@intentius/chant 0.124.34 → 0.124.35

package/src/lifecycle/deep-observe.ts

@@ -139,8 +139,10 @@ export function diffDeepObservation(
 
   for (const [name, entity] of entities) {
     const liveEntity = live.resources[name];
-    const declaredRaw = entity.props ?? {};
-    const liveRaw = liveEntity?.properties ?? {};
+    const prepare = (tree: Record<string, unknown>, side: "declared" | "live") =>
+      hooks?.prepare ? hooks.prepare(tree, { entityType: entity.entityType, side }) : tree;
+    const declaredRaw = prepare(entity.props ?? {}, "declared");
+    const liveRaw = prepare(liveEntity?.properties ?? {}, "live");
     const declaredPaths = deepPathSet(declaredRaw);
     const livePaths = deepPathSet(liveRaw);
 

package/src/lifecycle/green-apply.ts

@@ -0,0 +1,71 @@
+/**
+ * Applied-green records (#4168 step 9): the green commit apply on merge last
+ * applied to an environment, kept on `chant/lifecycle` so the next apply
+ * measures its change from there.
+ *
+ *   _green-applies/<env>.json    one record per environment, rewritten by each apply that finishes
+ *
+ * Apply on merge applies green commits, not each merge. `pr-apply --green`
+ * plans at the green commit, measured from the one recorded here, and writes
+ * this record once everything applied. A workspace member's record sits under
+ * `_members/<member>/_green-applies/` through the same `ledgerDir` prefix the
+ * merge records use.
+ */
+
+import { sortedJsonReplacer } from "../utils";
+import { ledgerDir, readBlobFromPath, readPathSha, RefCASConflictError, writeLedgerFiles, type LedgerLocation } from "./git";
+
+/** The directory on `chant/lifecycle` that holds applied-green records. */
+export const GREEN_APPLIES_DIR = "_green-applies";
+
+export const GREEN_APPLY_CONTRACT = 1;
+
+export interface GreenApplyRecord {
+  contract: number;
+  env: string;
+  member?: string;
+  /** The green commit applied. */
+  commit: string;
+  /** The commit the change was measured from: the green commit applied before, or the first apply's base. */
+  base: string;
+  /** The change set's digest. */
+  digest: string;
+  /** `merges` when the merged changes' approvals covered the plan, `gate` when the combined plan was approved at its own gate. */
+  approval: "merges" | "gate";
+  approvedBy: string[];
+  /** The first-parent commits from `base` (exclusive) to `commit`, oldest first. */
+  merges: string[];
+  appliedAt: string;
+}
+
+function recordFile(env: string): string {
+  return `${env}.json`;
+}
+
+/** The last green commit applied to `env`, or null when none is recorded. Reads the local `chant/lifecycle` and never fetches. */
+export async function readGreenApply(env: string, opts?: LedgerLocation): Promise<GreenApplyRecord | null> {
+  const text = await readBlobFromPath(GREEN_APPLIES_DIR, recordFile(env), opts);
+  if (text === null) return null;
+  try {
+    const doc = JSON.parse(text) as GreenApplyRecord;
+    return doc?.contract === GREEN_APPLY_CONTRACT && typeof doc.commit === "string" ? doc : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Write `record` for its environment. Does not push: call `pushLifecycleReport` (./git.ts) after. */
+export async function writeGreenApply(record: GreenApplyRecord, opts?: LedgerLocation): Promise<string> {
+  const file = recordFile(record.env);
+  const content = `${JSON.stringify(record, sortedJsonReplacer)}\n`;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const prior = await readPathSha(GREEN_APPLIES_DIR, file, opts);
+    const dir = await ledgerDir(GREEN_APPLIES_DIR, opts);
+    try {
+      return await writeLedgerFiles([{ path: `${dir}/${file}`, content, expectPriorSha: prior }], `Applied green ${record.commit} to ${record.env}`, opts);
+    } catch (err) {
+      if (!(err instanceof RefCASConflictError)) throw err;
+    }
+  }
+  throw new Error(`could not write the applied-green record for ${record.env}: chant/lifecycle kept moving`);
+}

