@intentius/chant 0.124.34 → 0.124.35

package/src/components/pr-pipeline.ts

@@ -196,10 +196,23 @@ export interface PrLoopJob {
   env: Record<string, string>;
   /** Shell lines to run before the command, to settle values the forge may leave unusable. */
   setup?: string[];
+  /**
+   * Shell lines a generated job runs first, before `setup`, to check out the
+   * commit it works on (#4168 step 9): the apply checks out the newest green
+   * commit. `chant ci run` and `ci serve` already run the job at that commit,
+   * so they skip these.
+   */
+  checkout?: string[];
   /** With `build` (#4088): the build line and the lint line, run in this order before the command. */
   build?: string[];
   /** With `waveGate` (#4003): the wave a generated apply job runs, 1-based. */
   wave?: number;
+  /**
+   * The branch an apply job takes its green commit from (#4168 step 9). A
+   * wave after the first checks out the commit wave 1 took, which the job
+   * receives as `GREEN_SHA` (#4221).
+   */
+  greenBranch?: string;
   /**
    * What the generated job runs in place of `command` (#4156): `chant ci run
    * <job> --in-place` with the same environment, gate, forge, events and
@@ -241,7 +254,7 @@ export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelin
   // #4156: the flags `chant ci run` rebuilds `command` from. It finds the member from the directory it runs in.
   const ciRun = (job: PrLoopJob["jobName"]): string[] => [
     "chant", "ci", "run", job, "--in-place", ...(job === "plan" ? ["--no-push"] : []),
-    "--base", '"$BASE_SHA"', ...(job === "plan" ? ["--pr", '"$PR_NUMBER"'] : []),
+    ...(job === "apply" ? [] : ["--base", '"$BASE_SHA"']), ...(job === "plan" ? ["--pr", '"$PR_NUMBER"'] : []),
     "--env", env, "--gate", gate, "--forge", forge,
     ...(job !== "record" && options.waveGate ? ["--wave-gate", options.waveGate] : []),
     ...(job !== "plan" && options.branch ? ["--branch", JSON.stringify(options.branch)] : []),
@@ -254,6 +267,7 @@ export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelin
   const planEnv = github
     ? { BASE_SHA: "${{ github.event.pull_request.base.sha }}", PR_NUMBER: "${{ github.event.pull_request.number }}", ...jobEnv }
     : { BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID", ...jobEnv };
+  const greenBranch = github ? JSON.stringify(options.branch ?? "main") : options.branch ? JSON.stringify(options.branch) : "$CI_DEFAULT_BRANCH";
   const applyEnv = github ? { BASE_SHA: "${{ github.event.before }}", ...jobEnv } : { BASE_SHA: "$CI_COMMIT_BEFORE_SHA", ...jobEnv };
   return [
     {
@@ -265,17 +279,19 @@ export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelin
       run: { command: ciRun("plan").join(" "), env: runEnv(planEnv) },
     },
     {
+      // #4168 step 9: the apply applies the newest green commit, measured from the one applied before it.
       jobName: "apply",
       command: [
-        "chant", "components", "pr-apply", "--base", '"$BASE_SHA"', ...common,
+        "chant", "components", "pr-apply", "--green", ...common,
         ...(options.requireReview === true ? ["--require-review"] : []),
         ...(options.waveGate ? ["--wave-gate", options.waveGate] : []),
         "--resume", PR_APPLY_RECORD,
       ].join(" "),
-      env: applyEnv,
-      setup: [github ? githubBaseFallback(options.branch) : gitlabBaseFallback(options.branch)],
+      env: jobEnv,
+      checkout: [greenCheckout(greenBranch)],
+      greenBranch,
       ...build,
-      run: { command: ciRun("apply").join(" "), env: runEnv(applyEnv) },
+      run: { command: ciRun("apply").join(" "), env: runEnv(jobEnv) },
     },
     {
       jobName: "record",
@@ -288,6 +304,15 @@ export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelin
   ];
 }
 
