@intentius/chant 0.124.45 → 0.124.48

package/src/cli/parse-args.ts

@@ -47,6 +47,7 @@ const BOOLEAN_FLAGS = new Set([
   "--up",
   "--down",
   "--include-dependents",
+  "--cross-root",
   "--local",
   "--json",
   "--progress-json",
@@ -153,13 +154,36 @@ export function parseArgs(args: string[]): ParsedArgs {
   // whose own value legitimately contains `=` (`--param=tier=production`
   // splits to flag `--param`, value `tier=production`, not further split on
   // the second `=`).
-  args = splitJoinedFlags(args, BOOLEAN_FLAGS);
+  //
+  // Tokens after a bare `--` are positionals (#4369), so they are not split.
+  const end = args.indexOf("--");
+  args = end < 0 ? splitJoinedFlags(args, BOOLEAN_FLAGS) : [...splitJoinedFlags(args.slice(0, end), BOOLEAN_FLAGS), ...args.slice(end)];
+
+  // chant #4369 — every token after a bare `--` is a positional, whatever it
+  // starts with: `chant search -- "-kind:X"` is the spelling that always works.
+  let onlyPositionals = false;
+  const positional = (arg: string): void => {
+    if (result.command) (result.positionals ??= []).push(arg);
+    if (!result.command) {
+      result.command = arg;
+    } else if (result.path === ".") {
+      result.path = arg;
+    } else if (!result.extraPositional) {
+      result.extraPositional = arg;
+    } else {
+      result.extraPositional2 = arg;
+    }
+  };
 
   let i = 0;
   while (i < args.length) {
     const arg = args[i];
 