package/src/lifecycle/publish-declaration.ts

@@ -45,6 +45,21 @@ export const NpmPublishSchema = z
      * `sbom.cyclonedx.json` it holds. `false` publishes without one.
      */
     sbom: sbomField.optional(),
+    /**
+     * `false` publishes each package straight to the reveal tag (`latest`
+     * unless the publish names another), with no `next` stage and no
+     * `npm dist-tag` move (#4040). For credentials that may publish but not
+     * move a dist-tag, such as npm trusted publishing without "Allow npm
+     * dist-tag" on the package's record (#3904). Default `true`.
+     */
+    stage: z.boolean().optional(),
+    /**
+     * A variable holding an npm token to retry with when a package's publish
+     * fails to authenticate (#4040), as chant's own publish-packages.sh does:
+     * a package whose trusted-publisher record is broken publishes with the
+     * token rather than failing the release. Unset or empty, there is no retry.
+     */
+    tokenEnv: envName.optional(),
   })
   .strict();
 

package/src/lifecycle/publish-npm.ts

@@ -42,10 +42,13 @@
  * npm makes the first version of a new package `latest` whatever tag it is
  * published under, so a package's first release is visible when it stages.
  *
- * Credentials are npm's own. chant reads no npm token and writes no `.npmrc`:
- * npm authenticates with the registry's `_authToken` in the user's or the
- * CI's npm config (`actions/setup-node` writes one that reads
- * `NODE_AUTH_TOKEN`), or by trusted publishing. npm runs with the run's
+ * Credentials are npm's own: npm authenticates with the registry's
+ * `_authToken` in the user's or the CI's npm config (`actions/setup-node`
+ * writes one that reads `NODE_AUTH_TOKEN`), or by trusted publishing. The one
+ * exception is `tokenEnv` (#4040): when a publish fails to authenticate, the
+ * package is published again with that variable's token in a throwaway npm
+ * user config, never on the command line, and without `--provenance` if the
+ * registry refuses the attestation on the token path. npm runs with the run's
  * environment, and everything it prints is redacted before chant prints it.
  */
 
@@ -58,6 +61,9 @@ import type { NpmPublishDeclaration } from "./publish-declaration";
 import { checkReleaseDigest, fileDigest, isDir, memberFile, publishTargetKey } from "./publish-targets";
 import { NPM_STAGE_TAG, PublishTargetError, type PublishContext, type PublishDeps, type PublishItem, type PublishTarget } from "./release-publish";
 
+/** npm's output when a publish could not authenticate, as publish-packages.sh matches it. */
+const NPM_AUTH_FAILED = /ENEEDAUTH|E401|need auth/;
+
 interface NpmPackage {
   path: string;
   abs: string;
@@ -133,9 +139,9 @@ export function npmAuditSignaturesArgs(decl: Pick<NpmPublishDeclaration, "regist
   return ["audit", "signatures", ...(decl.registry ? ["--registry", decl.registry] : [])];
 }
 