+/**
+ * What starts the apply under apply on merge (#4168 step 9): on GitHub the
+ * tick's workflow finishing (`workflow_run`, since tags its token pushes start
+ * no workflow), elsewhere a pushed `ci/green/*` tag. The name is
+ * `CI_GREEN_WORKFLOW_NAME` (../workspace/ci-green-workflow.ts).
+ */
+export const GREEN_TICK_WORKFLOW = "chant-ci-green";
+export const GREEN_TAG_PATTERN = "ci/green/**";
+
 /** The job a push to the target branch runs (#4168): `record`, or `apply` when the pipeline opts into apply on merge. */
 export function prLoopMergeJob(jobs: readonly PrLoopJob[], options: PrLoopPipelineOptions = {}): PrLoopJob {
   return jobs.find((j) => j.jobName === (options.applyOnMerge ? "apply" : "record"))!;
@@ -326,6 +351,8 @@ export function prLoopWaveJobs(components: DriverComponent[], apply: PrLoopJob):
     ...apply,
     command: `${apply.command} --wave ${i + 1}`,
     wave: i + 1,
+    // #4221: every wave after the first applies the commit wave 1 took.
+    ...(i > 0 && apply.greenBranch !== undefined ? { checkout: [pinnedGreenCheckout(apply.greenBranch)] } : {}),
     // #4156: the job runs it through chant ci run, which appends the same --wave to pr-apply.
     run: { ...apply.run, command: `${apply.run.command} --wave ${i + 1}` },
   }));
@@ -381,6 +408,30 @@ function pushBaseFallback(target: string, commit: string, diffBase?: string): st
   );
 }
 
+/**
+ * The line that checks out the newest green commit of `branch` (#4168 step
+ * 9), after fetching the branch and its tags, for the apply job. `chant ci
+ * last-green` exits 1 when no commit is green, which fails the job.
+ */
+export function greenCheckout(branch: string): string {
+  return `${fetchBranch(branch)} && GREEN_SHA="$(chant ci last-green)" && git checkout --quiet --detach "$GREEN_SHA"`;
+}
+
+/**
+ * The line a wave after the first runs in place of {@link greenCheckout}
+ * (#4221): it checks out `GREEN_SHA`, the commit wave 1 took, so a commit
+ * that goes green while the waves run waits for a run of its own. An empty
+ * `GREEN_SHA` fails the job.
+ */
+export function pinnedGreenCheckout(branch: string): string {
+  return `test -n "$GREEN_SHA" && ${fetchBranch(branch)} && git checkout --quiet --detach "$GREEN_SHA"`;
+}
+
+function fetchBranch(branch: string): string {
+  const name = branch.replace(/^"|"$/g, "");
+  return `git fetch --quiet --tags origin "+refs/heads/${name}:refs/remotes/origin/${name}"`;
+}
+
 /**
  * GitLab sets `CI_COMMIT_BEFORE_SHA` to forty zeros on a branch's first push.
  * The line replaces it with the merge request's diff base when the pipeline

package/src/components/promote.test.ts

@@ -197,6 +197,13 @@ describe("taking the build out of a composition", () => {
     expect("error" in prepared && prepared.error).toMatch(/no publish step/);
   });
 
+  test("#4222: no publish step passes when a release records its templates, and says it is template-only", () => {
+    const c: DriverComponent = { name: "chart", deploy: [{ phase: "Apply", steps: [{ kind: "helm-upgrade" }] }] };
+    const prepared = withoutBuildSteps(c, { templatesPinned: true });
+    expect("error" in prepared).toBe(false);
+    expect("templateOnly" in prepared && prepared.templateOnly).toBe(true);
+  });
+
   test("two publish steps are refused", () => {
     const c = service("api");
     c.deploy[1].steps.push({ kind: "publish-artifact", from: "archive:x.jar" });

package/src/components/promote.ts

@@ -23,7 +23,7 @@
  *
  * A composition the transform cannot pin to one recorded digest is refused
  * before anything runs: one with no publish step (nothing would carry the
- * digest), one with more than one (the ledger records one digest per
+ * digest) unless a release records its templates (#4222), one with more than one (the ledger records one digest per
  * component), and one whose remaining steps read an output of a removed build
  * step (it would resolve to nothing).
  *
@@ -402,6 +402,8 @@ export interface PromotableComponent {
   component: DriverComponent;
   /** The kinds removed, in composition order. */
   removed: string[];
+  /** #4222: the component has no publish step and deploys the templates a release records, so its record carries their digest. */
+  templateOnly?: boolean;
 }
 
