefix: "p" }, async (args, stdin) => {
+      runs.push({ args, stdin });
+    });
+    await put("12/abc/pr-plan.json", "{}\n", "application/json");
+    expect(runs).toEqual([{ args: ["s3", "cp", "-", "s3://b/p/12/abc/pr-plan.json", "--content-type", "application/json", "--only-show-errors"], stdin: "{}\n" }]);
+  });
+});