@intentius/chant 0.124.29 → 0.124.30

package/src/cli/handlers/fan-out.test.ts

@@ -84,6 +84,13 @@ let inputs: Record<string, Record<string, unknown>> = {};
 let stepOutputs: Record<string, Record<string, unknown>> = {};
 /** Called as a component's step starts, before it applies. */
 let onStart: (component: string) => void = () => {};
+/**
+ * What each stack exposes in the deployed estate, read through the step's
+ * `outputs` as cfn-deploy's `describeStack` does (#4104). `undefined` leaves
+ * the capability with no `outputs`; an `Error` makes the read fail.
+ */
+let liveOutputs: Record<string, Record<string, unknown> | Error> | undefined;
+let outputsRead: string[] = [];
 
 function makeArgs(overrides: Partial<ParsedArgs>): ParsedArgs {
   return {
@@ -114,6 +121,8 @@ beforeEach(() => {
   inputs = {};
   stepOutputs = {};
   onStart = () => {};
+  liveOutputs = undefined;
+  outputsRead = [];
   gateLedger = memoryGateLedgerPort();
   stderrLines = [];
   stdoutLines = [];
@@ -149,6 +158,16 @@ beforeEach(() => {
         if (failing.includes(runCtx.component)) throw new Error(`${runCtx.component} failed`);
         return { ok: true, ...(stepOutputs[runCtx.component] ? { outputs: stepOutputs[runCtx.component] } : {}) };
       },
+      ...(liveOutputs
+        ? {
+            async outputs(readCtx: { component: string }) {
+              outputsRead.push(readCtx.component);
+              const live = liveOutputs![readCtx.component];
+              if (live instanceof Error) throw live;
+              return { ...(live ?? {}) };
+            },
+          }
+        : {}),
     } as never);
     return Promise.resolve(registry);
   });
@@ -849,3 +868,66 @@ describe("progress carries only for an unchanged input (#4081)", () => {
     expect(stderr()).toContain("does not record what each component applied, so none of its progress carries");
   });
 });
+
+describe("a seed's outputs, read from the deployed estate (#4104)", () => {
+  /** cluster-a reads net's TopicArn, and the change touches cluster-a alone. */
+  function wireClusterA(): void {
+    const wired: Component = {
+      name: "cluster-a",
+      dependsOn: ["net"],
+      deploy: [
+        {
+          phase: "Apply",
+          steps: [{ kind: "cfn-deploy", stack: "cluster-a-stack", inputs: { topic: { stackOutput: { stack: "net", name: "TopicArn" } } } }],
+        },
+      ],
+    };
+    const estate = ESTATE.map((c) => (c.name === "cluster-a" ? wired : c));
+    discoverComponentsMock.mockResolvedValue({
+      components: new Map(estate.map((c) => [c.name, { component: c, exportName: c.name, filePath: `${c.name}.component.ts` }])),
+      sourceFiles: [],
+      errors: [],
+    });
+    affectedStacksMock.mockResolvedValue({ changed: ["cluster-a-stack"], dependents: [], indeterminate: [] });
+  }
+
+  test("a cluster-a-only change runs cluster-a with net's deployed outputs, and says it read them", async () => {
+    wireClusterA();
+    liveOutputs = { net: { TopicArn: "arn:aws:sns:us-east-1:000000000000:net", QueueUrl: "http://q" } };
+    expect(await runComponentsFanOut(ctx({ base: "main", env: "test" }))).toBe(0);
+    expect(ran).not.toContain("net");
+    expect(outputsRead).toEqual(["net"]);
+    expect(inputs["cluster-a"]).toEqual(expect.objectContaining({ inputs: { topic: "arn:aws:sns:us-east-1:000000000000:net" } }));
+    expect(stderr()).toContain("net: outputs read from the deployed estate (QueueUrl, TopicArn)");
+  });
+
+  test("--seed-outputs wins: a seed it gives is not read", async () => {
+    wireClusterA();
+    liveOutputs = { net: { TopicArn: "arn:deployed" } };
+    const dir = await mkdtemp(join(tmpdir(), "fan-out-"));
+    try {
+      const seed = join(dir, "seed.json");
+      await writeFile(seed, JSON.stringify({ net: { TopicArn: "arn:seeded" } }));
+      expect(await runComponentsFanOut(ctx({ base: "main", env: "test", seedOutputs: [seed] }))).toBe(0);
+      expect(outputsRead).toEqual([]);
+      expect(inputs["cluster-a"]).toEqual(expect.objectContaining({ inputs: { topic: "arn:seeded" } }));
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("a read that fails stops the fan-out before anything runs, naming the seed", async () => {
+    wireClusterA();
+    liveOutputs = { net: new Error("ExpiredToken") };
+    expect(await runComponentsFanOut(ctx({ base: "main", env: "test" }))).toBe(1);
+    expect(ran).toEqual([]);
+    expect(stderr()).toContain("could not read the deployed outputs of net: ExpiredToken");
+  });
+
+  test("--dry-run reads nothing", async () => {
+    wireClusterA();
+    liveOutputs = { net: { TopicArn: "arn:deployed" } };
+    expect(await runComponentsFanOut(ctx({ base: "main", env: "test", dryRun: true }))).toBe(0);
+    expect(outputsRead).toEqual([]);
+  });
+});

