@intentius/chant 0.124.38 → 0.124.40

package/src/cli/handlers/pr-endpoint.test.ts

@@ -0,0 +1,169 @@
+/**
+ * `chant components pr-plan` for an environment that declares an endpoint
+ * (#4281): every request a capability's plan sends goes to that endpoint and
+ * no other host, the way a `--live` read does (`../../live-endpoint.ts`).
+ *
+ * The capability stands in for azure's `arm-deploy`, gcp's `gcp-apply` and
+ * aws's `cfn-deploy`: its plan reads the endpoint from its lexicon's ambient
+ * var, else the real cloud's host, and sends a request through `fetch`, which
+ * is replaced here and only records. Nothing leaves the process. Git, the
+ * change signal, the derivation and the gate ledger are fakes, and the
+ * lifecycle branch can't be pushed.
+ */
+
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import type { DriverComponent } from "../../components/driver";
+import type { DeployContext } from "../../components/capability";
+import type { EmulatorCapability } from "../../op/emulator-lifecycle";
+import type { ParsedArgs } from "../registry";
+
+const HEAD = "a".repeat(40);
+const BASE = "b".repeat(40);
+const EMULATOR = "http://localhost:4566";
+const REAL_CLOUD = "https://management.fakecloud.example";
+const ENDPOINT_VAR = "FAKECLOUD_ENDPOINT_URL";
+
+vi.mock("../../components/changed-files", () => ({
+  resolveCommit: async () => HEAD,
+  resolveMergeBase: async () => BASE,
+}));
+
+vi.mock("../../config", async () => {
+  const actual = await vi.importActual<typeof import("../../config")>("../../config");
+  return {
+    ...actual,
+    loadChantConfig: async () => ({
+      config: { environments: [{ name: "floci", endpoint: EMULATOR }, { name: "prod" }] },
+    }),
+  };
+});
+
+vi.mock("./fan-out", () => ({
+  resolveChangedUnits: async () => ({ units: { changed: ["net"], indeterminate: [] } }),
+}));
+
+vi.mock("../../lifecycle/gate-change-set", () => ({
+  storeGateChangeSet: async () => ({ written: false }),
+  readGraphIds: async () => ({ ids: [] }),
+  setGraphIdReader: () => {},
+  gateGraphReader: () => async () => ({ ids: [] }),
+}));
+vi.mock("../../lifecycle/git", async () => {
+  const actual = await vi.importActual<typeof import("../../lifecycle/git")>("../../lifecycle/git");
+  return { ...actual, pushLifecycleReport: async () => { throw new Error("pr-endpoint.test must not push chant/lifecycle"); } };
+});
+
+vi.mock("./run", () => ({
+  GATED_EXIT_CODE: 3,
+  autoReleaseRun: (id: string) => ({ runId: id, runOrigin: { forge: "local" } }),
+  recordAutoReleasesForRun: async () => [],
+}));
+
+vi.mock("../../op/gate", async () => {
+  const actual = await vi.importActual<typeof import("../../op/gate")>("../../op/gate");
+  return { ...actual, gitGateLedgerPort: () => actual.memoryGateLedgerPort(), gateIsSealed: async () => false };
+});
+
+vi.mock("../../components/fan-out-support", async () => {
+  const { CapabilityRegistry } = await import("../../components/capability");
+  const { planFanOut } = await import("../../components/fan-out");
+  const { computePlanDigest } = await import("../../lifecycle/plan-digest");
+  const registry = new CapabilityRegistry();
+  registry.register({
+    kind: "fakecloud-deploy",
+    async plan(_ctx: DeployContext, input: { root: string }) {
+      // What arm-deploy, gcp-apply and cfn-deploy do: the ambient var, else the real host.
+      const base = process.env[ENDPOINT_VAR] ?? REAL_CLOUD;
+      await fetch(`${base}/deployments/${input.root}`);
+      const planDigest = computePlanDigest("fakecloud-deploy", { root: input.root });
+      return {
+        member: input.root,
+        planDigest,
+        artifact: { planDigest },
+        changeSet: { member: { member: input.root, lexicon: "fakecloud", planner: "fakecloud", status: "planned", planDigest, holes: [] }, entries: [] },
+      };
+    },
+    async outputs() {
+      return {};
+    },
+    async run() {
+      throw new Error("pr-plan must not apply");
+    },
+  } as never);
+  const component = (name: string, dependsOn: string[] = []): DriverComponent => ({
+    name,
+    dependsOn,
+    deploy: [{ phase: "Apply", steps: [{ kind: "fakecloud-deploy", root: name }] }],
+  });
+  const estate = [component("net"), component("app", ["net"])];
+  return {
+    fanOutRegistry: async () => registry,
+    deriveFanOut: async () => ({
+      success: true,
+      components: estate,
+      plan: planFanOut({ components: estate, changed: ["net"] }),
+      signal: { changed: ["net"], indeterminate: [], unclaimed: [] },
+    }),
+  };
+});
+
+/** The lexicon plugin, declaring its endpoint var through its emulator as aws, azure and gcp do. */
+const emulator: EmulatorCapability = {
+  spec: { name: "chant-fakecloud", image: "fakecloud:0", containerPort: 4566, healthPath: "/health" },
+  env: (endpoint) => ({ [ENDPOINT_VAR]: endpoint, FAKECLOUD_ACCESS_KEY: "test" }),
+};
+const plugins = [{ name: "fakecloud", emulator }];
+
+const { runComponentsPrPlan } = await import("./pr");
+
+let dir: string;
+let hosts: string[];
+
+const ctx = (env: string) =>
+  ({
+    args: { command: "components", path: "pr-plan", format: "", fix: false, watch: false, verbose: false, help: false, live: false, base: "main", env, output: dir, pr: 7 } as ParsedArgs,
+    plugins,
+  }) as never;
+
+beforeEach(async () => {
+  dir = await mkdtemp(join(tmpdir(), "pr-endpoint-"));
+  hosts = [];
+  delete process.env[ENDPOINT_VAR];
+  vi.stubGlobal("fetch", vi.fn(async (url: string | URL) => {
+    hosts.push(new URL(String(url)).host);
+    return new Response("{}", { status: 200 });
+  }));
+  vi.spyOn(console, "error").mockImplementation(() => {});
+  vi.spyOn(console, "log").mockImplementation(() => {});
+});
+
+afterEach(async () => {
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+  delete process.env[ENDPOINT_VAR];
+  await rm(dir, { recursive: true, force: true });
+});
+
+describe("pr-plan against an environment that declares an endpoint (#4281)", () => {
+  test("every plan request goes to the declared endpoint and no other host, and the var is restored after", async () => {
+    expect(await runComponentsPrPlan(ctx("floci"))).toBe(0);
+    expect(hosts.length).toBe(2);
+    expect(new Set(hosts)).toEqual(new Set(["localhost:4566"]));
+    expect(process.env[ENDPOINT_VAR]).toBeUndefined();
+  });
+
+  test("an environment with no endpoint is left to the capability's own default", async () => {
+    expect(await runComponentsPrPlan(ctx("prod"))).toBe(0);
+    expect(new Set(hosts)).toEqual(new Set([new URL(REAL_CLOUD).host]));
+  });
+
+  test("an ambient var already set wins over the declared endpoint", async () => {
+    process.env[ENDPOINT_VAR] = "http://127.0.0.1:9999";
+    expect(await runComponentsPrPlan(ctx("floci"))).toBe(0);
+    expect(new Set(hosts)).toEqual(new Set(["127.0.0.1:9999"]));
+    expect(process.env[ENDPOINT_VAR]).toBe("http://127.0.0.1:9999");
+  });
+});