-function run(bin: string, args: string[], ctx: PublishContext, cwd: string = ctx.cwd): Promise<{ code: number; output: string[] }> {
+function run(bin: string, args: string[], ctx: PublishContext, cwd: string = ctx.cwd, env: NodeJS.ProcessEnv = ctx.env): Promise<{ code: number; output: string[] }> {
   return new Promise((resolvePromise, reject) => {
-    const child = spawn(bin, args, { cwd, env: ctx.env, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn(bin, args, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
     const output: string[] = [];
     let partial = { out: "", err: "" };
     const take = (key: "out" | "err") => (chunk: Buffer) => {
@@ -159,9 +165,12 @@ export function npmTarget(decl: NpmPublishDeclaration, deps: PublishDeps): Publi
   const registry = decl.registry ?? "the registry npm's config names";
   const shown = (tag: string) => `${registry}, dist-tag ${tag}`;
   const revealTag = (ctx: PublishContext) => ctx.tag ?? "latest";
-  const npm = async (ctx: PublishContext, args: string[], cwd?: string): Promise<{ code: number; output: string[] }> => {
+  // Under `stage: false` a package goes straight to the reveal tag, and the reveal moves no tag (#4040).
+  const staging = decl.stage !== false;
+  const stageTag = (ctx: PublishContext) => (staging ? NPM_STAGE_TAG : revealTag(ctx));
+  const npm = async (ctx: PublishContext, args: string[], cwd?: string, env?: NodeJS.ProcessEnv): Promise<{ code: number; output: string[] }> => {
     try {
-      return await run(bin, args, ctx, cwd);
+      return await run(bin, args, ctx, cwd, env);
     } catch (err) {
       throw new PublishTargetError("publish-npm-failed", ctx.redactor.redact(`npm could not be run: ${err instanceof Error ? err.message : String(err)}`), "Install npm, or put it on PATH.");
     }
@@ -171,10 +180,37 @@ export function npmTarget(decl: NpmPublishDeclaration, deps: PublishDeps): Publi
     const r = await npm(ctx, ["view", `${pkg.name}@${pkg.version}`, "version", ...(decl.registry ? ["--registry", decl.registry] : [])]);
     return r.code === 0 && r.output.some((l) => l.trim() === pkg.version || l.trim() === JSON.stringify(pkg.version));
   };
+  /**
+   * The `tokenEnv` retry (#4040): a publish that failed to authenticate runs
+   * again with the token in a throwaway user config, and once more without
+   * `--provenance` when the token path refuses the attestation.
+   */
+  const withToken = async (ctx: PublishContext, pkg: NpmPackage, args: string[], failed: { code: number; output: string[] }) => {
+    const token = decl.tokenEnv ? ctx.env[decl.tokenEnv] : undefined;
+    if (!token || !failed.output.some((l) => NPM_AUTH_FAILED.test(l))) return failed;
+    ctx.log(`${pkg.name}@${pkg.version} could not authenticate; publishing again with ${decl.tokenEnv}`);
+    const dir = mkdtempSync(join(tmpdir(), "chant-npm-token-"));
+    try {
+      const userconfig = join(dir, ".npmrc");
+      const host = (decl.registry ?? "https://registry.npmjs.org/").replace(/^https?:/, "").replace(/\/?$/, "/");
+      writeFileSync(userconfig, `${host}:_authToken=${token}\n`, { mode: 0o600 });
+      const env = { ...ctx.env, NPM_CONFIG_USERCONFIG: userconfig };
+      let result = await npm(ctx, args, undefined, env);
+      for (const line of result.output) ctx.log(`  ${line}`);
+      if (result.code !== 0 && args.includes("--provenance") && result.output.some((l) => /^npm (error|ERR!).*(provenance|attestation)/i.test(l))) {
+        ctx.log(`${pkg.name}@${pkg.version}: the registry refused provenance on the token path; publishing without an attestation`);