package/src/cli/handlers/fan-out.ts

@@ -67,6 +67,8 @@ import { summaryLedgerPrefix, writeGatedRunSummary } from "../../op/gate-summary
 import { approveCommand, gateIsSealed } from "../../op/gate";
 import { getHeadCommit } from "../../lifecycle/git";
 import { remainingFanOut, type ChangedUnits, type FanOutProgress } from "../../components/fan-out";
+import { readDeployedOutputs } from "../../components/wave-plan";
+import { deployContext } from "../../components/driver";
 import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli";
 import { formatError, formatInfo, formatWarning } from "../format";
 import { FAN_OUT_GATE_OP } from "../../op/gate-name";
@@ -343,6 +345,36 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
   }
 
   const registry = await fanOutRegistry(projectPath, config);
+  const env = args.env ?? "local";
+
+  // A completed component's recorded outputs win over a `--seed-outputs`
+  // entry for the same name, as a fresh apply's outputs merge over a seed in
+  // the driver: the record holds what this fan-out itself applied. A seed
+  // neither gives is read from the deployed estate (#4104), through its
+  // capability's `outputs`, as pr-plan reads a dependency outside the change.
+  // One that cannot be read leaves its dependents' references unresolved.
+  const componentOutputs: Record<string, Record<string, unknown>> = { ...seededOutputs, ...priorOutputs };
+  const seeds = (progress ? remainingFanOut(derived.plan, derived.components, progress) : derived.plan).seeds;
+  let deployedSeeds: Record<string, string[]>;
+  try {
+    deployedSeeds = await readDeployedOutputs(
+      seeds,
+      new Map(derived.components.map((c) => [c.name, c])),
+      registry,
+      (name) => deployContext({ env }, name),
+      componentOutputs,
+    );
+  } catch (err) {
+    console.error(formatError({
+      message: `could not read the deployed outputs of ${seeds.filter((s) => !(s in componentOutputs)).join(", ")}: ${err instanceof Error ? err.message : String(err)}`,
+      hint: "Nothing ran. --seed-outputs <file> gives a component's outputs instead of reading them.",
+    }));
+    return 1;
+  }
+  for (const [name, keys] of Object.entries(deployedSeeds)) {
+    console.error(formatInfo(`${name}: outputs read from the deployed estate (${keys.length > 0 ? keys.join(", ") : "none yet"})`));
+  }
+
   // #3061: the commit this run deploys, for the workloads' vcs.ref.head.revision.
   const revision = await getHeadCommit().catch(() => undefined);
 
@@ -378,12 +410,9 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
   let result;
   try {
     result = await runFanOut(derived.plan, derived.components, registry, {
-      env: args.env ?? "local",
+      env,
       releaseIdentity: () => (revision ? { revision } : {}),
-      // A completed component's recorded outputs win over a `--seed-outputs`
-      // entry for the same name, as a fresh apply's outputs merge over a seed in
-      // the driver: the record holds what this fan-out itself applied.
-      componentOutputs: { ...seededOutputs, ...priorOutputs },
+      componentOutputs,
       ...(gate ? { gate } : {}),
       ...(waveGate ? { waveGate } : {}),
       ...(waveGate