package/src/cli/handlers/pr.ts

@@ -118,7 +118,9 @@ import { findWorkspaceRoot } from "../../project-root";
 import { resolveChangedUnits } from "./fan-out";
 import { coverByMerges, greenOp, type GreenTarget } from "../../components/green-cover";
 import { GATED_EXIT_CODE, autoReleaseRun, recordAutoReleasesForRun } from "./run";
+import { appliedDigestOf } from "../../components/auto-release";
 import type { CommandContext } from "../registry";
+import { withComponentEndpoint } from "../component-endpoint";
 import type { ComponentChangeSignal, FanOutPlan } from "../../components/fan-out";
 import { failedRunExitCode, type DriverComponent } from "../../components/driver";
 import type { CapabilityRegistry } from "../../components/capability";
@@ -421,7 +423,7 @@ function openUpload(events: StageEvents, stage: "plan" | "apply" | "record", pr:
 /** chant components pr-plan --base <ref> --pr <n> [--env <env>] [--gate <name>] [--forge <kind>] [--output <dir>] [--json] [--events-json] [--report-url <url>] */
 export function runComponentsPrPlan(ctx: CommandContext): Promise<number> {
   if (refusesEventsWithJson(ctx.args, "the stage's report")) return Promise.resolve(1);
-  return withStageEvents("pr-plan", ctx, (events) => prPlan(ctx, events));
+  return withStageEvents("pr-plan", ctx, (events) => withComponentEndpoint(ctx, () => prPlan(ctx, events)));
 }
 
