@intentius/chant 0.124.31 → 0.124.33

package/src/cli/parse-args.ts

@@ -69,6 +69,10 @@ const BOOLEAN_FLAGS = new Set([
   "--setup-key",
   "--trust",
   "--unsigned",
+  "--in-place",
+  "--require-runner-start",
+  "--no-push",
+  "--no-require-review",
   "--expire",
   "--check-live",
   "--check-snapshot",
@@ -406,9 +410,17 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.requireProvenance = true;
     } else if (arg === "--pr-loop") {
       result.prLoop = true;
+    } else if (arg === "--apply-on-merge") {
+      // `chant build --pr-loop --apply-on-merge` and `chant ci serve --apply-on-merge` (#4168): opt into applying on merge.
+      result.applyOnMerge = true;
     } else if (arg === "--pr-build") {
       // `chant build --pr-loop --pr-build` (#4088), and `chant ci run --pr-build` (#4094).
       result.prBuild = true;
+    } else if (arg === "--build-command") {
+      // `chant ci serve --build-command <line>` (#4169): the line that builds a requested commit.
+      const line = args[++i];
+      if (line === undefined || line === "") throw new Error("--build-command needs a shell line: --build-command '<line>'");
+      result.ciBuildCommand = line;
     } else if (arg === "--pr-build-command") {
       const line = args[++i];
       if (line === undefined || line === "") throw new Error("--pr-build-command needs a shell line: --pr-build-command '<line>'");
@@ -777,6 +789,22 @@ export function parseArgs(args: string[]): ParsedArgs {
     } else if (arg === "--trust") {
       // `chant ci serve|run --setup-key --trust` (#4099): list the key in .chant/trust.json on a branch.
       result.trustKey = true;
+    } else if (arg === "--in-place") {
+      // `chant ci run --in-place` (#4156): run the job in this checkout, as a generated forge job does.
+      result.ciInPlace = true;
+    } else if (arg === "--require-runner-start") {
+      // `chant ci run --require-runner-start` (#4147): refuse the job unless a provisioner's runner-start statement names it.
+      result.requireRunnerStart = true;
+    } else if (arg === "--job") {
+      // `chant ci runner-start sign --job <json|@file>` (#4147): the CI job a runner was started for.
+      result.ciJob = args[++i];
+      if (!result.ciJob || result.ciJob.startsWith("-")) throw new Error("--job needs the job as JSON or @<file>: --job @job.json");
+    } else if (arg === "--no-push") {
+      // `chant ci run --no-push` (#4156): keep the run record on the local chant/lifecycle.
+      result.noPush = true;
+    } else if (arg === "--no-require-review") {
+      // `chant ci run apply --no-require-review` (#4156): the apply without pr-apply's --require-review, the default since #4168.
+      result.requireReview = false;
     } else if (arg === "--unsigned") {
       // `chant ci serve --unsigned` (#4099): serve without a runner key listed at the target's head.
       result.unsigned = true;