package/src/cli/handlers/pr.ts

@@ -112,6 +112,11 @@ interface Prepared {
   head: string;
   gate: string;
   forge?: PrForge;
+  /**
+   * Every component in the project, not the selection (`deriveFanOut`), so
+   * the plan reads the deployed outputs of a dependency the change did not
+   * select (#4104).
+   */
   components: DriverComponent[];
   plan: FanOutPlan;
   signal: ComponentChangeSignal;

package/src/cli/main.ts

@@ -249,6 +249,33 @@ CI:
                         chant/lifecycle that a runner key signed. Pushes the
                         tags. --key, or the PEM in CHANT_RUNNER_KEY, signs
                         each tag with a runner key.
+  ci run plan|apply --env <env> --base <sha> [--pr <n>] [--commit <sha>]
+              [--forge github|gitlab|forgejo] [--gate <name>] [--branch <name>]
+              [--events-json] [--report-url <url>] [--image <image>]
+              [--before-script <line>]... [--pr-build]
+              [--pr-build-command <line>] [--chant <command>]
+              [--pass-env <NAME>]... [--key <runner key.pem>] [-o <dir>]
+                        Run the pull-request pipeline's plan or apply job as
+                        a pipeline Op in a fresh worktree of --commit (default
+                        HEAD) with a clean environment. --base and --pr stand
+                        in for the forge's event values. --pr-build runs
+                        the job's build and lint lines first. Records the run as
+                        pr-plan or pr-apply on chant/lifecycle, signed with
+                        --key or CHANT_RUNNER_KEY, so ci tick from runs counts
+                        it, and copies the report to -o (default .chant/pr).
+  ci serve --forge forgejo|github --repo <owner/repo> --env <env>
+              [--interval <s>] [--max-jobs <n>] [--state <dir>]
+              [--author <login>]... [--once] [--rerun-failed]
+              [ci run's job flags]
+                        Poll the forge for open pull requests and the target
+                        branch's head, and run ci run plan for each new pull
+                        request head and ci run apply for each new commit on
+                        the branch. Dedupes on job and commit in a state file
+                        under --state, takes a lease per apply group, keeps
+                        each apply's resume record there, and runs at most
+                        --max-jobs (default 1) jobs at once. --once runs one
+                        poll and waits for its jobs. --rerun-failed runs a
+                        failed apply or plan again.
   ci workflow [--workflow <name>]... [--output <file>]  Write
               [--chant <command>] [--install <command>]
               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>]
@@ -1306,6 +1333,9 @@ export const commandRegistry: CommandDef[] = [
   { name: "ci list", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-green-cli")).runCiList(ctx) },
   { name: "ci tick", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-green-cli")).runCiTick(ctx) },
   { name: "ci workflow", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-green-cli")).runCiWorkflow(ctx) },
+  // #4094: one pull-request job as a pipeline Op in a fresh checkout, the chant runner's first slice.
+  { name: "ci run", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-run")).runCiRun(ctx) },
+  { name: "ci serve", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-serve")).runCiServe(ctx) },
   // #4026: the release cut from a green commit (ws-104). Imported on first use.
   { name: "release cut", runsNoConfig: true, handler: async (ctx) => (await import("./handlers/release")).runReleaseCut(ctx) },
   // #4027: publish a cut release, to the targets #4047 declares.