 async function prPlan(ctx: CommandContext, stage: StageEvents): Promise<number> {
@@ -482,7 +484,7 @@ async function prPlan(ctx: CommandContext, stage: StageEvents): Promise<number>
 /** chant components pr-apply --base <ref> [--pr <n>] [--env <env>] [--gate <name>] [--forge <kind>] [--require-review] [--output <dir>] [--json] [--events-json] [--report-url <url>] */
 export function runComponentsPrApply(ctx: CommandContext): Promise<number> {
   if (refusesEventsWithJson(ctx.args, "the stage's report")) return Promise.resolve(1);
-  return withStageEvents("pr-apply", ctx, (events) => prApply(ctx, events));
+  return withStageEvents("pr-apply", ctx, (events) => withComponentEndpoint(ctx, () => prApply(ctx, events)));
 }
 
 async function prApply(ctx: CommandContext, stage: StageEvents): Promise<number> {
@@ -695,7 +697,7 @@ async function prApply(ctx: CommandContext, stage: StageEvents): Promise<number>
       : {}),
   });
   recordAttempt();
-  await recordAutoReleasesForRun(applied.run.results, p.env, release.runId, resolveAutoReleaseDisabled(p.config, args.noReleaseRecord), release.runOrigin);
+  await recordAutoReleasesForRun(applied.run.results, p.env, release.runId, resolveAutoReleaseDisabled(p.config, args.noReleaseRecord), release.runOrigin, undefined, undefined, prAppliedDigests(p, applied.members));
   const report = prReport({
     ...base,
     approval,
@@ -715,10 +717,15 @@ async function prApply(ctx: CommandContext, stage: StageEvents): Promise<number>
   return code;
 }
 
+/** #4274: a component that published nothing is recorded by the plan digest its approval bound. */
+function prAppliedDigests(p: Prepared, members: PrMember[]) {
+  return appliedDigestOf({ components: p.components, env: p.env, projectRoot: resolve("."), members });
+}
+
 /** chant components pr-record --base <ref> [--pr <n>] [--env <env>] [--gate <name>] [--forge <kind>] [--output <dir>] [--json] [--events-json] [--report-url <url>] */
 export function runComponentsPrRecord(ctx: CommandContext): Promise<number> {
   if (refusesEventsWithJson(ctx.args, "the stage's report")) return Promise.resolve(1);
-  return withStageEvents("pr-record", ctx, (events) => prRecord(ctx, events));
+  return withStageEvents("pr-record", ctx, (events) => withComponentEndpoint(ctx, () => prRecord(ctx, events)));
 }
 
 /**
@@ -1485,7 +1492,7 @@ async function prApplyWaves(
       if (outputs) outputsSoFar[name] = outputs;
     }
     setWave({ ...entry, status: applied.status === "applied" ? "applied" : "failed" });
-    await recordAutoReleasesForRun(applied.run.results, p.env, at.release.runId, resolveAutoReleaseDisabled(p.config, args.noReleaseRecord), at.release.runOrigin);
+    await recordAutoReleasesForRun(applied.run.results, p.env, at.release.runId, resolveAutoReleaseDisabled(p.config, args.noReleaseRecord), at.release.runOrigin, undefined, undefined, prAppliedDigests(p, applied.members));
     if (applied.status !== "applied") {
       return stop(report({ status: "failed" }), failedRunExitCode(applied.run.results), applied.run.status === "gated" ? "gated" : undefined);
     }

package/src/cli/handlers/promote.ts

@@ -68,6 +68,7 @@ import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
 import { GATED_EXIT_CODE } from "./run";
 import type { CommandContext } from "../registry";
+import { withComponentEndpoint } from "../component-endpoint";
 import { redeployLine, releaseRollbackLine, rollbackTarget, unsettledComponents } from "../../lifecycle/mixed-environment";
 