-    if (arg === "--help" || arg === "-h") {
+    if (onlyPositionals) {
+      positional(arg);
+    } else if (arg === "--") {
+      onlyPositionals = true;
+    } else if (arg === "--help" || arg === "-h") {
       result.help = true;
     } else if (arg === "--version" || arg === "-V") {
       result.version = true;
@@ -339,6 +363,10 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.explain = true;
     } else if (arg === "--show") {
       result.show = args[++i];
+    } else if (arg === "--count-by") {
+      // `chant search --count-by kind|module|attr:<name>` (#4360)
+      result.countBy = args[++i];
+      if (!result.countBy || result.countBy.startsWith("-")) throw new Error("--count-by needs a grouping: --count-by kind, --count-by module or --count-by attr:<name>");
     } else if (arg === "--up") {
       result.up = true;
     } else if (arg === "--down") {
@@ -353,6 +381,19 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.head = args[++i];
     } else if (arg === "--include-dependents") {
       result.includeDependents = true;
+    } else if (arg === "--cross-root") {
+      // `chant workspace lint --cross-root` (#2549): the disagreement lint over every member's graph.
+      result.crossRoot = true;
+    } else if (arg === "--dependents-of") {
+      // `chant workspace run --dependents-of <member> --op <op>` (#2554).
+      const value = args[++i];
+      if (!value || value.startsWith("-")) throw new Error("--dependents-of needs a member name: --dependents-of <member>");
+      result.dependentsOf = value;
+    } else if (arg === "--pin") {
+      // `chant workspace train <env> --pin <member>=<label|digest>` (#2554), repeatable.
+      const value = args[++i];
+      if (!value || value.startsWith("-") || !value.includes("=")) throw new Error("--pin needs a member and a release: --pin <member>=<label|digest>");
+      (result.pins ??= []).push(value);
     } else if (arg === "--from-affected") {
       result.fromAffected = args[++i];
     } else if (arg === "--gate") {
@@ -508,6 +549,16 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.deep = true;
     } else if (arg === "--at") {
       result.at = args[++i];
+    } else if (arg === "--capability-view") {
+      // `chant graph --format ir --capability-view` and `chant workspace graph --capability-view` (#4378)
+      result.capabilityView = true;
+    } else if (arg === "--capabilities") {
+      // `chant search --capabilities` and `chant workspace search --capabilities` (#4375)
+      result.capabilities = true;
+    } else if (arg === "--snapshot") {
+      // `chant search` and `chant workspace search --snapshot <ref>` (#4374)
+      result.snapshot = args[++i];
+      if (!result.snapshot || result.snapshot.startsWith("-")) throw new Error("--snapshot needs a snapshot ref: --snapshot latest");
     } else if (arg === "--kind") {
       // `chant workspace records|graph|check --kind <kind file>` (#2546, #2549)
       result.kind = args[++i];
@@ -895,8 +946,8 @@ export function parseArgs(args: string[]): ParsedArgs {
     } else if (arg === "--expire") {
       result.expire = true;
     } else if (arg === "--role") {
-      // #2508 — a role the approver claims, which a gate's policy sees. A
-      // quorum reads roles from .chant/trust.json at base instead (#4290).
+      // #2508 — a role the approver claims, recorded on the approval. A quorum
+      // (#4290) and a gate policy (#4324) read roles from .chant/trust.json at base.
       // Repeatable, and a comma list works too.
       const value = args[++i] ?? "";
       result.roles = [...(result.roles ?? []), ...value.split(",").map((r) => r.trim()).filter(Boolean)];
@@ -934,6 +985,12 @@ export function parseArgs(args: string[]): ParsedArgs {
       // #2537 — `chant build` and `chant lint` at a declared workspace root
       // run on the root project alone instead of refusing with WSP000.
       result.rootOnly = true;
+    } else if (arg === "--forge-repos") {
+      // #3168 — `chant workspace check --forge-repos <file>`: the forge's
+      // repository list, as a warden reads it, for an org workspace's checks.
+      const value = args[++i];
+      if (!value || value.startsWith("-")) throw new Error("--forge-repos needs a file: --forge-repos <repos.json>");
+      result.forgeRepos = value;
     } else if (arg === "--generated") {
       // #2641 — `chant workspace check --generated` runs each declared
       // generator and compares its output with the file in the tree.
@@ -954,6 +1011,11 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.url = args[++i];
     } else if (arg === "--op") {
       result.op = args[++i];
+    } else if (arg === "--where") {
+      // #4363 — a typed filter on a contract read; repeatable, every clause has to hold.
+      const value = args[++i];
+      if (value === undefined || value.startsWith("--")) throw new Error("--where needs a clause: --where <field><op><value>");
+      result.where = [...(result.where ?? []), value];
     } else if (arg === "--since") {
       result.since = args[++i];
     } else if (arg === "--limit") {
@@ -972,17 +1034,19 @@ export function parseArgs(args: string[]): ParsedArgs {
       // every command, not scoped per-command, so "the command's known
       // flags" isn't something this loop can name in isolation.
       throw new Error(`Unknown flag: ${arg}\nRun "chant --help" to see supported flags.`);
-    } else if (!arg.startsWith("-")) {
-      if (result.command) (result.positionals ??= []).push(arg);
-      if (!result.command) {
-        result.command = arg;
-      } else if (result.path === ".") {
-        result.path = arg;
-      } else if (!result.extraPositional) {
-        result.extraPositional = arg;
-      } else {
-        result.extraPositional2 = arg;
-      }
+    } else if (/^-[A-Za-z]/.test(arg)) {
+      // chant #4369 — an unrecognised short flag (`-x`) is refused like an
+      // unrecognised `--flag` (#1127). It used to be dropped without a word,
+      // the same silent misparse #1127 closed for long flags. A lexicon's own
+      // mounted command still gets its short flags: `main` tries the plugin
+      // commands before rethrowing a parse error.
+      throw new Error(`Unknown flag: ${arg}\nRun "chant --help" to see supported flags.`);
+    } else {
+      // Anything else is a positional, including a token that starts with `-`
+      // but is not flag-shaped (#4369): `->kind:Bucket` is a search query that
+      // opens with an outgoing edge term, and dropping it made `chant search`
+      // answer for "." instead. A bare `-` is a positional too.
+      positional(arg);
     }
 
     i++;

