@intentius/chant 0.124.39 → 0.124.40

package/src/cli/handlers/run.ts

@@ -17,6 +17,7 @@ import { recordGateApproval } from "./operator";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
 import { parseParamFlags } from "../build-params-cli";
 import type { CommandContext } from "../registry";
+import { withComponentEndpoint } from "../component-endpoint";
 import { stewardBesideFor, stewardFormFor, stewardTurnLeaseName, DEFAULT_STEWARD_ENV, type StewardDeclaration } from "../../op/steward";
 import { holdBesideLease } from "../../op/steward-beside";
 import { acquireStewardTurn, STEWARD_TURN_WAIT_MS } from "../../op/operator";
@@ -29,11 +30,11 @@ import { ndjsonProgressSink } from "../../components/run-progress";
 import { findStoredRun, readRunEvents } from "../../run-event-store";
 import type { RunEvent } from "../../run-event";
 import { openCliRunEvents, refusesBothStreams, stdoutLine } from "../run-events";
-import { maybeRecordAutoRelease } from "../../components/auto-release";
+import { appliedDigestOf, extractRunDigest, maybeRecordAutoRelease, type AppliedDigest } from "../../components/auto-release";
 import { maybePersistBuildManifest } from "../../components/manifest-persistence";
 import { failedRunExitCode, type DriverComponentResult } from "../../components/driver";
 import { isComponentList, type ComponentRunPlan, type RunComponentsResult } from "../../components/cli-support";
-import { resolveCiRun, type ReleaseRecord, type RunOrigin } from "../../lifecycle/release-ledger";
+import { isApplyRecord, resolveCiRun, type ReleaseRecord, type RunOrigin } from "../../lifecycle/release-ledger";
 import { gateAdmission, gateApprover } from "../../components/promote";
 import { runOpGenerate } from "./run-generate";
 
@@ -935,10 +936,14 @@ export async function recordAutoReleasesForRun(
   releaseDigest?: string,
   /** #4222: the digest of the templates the release records for a component in `env`, for one that publishes no artifact. */
   templatesDigestOf?: (component: string) => string | null,
+  /** #4274: what a component that publishes no artifact applied (`appliedDigestOf`), so it is recorded too. */
+  appliedDigestOf?: (component: string) => AppliedDigest | null,
 ): Promise<ReleaseRecord[]> {
   const recorded: ReleaseRecord[] = [];
   for (const componentResult of results) {
     if (!componentResult.ok) continue;
+    // Hashed only for a component that promoted no artifact, the only one it is recorded for.
+    const applied = appliedDigestOf && !disabled && extractRunDigest(componentResult.records) === undefined ? appliedDigestOf(componentResult.component) : null;
     const outcome = await maybeRecordAutoRelease(
       {
         component: componentResult.component,
@@ -954,6 +959,7 @@ export async function recordAutoReleasesForRun(
         // #4043: the release the deploy was made under, when `--release` named one.
         ...(releaseDigest !== undefined ? { releaseDigest } : {}),
         ...(releaseDigest !== undefined && templatesDigestOf?.(componentResult.component) ? { templatesDigest: templatesDigestOf(componentResult.component)! } : {}),
+        ...(applied ? { appliedDigest: applied } : {}),
       },
       { disabled },
     );
@@ -1023,7 +1029,8 @@ export async function recordAutoReleasesForRun(
  * rather than loaded a second time.
  */
 export function runOpComponents(ctx: CommandContext): Promise<number> {
-  return withRecordingChoice(ctx, () => runComponentSelection(ctx));
+  // #4281: the components run against the environment's declared endpoint.
+  return withRecordingChoice(ctx, () => withComponentEndpoint(ctx, () => runComponentSelection(ctx)));
 }
 