 const PROMOTE_USAGE =
@@ -390,7 +391,20 @@ function approvalLine(r: import("../../lifecycle/merge-record").MergeRecord): st
  * which differ only in how the plan was chosen, whether the publish step runs,
  * and which field names the earlier release on the new record.
  */
-async function deployPlan(
+/** {@link deployPlanIn}, with `plan.to`'s declared endpoint applied (#4281). */
+function deployPlan(
+  ctx: CommandContext,
+  verb: Verb,
+  plan: PromotionPlan,
+  project: { projectPath: string; config: ChantConfig; targets: DriverComponent[] },
+  actor: string | undefined,
+  record: (item: PromotionItem, env: string, run: DeployRunInfo) => ReleaseRecordInput,
+  under?: UnderRelease,
+): Promise<number> {
+  return withComponentEndpoint(ctx, () => deployPlanIn(ctx, verb, plan, project, actor, record, under), { config: project.config, environment: plan.to });
+}
+
+async function deployPlanIn(
   ctx: CommandContext,
   verb: Verb,
   plan: PromotionPlan,
@@ -661,7 +675,7 @@ async function deployPlan(
         const admission = gateAdmission(result);
         const input = record(item, plan.to, { runId, ...(runOrigin ? { runOrigin } : {}), actor: actor!, timestamp, ...(approver ? { approver } : {}), ...(admission ? { admission } : {}) });
         const templates = templateDigests.get(item.component);
-        const { record: written } = await appendReleaseRecord(under ? { ...input, ...(templates ? { digest: templates } : {}), releaseDigest: under.release.releaseDigest } : input);
+        const { record: written } = await appendReleaseRecord(under ? { ...input, ...(templates ? { digest: templates, digestKind: "templates" as const } : {}), releaseDigest: under.release.releaseDigest } : input);
         recorded.push(written);
       }
       if (outcome) await appendDeployOutcome(outcome);

package/src/cli/handlers/run.test.ts

@@ -46,7 +46,8 @@ vi.mock("../../config", async () => {
   const actual = await vi.importActual<typeof import("../../config")>("../../config");
   return { ...actual, loadChantConfig: (...args: unknown[]) => loadChantConfigMock(...args) };
 });
-vi.mock("../../components/auto-release", () => ({
+vi.mock("../../components/auto-release", async () => ({
+  ...(await vi.importActual<typeof import("../../components/auto-release")>("../../components/auto-release")),
   maybeRecordAutoRelease: (...args: unknown[]) => maybeRecordAutoReleaseMock(...args),
 }));
 vi.mock("../../components/manifest-persistence", () => ({

package/src/cli/handlers/run.ts

@@ -17,6 +17,7 @@ import { recordGateApproval } from "./operator";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
 import { parseParamFlags } from "../build-params-cli";
 import type { CommandContext } from "../registry";
+import { withComponentEndpoint } from "../component-endpoint";
 import { stewardBesideFor, stewardFormFor, stewardTurnLeaseName, DEFAULT_STEWARD_ENV, type StewardDeclaration } from "../../op/steward";
 import { holdBesideLease } from "../../op/steward-beside";
 import { acquireStewardTurn, STEWARD_TURN_WAIT_MS } from "../../op/operator";
@@ -29,11 +30,11 @@ import { ndjsonProgressSink } from "../../components/run-progress";
 import { findStoredRun, readRunEvents } from "../../run-event-store";
 import type { RunEvent } from "../../run-event";
 import { openCliRunEvents, refusesBothStreams, stdoutLine } from "../run-events";
-import { maybeRecordAutoRelease } from "../../components/auto-release";
+import { appliedDigestOf, extractRunDigest, maybeRecordAutoRelease, type AppliedDigest } from "../../components/auto-release";
 import { maybePersistBuildManifest } from "../../components/manifest-persistence";
 import { failedRunExitCode, type DriverComponentResult } from "../../components/driver";
 import { isComponentList, type ComponentRunPlan, type RunComponentsResult } from "../../components/cli-support";
-import { resolveCiRun, type ReleaseRecord, type RunOrigin } from "../../lifecycle/release-ledger";
+import { isApplyRecord, resolveCiRun, type ReleaseRecord, type RunOrigin } from "../../lifecycle/release-ledger";
 import { gateAdmission, gateApprover } from "../../components/promote";
 import { runOpGenerate } from "./run-generate";
 