 /**
@@ -433,7 +435,7 @@ export const recordedDigestCapability: Capability<{ digest: string }, { digest:
  */
 export function withoutBuildSteps(
   component: DriverComponent,
-  opts: { pinDigest?: string; verb?: string } = {},
+  opts: { pinDigest?: string; verb?: string; templatesPinned?: boolean } = {},
 ): PromotableComponent | { error: string } {
   const verb = opts.verb ?? (opts.pinDigest === undefined ? "a promote" : "a rollback");
   const removed: string[] = [];
@@ -487,7 +489,10 @@ export function withoutBuildSteps(
 
   const deploy = component.deploy.map(strip).filter((p): p is DriverPhase => p !== undefined);
 
-  if (publishSteps === 0) {
+  // #4222: under a release that records this component's templates, the
+  // deploy reads them from the release (./release-promote.ts), so a component
+  // with no artifact deploys the release's content, not its current source.
+  if (publishSteps === 0 && !opts.templatesPinned) {
     return {
       error: `component "${component.name}" has no publish step, so nothing in its deploy carries a recorded digest; ` +
         `${verb} would deploy whatever its current source produces`,
@@ -519,7 +524,7 @@ export function withoutBuildSteps(
       }
     }
   }
-  return { component: { ...component, deploy }, removed };
+  return { component: { ...component, deploy }, removed, ...(publishSteps === 0 ? { templateOnly: true } : {}) };
 }
 
 /** Every same-project wiring reference anywhere in a step's fields (cross-stack `stackOutput` objects excluded). */

package/src/components/release-promote.test.ts

@@ -7,7 +7,7 @@ import { describe, test, expect } from "vitest";
 import { contentDigest } from "../content-digest";
 import { makeRelease, templateBytesDigest } from "../lifecycle/release-store";
 import type { DriverComponent } from "./driver";
-import { isImplicitRelease, pinReleaseTemplates, releaseArtifactMismatches, removePinnedTemplates, targetFiles, targetFor, writePinnedTemplates, RELEASE_TEMPLATES_DIR } from "./release-promote";
+import { isImplicitRelease, pinReleaseTemplates, releaseTemplatesDigest, releaseArtifactMismatches, removePinnedTemplates, targetFiles, targetFor, writePinnedTemplates, RELEASE_TEMPLATES_DIR } from "./release-promote";
 import type { ReleaseRecord } from "../lifecycle/release-ledger";
 import type { BuildArchiveManifest } from "./verbs/build-archive";
 import { withTestDir } from "@intentius/chant-test-utils";
@@ -210,3 +210,26 @@ describe("removePinnedTemplates (#4045)", () => {
     });
   });
 });
+
+describe("releaseTemplatesDigest (#4222)", () => {
+  const target = {
+    env: "staging",
+    params: [],
+    templates: [
+      { component: "infra", path: "b.json", digest: "sha256:b" },
+      { component: "infra", path: "a.json", digest: "sha256:a" },
+      { component: "app", path: "c.json", digest: "sha256:c" },
+    ],
+  };
+
+  test("digests the component's templates sorted by path, whatever order the target lists them", () => {
+    const reordered = { ...target, templates: [target.templates[1], target.templates[2], target.templates[0]] };
+    expect(releaseTemplatesDigest(target, "infra")).toBe(contentDigest("a.json\tsha256:a\nb.json\tsha256:b\n"));
+    expect(releaseTemplatesDigest(reordered, "infra")).toBe(releaseTemplatesDigest(target, "infra"));
+    expect(releaseTemplatesDigest(target, "app")).not.toBe(releaseTemplatesDigest(target, "infra"));
+  });
+
+  test("is null for a component the target records no template for", () => {
+    expect(releaseTemplatesDigest(target, "worker")).toBeNull();
+  });
+});

package/src/components/release-promote.ts

@@ -31,6 +31,7 @@ import { templateBytesDigest, type Release, type ReleaseTarget } from "../lifecy
 import { computePlanDigest } from "../lifecycle/plan-digest";
 import type { ReleaseRecord } from "../lifecycle/release-ledger";
 import type { BuildArchiveManifest } from "./verbs/build-archive";
+import { contentDigest } from "../content-digest";
 
 /** Where a promote under a release writes the recorded templates, relative to the member's directory. */
 export const RELEASE_TEMPLATES_DIR = ".chant/release-templates";
@@ -56,6 +57,20 @@ export function targetFor(release: Release, env: string): { target: ReleaseTarge
   };
 }
 