package/src/cli/registry.ts

@@ -23,7 +23,7 @@ export interface ParsedArgs {
   /** `--version` / `-V` (#2701): print the installed chant's version. */
   version?: boolean;
   report?: boolean;
-  /** `chant run` — force the local in-process executor (the default). */
+  /** `chant run` — force the local in-process executor (the default). `chant ci run --local` (#4161): run the job on this machine with no push, status or report upload. */
   local?: boolean;
   /**
    * `chant run <op> --on <lexicon>` (#2121) — which runtime hosts the run.
@@ -311,7 +311,10 @@ export interface ParsedArgs {
   /**
    * `chant components pr-apply --require-review` (#3183) — count an approval
    * only when its approver has a standing approving review on the pull
-   * request. Needs `--forge`.
+   * request. Needs `--forge`. `chant ci run apply --require-review`
+   * passes it on, and `chant build --pr-loop --require-review` generates a
+   * pipeline that does (#4168); `--no-require-review` (#4156) sets it false,
+   * which is the default.
    */
   requireReview?: boolean;
   /**
@@ -322,12 +325,20 @@ export interface ParsedArgs {
   reportUrl?: string;
   /**
    * `chant build --components --generate <lexicon> --pr-loop` (#3183) —
-   * generate the pull-request pipeline: plan on the pull request, apply on
-   * merge bound to the approved digest.
+   * generate the pull-request pipeline: plan on the pull request, and on
+   * merge record the plan (#4168), or apply it with `--apply-on-merge`.
    */
   prLoop?: boolean;
+  /**
+   * `chant build --pr-loop --apply-on-merge` and `chant ci serve
+   * --apply-on-merge` (#4168): on merge apply the approved plan, as before
+   * #4168, in place of recording it. Opt-in: a merge deploys nothing without it.
+   */
+  applyOnMerge?: boolean;
   /** `chant build --pr-loop --pr-build` (#4088) — build and lint before pr-plan and pr-apply. */
   prBuild?: boolean;
+  /** `chant ci serve --build-command <line>` (#4169) — the line that builds a commit a `ci/build/<sha>` tag asks for, in a worktree of it. */
+  ciBuildCommand?: string;
   /** `chant build --pr-loop --pr-build-command <line>` (#4088) — the build line to run in place of `chant build --env <env>`. */
   prBuildCommand?: string;
   /**
@@ -466,7 +477,7 @@ export interface ParsedArgs {
   ciSecrets?: string;
   /** `chant ci workflow --chant <command>` (#3573): the command the tick step runs chant with, in place of the npx pin. Also `chant ci run --chant` (#4094): what runs chant in the job. */
   ciChant?: string;
-  /** `chant ci run|serve --no-status` (#4097): post no commit status for the job. */
+  /** `chant ci run|serve --no-status` (#4097): post no commit status for the job. `chant components pr-plan|pr-apply --no-status` (#4161): post neither the status nor the note. */
   noStatus?: boolean;
   /** `chant ci run|serve --status-url <template>` (#4097): the link a job's status carries. `{key}` is `<pr>/<commit>[/<member>]`, as `--report-url` keys it. */
   statusUrl?: string;
@@ -502,8 +513,20 @@ export interface ParsedArgs {
   setupKey?: boolean;
   /** `chant ci serve|run --setup-key --trust` (#4099): list the runner key in .chant/trust.json on a branch pushed for review. */
   trustKey?: boolean;
-  /** `chant ci serve --unsigned` (#4099): start without a runner key listed in .chant/trust.json at the target's head. */
+  /**
+   * `chant ci serve --unsigned` (#4099): serve without signing. Since #4156
+   * that is the default without a trusted key, so it only skips the key, and
+   * is ignored when ci.green.signedSince requires signed runs.
+   */
   unsigned?: boolean;
+  /** `chant ci run --in-place` (#4156): run the job in this checkout at HEAD, as a generated forge job does. */
+  ciInPlace?: boolean;
+  /** `chant ci run --require-runner-start` (#4147): refuse the job unless a runner-start statement names it. */
+  requireRunnerStart?: boolean;
+  /** `chant ci runner-start sign --job <json|@file>` (#4147): the CI job a runner was started for. */
+  ciJob?: string;
+  /** `chant ci run --no-push` (#4156): write the run record on the local chant/lifecycle and push nothing. */
+  noPush?: boolean;
   /** `chant ci serve|run --setup-key --trust --principal <name>` (#4099): the principal the runner key is listed for. */
   ciPrincipal?: string;
   /** `chant workspace trust runner add <principal> --class runner|service` (#3510): the runner entry's class. */
@@ -757,8 +780,12 @@ export interface ResolvedCommand {
  * Supports compound commands like "dev generate" where args.command="dev"
  * and args.path="generate". Falls back to simple command matching.
  */
-/** Short command aliases. `chant lc …` is sugar for `chant lifecycle …`. */
-const COMMAND_ALIASES: Record<string, string> = { lc: "lifecycle" };
+/**
+ * Command aliases. `chant lc …` is sugar for `chant lifecycle …`, and
+ * `chant sync` for `chant update`, the command that syncs lexicon types
+ * (chant #3988).
+ */
+const COMMAND_ALIASES: Record<string, string> = { lc: "lifecycle", sync: "update" };
 