@@ -935,10 +936,14 @@ export async function recordAutoReleasesForRun(
   releaseDigest?: string,
   /** #4222: the digest of the templates the release records for a component in `env`, for one that publishes no artifact. */
   templatesDigestOf?: (component: string) => string | null,
+  /** #4274: what a component that publishes no artifact applied (`appliedDigestOf`), so it is recorded too. */
+  appliedDigestOf?: (component: string) => AppliedDigest | null,
 ): Promise<ReleaseRecord[]> {
   const recorded: ReleaseRecord[] = [];
   for (const componentResult of results) {
     if (!componentResult.ok) continue;
+    // Hashed only for a component that promoted no artifact, the only one it is recorded for.
+    const applied = appliedDigestOf && !disabled && extractRunDigest(componentResult.records) === undefined ? appliedDigestOf(componentResult.component) : null;
     const outcome = await maybeRecordAutoRelease(
       {
         component: componentResult.component,
@@ -954,6 +959,7 @@ export async function recordAutoReleasesForRun(
         // #4043: the release the deploy was made under, when `--release` named one.
         ...(releaseDigest !== undefined ? { releaseDigest } : {}),
         ...(releaseDigest !== undefined && templatesDigestOf?.(componentResult.component) ? { templatesDigest: templatesDigestOf(componentResult.component)! } : {}),
+        ...(applied ? { appliedDigest: applied } : {}),
       },
       { disabled },
     );
@@ -1023,7 +1029,8 @@ export async function recordAutoReleasesForRun(
  * rather than loaded a second time.
  */
 export function runOpComponents(ctx: CommandContext): Promise<number> {
-  return withRecordingChoice(ctx, () => runComponentSelection(ctx));
+  // #4281: the components run against the environment's declared endpoint.
+  return withRecordingChoice(ctx, () => withComponentEndpoint(ctx, () => runComponentSelection(ctx)));
 }
 
 /**
@@ -1281,7 +1288,11 @@ async function runComponentSelection(ctx: CommandContext): Promise<number> {
     // #3955: a run that records nothing has no release to report either.
     const disabled = resolveAutoReleaseDisabled(config, ctx.args.noReleaseRecord) || ledgerRecordingOff();
     const templatesDigestOf = underRelease ? await releaseTemplatesDigestOf(underRelease.release, env) : undefined;
-    const recorded = await recordAutoReleasesForRun(result.run.results, env, release.runId, disabled, release.runOrigin, underRelease?.releaseDigest, templatesDigestOf);
+    // #4274: a component that publishes nothing is recorded by its deploy-input digest.
+    const appliedOf = result.components ? appliedDigestOf({ components: result.components, env, projectRoot: projectPath }) : undefined;
+    const recorded = await recordAutoReleasesForRun(result.run.results, env, release.runId, disabled, release.runOrigin, underRelease?.releaseDigest, templatesDigestOf, appliedOf);
+    // A generated promote job promotes artifacts; an apply has none to name.
+    const promotable = recorded.filter((r) => !isApplyRecord(r));
     if (underRelease) await warnOnArtifactMismatch(underRelease.release, recorded);
     // `--digest-file` (#2602): the releases this run recorded, one
     // `<component>=<digest>` line each, the form `chant components promote
@@ -1290,7 +1301,7 @@ async function runComponentSelection(ctx: CommandContext): Promise<number> {
     if (ctx.args.digestFile) {
       const digestPath = resolve(ctx.args.digestFile);
       mkdirSync(dirname(digestPath), { recursive: true });
-      writeFileSync(digestPath, recorded.map((r) => `${r.component}=${r.digest}\n`).join(""));
+      writeFileSync(digestPath, promotable.map((r) => `${r.component}=${r.digest}\n`).join(""));
     }
   }
 