package/src/cli/parse-args.ts

@@ -42,6 +42,7 @@ const BOOLEAN_FLAGS = new Set([
   "--composites",
   "--stacks",
   "--components",
+  "--pr-build",
   "--up",
   "--down",
   "--include-dependents",
@@ -64,6 +65,7 @@ const BOOLEAN_FLAGS = new Set([
   "--yes",
   "--confirm-prod",
   "--once",
+  "--rerun-failed",
   "--expire",
   "--check-live",
   "--check-snapshot",
@@ -394,6 +396,13 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.requireProvenance = true;
     } else if (arg === "--pr-loop") {
       result.prLoop = true;
+    } else if (arg === "--pr-build") {
+      // `chant build --pr-loop --pr-build` (#4088), and `chant ci run --pr-build` (#4094).
+      result.prBuild = true;
+    } else if (arg === "--pr-build-command") {
+      const line = args[++i];
+      if (line === undefined || line === "") throw new Error("--pr-build-command needs a shell line: --pr-build-command '<line>'");
+      result.prBuildCommand = line;
     } else if (arg === "--before-script") {
       const line = args[++i];
       if (line === undefined || line === "") throw new Error("--before-script needs a shell line: --before-script '<line>'");
@@ -518,6 +527,32 @@ export function parseArgs(args: string[]): ParsedArgs {
       // `chant ci workflow --chant <command>` (#3573): what the tick step runs chant with.
       result.ciChant = args[++i];
       if (!result.ciChant || result.ciChant.startsWith("-")) throw new Error("--chant needs the command that runs chant, such as \"npx tsx packages/core/src/cli/main.ts\": --chant <command>");
+    } else if (arg === "--commit") {
+      // `chant ci run plan|apply --commit <sha>` (#4094): the commit the job runs at.
+      result.commit = args[++i];
+      if (!result.commit || result.commit.startsWith("-")) throw new Error("--commit needs the commit the job runs at: --commit <sha>");
+    } else if (arg === "--pass-env") {
+      // `chant ci run --pass-env <NAME>`, repeatable (#4094): a variable of the runner's environment the job gets.
+      const name = args[++i];
+      if (!name || name.startsWith("-")) throw new Error("--pass-env needs a variable's name, such as AWS_PROFILE: --pass-env <NAME>");
+      (result.passEnv ??= []).push(name);
+    } else if (arg === "--repo") {
+      // `chant ci serve --repo <owner/repo>` (#4095): the repository whose pull requests and target branch it polls.
+      result.ciRepo = args[++i];
+      if (!result.ciRepo || !/^[^/\s-][^/\s]*\/[^/\s]+$/.test(result.ciRepo)) throw new Error("--repo needs the repository as owner/name: --repo <owner/repo>");
+    } else if (arg === "--max-jobs") {
+      // `chant ci serve --max-jobs <n>` (#4095): how many jobs run at once.
+      const n = Number(args[++i]);
+      if (!Number.isInteger(n) || n < 1) throw new Error("--max-jobs needs a whole number of jobs, 1 or more: --max-jobs <n>");
+      result.maxJobs = n;
+    } else if (arg === "--author") {
+      // `chant ci serve --author <login>`, repeatable (#4095): plan only pull requests these people opened.
+      const login = args[++i];
+      if (!login || login.startsWith("-")) throw new Error("--author needs a forge login: --author <login>");
+      (result.ciAuthors ??= []).push(login);
+    } else if (arg === "--rerun-failed") {
+      // `chant ci serve --rerun-failed` (#4095): run again the failed apply at the target branch's head, and failed plans of open heads.
+      result.rerunFailed = true;
     } else if (arg === "--install") {
       // `chant ci workflow --install <command>` (#3573): a step before the tick that installs what --chant runs.
       result.ciInstall = args[++i];

package/src/cli/registry.ts

@@ -326,6 +326,10 @@ export interface ParsedArgs {
    * merge bound to the approved digest.
    */
   prLoop?: boolean;
+  /** `chant build --pr-loop --pr-build` (#4088) — build and lint before pr-plan and pr-apply. */
+  prBuild?: boolean;
+  /** `chant build --pr-loop --pr-build-command <line>` (#4088) — the build line to run in place of `chant build --env <env>`. */
+  prBuildCommand?: string;
   /**
    * `chant components fan-out --resume <file>` (#2420) — the attempt record
    * this fan-out reads before it starts and writes when it finishes. Repeating
@@ -454,8 +458,20 @@ export interface ParsedArgs {
   branch?: string;
   /** `chant ci workflow --workflow <name>`, repeatable (#3573): a workflow whose completion triggers a tick, beside those the scan finds. */
   ciWorkflows?: string[];
-  /** `chant ci workflow --chant <command>` (#3573): the command the tick step runs chant with, in place of the npx pin. */
+  /** `chant ci run plan|apply --commit <sha>` (#4094): the commit the job runs at. Default `HEAD`. */
+  commit?: string;
+  /** `chant ci run --pass-env <NAME>`, repeatable (#4094): a variable of the runner's environment the job gets, beside the few it always gets. */
+  passEnv?: string[];
+  /** `chant ci workflow --chant <command>` (#3573): the command the tick step runs chant with, in place of the npx pin. Also `chant ci run --chant` (#4094): what runs chant in the job. */
   ciChant?: string;
+  /** `chant ci serve --repo <owner/repo>` (#4095): the repository it polls. */
+  ciRepo?: string;
+  /** `chant ci serve --max-jobs <n>` (#4095): how many jobs run at once. Default 1. */
+  maxJobs?: number;
+  /** `chant ci serve --author <login>`, repeatable (#4095): plan only pull requests these logins opened. */
+  ciAuthors?: string[];
+  /** `chant ci serve --rerun-failed` (#4095): run again the failed apply at the target's head and failed plans of open heads. */
+  rerunFailed?: boolean;
   /** `chant ci workflow --install <command>` (#3573): a step before the tick that installs what `--chant` runs. */
   ciInstall?: string;
   /** `chant ci workflow --token-secret <NAME>` (#3573): the repository secret the tick's tag push authenticates with. */