package/src/cli/registry.ts

@@ -83,7 +83,7 @@ export interface ParsedArgs {
   /** `chant run events <run> --follow` (#4042) — stream the run's events as they happen, until `run-settle`. */
   follow?: boolean;
   live: boolean;
-  /** `chant migrate --from <name>` (default "github") */
+  /** `chant migrate --from <name>` (default "github"); `lexicon/dialect` for the sql lexicon */
   migrateFrom?: string;
   /** `chant import --kustomize <dir>` — render the kustomization, then import (#1548) */
   kustomize?: string;
@@ -103,9 +103,9 @@ export interface ParsedArgs {
   write?: boolean;
   /** `chant carve apply --write-source` — stamp the ownership marker into the emitted source */
   writeSource?: boolean;
-  /** `chant migrate --to <name>` (default "gitlab") */
+  /** `chant migrate --to <name>` (default "gitlab"); `lexicon/dialect` for the sql lexicon */
   migrateTo?: string;
-  /** `chant migrate --emit yaml|ts` */
+  /** `chant migrate --emit yaml|ts|sql` */
   emit?: string;
   /** Escalate needs-review diagnostics to errors (migrate command) */
   strict?: boolean;
@@ -246,6 +246,8 @@ export interface ParsedArgs {
   show?: string;
   /** `chant search --explain` — append a footer: universe count + why non-matches were excluded (#1139). */
   explain?: boolean;
+  /** `chant search --count-by kind|module|attr:<name>`: print one count per group instead of one row per match (#4360). */
+  countBy?: string;
   /** `chant graph --lens blast:<node> --up` — include upstream producers */
   up?: boolean;
   /** `chant graph --lens blast:<node> --down` — include downstream dependents */
@@ -261,6 +263,12 @@ export interface ParsedArgs {
   head?: string;
   /** `chant lifecycle affected --include-dependents` — add downstream consumers */
   includeDependents?: boolean;
+  /** `chant workspace run --dependents-of <member> --op <op>` (#2554): run the Op in every member that links to this one, directly or not. */
+  dependentsOf?: string;
+  /** `chant workspace lint --cross-root` (#2549): also run the disagreement lint and the lexicons' cross-root checks over every member's graph. */
+  crossRoot?: boolean;
+  /** `chant workspace train <env> --pin <member>=<label|digest>` (#2554), repeatable: the release a train pins for that member instead of its newest. */
+  pins?: string[];
   /**
    * `chant components fan-out --from-affected <file>` (#2420) — read the
    * stack-level change signal from the JSON `chant lifecycle affected --json`
@@ -446,6 +454,26 @@ export interface ParsedArgs {
    * should win.
    */
   at?: string;
+  /**
+   * `chant search "<q>" --snapshot <ref> --env <name>` and `chant workspace
+   * search "<q>" --snapshot <ref>` (#4374): the recorded snapshot to answer
+   * from. Plain search also takes it as `--at <ref>`, for compatibility;
+   * everywhere else in the read contract `--at` is a git revision.
+   */
+  snapshot?: string;
+  /**
+   * `chant search --capabilities` and `chant workspace search --capabilities`
+   * (#4375): print the capability catalog, the `capabilities` document of the
+   * read contract, instead of answering a query.
+   */
+  capabilities?: boolean;
+  /**
+   * `chant graph --format ir --capability-view` (#4378): add the lexicon-neutral
+   * view capability rules read, mapped by this chant's lexicons, to the IR as
+   * `capabilityView`. `chant workspace graph --capability-view` asks each
+   * member's chant for it and carries it on the member.
+   */
+  capabilityView?: boolean;
   /** `chant workspace records --kind <path>` (#2546): the record kind file to read records through. */
   kind?: string;
   /** Every `--kind` given, in order: `chant workspace graph --intent` reads each (#2651). */
@@ -618,6 +646,8 @@ export interface ParsedArgs {
    * generators run member code.
    */
   generated?: boolean;
+  /** `chant workspace check --forge-repos <file>` (#3168): the forge's repository list, checked against an org workspace's repo members (WSP014, WSP015). */
+  forgeRepos?: string;
   /**
    * `chant workspace build|lint|audit|graph --member <name>` (#2537): run only
    * the named members or example groups. Repeatable, and a comma list works too.
@@ -766,7 +796,7 @@ export interface ParsedArgs {
    * on a model-authored channel.
    */
   allowSameOrigin?: boolean;
-  /** `chant approve --role <name>` (#2508) — roles the approver claims, which a gate's policy sees. A quorum never counts them (#4290): its roles come from `.chant/trust.json` at base. Repeatable; a comma list also works. */
+  /** `chant approve --role <name>` (#2508) — roles the approver claims, recorded on the approval. Nothing trusts them: a quorum (#4290) and a gate policy (#4324) read roles from `.chant/trust.json` at base, for a sealed approval. Repeatable; a comma list also works. */
   roles?: string[];
   /** `chant approve --agent` (#2508) — record the approval as an agent's. An agent never counts toward a quorum; it passes a gate only through a policy permit in `enforce` mode. */
   agent?: boolean;
@@ -776,6 +806,8 @@ export interface ParsedArgs {
   op?: string;
   /** `chant operator log --since <iso>` (#2029) — only entries at or after this ISO-8601 instant. `chant workspace records --since <rev>` (#2673) — the revision to compare the records with. `chant workspace metrics --since <date>` (#4039) — the start of the window the metrics count. */
   since?: string;
+  /** `chant ledger`, `chant workspace records` and `chant workspace runs --where <field><op><value>` (#4363): typed filters, repeatable, all of which have to hold. */
+  where?: string[];
   /** `chant operator log --limit <n>` (#2029) — keep only the newest n entries (still printed oldest-first). */
   limit?: number;
   /** `chant approve <op> <gate> --url <url>` (#2028) — the address this resolution happened at (the PR/MR that carried the change), recorded typed on the gate-resolution fact so a reader is not sniffing `--note` for something link-shaped. Defaults to the PR/MR the surrounding CI job is for, when there is one. Must be an absolute http/https URL. */