package/src/components/auto-release-infra.test.ts

@@ -0,0 +1,131 @@
+/**
+ * #4274: a component that only deploys infrastructure gets a release record
+ * from `pr-apply` and `chant run --components`. Its digest is the plan digest
+ * its approval bound, or its deploy-input digest when nothing planned, and
+ * `digestKind` says which. Written into a workspace member's ledger, under
+ * the member's prefix on chant/lifecycle.
+ */
+
+import { afterAll, afterEach, beforeEach, describe, expect, test } from "vitest";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { appliedDigestOf } from "./auto-release";
+import { recordAutoReleasesForRun } from "../cli/handlers/run";
+import { clearMemberLedgerCache } from "../lifecycle/member-ledger";
+import { readReleaseLedger } from "../lifecycle/release-ledger";
+import type { DriverComponent, DriverComponentResult } from "./driver";
+
+const scratch: string[] = [];
+afterAll(() => {
+  for (const d of scratch) rmSync(d, { recursive: true, force: true });
+});
+
+function git(args: string[], cwd: string): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout;
+}
+
+/** A workspace whose member `infra` deploys one CloudFormation template and publishes nothing. */
+function workspace(): { root: string; member: string } {
+  const root = realpathSync(mkdtempSync(join(tmpdir(), "chant-infra-record-")));
+  scratch.push(root);
+  const files: Record<string, string> = {
+    "chant.workspace.json": JSON.stringify({ name: "acme", schema: 1, members: [{ name: "infra", dir: "services/infra", kind: "chant" }] }),
+    "services/infra/chant.config.json": JSON.stringify({ lexicons: ["aws"] }),
+    "services/infra/dist/infra.template.json": JSON.stringify({ Resources: {} }),
+  };
+  for (const [path, text] of Object.entries(files)) {
+    mkdirSync(dirname(join(root, path)), { recursive: true });
+    writeFileSync(join(root, path), text);
+  }
+  git(["init", "-q", "-b", "main"], root);
+  git(["config", "user.email", "test@chant.dev"], root);
+  git(["config", "user.name", "Test"], root);
+  git(["add", "-A"], root);
+  git(["commit", "-q", "-m", "init"], root);
+  return { root, member: join(root, "services/infra") };
+}
+
+const infra: DriverComponent = {
+  name: "infra",
+  deploy: [{ name: "Deploy", steps: [{ kind: "cfn-deploy", stackName: "infra", template: "dist/infra.template.json" }] }],
+} as unknown as DriverComponent;
+
+const applied = {
+  component: "infra",
+  ok: true,
+  status: "ok",
+  records: [{ component: "infra", phase: "Deploy", kind: "cfn-deploy", status: "ok", durationMs: 1, output: { stackId: "arn:aws:cloudformation:infra" } }],
+} as unknown as DriverComponentResult;
+
+const planDigest = `jcs1-sha256:${"a".repeat(64)}`;
+
+let cwd: string;
+beforeEach(() => {
+  cwd = process.cwd();
+  clearMemberLedgerCache();
+  process.env.GITHUB_ACTOR = "alice";
+});
+afterEach(() => {
+  process.chdir(cwd);
+  delete process.env.GITHUB_ACTOR;
+});
+
+describe("appliedDigestOf", () => {
+  test("a component with one planned member gets that member's plan digest", () => {
+    const of = appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere", members: [{ member: "infra", component: "infra", planDigest }] });
+    expect(of("infra")).toEqual({ digest: planDigest, kind: "plan" });
+  });
+
+  test("a component with several planned members gets the set digest over them, the same whatever their order", () => {
+    const members = [
+      { member: "infra/a", component: "infra", planDigest },
+      { member: "infra/b", component: "infra", planDigest: `jcs1-sha256:${"b".repeat(64)}` },
+    ];
+    const one = appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere", members })("infra");
+    const two = appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere", members: [...members].reverse() })("infra");
+    expect(one?.kind).toBe("plan");
+    expect(one?.digest).not.toBe(planDigest);
+    expect(two).toEqual(one);
+  });
+
+  test("a component that planned nothing gets its deploy-input digest, which moves with the template it deploys", () => {
+    const { member } = workspace();
+    const before = appliedDigestOf({ components: [infra], env: "staging", projectRoot: member })("infra");
+    expect(before?.kind).toBe("deploy-input");
+    writeFileSync(join(member, "dist/infra.template.json"), JSON.stringify({ Resources: { Bucket: {} } }));
+    const after = appliedDigestOf({ components: [infra], env: "staging", projectRoot: member })("infra");
+    expect(after?.kind).toBe("deploy-input");
+    expect(after?.digest).not.toBe(before?.digest);
+  });
+
+  test("a component the run doesn't know has none", () => {
+    expect(appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere" })("other")).toBeNull();
+  });
+});
+
+describe("recordAutoReleasesForRun for an infrastructure-only component", () => {
+  test("a pr-apply records the plan digest under the member's prefix", async () => {
+    const { root, member } = workspace();
+    process.chdir(member);
+    const of = appliedDigestOf({ components: [infra], env: "staging", projectRoot: member, members: [{ member: "infra", component: "infra", planDigest }] });
+    const recorded = await recordAutoReleasesForRun([applied], "staging", "run-1", false, { forge: "local" }, undefined, undefined, of);
+    expect(recorded).toHaveLength(1);
+    expect(recorded[0]).toMatchObject({ component: "infra", env: "staging", digest: planDigest, digestKind: "plan", actor: "alice" });
+
+    const files = git(["ls-tree", "-r", "--name-only", "chant/lifecycle"], root).split("\n").filter(Boolean);
+    expect(files).toContain("_members/infra/staging/releases.jsonl");
+    const { records } = await readReleaseLedger("staging", { cwd: member });
+    expect(records).toEqual([expect.objectContaining({ digest: planDigest, digestKind: "plan" })]);
+  });
+
+  test("without an applied digest it records nothing, as before", async () => {
+    const { member } = workspace();
+    process.chdir(member);
+    const recorded = await recordAutoReleasesForRun([applied], "staging", "run-1", false);
+    expect(recorded).toEqual([]);
+  });
+});