package/src/components/pr-pipeline.ts

@@ -36,6 +36,12 @@
  * the change set and the events where a reader outside CI can fetch them;
  * the job's own environment brings the credentials an `s3://` URL needs.
  *
+ * With `build` (#4088) both jobs run the project's build and `chant lint`
+ * before their command, and fail on an error. A `cfn-deploy` member's plan
+ * and apply read the built template, so a project with one needs it. The
+ * build is `chant build --env <env>`, or `buildCommand` when the templates
+ * come from several builds (`npm run build`).
+ *
  * In a workspace member (#3465) both commands run in the member's directory
  * and pass `--member <name>`, so the member's gate (`pr-<number>-<member>`),
  * note and statuses stay apart from every other member's on the same pull
@@ -105,6 +111,20 @@ export interface PrLoopPipelineOptions {
    * such as `$CHANT_REPORT_URL`.
    */
   reportUrl?: string;
+  /**
+   * Build and lint before `pr-plan` and before `pr-apply` (#4088): the build
+   * line, then `chant lint`, each failing the job on an error. A `cfn-deploy`
+   * member reads the built template, so a project with one sets this. The
+   * build line is `chant build --env <env>` unless `buildCommand` names
+   * another. Default false.
+   */
+  build?: boolean;
+  /**
+   * The shell line that builds the project in place of `chant build --env
+   * <env>`, for a project whose templates come from several builds, such as
+   * `npm run build`. Setting it turns `build` on.
+   */
+  buildCommand?: string;
   /**
    * Which GitHub-shaped forge the workflow is for. Set by the forgejo
    * generator, which reuses the github one; a caller never needs to.
@@ -126,6 +146,14 @@ export interface PrLoopJob {
   env: Record<string, string>;
   /** Shell lines to run before the command, to settle values the forge may leave unusable. */
   setup?: string[];
+  /** With `build` (#4088): the build line and the lint line, run in this order before the command. */
+  build?: string[];
+}
+
+/** The lines `build` (#4088) runs before a job's command: the build, then the lint. Empty without the option. */
+export function prLoopBuildLines(env: string, options: PrLoopPipelineOptions = {}): string[] {
+  if (!options.build && !options.buildCommand) return [];
+  return [options.buildCommand ?? `chant build --env ${env}`, "chant lint"];
 }
 
 /**
@@ -142,6 +170,8 @@ export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelin
     ...(options.reportUrl ? ["--report-url", JSON.stringify(options.reportUrl)] : []),
   ];
   const github = forge !== "gitlab";
+  const buildLines = prLoopBuildLines(env, options);
+  const build = buildLines.length > 0 ? { build: buildLines } : {};
   const jobEnv: Record<string, string> = {
     ...(github ? { GITHUB_TOKEN: GITHUB_JOB_TOKEN } : {}),
     ...(options.events ? { CHANT_RUN_EVENTS_DIR: PR_LOOP_EVENTS_DIR } : {}),
@@ -153,6 +183,7 @@ export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelin
       env: github
         ? { BASE_SHA: "${{ github.event.pull_request.base.sha }}", PR_NUMBER: "${{ github.event.pull_request.number }}", ...jobEnv }
         : { BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID", ...jobEnv },
+      ...build,
     },
     {
       jobName: "apply",
@@ -163,6 +194,7 @@ export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelin
       ].join(" "),
       env: github ? { BASE_SHA: "${{ github.event.before }}", ...jobEnv } : { BASE_SHA: "$CI_COMMIT_BEFORE_SHA", ...jobEnv },
       ...(github ? {} : { setup: [gitlabBaseFallback(options.branch)] }),
+      ...build,
     },
   ];
 }