+/**
+ * The digest a release record carries for a component with no artifact
+ * (#4222): `sha256:` over the paths and digests of the templates `target`
+ * records for `component`, sorted by path. A template-only component (a
+ * `cfn-deploy` with no publish step) deployed under a release is recorded with
+ * it, so promote and rollback under a release find what the environment runs.
+ * Null when the target records no template for the component.
+ */
+export function releaseTemplatesDigest(target: ReleaseTarget, component: string): string | null {
+  const own = target.templates.filter((t) => t.component === component).map((t) => `${t.path}\t${t.digest}`).sort();
+  if (own.length === 0) return null;
+  return contentDigest(`${own.join("\n")}\n`);
+}
+
 /** Whether a release is of a project with no components (#4046): no artifact, and every template it records has `component: null`. */
 export function isImplicitRelease(release: Release): boolean {
   const templates = release.targets.flatMap((t) => t.templates);

package/src/deep-observation.ts

@@ -334,6 +334,14 @@ export interface DeepNormalizationHooks {
    * or a value-derived hash.
    */
   mask?(node: DeepNode): boolean;
+  /**
+   * Rewrite one raw property tree before anything else reads it, on both
+   * sides. For a difference no per-node hook can reach, such as a map whose
+   * keys are references: an ARM `identity.userAssignedIdentities` is keyed by
+   * `[resourceId(...)]` in source and by the evaluated resource id live
+   * (#4231). Return the tree to compare; leave anything else as it was.
+   */
+  prepare?(tree: Record<string, unknown>, context: { entityType: string; side: DeepSide }): Record<string, unknown>;
 }
 
 /** Everything the pass needs besides the tree itself. */

package/src/graph-declared.test.ts

@@ -84,3 +84,21 @@ describe("buildDeclaredPerStack groups by declared stack (#1433)", () => {
     }
   });
 });
+
+describe("buildDeclaredPerStack takes edges from the lexicon hooks (#4232)", () => {
+  test("withEdges sees each stack's entities by bare key, and its edges are qualified with the stack", async () => {
+    const seen: string[][] = [];
+    const ir = await buildDeclaredPerStack(
+      [{ name: "network", src: "network/src" }, { name: "app", src: "app/src" }],
+      dir,
+      (g, entities) => {
+        seen.push([...entities.keys()].sort());
+        const [only] = g.nodes;
+        return only ? { ...g, edges: [...g.edges, { from: only.id, to: only.id, kind: "ref", viaAttr: "self" }] } : g;
+      },
+    );
+    expect(seen).toEqual([["vpc"], ["service"]]);
+    expect(ir.edges).toContainEqual({ from: "network::vpc", to: "network::vpc", kind: "ref", viaAttr: "self" });
+    expect(ir.edges).toContainEqual({ from: "app::service", to: "app::service", kind: "ref", viaAttr: "self" });
+  });
+});

package/src/graph-declared.ts

@@ -1,5 +1,6 @@
 import { resolve } from "node:path";
 import { discover } from "./discovery/index";
+import type { Declarable } from "./declarable";
 import { buildGraphIr, type GraphIR, type IRNode } from "./graph-ir";
 
 /**
@@ -19,10 +20,14 @@ import { buildGraphIr, type GraphIR, type IRNode } from "./graph-ir";
  *
  * A stack without `src` contributes nothing here — it has no declared source to
  * scope to (its live nodes still show as foreign in the overlay).
+ *
+ * `withEdges` adds what the lexicons' `graphEdges` hooks resolve to each
+ * stack's graph before its ids are qualified (#4232).
  */
 export async function buildDeclaredPerStack(
   stacks: Array<{ name: string; src?: string }>,
   projectPath: string,
+  withEdges?: (ir: GraphIR, entities: Map<string, Declarable>) => GraphIR,
 ): Promise<GraphIR> {
   const nodes: IRNode[] = [];
   const edges: GraphIR["edges"] = [];
@@ -36,7 +41,9 @@ export async function buildDeclaredPerStack(
   const byStack: Record<string, string[]> = {};
   for (const st of stacks) {
     if (!st.src) continue;
-    const g = buildGraphIr((await discover(resolve(projectPath, st.src))).entities, projectPath);
+    const { entities } = await discover(resolve(projectPath, st.src));
+    const built = buildGraphIr(entities, projectPath);
+    const g = withEdges ? withEdges(built, entities) : built;
     const q = (id: string) => `${st.name}::${id}`;
     for (const n of g.nodes) {
       const id = q(n.id);

package/src/graph-detail.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect } from "vitest";
 import { applyDetail, DETAIL, detailInertNotice } from "./graph-detail";
-import type { GraphIR } from "./graph-ir";
+import { overlayGraphs, sourceOverlayGraphs, type GraphIR } from "./graph-ir";
 