 /**
@@ -1281,7 +1288,11 @@ async function runComponentSelection(ctx: CommandContext): Promise<number> {
     // #3955: a run that records nothing has no release to report either.
     const disabled = resolveAutoReleaseDisabled(config, ctx.args.noReleaseRecord) || ledgerRecordingOff();
     const templatesDigestOf = underRelease ? await releaseTemplatesDigestOf(underRelease.release, env) : undefined;
-    const recorded = await recordAutoReleasesForRun(result.run.results, env, release.runId, disabled, release.runOrigin, underRelease?.releaseDigest, templatesDigestOf);
+    // #4274: a component that publishes nothing is recorded by its deploy-input digest.
+    const appliedOf = result.components ? appliedDigestOf({ components: result.components, env, projectRoot: projectPath }) : undefined;
+    const recorded = await recordAutoReleasesForRun(result.run.results, env, release.runId, disabled, release.runOrigin, underRelease?.releaseDigest, templatesDigestOf, appliedOf);
+    // A generated promote job promotes artifacts; an apply has none to name.
+    const promotable = recorded.filter((r) => !isApplyRecord(r));
     if (underRelease) await warnOnArtifactMismatch(underRelease.release, recorded);
     // `--digest-file` (#2602): the releases this run recorded, one
     // `<component>=<digest>` line each, the form `chant components promote
@@ -1290,7 +1301,7 @@ async function runComponentSelection(ctx: CommandContext): Promise<number> {
     if (ctx.args.digestFile) {
       const digestPath = resolve(ctx.args.digestFile);
       mkdirSync(dirname(digestPath), { recursive: true });
-      writeFileSync(digestPath, recorded.map((r) => `${r.component}=${r.digest}\n`).join(""));
+      writeFileSync(digestPath, promotable.map((r) => `${r.component}=${r.digest}\n`).join(""));
     }
   }
 