 export function resolveCommand(args: ParsedArgs, registry: CommandDef[]): ResolvedCommand | null {
   const command = COMMAND_ALIASES[args.command] ?? args.command;

package/src/codegen/generate-post-synth-barrel.ts

@@ -14,7 +14,7 @@
  */
 
 import { createRequire } from "module";
-import { listRuleFiles } from "../lint/discover";
+import { listRuleFiles, ruleModuleBase } from "../lint/discover";
 import { isPostSynthCheck } from "../lint/post-synth";
 
 export interface BarrelEntry {
@@ -34,7 +34,7 @@ export function scanPostSynthChecks(dir: string, importMetaUrl: string): BarrelE
   const require = createRequire(importMetaUrl);
   const entries: BarrelEntry[] = [];
   for (const file of listRuleFiles(dir)) {
-    const base = file.replace(/\.ts$/, "");
+    const base = ruleModuleBase(file);
     let mod: Record<string, unknown>;
     try {
       mod = require(`${dir}/${base}`) as Record<string, unknown>;

package/src/codegen/lexicon-regen.ts

@@ -402,7 +402,7 @@ function runExampleHarness(lexiconDir: string, verbose: boolean): RegenFailure |
 /**
  * Extract the fresh surface from the generated artifacts in the lexicon directory.
  */
-function extractFreshSurface(lexiconDir: string): SurfaceSnapshot | null {
+export function extractFreshSurface(lexiconDir: string): SurfaceSnapshot | null {
   const generatedDir = join(lexiconDir, "src", "generated");
   if (!existsSync(generatedDir)) return null;
 

package/src/codegen/pinned-upgrade.ts

@@ -29,7 +29,7 @@ import { regenLexicon, type RegenResult } from "./lexicon-regen";
 import { fetchWithRetry } from "./fetch";
 import { isLexiconPlugin, type UpstreamPin } from "../lexicon";
 import { importLexiconPackage } from "../lexicon-module";
-import { ensureTypeScriptLoader } from "../ts-loader";
+import { ensureTypeScriptLoaderFor } from "../ts-loader";
 
 // ── Public types ──────────────────────────────────────────────────────
 
@@ -252,7 +252,7 @@ export async function loadUpstreamPins(lexicon: LexiconId, lexiconDir?: string):
   const entry = lexiconDir ? lexiconEntry(lexiconDir) : null;
   if (entry) {
     try {
-      ensureTypeScriptLoader();
+      ensureTypeScriptLoaderFor(entry);
       const pins = pinsOf((await import(pathToFileURL(entry).href)) as Record<string, unknown>);
       if (pins.length > 0) return pins;
     } catch {

package/src/codegen/post-synth-barrel-guards.test.ts

@@ -26,17 +26,12 @@ describe("post-synth barrel is exported", () => {
   test.each(lexiconDirs)("%s exports ./lint/post-synth", (lexicon) => {
     const pkg = JSON.parse(readFileSync(join(lexiconsDir, lexicon, "package.json"), "utf-8"));
     const entry = pkg.exports?.["./lint/post-synth"];
-    // Lexicons shipping .d.ts use a conditional export — `types` resolves to the
-    // emitted declaration for external consumers; `development`/`default` keep
-    // runtime resolution on source (in-repo and published alike). Lexicons not
-    // yet building dist keep the plain source string.
-    if (typeof entry === "string") {
-      expect(entry).toBe("./src/lint/post-synth/index.ts");
-    } else {
-      expect(entry?.development).toBe("./src/lint/post-synth/index.ts");
-      expect(entry?.types).toBe("./dist/lint/post-synth/index.d.ts");
-      expect(entry?.default).toBe("./src/lint/post-synth/index.ts");
-    }
+    // A conditional export: `types` resolves to the emitted declaration,
+    // `development` keeps the repository's own resolution on source, and
+    // `default` is the compiled JS the package publishes (#3981).
+    expect(entry?.development).toBe("./src/lint/post-synth/index.ts");
+    expect(entry?.types).toBe("./dist/lint/post-synth/index.d.ts");
+    expect(entry?.default).toBe("./dist/lint/post-synth/index.js");
   });
 });
 