package/src/components/pr-run.test.ts

@@ -60,6 +60,8 @@ function world() {
     planned: [] as Array<{ root: string; vars?: Record<string, unknown> }>,
     outputsRead: [] as string[],
     applied: [] as string[],
+    /** The vars each root applied with, after wiring resolved. */
+    ranWith: {} as Record<string, Record<string, unknown> | undefined>,
     fromPlan: {} as Record<string, boolean>,
     failing: new Set<string>(),
     planFailing: new Set<string>(),
@@ -100,6 +102,7 @@ function world() {
     },
     async run(ctx: DeployContext, input: RootInput) {
       w.fromPlan[input.root] = ctx.plans?.[input.root] !== undefined;
+      w.ranWith[input.root] = input.vars;
       if (w.failing.has(input.root)) throw new Error(`${input.root} failed`);
       w.applied.push(input.root);
       if (input.root === "a") w.state.a = { id: `a-${w.versions.a ?? "v1"}` };
@@ -166,6 +169,130 @@ describe("planPrSet", () => {
   });
 });
 
+describe("a dependency outside the selection (#4104)", () => {
+  /** Two members: `up`, and `down` reading its `id`. The pull request changes `down` alone. */
+  const PAIR: DriverComponent[] = [root("up"), root("down", ["up"], { upstream: { stackOutput: { stack: "up", name: "id" } } })];
+
+  function pairWorld() {
+    const w = world();
+    w.state = { up: { id: "up-live", arn: "arn:up" } };
+    w.versions.down = "v2";
+    return w;
+  }
+
+  test("the dependent's plan resolves the upstream's outputs from its deployed outputs, and the report lists them", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    expect(plan.order).toEqual(["down"]);
+    expect(plan.seeds).toEqual(["up"]);
+
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    expect(w.outputsRead).toEqual(["up"]);
+    expect(w.planned).toEqual([{ root: "down", vars: { upstream: "up-live" } }]);
+    expect(set.outputs).toEqual({ up: { id: "up-live", arn: "arn:up" } });
+    expect(set.deployedOutputs).toEqual({ up: ["arn", "id"] });
+
+    const report = prReport({
+      stage: "plan",
+      pr: 12,
+      env: "prod",
+      base: "1".repeat(40),
+      head: "2".repeat(40),
+      op: "pr-12",
+      gate: "pr-apply",
+      plan,
+      signal: { changed: ["down"], indeterminate: [], unclaimed: [] },
+      set,
+      approval: { status: "pending" },
+      status: "planned",
+    });
+    expect(report.deployedOutputs).toEqual({ up: ["arn", "id"] });
+    expect(report.selection).toMatchObject({ changed: ["down"], dependents: [] });
+  });
+
+  test("the apply's plan reads the same outputs, gets the approved digest, and applies against them", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    const approved = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+
+    // pr-apply plans the members again before anything applies.
+    w.outputsRead.length = 0;
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    expect(w.outputsRead).toEqual(["up"]);
+    expect(set.doc.digest).toBe(approved.doc.digest);
+    const check = await decidePrGate(memoryGateLedgerPort({ resolutions: [approval(approved.doc.digest)] }), {
+      op: "pr-12",
+      gate: "pr-apply",
+      digest: set.doc.digest,
+      now: NOW,
+    });
+    expect(check.satisfied).toBe(true);
+
+    const { members, status } = await applyPrSet({ components: PAIR, plan, registry: w.registry, env: "prod", set });
+    expect(status).toBe("applied");
+    expect(w.applied).toEqual(["down"]);
+    expect(w.ranWith.down).toEqual({ upstream: "up-live" });
+    expect(members.map((m) => [m.member, m.status, m.inputsMoved])).toEqual([["down", "applied", undefined]]);
+  });
+
+  test("an upstream whose deployed output moved after approval moves the apply's digest", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    const approved = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    w.state.up = { id: "up-moved", arn: "arn:up" };
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    expect(set.doc.digest).not.toBe(approved.doc.digest);
+  });
+
+  test("--seed-outputs wins: a seeded upstream is not read and not listed", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod", seededOutputs: { up: { id: "up-seeded" } } });
+    expect(w.outputsRead).toEqual([]);
+    expect(w.planned).toEqual([{ root: "down", vars: { upstream: "up-seeded" } }]);
+    expect(set.deployedOutputs).toBeUndefined();
+  });
+
+  test("an upstream whose steps cannot say leaves the reference unresolved", async () => {
+    const w = pairWorld();
+    const silent: DriverComponent[] = [
+      { name: "up", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "no-outputs" }] }] },
+      PAIR[1]!,
+    ];
+    w.registry.register({ kind: "no-outputs", async run() { return {}; } } as never);
+    const plan = planFanOut({ components: silent, changed: ["down"] });
+    const set = await planPrSet({ components: silent, plan, registry: w.registry, env: "prod" });
+    expect(w.outputsRead).toEqual([]);
+    expect(set.outputs).toEqual({});
+    expect(set.deployedOutputs).toBeUndefined();
+    expect(w.planned).toHaveLength(1);
+    expect(w.planned[0]!.vars?.upstream).not.toBe("up-live");
+  });
+
+  test("the selection in place of the whole graph is refused, naming the dependency", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    await expect(planPrSet({ components: [PAIR[1]!], plan, registry: w.registry, env: "prod" })).rejects.toThrow(/up, a dependency of a planned member/);
+  });
+
+  test("a resume plans against the record's outputs and reads no dependency they cover", async () => {
+    const w = world();
+    w.versions.a = "v2";
+    const plan = planFanOut({ components: ESTATE, changed: ["a"] });
+    const { set, first, record } = await firstAttempt(w, plan, ["app"]);
+    expect(first.run.completed).toEqual(["a"]);
+    expect(set.deployedOutputs).toEqual({ a: ["id"], net: ["cidr"] });
+
+    w.outputsRead.length = 0;
+    w.state.net = { cidr: "10.9.0.0/16" };
+    const resumed = await resumePrSet({ components: ESTATE, plan, registry: w.registry, env: "prod", record, completed: ["a"] });
+    if (!resumed.ok) throw new Error(resumed.reasons.join("; "));
+    expect(w.outputsRead).toEqual([]);
+    expect(resumed.set.doc.digest).toBe(set.doc.digest);
+    expect(resumed.set.outputs).toBe(record.planOutputs);
+  });
+});
+
 describe("the gate", () => {
   test("pending with no approval, approved for the digest, changed for another one", async () => {
     const w = world();