package/src/components/auto-release-infra.test.ts

@@ -0,0 +1,131 @@
+/**
+ * #4274: a component that only deploys infrastructure gets a release record
+ * from `pr-apply` and `chant run --components`. Its digest is the plan digest
+ * its approval bound, or its deploy-input digest when nothing planned, and
+ * `digestKind` says which. Written into a workspace member's ledger, under
+ * the member's prefix on chant/lifecycle.
+ */
+
+import { afterAll, afterEach, beforeEach, describe, expect, test } from "vitest";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { appliedDigestOf } from "./auto-release";
+import { recordAutoReleasesForRun } from "../cli/handlers/run";
+import { clearMemberLedgerCache } from "../lifecycle/member-ledger";
+import { readReleaseLedger } from "../lifecycle/release-ledger";
+import type { DriverComponent, DriverComponentResult } from "./driver";
+
+const scratch: string[] = [];
+afterAll(() => {
+  for (const d of scratch) rmSync(d, { recursive: true, force: true });
+});
+
+function git(args: string[], cwd: string): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout;
+}
+
+/** A workspace whose member `infra` deploys one CloudFormation template and publishes nothing. */
+function workspace(): { root: string; member: string } {
+  const root = realpathSync(mkdtempSync(join(tmpdir(), "chant-infra-record-")));
+  scratch.push(root);
+  const files: Record<string, string> = {
+    "chant.workspace.json": JSON.stringify({ name: "acme", schema: 1, members: [{ name: "infra", dir: "services/infra", kind: "chant" }] }),
+    "services/infra/chant.config.json": JSON.stringify({ lexicons: ["aws"] }),
+    "services/infra/dist/infra.template.json": JSON.stringify({ Resources: {} }),
+  };
+  for (const [path, text] of Object.entries(files)) {
+    mkdirSync(dirname(join(root, path)), { recursive: true });
+    writeFileSync(join(root, path), text);
+  }
+  git(["init", "-q", "-b", "main"], root);
+  git(["config", "user.email", "test@chant.dev"], root);
+  git(["config", "user.name", "Test"], root);
+  git(["add", "-A"], root);
+  git(["commit", "-q", "-m", "init"], root);
+  return { root, member: join(root, "services/infra") };
+}
+
+const infra: DriverComponent = {
+  name: "infra",
+  deploy: [{ name: "Deploy", steps: [{ kind: "cfn-deploy", stackName: "infra", template: "dist/infra.template.json" }] }],
+} as unknown as DriverComponent;
+
+const applied = {
+  component: "infra",
+  ok: true,
+  status: "ok",
+  records: [{ component: "infra", phase: "Deploy", kind: "cfn-deploy", status: "ok", durationMs: 1, output: { stackId: "arn:aws:cloudformation:infra" } }],
+} as unknown as DriverComponentResult;
+
+const planDigest = `jcs1-sha256:${"a".repeat(64)}`;
+
+let cwd: string;
+beforeEach(() => {
+  cwd = process.cwd();
+  clearMemberLedgerCache();
+  process.env.GITHUB_ACTOR = "alice";
+});
+afterEach(() => {
+  process.chdir(cwd);
+  delete process.env.GITHUB_ACTOR;
+});
+
+describe("appliedDigestOf", () => {
+  test("a component with one planned member gets that member's plan digest", () => {
+    const of = appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere", members: [{ member: "infra", component: "infra", planDigest }] });
+    expect(of("infra")).toEqual({ digest: planDigest, kind: "plan" });
+  });
+
+  test("a component with several planned members gets the set digest over them, the same whatever their order", () => {
+    const members = [
+      { member: "infra/a", component: "infra", planDigest },
+      { member: "infra/b", component: "infra", planDigest: `jcs1-sha256:${"b".repeat(64)}` },
+    ];
+    const one = appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere", members })("infra");
+    const two = appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere", members: [...members].reverse() })("infra");
+    expect(one?.kind).toBe("plan");
+    expect(one?.digest).not.toBe(planDigest);
+    expect(two).toEqual(one);
+  });
+
+  test("a component that planned nothing gets its deploy-input digest, which moves with the template it deploys", () => {
+    const { member } = workspace();
+    const before = appliedDigestOf({ components: [infra], env: "staging", projectRoot: member })("infra");
+    expect(before?.kind).toBe("deploy-input");
+    writeFileSync(join(member, "dist/infra.template.json"), JSON.stringify({ Resources: { Bucket: {} } }));
+    const after = appliedDigestOf({ components: [infra], env: "staging", projectRoot: member })("infra");
+    expect(after?.kind).toBe("deploy-input");
+    expect(after?.digest).not.toBe(before?.digest);
+  });
+
+  test("a component the run doesn't know has none", () => {
+    expect(appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere" })("other")).toBeNull();
+  });
+});
+
+describe("recordAutoReleasesForRun for an infrastructure-only component", () => {
+  test("a pr-apply records the plan digest under the member's prefix", async () => {
+    const { root, member } = workspace();
+    process.chdir(member);
+    const of = appliedDigestOf({ components: [infra], env: "staging", projectRoot: member, members: [{ member: "infra", component: "infra", planDigest }] });
+    const recorded = await recordAutoReleasesForRun([applied], "staging", "run-1", false, { forge: "local" }, undefined, undefined, of);
+    expect(recorded).toHaveLength(1);
+    expect(recorded[0]).toMatchObject({ component: "infra", env: "staging", digest: planDigest, digestKind: "plan", actor: "alice" });
+
+    const files = git(["ls-tree", "-r", "--name-only", "chant/lifecycle"], root).split("\n").filter(Boolean);
+    expect(files).toContain("_members/infra/staging/releases.jsonl");
+    const { records } = await readReleaseLedger("staging", { cwd: member });
+    expect(records).toEqual([expect.objectContaining({ digest: planDigest, digestKind: "plan" })]);
+  });
+
+  test("without an applied digest it records nothing, as before", async () => {
+    const { member } = workspace();
+    process.chdir(member);
+    const recorded = await recordAutoReleasesForRun([applied], "staging", "run-1", false);
+    expect(recorded).toEqual([]);
+  });
+});