package/src/components/capability.ts

@@ -43,7 +43,9 @@ export interface DeployContext {
    * (#3049), keyed by {@link CapabilityPlan.member}. Set by a gated-wave
    * fan-out and by a pull request's apply (#3183). A capability whose `run`
    * finds its own member here applies that plan, the one the approver
-   * approved, instead of planning again.
+   * approved, instead of planning again. A `run` that finds the target moved
+   * since that plan refuses with an error {@link isPlanMovedError} accepts
+   * (#3997), and the command that applied it exits 3, as for a moved digest.
    */
   plans?: Record<string, unknown>;
   /**
@@ -90,6 +92,27 @@ export interface CapabilityPlan {
    * still counts toward the digest, with no entries.
    */
   changeSet?: ChangeSetPart;
+  /**
+   * The outputs `run` will expose once it applies this plan (#3999), as far
+   * as the plan can tell. A pull request's plan reads a dependent's
+   * `stackOutput()` references into this member from here when both are in
+   * the change, instead of from the outputs standing now. Absent when the
+   * plan cannot say: every output of the step is then known only after it
+   * applies.
+   */
+  outputs?: PlannedOutputs;
+}
+
+/**
+ * What a plan says about the outputs its apply will leave (#3999). An
+ * output named in neither field is known only after apply, the same as one
+ * in `unknown`.
+ */
+export interface PlannedOutputs {
+  /** Each output whose value the plan knows, by name: what `run` will expose. */
+  known: Record<string, unknown>;
+  /** Outputs the plan names whose value is known only after apply, sorted. */
+  unknown: string[];
 }
 
 /**
@@ -136,8 +159,11 @@ export interface Capability<In = unknown, Out = unknown> {
   /**
    * Optional: the outputs `run` exposed when it last ran, read without
    * changing anything (#3183). A pull request's plan reads them for each
-   * component a planned one depends on, so a `stackOutput()` wiring resolves
-   * to the value standing now. The shape is `run`'s `outputs` field.
+   * component a planned one depends on that the change does not plan
+   * (#4104), so a `stackOutput()` wiring resolves to the value standing now.
+   * A dependency the change plans is read from its plan's
+   * {@link CapabilityPlan.outputs} instead (#3999). The shape is `run`'s
+   * `outputs` field.
    */
   outputs?(ctx: DeployContext, input: In): Promise<Record<string, unknown>>;
   /**
@@ -160,6 +186,28 @@ export type CapabilityInput<C> = C extends Capability<infer In, unknown> ? In :
 /** Extract a capability's `Out` type. */
 export type CapabilityOutput<C> = C extends Capability<unknown, infer Out> ? Out : never;
 
+/**
+ * The exit code of a command whose capability step refused a plan that moved
+ * since it was approved: 3, the code `pr-apply` gives a moved digest and a
+ * run gives a gate (#3997).
+ */
+export const PLAN_MOVED_EXIT_CODE = 3;
+
+/**
+ * Whether `err` is a `run`'s refusal to apply a plan from
+ * `DeployContext.plans` because the target moved since it was planned
+ * (#3997). The mark is a `planMoved: true` property, not a class, so a
+ * lexicon built against an older core can set it. An `exitCode` of
+ * {@link PLAN_MOVED_EXIT_CODE} on the error is the same mark. Any other
+ * `exitCode` is ignored: a failed step exits 1, so a capability can't pick
+ * the process's exit code.
+ */
+export function isPlanMovedError(err: unknown): boolean {
+  if (typeof err !== "object" || err === null) return false;
+  const e = err as { planMoved?: unknown; exitCode?: unknown };
+  return e.planMoved === true || e.exitCode === PLAN_MOVED_EXIT_CODE;
+}
+
 /**
  * Thrown by a stub `run`/`rollback` — the verb is specified and typed but has
  * no cloud implementation yet. Distinguishes "not implemented" from a runtime