package/src/components/pr-run.ts

@@ -19,6 +19,16 @@
  * its dependents in one rollout is what gated waves are for (#3049): each
  * wave is planned after the one before it applied.
  *
+ * A dependency the change did not select is read the same way (#4104), so
+ * a change to one cluster plans it against the network it sits on. That is
+ * why `components` is every component in the project and not the selection.
+ * `--seed-outputs` wins over a read, and a dependency whose steps cannot say
+ * leaves its dependents' references unresolved. The apply stage's plan reads
+ * the same dependencies, so on the same estate it gets the digest the plan
+ * stage showed, and it applies against the outputs its plans read
+ * (`set.outputs`). A resume plans against the outputs the approved plans
+ * read, from the record (`planOutputs`), and reads nothing those cover.
+ *
  * ## Finishing an apply that failed partway
  *
  * {@link resumePrSet} (#3464) is fan-out's resume (#2417, #3049) for a pull
@@ -53,10 +63,10 @@ import type { PrApplyRecord } from "./fan-out-record";
 import type { CapabilityRegistry } from "./capability";
 import type { RunProgressEvent } from "./run-progress";
 import type { RunEventSink } from "../run-event-stream";
-import { planWaveComponent, readComponentOutputs } from "./wave-plan";
+import { planWaveComponent, readDeployedOutputs } from "./wave-plan";
 