package/src/components/auto-release.test.ts

@@ -181,7 +181,46 @@ describe("maybeRecordAutoRelease", () => {
     );
     expect(outcome).toMatchObject({ recorded: true });
     const [input] = appendReleaseRecordMock.mock.calls[0];
-    expect(input).toMatchObject({ digest: "sha256:tpl", releaseDigest: "sha256:rel" });
+    expect(input).toMatchObject({ digest: "sha256:tpl", releaseDigest: "sha256:rel", digestKind: "templates" });
+  });
+
+  test("#4274: a run that published nothing records what it applied, and says which digest that is", async () => {
+    appendReleaseRecordMock.mockResolvedValue({
+      commit: "c".repeat(40),
+      record: { version: 1, component: "infra", env: "staging", digest: "sha256:plan", gitSha: "x", runId: "r", timestamp: "t", actor: "alice", digestKind: "plan" },
+    });
+    const outcome = await maybeRecordAutoRelease(
+      { component: "infra", env: "staging", success: true, records: [applyRecord()], runId: "run-1", appliedDigest: { digest: "sha256:plan", kind: "plan" } },
+      { actor: "alice", gitSha: "a".repeat(40) },
+    );
+    expect(outcome).toMatchObject({ recorded: true });
+    expect(appendReleaseRecordMock.mock.calls[0][0]).toMatchObject({ digest: "sha256:plan", digestKind: "plan" });
+  });
+
+  test("#4274: an artifact digest wins over what the run applied, and carries no digestKind", async () => {
+    appendReleaseRecordMock.mockResolvedValue({
+      commit: "c".repeat(40),
+      record: { version: 1, component: "svc", env: "prod", digest: "sha256:abc", gitSha: "x", runId: "r", timestamp: "t", actor: "alice" },
+    });
+    await maybeRecordAutoRelease(
+      { component: "svc", env: "prod", success: true, records: [publishRecord("sha256:abc")], runId: "run-1", appliedDigest: { digest: "sha256:in", kind: "deploy-input" } },
+      { actor: "alice", gitSha: "a".repeat(40) },
+    );
+    const [input] = appendReleaseRecordMock.mock.calls[0];
+    expect(input).toMatchObject({ digest: "sha256:abc" });
+    expect(input).not.toHaveProperty("digestKind");
+  });
+
+  test("#4274: a templates digest under a release wins over what the run applied", async () => {
+    appendReleaseRecordMock.mockResolvedValue({
+      commit: "c".repeat(40),
+      record: { version: 1, component: "infra", env: "staging", digest: "sha256:tpl", gitSha: "x", runId: "r", timestamp: "t", actor: "alice" },
+    });
+    await maybeRecordAutoRelease(
+      { component: "infra", env: "staging", success: true, records: [applyRecord()], runId: "run-1", releaseDigest: "sha256:rel", templatesDigest: "sha256:tpl", appliedDigest: { digest: "sha256:in", kind: "deploy-input" } },
+      { actor: "alice", gitSha: "a".repeat(40) },
+    );
+    expect(appendReleaseRecordMock.mock.calls[0][0]).toMatchObject({ digest: "sha256:tpl", digestKind: "templates" });
   });
 
   test("#4222: a templates digest without a release is ignored", async () => {

package/src/components/auto-release.ts

@@ -26,8 +26,10 @@
  * env vars, timestamp is a real `new Date()` taken at record time).
  */
 import { getHeadCommit, pushLifecycle, StaleLifecycleBranchError } from "../lifecycle/git";
-import { appendReleaseRecord, InvalidReleaseRecordError, type ReleaseAdmission, type ReleaseRecord, type RunOrigin } from "../lifecycle/release-ledger";
-import type { DriverStepRecord } from "./driver";
+import { appendReleaseRecord, InvalidReleaseRecordError, type ReleaseAdmission, type ReleaseDigestKind, type ReleaseRecord, type RunOrigin } from "../lifecycle/release-ledger";
+import { changeSetDigest } from "../change-set";
+import type { DriverComponent, DriverStepRecord } from "./driver";
+import { componentInputDigests } from "./fan-out-inputs";
 
 /**
  * A step output that represents a *promoted* artifact — a publish-family result
@@ -68,6 +70,32 @@ export function extractRunDigest(records: DriverStepRecord[]): string | undefine
   return found;
 }
 