 // A small graph: a gcp vpc/subnet pair plus a k8s namespace and deployment that
 // came from one composite instance ("db"), with the deployment referencing the
@@ -294,3 +294,70 @@ describe("detailInertNotice (#1489)", () => {
     expect(detailInertNotice(edgeless, detailed)).toContain("no edges at all");
   });
 });
+
+describe("T1 rolls a composite's overlay status up from its members (#4227)", () => {
+  // Two stacks' worth of one FargateAlb, keyed `${stack}::${logicalId}` as a
+  // multi-stack live read keys them (#1162).
+  const member = (id: string, attrs: Record<string, unknown> = {}) => ({
+    id: `three-cloud-aws::${id}`,
+    kind: "Resource",
+    lexicon: "aws",
+    compositeParent: "FargateAlb",
+    compositeInstance: "web",
+    attrs,
+  });
+  const declared: GraphIR = {
+    nodes: [member("webAlb"), member("webService"), member("webTaskDef")],
+    edges: [],
+    groups: { byLexicon: {} },
+  };
+  const live = (ids: string[], extra: GraphIR["nodes"] = []): GraphIR => ({
+    nodes: [...ids.map((id) => ({ id: `three-cloud-aws::${id}`, kind: "Resource", lexicon: "aws", attrs: {} })), ...extra],
+    edges: [],
+    groups: { byLexicon: {} },
+  });
+  const web = (ir: GraphIR) => applyDetail(ir, DETAIL.COMPOSITES).nodes.find((n) => n.id === "web")!;
+  const all = ["webAlb", "webService", "webTaskDef"];
+
+  test("every member good gives good, on either anchor", () => {
+    for (const ir of [sourceOverlayGraphs(declared, live(all)), overlayGraphs(live(all), declared)]) {
+      expect(web(ir).attrs).toEqual({ members: 3, _status: "good" });
+    }
+  });
+
+  test("an absent member makes the composite pending, and is named", () => {
+    for (const ir of [sourceOverlayGraphs(declared, live(["webAlb", "webTaskDef"])), overlayGraphs(live(["webAlb", "webTaskDef"]), declared)]) {
+      expect(web(ir).attrs).toEqual({ members: 3, _status: "accent", _memberStatus: { accent: ["three-cloud-aws::webService"] } });
+    }
+  });
+
+  test("an unobserved member gives neutral, and an absent one outranks it", () => {
+    const unobserved = { "three-cloud-aws::webTaskDef": { reason: "unsupported-kind" } } as never;
+    expect(web(sourceOverlayGraphs(declared, live(["webAlb", "webService"]), { unobserved })).attrs).toEqual({
+      members: 3,
+      _status: "neutral",
+      _memberStatus: { neutral: ["three-cloud-aws::webTaskDef"] },
+    });
+    expect(web(sourceOverlayGraphs(declared, live(["webAlb"]), { unobserved })).attrs).toEqual({
+      members: 3,
+      _status: "accent",
+      _memberStatus: { accent: ["three-cloud-aws::webService"], neutral: ["three-cloud-aws::webTaskDef"] },
+    });
+  });
+
+  test("a foreign resource stays its own node and leaves the composite good", () => {
+    const foreign = { id: "three-cloud-aws::strayBucket", kind: "Bucket", lexicon: "aws", attrs: {} };
+    const ir = applyDetail(sourceOverlayGraphs(declared, live(all, [foreign])), DETAIL.COMPOSITES);
+    expect(ir.nodes.find((n) => n.id === "web")!.attrs).toEqual({ members: 3, _status: "good" });
+    expect(ir.nodes.find((n) => n.id === foreign.id)!.attrs).toEqual({ _status: "warn" });
+  });
+
+  test("a member painted with a status the rollup does not know is never hidden", () => {
+    const ir: GraphIR = { ...declared, nodes: [member("webAlb", { _status: "good" }), member("webService", { _status: "drifted" })] };
+    expect(web(ir).attrs).toEqual({ members: 2, _status: "drifted", _memberStatus: { drifted: ["three-cloud-aws::webService"] } });
+  });
+
+  test("a graph read without --overlay carries no _status on the composite", () => {
+    expect(web(declared).attrs).toEqual({ members: 3 });
+  });
+});

package/src/graph-detail.ts

@@ -124,6 +124,34 @@ function toDeclarables(ir: GraphIR): GraphIR {
   return { ...ir, nodes: ir.nodes.map((n) => ({ ...n, attrs: resourceAttrs(n.attrs) })) };
 }
 