 export interface PrPlanSetOptions {
-  /** Every component in the project. */
+  /** Every component in the project, not the selection: a planned member's dependency outside it is read too (#4104). */
   components: DriverComponent[];
   /** The fan-out the change derives (`planFanOut`). Its `order` is what is planned. */
   plan: FanOutPlan;
@@ -85,6 +95,12 @@ export interface PrPlanSet {
   plans: Record<string, Record<string, unknown>>;
   /** The outputs the plans read: the seeds, and each dependency's outputs as they stood. */
   outputs: Record<string, Record<string, unknown>>;
+  /**
+   * Per dependency read from the deployed estate (#4104), the names of the
+   * outputs the read gave, sorted. The seeds are not here. Absent when
+   * nothing was read. The report's `deployedOutputs`.
+   */
+  deployedOutputs?: Record<string, string[]>;
   /** Whether any component failed to plan. */
   failed: boolean;
 }
@@ -101,12 +117,15 @@ function failedParts(component: DriverComponent, error: string): ChangeSetPart[]
 /**
  * Plan every component in `plan.order`, a wave at a time, each against the
  * outputs its dependencies have now. Never throws for a component that fails
- * to plan: it becomes a failed member, and `failed` is set.
+ * to plan: it becomes a failed member, and `failed` is set. Throws when a
+ * planned member's dependency is not among `components`, which means the
+ * caller passed the selection where the whole graph belongs.
  */
 export async function planPrSet(options: PrPlanSetOptions): Promise<PrPlanSet> {
   const byName = new Map(options.components.map((c) => [c.name, c]));
   const outputs: Record<string, Record<string, unknown>> = { ...(options.seededOutputs ?? {}) };
   const read = new Set(Object.keys(outputs));
+  const deployed: Record<string, string[]> = {};
   const parts: ChangeSetPart[] = [];
   const componentOf = new Map<string, string>();
   const plans: Record<string, Record<string, unknown>> = {};
@@ -117,15 +136,14 @@ export async function planPrSet(options: PrPlanSetOptions): Promise<PrPlanSet> {
   for (const wave of options.plan.waves) {
     // The dependencies' outputs first, each read once. A dependency that
     // cannot say leaves its references unresolved, which its dependent's
-    // plan reports if it needs them.
-    for (const name of wave) {
-      for (const dep of byName.get(name)?.dependsOn ?? []) {
-        if (read.has(dep) || !byName.has(dep)) continue;
-        read.add(dep);
-        const found = await readComponentOutputs(byName.get(dep)!, options.registry, deployContext(options, dep), outputs);
-        if (found) outputs[dep] = found;
-      }
+    // plan reports if it needs them. A dependency outside the selection is
+    // read the same way (#4104).
+    const deps = [...new Set(wave.flatMap((name) => byName.get(name)?.dependsOn ?? []))].filter((dep) => !read.has(dep));
+    for (const dep of deps) {
+      read.add(dep);
+      if (!byName.has(dep)) throw new Error(`planPrSet: ${dep}, a dependency of a planned member, is not among the components; pass every component in the project`);
     }
+    Object.assign(deployed, await readDeployedOutputs(deps, byName, options.registry, (dep) => deployContext(options, dep), outputs));
     const planned = await Promise.all(
       wave.map(async (name) => {
         const at = { component: name, phase: PR_PLAN_PHASE, step: "plan" };
@@ -170,7 +188,8 @@ export async function planPrSet(options: PrPlanSetOptions): Promise<PrPlanSet> {
     counts: memberCounts(doc, m.member),
     ...(m.error ? { error: m.error } : {}),
   }));
-  return { doc, members, plans, outputs, failed };
+  const deployedOutputs = Object.fromEntries(Object.entries(deployed).sort(([a], [b]) => a.localeCompare(b)));
+  return { doc, members, plans, outputs, failed, ...(Object.keys(deployedOutputs).length > 0 ? { deployedOutputs } : {}) };
 }
 
 /**
@@ -488,6 +507,7 @@ export function prReport(input: PrReportInput): PrReport {
     ...(input.refusal ? { refusal: input.refusal } : {}),
     ...(input.message ? { message: input.message } : {}),
     ...(input.resumed ? { resumed: { applied: [...input.resumed].sort() } } : {}),
+    ...(input.set.deployedOutputs ? { deployedOutputs: input.set.deployedOutputs } : {}),
     approval: input.approval,
     selection: {
       changed: input.plan.order.filter((c) => changed.has(c)),