+/**
+ * What each component of a run applied, for the ones that publish no artifact
+ * (#4274). A component with planned members (`pr-apply`'s change set) gets its
+ * plan digest: the one member's `planDigest`, or with several the
+ * change-set digest over them, the way a set's digest is taken. Any other gets
+ * its deploy-input digest from `componentInputDigests`, computed on first use.
+ */
+export function appliedDigestOf(input: {
+  /** Every component of the project, so a component's upstream digests count. */
+  components: DriverComponent[];
+  env: string;
+  projectRoot: string;
+  /** The planned members a pull request applied, when there were any. */
+  members?: ReadonlyArray<{ member: string; component: string; planDigest: string | null }>;
+}): (component: string) => AppliedDigest | null {
+  let inputs: Record<string, string> | undefined;
+  return (component) => {
+    const planned = (input.members ?? []).filter((m): m is typeof m & { planDigest: string } => m.component === component && m.planDigest !== null);
+    if (planned.length === 1) return { digest: planned[0]!.planDigest, kind: "plan" };
+    if (planned.length > 1) return { digest: changeSetDigest(planned), kind: "plan" };
+    inputs ??= componentInputDigests(input.components, { projectRoot: input.projectRoot, env: input.env });
+    const digest = inputs[component];
+    return digest === undefined ? null : { digest, kind: "deploy-input" };
+  };
+}
+
 /** Explicit reasons `maybeRecordAutoRelease` declined to write a record — never a thrown error, since "nothing to record" (or "opted out") is an expected, common outcome. */
 export type AutoReleaseSkipReason =
   | "opted-out"
@@ -109,6 +137,19 @@ export interface AutoReleaseRunInfo {
    * when the run published no artifact. Set only with `releaseDigest`.
    */
   templatesDigest?: string;
+  /**
+   * What the run applied, for a component that published no artifact (#4274):
+   * its plan digest, or its deploy-input digest when nothing planned. Recorded
+   * as `digest` with `digestKind`, after an artifact digest and
+   * `templatesDigest`, so an infrastructure-only component has a record too.
+   */
+  appliedDigest?: AppliedDigest;
+}
+
+/** A digest naming what a component applied, not an artifact (#4274). */
+export interface AppliedDigest {
+  digest: string;
+  kind: Extract<ReleaseDigestKind, "plan" | "deploy-input">;
 }
 
 /** Opt-out + field-override knobs for auto-release recording, threaded from CLI flags/config (#597: "opt-out-able (flag/config), documented default"). */
@@ -142,7 +183,8 @@ function resolveActor(override?: string): string | undefined {
  *  - `run.success` false — defensive; callers should not reach here on failure.
  *  - no digest found in the run's records — a component with no publish step
  *    has nothing to bind a release record to, unless the run was made under a
- *    release that records its templates (`templatesDigest`, #4222).
+ *    release that records its templates (`templatesDigest`, #4222) or the
+ *    caller names what it applied (`appliedDigest`, #4274).
  *  - no resolvable actor — mirrors `runComponentsReleaseRecord`'s hard
  *    requirement; an unattributed record defeats the ledger's purpose.
  *
@@ -166,7 +208,10 @@ export async function maybeRecordAutoRelease(
     return { recorded: false, reason: "run-not-successful" };
   }
 
-  const digest = run.digest ?? extractRunDigest(run.records ?? []) ?? (run.releaseDigest ? run.templatesDigest : undefined);
+  const artifact = run.digest ?? extractRunDigest(run.records ?? []);
+  const templates = artifact === undefined && run.releaseDigest ? run.templatesDigest : undefined;
+  const digest = artifact ?? templates ?? run.appliedDigest?.digest;
+  const digestKind: ReleaseDigestKind | undefined = artifact !== undefined ? undefined : templates !== undefined ? "templates" : run.appliedDigest?.kind;
   if (!digest) {
     return { recorded: false, reason: "no-digest", detail: `component "${run.component}" published no digest-bearing artifact` };
   }
@@ -201,6 +246,7 @@ export async function maybeRecordAutoRelease(
         ...(run.profileOverride ? { profileOverride: run.profileOverride } : {}),
         ...(run.inputDigest ? { inputDigest: run.inputDigest } : {}),
         ...(run.releaseDigest ? { releaseDigest: run.releaseDigest } : {}),
+        ...(digestKind ? { digestKind } : {}),
       },
       { cwd: options.cwd },
     );

package/src/components/cli-support.ts

@@ -489,6 +489,8 @@ export interface RunComponentsResult {
   run?: DriverRunResult;
   /** Component names actually dispatched to the driver, in run order. */
   selected: string[];
+  /** The components dispatched, as they ran (#4274): what a component's deploy-input digest is taken over. */
+  components?: DriverComponent[];
   error?: string;
   /** Set when the run stopped at a `gate` nobody has approved (#2119): the component it stopped at and the pending fact recorded for it. */
   gated?: {
@@ -718,6 +720,7 @@ export async function runComponents(
         success: run.status === "ok",
         run,
         selected,
+        components: resolvedTargets,
         buildParams: options.buildParams,
         ...(run.status === "gated" && run.gate
           ? {
@@ -785,6 +788,7 @@ export async function runComponents(
       success: componentResult.ok,
       run,
       selected,
+      components: resolvedTargets,
       buildParams: options.buildParams,
       ...(componentResult.status === "gated" && componentResult.gate
         ? {