+        result = await npm(ctx, args.filter((a) => a !== "--provenance"), undefined, env);
+        for (const line of result.output) ctx.log(`  ${line}`);
+      }
+      return result;
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  };
   const read = (ctx: PublishContext) => decl.packages.map((p) => readPackage(ctx, p, decl.sbom));
   const extra = (pkg: NpmPackage) => ({ ...(pkg.digest ? { digest: pkg.digest } : {}), ...(pkg.sbom ? { sbom: pkg.sbom } : {}) });
   const plan = async (ctx: PublishContext): Promise<PublishItem[]> =>
-    read(ctx).map((pkg) => ({ name: `${pkg.name}@${pkg.version}`, destination: `${shown(NPM_STAGE_TAG)}, then ${revealTag(ctx)}`, ...extra(pkg) }));
+    read(ctx).map((pkg) => ({ name: `${pkg.name}@${pkg.version}`, destination: staging ? `${shown(NPM_STAGE_TAG)}, then ${revealTag(ctx)}` : shown(revealTag(ctx)), ...extra(pkg) }));
   /**
    * In CI, install what was published into an empty directory and run
    * `npm audit signatures` there (#4049), which checks each package's
@@ -212,21 +248,22 @@ export function npmTarget(decl: NpmPublishDeclaration, deps: PublishDeps): Publi
       const pkgs = read(ctx);
       const items: PublishItem[] = [];
       for (const pkg of pkgs) {
-        const item: PublishItem = { name: `${pkg.name}@${pkg.version}`, destination: shown(NPM_STAGE_TAG), ...extra(pkg) };
+        const item: PublishItem = { name: `${pkg.name}@${pkg.version}`, destination: shown(stageTag(ctx)), ...extra(pkg) };
         if (await onRegistry(ctx, pkg)) {
           ctx.log(`${item.name} is already on the registry; not published again`);
           items.push({ ...item, present: true });
           continue;
         }
-        const args = npmPublishArgs(decl, pkg.abs, ctx);
+        const args = npmPublishArgs(decl, pkg.abs, ctx, stageTag(ctx));
         ctx.log(`npm publish ${pkg.path} ${args.slice(2).join(" ")}`);
-        const result = await npm(ctx, args);
+        let result = await npm(ctx, args);
         for (const line of result.output) ctx.log(`  ${line}`);
+        if (result.code !== 0) result = await withToken(ctx, pkg, args, result);
         if (result.code !== 0) {
           const done = items.map((i) => i.name);
           throw new PublishTargetError(
             "publish-npm-failed",
-            `npm publish of ${item.name} exited ${result.code}${done.length > 0 ? `, after ${done.join(", ")} were staged under ${NPM_STAGE_TAG}` : ", before any package was staged"}: ${result.output.at(-1) ?? "npm printed nothing"}`,
+            `npm publish of ${item.name} exited ${result.code}${done.length > 0 ? `, after ${done.join(", ")} were ${staging ? "staged" : "published"} under ${stageTag(ctx)}` : `, before any package was ${staging ? "staged" : "published"}`}: ${result.output.at(-1) ?? "npm printed nothing"}`,
           );
         }
         items.push(item);
@@ -237,6 +274,11 @@ export function npmTarget(decl: NpmPublishDeclaration, deps: PublishDeps): Publi
       const tag = revealTag(ctx);
       const pkgs = read(ctx);
       const items: PublishItem[] = [];
+      if (!staging) {
+        // Already under the reveal tag since the stage; only the audit is left.
+        if (ctx.provenance.oidc) await audit(ctx, pkgs);
+        return { target: this.name, destination: this.destination, items: pkgs.map((pkg) => ({ name: `${pkg.name}@${pkg.version}`, destination: shown(tag), ...extra(pkg) })) };
+      }
       // The declared order: the first package is the set's core, and its tag moves first.
       for (const pkg of pkgs) {
         const args = npmDistTagArgs(decl, pkg.name, pkg.version, tag);