+/** Overlay statuses from the least to the most in need of attention: a
+ * composite takes its worst member's (#4227). An unknown status ranks above
+ * `warn`, so a status this list does not know yet is never hidden. */
+const STATUS_RANK = ["good", "runtime", "neutral", "accent", "warn"];
+
+function statusRank(status: string): number {
+  const i = STATUS_RANK.indexOf(status);
+  return i === -1 ? STATUS_RANK.length : i;
+}
+
+/** A collapsed composite's overlay paint, rolled up from its members (#4227):
+ * `_status` is the worst member status, and `_memberStatus` lists the members
+ * that are not `good` under their status. Nothing when no member carries a
+ * `_status`, as in a graph read without `--overlay`. */
+function rollupStatus(members: IRNode[]): Record<string, unknown> {
+  const painted = members.filter((m) => typeof m.attrs._status === "string");
+  if (painted.length === 0) return {};
+  let worst = "good";
+  const notGood: Record<string, string[]> = {};
+  for (const m of painted) {
+    const status = m.attrs._status as string;
+    if (statusRank(status) > statusRank(worst)) worst = status;
+    if (status !== "good") (notGood[status] ??= []).push(m.id);
+  }
+  for (const ids of Object.values(notGood)) ids.sort();
+  return { _status: worst, ...(Object.keys(notGood).length > 0 ? { _memberStatus: notGood } : {}) };
+}
+
 /** T1 — collapse each composite instance to one node; internal edges disappear.
  * Topology view: surviving plain nodes keep only overlay paint, not properties. */
 function toComposites(ir: GraphIR): GraphIR {
@@ -169,7 +197,7 @@ function toComposites(ir: GraphIR): GraphIR {
       id: collapsedId.get(key)!,
       kind: types.size === 1 ? [...types][0] : "Composite",
       lexicon: lexicons.size === 1 ? [...lexicons][0] : "multi",
-      attrs: { members: members.length },
+      attrs: { members: members.length, ...rollupStatus(members) },
     });
   }
 

package/src/graph-ir.ts

@@ -1078,13 +1078,21 @@ function tagStatus(n: IRNode, status: OverlayNodeStatus, unobserved?: Unobserved
  * no live edges). Sorted; the live groups pass through unchanged.
  */
 export function overlayGraphs(live: GraphIR, declared: GraphIR, opts?: OverlayOptions): GraphIR {
-  const declaredIds = new Set(declared.nodes.map((n) => n.id));
+  const declaredById = new Map(declared.nodes.map((n) => [n.id, n]));
   const liveIds = new Set(live.nodes.map((n) => n.id));
   const unobserved = opts?.unobserved ?? {};
 
-  const nodes: IRNode[] = live.nodes.map((n) =>
-    tagStatus(n, declaredIds.has(n.id) ? "good" : n.runtimeOwner ? "runtime" : "warn"),
-  );
+  const nodes: IRNode[] = live.nodes.map((n) => {
+    const d = declaredById.get(n.id);
+    if (!d) return tagStatus(n, n.runtimeOwner ? "runtime" : "warn");
+    // A managed node keeps the composite it was declared in, so `--detail 1`
+    // collapses it with its siblings and rolls their status up (#4227).
+    const membership = {
+      ...(d.compositeInstance ? { compositeInstance: d.compositeInstance } : {}),
+      ...(d.compositeParent ? { compositeParent: d.compositeParent } : {}),
+    };
+    return tagStatus({ ...n, ...membership }, "good");
+  });
   for (const n of declared.nodes) {
     if (liveIds.has(n.id)) continue;
     const u = unobserved[n.id];