package/src/components/deploy-units.ts

@@ -59,6 +59,11 @@ export const DEPLOY_UNIT_RULES: readonly DeployUnitRule[] = [
   // A Terraform-family root (#3049). Its unit is the root's name in
   // `terraform.roots`, which is also the member a gated wave's digest names.
   { kind: "terraform-apply", field: "root", lexicon: "terraform" },
+  // An ARM template applied into one resource group (#4273). Its unit is the group.
+  { kind: "arm-deploy", field: "resourceGroup", lexicon: "azure" },
+  // A Config Connector manifest applied over REST (#4273). Its unit is the
+  // step's `stack`, the member its plan names.
+  { kind: "gcp-apply", field: "stack", lexicon: "gcp" },
 ];
 
 /** One resolved unit a component's deploy composition targets. */

package/src/components/promote.test.ts

@@ -108,6 +108,45 @@ describe("planning", () => {
   });
 });
 
+describe("records of an apply, not an artifact (#4274)", () => {
+  const apply = (component: string, timestamp: string, digestKind: "plan" | "deploy-input" = "plan"): ReleaseRecord => ({
+    ...rec(component, "staging", `jcs1-sha256:${timestamp.slice(0, 10)}`, timestamp),
+    digestKind,
+  });
+  const records = [
+    rec("api", "staging", "sha256:api", "2026-01-02T00:00:00Z"),
+    apply("infra", "2026-01-02T00:00:00Z"),
+    apply("infra", "2026-01-03T00:00:00Z", "deploy-input"),
+  ];
+
+  test("promoting every component leaves an infrastructure component out and says why", () => {
+    const plan = planPromotion({ from: "staging", to: "prod", sourceRecords: records, declared: ["api", "infra"] }) as PromotionPlan;
+    expect(plan.items.map((i) => i.component)).toEqual(["api"]);
+    expect(plan.notPromoted).toEqual([{ component: "infra", reason: expect.stringMatching(/only applies are recorded/) }]);
+  });
+
+  test("a newer apply never hides the artifact release before it", () => {
+    const mixed = [rec("api", "staging", "sha256:api", "2026-01-01T00:00:00Z"), apply("api", "2026-01-05T00:00:00Z")];
+    const picked = selectRelease(mixed, "api", "staging");
+    expect("record" in picked && picked.record.digest).toBe("sha256:api");
+  });
+
+  test("promote, rollback and redeploy of a component with only applies are refused by name", () => {
+    const promote = planPromotion({ from: "staging", to: "prod", sourceRecords: records, declared: ["api", "infra"], component: "infra" });
+    expect("error" in promote && promote.error).toMatch(/"infra" has only applies recorded in "staging"/);
+    const rollback = planRollback({ env: "staging", records, declared: ["infra"], component: "infra" });
+    expect("error" in rollback && rollback.error).toMatch(/only applies recorded/);
+    const redeploy = planRedeploy({ env: "staging", records, declared: ["infra"], component: "infra" });
+    expect("error" in redeploy && redeploy.error).toMatch(/only applies recorded/);
+  });
+
+  test("a rollback or redeploy carries a templates digest's kind forward", () => {
+    const source: ReleaseRecord = { ...rec("infra", "staging", "sha256:tpl", "2026-01-02T00:00:00Z"), digestKind: "templates" };
+    const run = { runId: "r2", actor: "ci", timestamp: "2026-01-04T00:00:00Z" };
+    expect(rollbackRecord({ component: "infra", digest: "sha256:tpl", source }, "staging", run)).toMatchObject({ digestKind: "templates" });
+  });
+});
+
 describe("pinning each component to a digest (#2602)", () => {
   // api's pinned release is older than its latest one: another pipeline
   // recorded sha256:newer while this one ran.