package/src/lifecycle/publish-targets.test.ts

@@ -166,6 +166,51 @@ describe("npm", () => {
     expect(readFakeNpmRegistry(log).packages["@acme/kit"]!.distTags).toEqual({ latest: "1.3.0", next: "1.4.0", beta: "1.4.0" });
   });
 
+  test("stage: false publishes each package straight to latest in the order declared and moves no dist-tag (#4040)", async () => {
+    const { dir, npm, log } = setup();
+    const [target] = await createPublishTargets([decl({ type: "npm", packages: ["packages/core", "kit.tgz"], access: "public", stage: false })], { npm });
+    const ctx = context(dir, { env: { PATH: process.env.PATH }, provenance: OIDC });
+    expect((await target!.plan(ctx))[0]!.destination).toBe("the registry npm's config names, dist-tag latest");
+    const staged = await target!.stage(ctx);
+    expect(latest(log)).toEqual({ "@acme/core": "1.4.0", "@acme/cli": "1.3.0", "@acme/kit": "1.4.0" });
+    const before = calls(log).length;
+    const done = await target!.reveal(ctx, staged);
+    expect(calls(log).filter((c) => c.args[0] === "publish").map((c) => c.args)).toEqual([
+      ["publish", join(dir, "packages/core"), "--tag", "latest", "--access", "public", "--provenance"],
+      ["publish", join(dir, "kit.tgz"), "--tag", "latest", "--access", "public", "--provenance"],
+    ]);
+    // The reveal only audits.
+    expect(calls(log).slice(before).map((c) => c.args[0])).toEqual(["install", "audit"]);
+    expect(done.items.map((i) => i.destination)).toEqual(Array(2).fill("the registry npm's config names, dist-tag latest"));
+    expect(readFakeNpmRegistry(log).packages["@acme/core"]!.distTags.next).toBeUndefined();
+  });
+
+  test("tokenEnv: a package that can't authenticate publishes again with the token from a throwaway user config, then without provenance if the token path refuses it (#4040)", async () => {
+    const { dir, npm, log } = setup();
+    const [target] = await createPublishTargets([decl({ type: "npm", packages: ["packages/core", "kit.tgz"], stage: false, tokenEnv: "NPM_TOKEN" })], { npm });
+    const env = { PATH: process.env.PATH, NPM_TOKEN: "npm_fallback99", FAKE_NPM_NEEDAUTH: "kit.tgz", FAKE_NPM_TOKEN_NO_PROVENANCE: "1" };
+    const ctx = context(dir, { env, provenance: OIDC });
+    await target!.stage(ctx);
+    const publishes = calls(log).filter((c) => c.args[0] === "publish") as Array<{ args: string[]; userconfig?: string }>;
+    expect(publishes.map((c) => [c.args[1], c.args.includes("--provenance"), Boolean(c.userconfig)])).toEqual([
+      [join(dir, "packages/core"), true, false],
+      [join(dir, "kit.tgz"), true, false],
+      [join(dir, "kit.tgz"), true, true],
+      [join(dir, "kit.tgz"), false, true],
+    ]);
+    expect(publishes[2]!.userconfig).toBe("//registry.npmjs.org/:_authToken=npm_fallback99\n");
+    expect(latest(log)["@acme/kit"]).toBe("1.4.0");
+    expect(ctx.lines.join("\n")).not.toContain("npm_fallback99");
+  });
+
+  test("tokenEnv: with the variable unset, or a failure that is not authentication, there is no retry", async () => {
+    const { dir, npm, log } = setup();
+    const [target] = await createPublishTargets([decl({ type: "npm", packages: ["kit.tgz"], stage: false, tokenEnv: "NPM_TOKEN" })], { npm });
+    await expect(target!.stage(context(dir, { env: { PATH: process.env.PATH, FAKE_NPM_NEEDAUTH: "kit.tgz" } }))).rejects.toThrow(/exited 1/);
+    await expect(target!.stage(context(dir, { env: { PATH: process.env.PATH, NPM_TOKEN: "t", FAKE_NPM_FAIL: "kit.tgz" } }))).rejects.toThrow(/403/);
+    expect(calls(log).filter((c) => c.args[0] === "publish")).toHaveLength(2);
+  });
+
   test("a stage that failed part way names what it staged and, run again, publishes only the rest; a tag move that fails names what moved", async () => {
     const { dir, npm, log } = setup();
     const [target] = await createPublishTargets([decl({ type: "npm", packages: ["packages/core", "packages/cli", "packages/kit"] })], { npm });