package/src/lifecycle/__fixtures__/publish-fakes.ts

@@ -168,7 +168,8 @@ const { execFileSync } = require("child_process");
 const args = process.argv.slice(2);
 const token = process.env.NODE_AUTH_TOKEN || "";
 const regFile = ${JSON.stringify(log)} + ".registry.json";
-fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify({ args, tokenSet: token !== "" }) + "\\n");
+const userconfig = process.env.NPM_CONFIG_USERCONFIG ? fs.readFileSync(process.env.NPM_CONFIG_USERCONFIG, "utf-8") : "";
+fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify({ args, tokenSet: token !== "", ...(userconfig ? { userconfig } : {}) }) + "\\n");
 console.log("npm notice using //registry.example/:_authToken=" + token);
 console.error("npm notice token " + token);
 const reg = fs.existsSync(regFile) ? JSON.parse(fs.readFileSync(regFile, "utf-8")) : { packages: {} };
@@ -177,6 +178,9 @@ const flag = (name) => { const i = args.indexOf(name); return i < 0 ? null : arg
 const split = (spec) => { const at = spec.lastIndexOf("@"); return [spec.slice(0, at), spec.slice(at + 1)]; };
 if (args[0] === "publish") {
   if (process.env.FAKE_NPM_FAIL && args[1] && args[1].includes(process.env.FAKE_NPM_FAIL)) { console.error("npm error 403 Forbidden"); process.exit(1); }
+  // A package whose trusted-publisher record is broken: only a token in the user config publishes it.
+  if (process.env.FAKE_NPM_NEEDAUTH && args[1] && args[1].includes(process.env.FAKE_NPM_NEEDAUTH) && !userconfig.includes("_authToken=")) { console.error("npm error code ENEEDAUTH"); process.exit(1); }
+  if (process.env.FAKE_NPM_TOKEN_NO_PROVENANCE && userconfig && args.includes("--provenance")) { console.error("npm error 422 Unprocessable Entity - provenance statement does not match the publisher"); process.exit(1); }
   const text = fs.statSync(args[1]).isDirectory() ? fs.readFileSync(path.join(args[1], "package.json"), "utf-8") : execFileSync("tar", ["-xzOf", args[1], "package/package.json"], { encoding: "utf-8" });
   const { name, version } = JSON.parse(text);
   const p = reg.packages[name] || (reg.packages[name] = { versions: [], distTags: {} });