package/src/components/promote.ts

@@ -39,7 +39,7 @@
  */
 
 import { parseWiringRef, type WiringRef } from "../lint/rules/comp/support";
-import { latestPerComponent, type ReleaseRecord, type ReleaseRecordInput, type ReleaseAdmission, type RunOrigin } from "../lifecycle/release-ledger";
+import { isApplyRecord, latestPerComponent, type ReleaseRecord, type ReleaseRecordInput, type ReleaseAdmission, type RunOrigin } from "../lifecycle/release-ledger";
 import { CapabilityRegistry, type Capability } from "./capability";
 import {
   runInterpretDriver,
@@ -109,19 +109,35 @@ export function selectRelease(
   env: string,
   digest?: string,
 ): { record: ReleaseRecord } | { error: string } {
-  const own = records.filter((r) => r.component === component);
-  if (own.length === 0) return { error: `no release of "${component}" is recorded in "${env}"` };
-  if (digest === undefined) return { record: latestPerComponent(own).get(component)! };
-  const matching = own.filter((r) => r.digest === digest);
+  const own = deployableRecords(records, component, env);
+  if ("error" in own) return own;
+  if (digest === undefined) return { record: latestPerComponent(own.records).get(component)! };
+  const matching = own.records.filter((r) => r.digest === digest);
   if (matching.length === 0) {
     return {
       error: `digest ${digest} is not recorded for "${component}" in "${env}"; ` +
-        `its recorded digests are ${[...new Set(own.map((r) => r.digest))].join(", ")}`,
+        `its recorded digests are ${[...new Set(own.records.map((r) => r.digest))].join(", ")}`,
     };
   }
   return { record: latestPerComponent(matching).get(component)! };
 }
 
+/**
+ * The records of `component` a promote, rollback or redeploy can deploy from
+ * (#4274): every one but those that only say it applied ({@link isApplyRecord}),
+ * whose digest is a plan or deploy-input digest and names no artifact.
+ */
+function deployableRecords(records: ReleaseRecord[], component: string, env: string): { records: ReleaseRecord[] } | { error: string } {
+  const own = records.filter((r) => r.component === component);
+  if (own.length === 0) return { error: `no release of "${component}" is recorded in "${env}"` };
+  const deployable = own.filter((r) => !isApplyRecord(r));
+  if (deployable.length === 0) return { error: appliesOnly(component, env) };
+  return { records: deployable };
+}
+
+const appliesOnly = (component: string, env: string): string =>
+  `"${component}" has only applies recorded in "${env}", each by a plan or deploy-input digest, so no artifact of it can be deployed again`;
+
 /**
  * Read `--digest <component>=<digest>` values (#2602) into a component-to-
  * digest map. A value with no `=` is left to the single-component form
@@ -198,13 +214,17 @@ export function planPromotion(input: {
     return { from, to, items: [{ component, digest: picked.record.digest, source: picked.record }], notPromoted: [] };
   }
 
-  const latest = latestPerComponent(sourceRecords);
+  const latest = latestPerComponent(sourceRecords.filter((r) => !isApplyRecord(r)));
   const items: PromotionItem[] = [];
   const notPromoted: PromotionPlan["notPromoted"] = [];
   for (const [name, record] of [...latest].sort(([a], [b]) => a.localeCompare(b))) {
     if (declared.includes(name)) items.push({ component: name, digest: record.digest, source: record });
     else notPromoted.push({ component: name, reason: "recorded but not declared in this checkout" });
   }
+  // #4274: a component that only applied (infrastructure, no artifact) has nothing to promote.
+  for (const name of [...new Set(sourceRecords.filter((r) => isApplyRecord(r) && !latest.has(r.component)).map((r) => r.component))].sort()) {
+    notPromoted.push({ component: name, reason: "only applies are recorded, by a plan or deploy-input digest; there is no artifact to promote" });
+  }
   if (items.length === 0) {
     return { error: `nothing to promote: no component declared here has a release recorded in "${from}"` };
   }
@@ -228,9 +248,10 @@ export function planRollback(input: {
   if (!declared.includes(component)) {
     return { error: `component "${component}" is not declared in this checkout` };
   }
-  const own = records.filter((r) => r.component === component);
-  const current = latestPerComponent(own).get(component);
-  if (!current) return { error: `no release of "${component}" is recorded in "${env}"` };
+  const deployable = deployableRecords(records, component, env);
+  if ("error" in deployable) return deployable;
+  const own = deployable.records;
+  const current = latestPerComponent(own).get(component)!;
 