package/src/lifecycle/release-compose.test.ts

@@ -0,0 +1,125 @@
+/**
+ * `release compose` (#4168 4.3): chosen trunk commits cherry-picked onto a
+ * base, each with a `Chant-Composed-From` trailer, on a pushed
+ * `chant/compose/<name>` branch, appended to and never rewritten.
+ */
+
+import { describe, test, expect } from "vitest";
+import { withTestDir } from "@intentius/chant-test-utils";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { composeRelease, ComposeError } from "./release-compose";
+import { composeBranchContaining, composedFrom, composedIncluding, compositionOf } from "./compose-refs";
+
+function git(dir: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd: dir, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(r.stderr);
+  return r.stdout.trim();
+}
+
+/** A clone of a bare remote with trunk: base, then #1 (a.txt), #2 (b.txt, work w-2), #3 (a.txt again). */
+function trunk(dir: string): { clone: string; remote: string; base: string; c1: string; c2: string; c3: string } {
+  const remote = join(dir, "remote.git");
+  const clone = join(dir, "clone");
+  git(dir, "init", "-q", "--bare", "-b", "main", remote);
+  mkdirSync(clone);
+  for (const args of [["init", "-q", "-b", "main"], ["config", "user.email", "t@chant.dev"], ["config", "user.name", "T"], ["remote", "add", "origin", remote]]) git(clone, ...args);
+  const commit = (file: string, text: string, message: string): string => {
+    writeFileSync(join(clone, file), text);
+    git(clone, "add", file);
+    git(clone, "commit", "-q", "-m", message);
+    return git(clone, "rev-parse", "HEAD");
+  };
+  const base = commit("a.txt", "a0\n", "base");
+  const c1 = commit("a.txt", "a1\n", "fix a (#1)");
+  const c2 = commit("b.txt", "b\n", "add b (#2)\n\nChant-Record: work:w-2");
+  const c3 = commit("a.txt", "a3\n", "rework a (#3)");
+  git(clone, "push", "-q", "origin", "main");
+  git(clone, "fetch", "-q", "origin");
+  return { clone, remote, base, c1, c2, c3 };
+}
+
+const TRUNK = { remote: "origin", branch: "main" };
+
+describe("composeRelease", () => {
+  test("picks the chosen changes in trunk order onto the base, with trailers, and pushes the branch", async () => {
+    await withTestDir(async (dir) => {
+      const t = trunk(dir);
+      const dry = await composeRelease({ cwd: t.clone, name: "hotfix", base: t.base, prs: [], works: ["w-2"], yes: false, trunk: TRUNK });
+      expect(dry.written).toBe(false);
+      expect(dry.picked.map((s) => s.commit)).toEqual([t.c2]);
+      expect(git(t.clone, "branch", "--list", "chant/compose/hotfix")).toBe("");
+
+      const r = await composeRelease({ cwd: t.clone, name: "hotfix", base: t.base, prs: [2, 1], works: [], yes: true, trunk: TRUNK });
+      expect(r.picked.map((s) => s.commit)).toEqual([t.c1, t.c2]);
+      expect(r.picked[1].work).toEqual(["w-2"]);
+      expect(r.written).toBe(true);
+      expect(r.pushed).toBe(true);
+      expect(git(t.remote, "rev-parse", "refs/heads/chant/compose/hotfix")).toBe(r.tip);
+      expect(composedFrom(t.clone, r.tip)).toEqual([t.c2]);
+      expect(compositionOf(t.clone, r.tip)).toEqual({ branch: null, base: t.base, sources: [t.c1, t.c2] });
+      expect(composeBranchContaining(t.clone, r.tip)?.branch).toBe("chant/compose/hotfix");
+      expect(composedIncluding(t.clone, t.c1)).toEqual([{ branch: "chant/compose/hotfix", commit: git(t.clone, "rev-parse", `${r.tip}^`) }]);
+      expect(git(t.clone, "show", `${r.tip}:a.txt`)).toBe("a1");
+    });
+  });
+
+  test("appends to the branch, skips what it carries, and refuses another base", async () => {
+    await withTestDir(async (dir) => {
+      const t = trunk(dir);