package/src/components/changed-files.test.ts

@@ -9,7 +9,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { afterAll, describe, expect, test } from "vitest";
-import { changedFilesBetween } from "./changed-files";
+import { changedFilesBetween, EMPTY_TREE_SHA, resolveMergeBase } from "./changed-files";
 
 const repo = mkdtempSync(join(tmpdir(), "chant-changed-files-"));
 afterAll(() => rmSync(repo, { recursive: true, force: true }));
@@ -56,3 +56,18 @@ describe("changedFilesBetween", () => {
     ]);
   });
 });
+
+describe("the empty tree as the base (a root commit, #4004)", () => {
+  test("is its own merge base, and every file the head holds counts as changed", async () => {
+    expect(await resolveMergeBase(repo, EMPTY_TREE_SHA, "HEAD")).toBe(EMPTY_TREE_SHA);
+    expect(await changedFilesBetween(repo, EMPTY_TREE_SHA)).toEqual([
+      "apps/web/main.tf",
+      "infra/network/roots/vpc/main.tf",
+      "shared/modules/base/main.tf",
+    ]);
+  });
+
+  test("is git's own empty tree", () => {
+    expect(git("hash-object", "-t", "tree", "/dev/null")).toBe(EMPTY_TREE_SHA);
+  });
+});

package/src/components/changed-files.ts

@@ -20,13 +20,21 @@ async function git(cwd: string, args: string[]): Promise<string> {
   return stdout;
 }
 
+/**
+ * Git's empty tree. A root commit has no parent, so a push of one is measured
+ * from this (#4004): every file it holds counts as changed.
+ */
+export const EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+
 /**
  * The commit a change is measured from: the merge base of `base` and `head`.
  * A pull request's head that branched before `base` moved is measured from
  * where it branched, so the other changes on `base` are not counted as its
- * own; a merge commit's first parent is its own merge base.
+ * own; a merge commit's first parent is its own merge base. The empty tree
+ * has no merge base with anything and is returned as it is.
  */
 export async function resolveMergeBase(cwd: string, base: string, head = "HEAD"): Promise<string> {
+  if (base === EMPTY_TREE_SHA) return base;
   try {
     return (await git(cwd, ["merge-base", base, head])).trim();
   } catch (err) {