package/src/components/builders.ts

@@ -19,6 +19,8 @@ import type {
   ZipPackageInput,
   JvmBuildInput,
   GenerateSbomInput,
+  PublishImageInput,
+  PublishArtifactInput,
   SignInput,
   AttestProvenanceInput,
   VerifyInput,
@@ -64,6 +66,12 @@ export const vulnGate = step<VulnGateInput>("vuln-gate");
 // The cloud-specific waits (`wait-for-stack`/`wait-steady-state`/`wait-job`)
 // ship as builders from the aws lexicon, alongside their capabilities.
 export const waitClusterHealthy = step<WaitClusterHealthyInput>("wait-cluster-healthy");
+// ── publish (core owns the verb; each cloud lexicon contributes a registry login backend) ──
+export const publishImage = step<PublishImageInput>("publish-image");
+export const publishArtifact = step<PublishArtifactInput>("publish-artifact");
+/** Alias for {@link publishArtifact}. */
+export const publishAsset = publishArtifact;
+
 export const waitEndpoint = step<WaitEndpointInput>("wait-endpoint");
 export const healthGate = step<HealthGateInput>("health-gate");
 

package/src/components/capability-plugin-loader.ts

@@ -26,6 +26,8 @@ import { lexiconModulePath, importLexiconPackage } from "../lexicon-module";
 import type { CapabilityPlugin } from "./capability-plugin";
 import { isCapabilityPlugin } from "./capability-plugin";
 import { starterCapabilityPlugin } from "./starter-plugin";
+import { isRegistryBackendConsumer, type RegistryLoginBackend } from "./verbs/publish-image";
+import { isStorageBackendConsumer, type ArtifactStorageBackend } from "./verbs/publish-artifact";
 
 /** Thrown when a dynamically-imported capability package does not satisfy `CapabilityPlugin` — the "malformed capability package" case #559 asks doctor/validation to detect. */
 export class MalformedCapabilityPluginError extends Error {
@@ -165,9 +167,19 @@ export function registerCapabilityPlugins(
     }
   }
 