+      const first = await composeRelease({ cwd: t.clone, name: "x", base: t.base, prs: [1], works: [], yes: true, trunk: TRUNK });
+      const again = await composeRelease({ cwd: t.clone, name: "x", prs: [1, 2], works: [], yes: true, trunk: TRUNK });
+      expect(again.from).toBe(first.tip);
+      expect(again.already.map((s) => s.commit)).toEqual([t.c1]);
+      expect(again.picked.map((s) => s.commit)).toEqual([t.c2]);
+      expect(git(t.clone, "rev-parse", `${again.tip}^`)).toBe(first.tip);
+      await expect(composeRelease({ cwd: t.clone, name: "x", base: t.c1, prs: [3], works: [], yes: true, trunk: TRUNK })).rejects.toMatchObject({ code: "compose-base-differs" });
+    });
+  });
+
+  test("stops on a conflict, names the change and the file, and writes nothing", async () => {
+    await withTestDir(async (dir) => {
+      const t = trunk(dir);
+      const err = await composeRelease({ cwd: t.clone, name: "y", base: t.base, prs: [3], works: [], yes: true, trunk: TRUNK }).catch((e: unknown) => e);
+      expect(err).toBeInstanceOf(ComposeError);
+      expect((err as ComposeError).code).toBe("compose-conflict");
+      expect((err as ComposeError).conflict).toMatchObject({ commit: t.c3, files: ["a.txt"] });
+      expect((err as ComposeError).message).toContain("#3");
+      expect(git(t.clone, "branch", "--list", "chant/compose/y")).toBe("");
+      expect(spawnSync("git", ["rev-parse", "--verify", "--quiet", "refs/heads/chant/compose/y"], { cwd: t.remote }).status).not.toBe(0);
+      expect(git(t.clone, "worktree", "list").split("\n")).toHaveLength(1);
+    });
+  });
+
+  test("refuses a change trunk does not have, a bad name, and no base for a new branch", async () => {
+    await withTestDir(async (dir) => {
+      const t = trunk(dir);
+      await expect(composeRelease({ cwd: t.clone, name: "z", base: t.base, prs: [9], works: [], yes: false, trunk: TRUNK })).rejects.toMatchObject({ code: "compose-source-unknown" });
+      await expect(composeRelease({ cwd: t.clone, name: "../z", base: t.base, prs: [1], works: [], yes: false, trunk: TRUNK })).rejects.toMatchObject({ code: "compose-name-invalid" });
+      await expect(composeRelease({ cwd: t.clone, name: "z", prs: [1], works: [], yes: false, trunk: TRUNK })).rejects.toMatchObject({ code: "compose-base-unknown" });
+      await expect(composeRelease({ cwd: t.clone, name: "z", base: t.base, prs: [], works: [], yes: false, trunk: TRUNK })).rejects.toMatchObject({ code: "compose-nothing-chosen" });
+    });
+  });
+});
+
+describe("composeRelease after a hand-made commit", () => {
+  test("keeps the branch's base when its tip carries no trailer", async () => {
+    await withTestDir(async (dir) => {
+      const t = trunk(dir);
+      const first = await composeRelease({ cwd: t.clone, name: "h", base: t.base, prs: [1], works: [], yes: true, trunk: TRUNK });
+      // A person resolves something on the branch and pushes it.
+      git(t.clone, "checkout", "-q", "chant/compose/h");
+      writeFileSync(join(t.clone, "c.txt"), "by hand\n");
+      git(t.clone, "add", "c.txt");
+      git(t.clone, "commit", "-q", "-m", "by hand");
+      git(t.clone, "push", "-q", "origin", "chant/compose/h");
+      git(t.clone, "checkout", "-q", "main");
+      const next = await composeRelease({ cwd: t.clone, name: "h", base: t.base, prs: [1, 2], works: [], yes: true, trunk: TRUNK });
+      expect(next.base).toBe(t.base);
+      expect(next.already.map((s) => s.commit)).toEqual([t.c1]);
+      expect(next.picked.map((s) => s.commit)).toEqual([t.c2]);
+      expect(git(t.clone, "rev-parse", `${next.tip}~2`)).toBe(first.tip);
+    });
+  });
+});