package/src/components/auto-release.test.ts

@@ -181,7 +181,46 @@ describe("maybeRecordAutoRelease", () => {
     );
     expect(outcome).toMatchObject({ recorded: true });
     const [input] = appendReleaseRecordMock.mock.calls[0];
-    expect(input).toMatchObject({ digest: "sha256:tpl", releaseDigest: "sha256:rel" });
+    expect(input).toMatchObject({ digest: "sha256:tpl", releaseDigest: "sha256:rel", digestKind: "templates" });
+  });
+
+  test("#4274: a run that published nothing records what it applied, and says which digest that is", async () => {
+    appendReleaseRecordMock.mockResolvedValue({
+      commit: "c".repeat(40),
+      record: { version: 1, component: "infra", env: "staging", digest: "sha256:plan", gitSha: "x", runId: "r", timestamp: "t", actor: "alice", digestKind: "plan" },
+    });
+    const outcome = await maybeRecordAutoRelease(
+      { component: "infra", env: "staging", success: true, records: [applyRecord()], runId: "run-1", appliedDigest: { digest: "sha256:plan", kind: "plan" } },
+      { actor: "alice", gitSha: "a".repeat(40) },
+    );
+    expect(outcome).toMatchObject({ recorded: true });
+    expect(appendReleaseRecordMock.mock.calls[0][0]).toMatchObject({ digest: "sha256:plan", digestKind: "plan" });
+  });
+
+  test("#4274: an artifact digest wins over what the run applied, and carries no digestKind", async () => {
+    appendReleaseRecordMock.mockResolvedValue({
+      commit: "c".repeat(40),
+      record: { version: 1, component: "svc", env: "prod", digest: "sha256:abc", gitSha: "x", runId: "r", timestamp: "t", actor: "alice" },
+    });
+    await maybeRecordAutoRelease(
+      { component: "svc", env: "prod", success: true, records: [publishRecord("sha256:abc")], runId: "run-1", appliedDigest: { digest: "sha256:in", kind: "deploy-input" } },
+      { actor: "alice", gitSha: "a".repeat(40) },
+    );
+    const [input] = appendReleaseRecordMock.mock.calls[0];
+    expect(input).toMatchObject({ digest: "sha256:abc" });
+    expect(input).not.toHaveProperty("digestKind");
+  });
+
+  test("#4274: a templates digest under a release wins over what the run applied", async () => {
+    appendReleaseRecordMock.mockResolvedValue({
+      commit: "c".repeat(40),
+      record: { version: 1, component: "infra", env: "staging", digest: "sha256:tpl", gitSha: "x", runId: "r", timestamp: "t", actor: "alice" },
+    });
+    await maybeRecordAutoRelease(
+      { component: "infra", env: "staging", success: true, records: [applyRecord()], runId: "run-1", releaseDigest: "sha256:rel", templatesDigest: "sha256:tpl", appliedDigest: { digest: "sha256:in", kind: "deploy-input" } },
+      { actor: "alice", gitSha: "a".repeat(40) },
+    );
+    expect(appendReleaseRecordMock.mock.calls[0][0]).toMatchObject({ digest: "sha256:tpl", digestKind: "templates" });
   });
 
   test("#4222: a templates digest without a release is ignored", async () => {

package/src/components/auto-release.ts

@@ -26,8 +26,10 @@
  * env vars, timestamp is a real `new Date()` taken at record time).
  */
 import { getHeadCommit, pushLifecycle, StaleLifecycleBranchError } from "../lifecycle/git";
-import { appendReleaseRecord, InvalidReleaseRecordError, type ReleaseAdmission, type ReleaseRecord, type RunOrigin } from "../lifecycle/release-ledger";
-import type { DriverStepRecord } from "./driver";
+import { appendReleaseRecord, InvalidReleaseRecordError, type ReleaseAdmission, type ReleaseDigestKind, type ReleaseRecord, type RunOrigin } from "../lifecycle/release-ledger";
+import { changeSetDigest } from "../change-set";
+import type { DriverComponent, DriverStepRecord } from "./driver";
+import { componentInputDigests } from "./fan-out-inputs";
 
 /**
  * A step output that represents a *promoted* artifact — a publish-family result
@@ -68,6 +70,32 @@ export function extractRunDigest(records: DriverStepRecord[]): string | undefine
   return found;
 }
 