package/src/components/deploy-inputs.test.ts

@@ -0,0 +1,108 @@
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { componentDeployInputs, directoryDigest, directoryFiles, stepInputRefs } from "./deploy-inputs";
+import { componentPlanDigest } from "./gate-plan";
+import type { DriverComponent, DriverPhase } from "./driver";
+
+let root: string;
+
+const write = (path: string, content: string): void => {
+  mkdirSync(dirname(join(root, path)), { recursive: true });
+  writeFileSync(join(root, path), content);
+};
+const deploy = (...steps: Array<Record<string, unknown>>): DriverPhase[] => [{ phase: "Deploy", steps: steps as never }];
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "deploy-inputs-"));
+});
+
+afterEach(() => {
+  rmSync(root, { recursive: true, force: true });
+});
+
+describe("stepInputRefs", () => {
+  test("a kind's own fields and the template fields, literal paths only", () => {
+    const refs = stepInputRefs("Deploy", { kind: "helm-upgrade", release: "web", chart: "chart", values: ["a.yaml", "@Cfg.values"] } as never);
+    expect(refs.map((r) => [r.field, r.path])).toEqual([["values", "a.yaml"], ["chart", "chart"]]);
+  });
+
+  test("an archive path or a wired value is a build output and is not named", () => {
+    expect(stepInputRefs("Deploy", { kind: "cfn-deploy", template: "archive:stack.json" } as never)).toEqual([]);
+    expect(stepInputRefs("Deploy", { kind: "s3-sync", from: "@Build.dir", to: "s3://b" } as never)).toEqual([]);
+  });
+
+  test("a Docker build's Dockerfile is named under its context", () => {
+    const refs = stepInputRefs("Build", { kind: "docker-build", context: "app", dockerfile: "Dockerfile.prod" } as never);
+    expect(refs.map((r) => r.path)).toEqual(["app", "app/Dockerfile.prod"]);
+  });
+});
+
+describe("componentDeployInputs", () => {
+  test("a file by its bytes, a directory by its files; a missing path is left out", () => {
+    write("values.yaml", "a: 1\n");
+    write("chart/Chart.yaml", "name: c\n");
+    const read = componentDeployInputs(deploy({ kind: "helm-upgrade", chart: "chart", values: ["values.yaml", "gone.yaml"] }), root);
+    expect(read.inputs.map((i) => i.path)).toEqual(["chart", "values.yaml"]);
+    expect(read.inputs.find((i) => i.path === "values.yaml")?.digest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(read.unbound).toEqual([]);
+  });
+
+  test("a directory's digest moves with a file's bytes, a new file and a renamed one", () => {
+    write("site/index.html", "<h1>a</h1>");
+    const before = directoryDigest(root, "site");
+    write("site/index.html", "<h1>b</h1>");
+    const edited = directoryDigest(root, "site");
+    expect(edited).not.toBe(before);
+    write("site/about.html", "x");
+    expect(directoryDigest(root, "site")).not.toBe(edited);
+  });
+
+  test("the same files under another parent hash the same: the digest reads paths from the directory", () => {
+    write("a/chart/Chart.yaml", "name: c\n");
+    write("b/chart/Chart.yaml", "name: c\n");
+    expect(directoryDigest(root, "a/chart")).toBe(directoryDigest(root, "b/chart"));
+  });
+
+  test("in a git repository, a directory leaves out what git ignores, and a directory git ignores is a build output", () => {
+    execFileSync("git", ["init", "-q"], { cwd: root });
+    write(".gitignore", "node_modules/\ndist/\n");
+    write("app/server.js", "1");
+    write("app/node_modules/dep/index.js", "1");
+    write("dist/index.html", "1");
+    expect(directoryFiles(root, "app")).toEqual(["app/server.js"]);
+    const read = componentDeployInputs(deploy({ kind: "docker-build", context: "app" }, { kind: "s3-sync", from: "dist", to: "s3://b" }), root);
+    expect(read.inputs.map((i) => i.path)).toEqual(["app"]);
+    expect(read.unbound).toEqual([{ phase: "Deploy", kind: "s3-sync", reason: expect.stringMatching(/"dist" is a directory git ignores, so a build output/) }]);
+  });
+
+  test("a file git ignores is still hashed when a step names it, as a template chant build writes", () => {
+    execFileSync("git", ["init", "-q"], { cwd: root });
+    write(".gitignore", "dist/\n");
+    write("dist/stack.json", "{}");
+    expect(componentDeployInputs(deploy({ kind: "cfn-deploy", template: "dist/stack.json" }), root).inputs.map((i) => i.path)).toEqual(["dist/stack.json"]);
+  });
+
+  test("a shell step is unbound; `include` limits the steps read", () => {
+    write("chart/Chart.yaml", "x");
+    const phases = deploy({ kind: "shell", cmd: "./go.sh", reason: "t" }, { kind: "helm-upgrade", chart: "chart" });
+    expect(componentDeployInputs(phases, root).unbound.map((u) => u.kind)).toEqual(["shell"]);
+    expect(componentDeployInputs(phases, root, (s) => s.kind !== "helm-upgrade").inputs).toEqual([]);
+  });
+});
+
+describe("componentPlanDigest with inputs", () => {
+  const component: DriverComponent = { name: "web", dependsOn: [], deploy: deploy({ kind: "helm-upgrade", chart: "chart" }) };
+
+  test("no inputs keeps the digest a composition had before #4155", () => {
+    expect(componentPlanDigest({ environment: "prod", component, inputs: [] })).toBe(componentPlanDigest({ environment: "prod", component }));
+  });
+
+  test("an input's digest moves the plan digest", () => {
+    const a = componentPlanDigest({ environment: "prod", component, inputs: [{ path: "chart", digest: "sha256:aa" }] });
+    const b = componentPlanDigest({ environment: "prod", component, inputs: [{ path: "chart", digest: "sha256:bb" }] });
+    expect(a).not.toBe(b);
+  });
+});