   let target: ReleaseRecord;
   if (digest !== undefined) {
@@ -284,7 +305,7 @@ export function planReleaseRollback(input: {
       notPromoted.push({ component, reason: `in release ${name} but not declared in this checkout` });
       continue;
     }
-    const ran = records.filter((r) => r.component === component && r.releaseDigest === release.releaseDigest);
+    const ran = records.filter((r) => r.component === component && r.releaseDigest === release.releaseDigest && !isApplyRecord(r));
     if (ran.length === 0) {
       neverRan.push(component);
       continue;
@@ -299,7 +320,7 @@ export function planReleaseRollback(input: {
     };
   }
   if (items.length === 0) return { error: `release ${name} has no component declared in this checkout` };
-  const current = latestPerComponent(records);
+  const current = latestPerComponent(records.filter((r) => !isApplyRecord(r)));
   const already = items.every((i) => {
     const now = current.get(i.component);
     return now !== undefined && now.releaseDigest === release.releaseDigest && now.digest === i.digest && !input.unsettled?.has(i.component);
@@ -329,8 +350,9 @@ export function planRedeploy(input: {
   if (!declared.includes(component)) {
     return { error: `component "${component}" is not declared in this checkout` };
   }
-  const current = latestPerComponent(records.filter((r) => r.component === component)).get(component);
-  if (!current) return { error: `no release of "${component}" is recorded in "${env}"` };
+  const deployable = deployableRecords(records, component, env);
+  if ("error" in deployable) return deployable;
+  const current = latestPerComponent(deployable.records).get(component)!;
   if (digest !== undefined && digest !== current.digest) {
     return {
       error: `${digest} is not the current release of "${component}" in "${env}" (that is ${current.digest}); ` +
@@ -699,6 +721,8 @@ function sharedRecord(item: PromotionItem, env: string, run: DeployRunInfo): Rel
     ...(run.admission ? { admission: run.admission } : {}),
     ...(source.manifestDigest ? { manifestDigest: source.manifestDigest } : {}),
     ...(source.inputDigest ? { inputDigest: source.inputDigest } : {}),
+    // #4274: a release's templates digest stays one when it is deployed again.
+    ...(source.digestKind ? { digestKind: source.digestKind } : {}),
   };
 }
 

package/src/lifecycle/__fixtures__/publish-fakes.ts

@@ -203,7 +203,12 @@ if (args[0] === "publish") {
   const [name, version] = split(args[1]);
   const p = reg.packages[name];
   if (!p) { console.error("npm error 404 Not Found - " + name); process.exit(1); }
-  if (p.lag && p.lag[version] > 0) { p.lag[version] -= 1; save(); }
+  if (process.env.FAKE_NPM_VIEW_ERROR && name.includes(process.env.FAKE_NPM_VIEW_ERROR) && p.versions.includes(version)) { console.error("npm error code E500"); console.error("npm error 500 Internal Server Error - GET https://registry.example/" + name); process.exit(1); }
+  if (p.lag && p.lag[version] > 0) {
+    p.lag[version] -= 1; save();
+    // A new package npm does not serve yet answers 404, as the real registry does.
+    if (process.env.FAKE_NPM_LAG_404) { console.error("npm error code E404"); console.error("npm error 404 No match found for version " + version); process.exit(1); }
+  }
   else if (p.versions.includes(version)) console.log(version);
 } else if (args[0] === "dist-tag" && args[1] === "add") {
   const [name, version] = split(args[2]);

package/src/lifecycle/publish-declaration.ts

@@ -61,9 +61,10 @@ export const NpmPublishSchema = z
      */
     tokenEnv: envName.optional(),
     /**
-     * Seconds the reveal waits for the registry to serve every version it
-     * published before installing them to audit (#4244). A registry accepts a
-     * publish before it serves it. Default 600.
+     * A cap, in seconds, on the reveal's wait for the registry to serve every
+     * version it published before installing them to audit (#4244). A
+     * registry accepts a publish before it serves it. Unset, the wait ends
+     * only when every version is served or the registry fails (#4271).
      */
     registryWait: z.number().int().min(0).optional(),
   })