+/**
+ * What each component of a run applied, for the ones that publish no artifact
+ * (#4274). A component with planned members (`pr-apply`'s change set) gets its
+ * plan digest: the one member's `planDigest`, or with several the
+ * change-set digest over them, the way a set's digest is taken. Any other gets
+ * its deploy-input digest from `componentInputDigests`, computed on first use.
+ */
+export function appliedDigestOf(input: {
+  /** Every component of the project, so a component's upstream digests count. */
+  components: DriverComponent[];
+  env: string;
+  projectRoot: string;
+  /** The planned members a pull request applied, when there were any. */
+  members?: ReadonlyArray<{ member: string; component: string; planDigest: string | null }>;
+}): (component: string) => AppliedDigest | null {
+  let inputs: Record<string, string> | undefined;
+  return (component) => {
+    const planned = (input.members ?? []).filter((m): m is typeof m & { planDigest: string } => m.component === component && m.planDigest !== null);
+    if (planned.length === 1) return { digest: planned[0]!.planDigest, kind: "plan" };
+    if (planned.length > 1) return { digest: changeSetDigest(planned), kind: "plan" };
+    inputs ??= componentInputDigests(input.components, { projectRoot: input.projectRoot, env: input.env });
+    const digest = inputs[component];
+    return digest === undefined ? null : { digest, kind: "deploy-input" };
+  };
+}
+
 /** Explicit reasons `maybeRecordAutoRelease` declined to write a record — never a thrown error, since "nothing to record" (or "opted out") is an expected, common outcome. */
 export type AutoReleaseSkipReason =
   | "opted-out"
@@ -109,6 +137,19 @@ export interface AutoReleaseRunInfo {
    * when the run published no artifact. Set only with `releaseDigest`.
    */
   templatesDigest?: string;
+  /**
+   * What the run applied, for a component that published no artifact (#4274):
+   * its plan digest, or its deploy-input digest when nothing planned. Recorded
+   * as `digest` with `digestKind`, after an artifact digest and
+   * `templatesDigest`, so an infrastructure-only component has a record too.
+   */
+  appliedDigest?: AppliedDigest;
+}
+
+/** A digest naming what a component applied, not an artifact (#4274). */
+export interface AppliedDigest {
+  digest: string;
+  kind: Extract<ReleaseDigestKind, "plan" | "deploy-input">;
 }
 
 /** Opt-out + field-override knobs for auto-release recording, threaded from CLI flags/config (#597: "opt-out-able (flag/config), documented default"). */
@@ -142,7 +183,8 @@ function resolveActor(override?: string): string | undefined {
  *  - `run.success` false — defensive; callers should not reach here on failure.
  *  - no digest found in the run's records — a component with no publish step
  *    has nothing to bind a release record to, unless the run was made under a
- *    release that records its templates (`templatesDigest`, #4222).
+ *    release that records its templates (`templatesDigest`, #4222) or the
+ *    caller names what it applied (`appliedDigest`, #4274).
  *  - no resolvable actor — mirrors `runComponentsReleaseRecord`'s hard
  *    requirement; an unattributed record defeats the ledger's purpose.
  *
@@ -166,7 +208,10 @@ export async function maybeRecordAutoRelease(
     return { recorded: false, reason: "run-not-successful" };
   }
 
-  const digest = run.digest ?? extractRunDigest(run.records ?? []) ?? (run.releaseDigest ? run.templatesDigest : undefined);
+  const artifact = run.digest ?? extractRunDigest(run.records ?? []);
+  const templates = artifact === undefined && run.releaseDigest ? run.templatesDigest : undefined;
+  const digest = artifact ?? templates ?? run.appliedDigest?.digest;
+  const digestKind: ReleaseDigestKind | undefined = artifact !== undefined ? undefined : templates !== undefined ? "templates" : run.appliedDigest?.kind;
   if (!digest) {
     return { recorded: false, reason: "no-digest", detail: `component "${run.component}" published no digest-bearing artifact` };
   }
@@ -201,6 +246,7 @@ export async function maybeRecordAutoRelease(
         ...(run.profileOverride ? { profileOverride: run.profileOverride } : {}),
         ...(run.inputDigest ? { inputDigest: run.inputDigest } : {}),
         ...(run.releaseDigest ? { releaseDigest: run.releaseDigest } : {}),
+        ...(digestKind ? { digestKind } : {}),
       },
       { cwd: options.cwd },
     );