package/src/lifecycle/compose-refs.ts

@@ -0,0 +1,125 @@
+/**
+ * Composed commits (#4168 4.3), as git holds them. A composed release lives
+ * on a pushed `chant/compose/<name>` branch whose commits each cherry-pick
+ * one trunk commit and name it in a `Chant-Composed-From: <sha>` trailer.
+ * The base is the commit the first composed commit was picked onto.
+ *
+ * Kept free of other chant imports, so the ci tick, the cut, the metrics
+ * and the compose command read composed commits the same way.
+ */
+
+import { execFileSync } from "node:child_process";
+
+/** The branch prefix a composed release lives under. */
+export const COMPOSE_BRANCH_PREFIX = "chant/compose/";
+
+/** The trailer naming the trunk commit a composed commit picks. */
+export const COMPOSED_FROM_TRAILER = "Chant-Composed-From";
+
+/** What a composed commit carries: its branch when one is known, its base, and the trunk commits picked onto the base, oldest first. */
+export interface Composition {
+  branch: string | null;
+  base: string;
+  sources: string[];
+}
+
+function tryGit(top: string, args: string[]): string | null {
+  try {
+    return execFileSync("git", args, { cwd: top, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024 }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/** Whether `branch` names a compose branch. */
+export function isComposeBranch(branch: unknown): branch is string {
+  return typeof branch === "string" && branch.startsWith(COMPOSE_BRANCH_PREFIX) && branch.length > COMPOSE_BRANCH_PREFIX.length;
+}
+
+/** The trunk commits one commit's `Chant-Composed-From` trailers name. */
+export function composedFrom(top: string, sha: string): string[] {
+  const out = tryGit(top, ["show", "-s", `--format=%(trailers:key=${COMPOSED_FROM_TRAILER},valueonly,separator=%x00)`, sha]);
+  return (out ?? "")
+    .split("\0")
+    .map((s) => s.trim())
+    .filter((s) => /^[0-9a-f]{40}$/.test(s));
+}
+
+/**
+ * The composition `sha` ends: walk its first parents while each commit
+ * carries a `Chant-Composed-From` trailer. Null when `sha` carries none.
+ */
+export function compositionOf(top: string, sha: string, branch: string | null = null): Composition | null {
+  const sources: string[] = [];
+  let at = sha;
+  for (;;) {
+    const from = composedFrom(top, at);
+    if (from.length === 0) break;
+    sources.unshift(...from);
+    const parent = tryGit(top, ["rev-parse", "--verify", "--quiet", `${at}^1`]);
+    if (!parent) break;
+    at = parent;
+  }
+  if (sources.length === 0) return null;
+  return { branch, base: at, sources };
+}
+
+/** The compose branches this clone knows on `remote`, as `{ branch, ref }`, by name. */
+export function remoteComposeBranches(top: string, remote = "origin"): Array<{ branch: string; ref: string }> {
+  const prefix = `refs/remotes/${remote}/`;
+  const out = tryGit(top, ["for-each-ref", "--format=%(refname)", `${prefix}${COMPOSE_BRANCH_PREFIX}`]);
+  return (out ?? "")
+    .split("\n")
+    .filter(Boolean)
+    .map((ref) => ({ branch: ref.slice(prefix.length), ref }))
+    .sort((a, b) => (a.branch < b.branch ? -1 : 1));
+}
+
+/**
+ * What a commit of a compose branch carries beyond trunk: walk its first
+ * parents back to the first commit `trunkRef` reaches, which is the base,
+ * collecting the `Chant-Composed-From` trailers on the way. A commit a
+ * person made on the branch, such as a resolved conflict, carries none and
+ * is walked past. Null when `sha` is on trunk or no trunk commit is found.
+ */
+export function compositionOnTrunk(top: string, sha: string, trunkRef: string, branch: string | null = null): Composition | null {
+  const onTrunk = (c: string) => tryGit(top, ["merge-base", "--is-ancestor", c, trunkRef]) !== null;
+  if (onTrunk(sha)) return null;
+  const sources: string[] = [];
+  let at: string | null = sha;
+  while (at && !onTrunk(at)) {
+    sources.unshift(...composedFrom(top, at));
+    at = tryGit(top, ["rev-parse", "--verify", "--quiet", `${at}^1`]);
+  }
+  return at ? { branch, base: at, sources } : null;
+}
+
+/** The pushed compose branch `sha` is a first-parent commit of, as this clone last fetched it, or null. */
+export function composeBranchContaining(top: string, sha: string, remote = "origin"): { branch: string; ref: string } | null {
+  for (const b of remoteComposeBranches(top, remote)) {
+    const line = tryGit(top, ["rev-list", "--first-parent", b.ref]);
+    if (line?.split("\n").includes(sha)) return b;
+  }
+  return null;
+}
+
+/** The composed commits on the pushed compose branches that pick `trunkSha`. */
+export function composedIncluding(top: string, trunkSha: string, remote = "origin"): Array<{ branch: string; commit: string }> {
+  const out: Array<{ branch: string; commit: string }> = [];
+  for (const b of remoteComposeBranches(top, remote)) {
+    const tip = tryGit(top, ["rev-parse", "--verify", "--quiet", `${b.ref}^{commit}`]);
+    if (!tip) continue;
+    const composition = compositionOf(top, tip, b.branch);
+    if (!composition?.sources.includes(trunkSha)) continue;
+    // The composed commit that picked it: walk the composed commits for its trailer.
+    let at: string | null = tip;
+    while (at && at !== composition.base) {
+      if (composedFrom(top, at).includes(trunkSha)) {
+        out.push({ branch: b.branch, commit: at });
+        break;
+      }
+      at = tryGit(top, ["rev-parse", "--verify", "--quiet", `${at}^1`]);
+    }
+  }
+  return out;
+}

package/src/lifecycle/deep-observe.test.ts

@@ -108,6 +108,26 @@ describe("diffDeepObservation", () => {
     expect(result.unchanged).toEqual(["r"]);
   });
 
+  test("prepare rewrites each raw tree, both sides, before paths are taken (#4231)", () => {
+    const seen: string[] = [];
+    const rekey: DeepNormalizationHooks = {
+      prepare(tree, { side }) {
+        seen.push(side);
+        const ids = tree.ids as Record<string, unknown> | undefined;
+        if (!ids) return tree;
+        return { ...tree, ids: Object.fromEntries(Object.entries(ids).map(([k, v]) => [k.toLowerCase(), v])) };
+      },
+    };
+    const result = diffDeepObservation(
+      entities({ r: { entityType: "T", props: { ids: { "A/B": {} } } } }),
+      { resources: { r: { type: "T", properties: { ids: { "a/b": {} } } } }, unobserved: {} },
+      rekey,
+    );
+    expect(seen.sort()).toEqual(["declared", "live"]);
+    expect(result.drifted).toEqual([]);
+    expect(result.unchanged).toEqual(["r"]);
+  });
+
   test("a declared property at its default is still compared", () => {
     const result = diffDeepObservation(
       entities({ r: { entityType: "AWS::IAM::Role", props: { Path: "/" } } }),