+  const backends: RegistryLoginBackend[] = [];
+  for (const plugin of plugins) backends.push(...(plugin.registryBackends?.() ?? []));
+  const storage: ArtifactStorageBackend[] = [];
+  for (const plugin of plugins) storage.push(...(plugin.storageBackends?.() ?? []));
+
   for (const plugin of plugins) {
     for (const capability of plugin.capabilities()) {
-      registry.register(capability);
+      // A capability that consumes registry login backends (`publish-image`)
+      // is re-bound to the backends of the plugins loaded for this registry.
+      let bound = capability;
+      if (isRegistryBackendConsumer(bound)) bound = bound.withRegistryBackends(backends) as typeof bound;
+      if (isStorageBackendConsumer(bound)) bound = bound.withStorageBackends(storage) as typeof bound;
+      registry.register(bound);
     }
   }
   return registry;

package/src/components/capability-plugin.ts

@@ -32,6 +32,8 @@ import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import type { Capability } from "./capability";
+import type { RegistryLoginBackend } from "./verbs/publish-image";
+import type { ArtifactStorageBackend } from "./verbs/publish-artifact";
 
 /**
  * Manifest for a packaged capability plugin — the capability-side analogue
@@ -88,6 +90,20 @@ export interface CapabilityPlugin {
   /** Capability kinds grouped by family, informational — mirrors `STARTER_VERB_FAMILIES` (./registry.ts) shape for third-party plugins that want to publish the same grouping. */
   families?(): Record<string, readonly string[]>;
 
+  /**
+   * Registry login backends this plugin contributes to core's `publish-image`
+   * verb (aws: ECR, azure: ACR, gcp: Artifact Registry). Not capabilities, so
+   * several plugins may contribute without a duplicate-kind clash.
+   */
+  registryBackends?(): RegistryLoginBackend[];
+
+  /**
+   * Object-storage backends this plugin contributes to core's
+   * `publish-artifact` verb (aws: S3, azure: Blob, gcp: GCS). Like
+   * `registryBackends`, not capabilities, so several plugins may contribute.
+   */
+  storageBackends?(): ArtifactStorageBackend[];
+
   /** Optional initialization hook, called once after load (mirrors `LexiconPlugin.init`). */
   init?(): void | Promise<void>;
 }

package/src/components/pr-env-ports.ts

@@ -0,0 +1,89 @@
+/**
+ * The ports `chant components pr-env` runs ./pr-env-run.ts with: the records
+ * on chant/lifecycle (`_pr-envs/records.jsonl`), the gate ledger there, and
+ * the note and status on the forge. They sit apart from ./pr-env-run.ts
+ * because the gate port loads ./pr-run.ts and ../op/gate.ts, which bring
+ * Ajv, js-yaml and the component driver. A product with its own ports
+ * imports `@intentius/chant/components/pr-env-run` and never loads these.
+ */
+
+import type { PrForge } from "../pr-forge";
+import type { PrEnvPorts } from "./pr-env-run";
+import {
+  PR_ENV_LEDGER_DIR,
+  PR_ENV_LEDGER_FILE,
+  parsePrEnvRecords,
+  prEnvNoteMarker,
+  prEnvStatusContext,
+  prEnvStatusDescription,
+  prEnvStatusState,
+  renderPrEnvNote,
+  type PrEnvReport,
+} from "./pr-environment";
+
+/**
+ * The note and the `chant/pr-env` status on the forge. A refusal from the
+ * forge warns and never fails the run.
+ */
+export function forgePrEnvPublisher(forge: PrForge, warn: (message: string) => void = () => {}): (report: PrEnvReport) => Promise<void> {
+  return async (report) => {
+    const { forgePrincipalOf } = await import("../pr-forge");
+    const note = renderPrEnvNote(report, forgePrincipalOf(forge.kind, forge.host, "<your-login>"));
+    if (report.head) {
+      try {
+        await forge.setStatus(report.head, { context: prEnvStatusContext(report.member), state: prEnvStatusState(report), description: prEnvStatusDescription(report), ...(forge.runUrl ? { url: forge.runUrl } : {}) });
+      } catch (err) {
+        warn(`could not set the ${prEnvStatusContext(report.member)} status: ${messageOf(err)}`);
+      }
+    }
+    try {
+      await forge.upsertNote(report.pr, prEnvNoteMarker(report.env, report.member), note);
+    } catch (err) {
+      warn(`could not post the note on #${report.pr}: ${messageOf(err)}`);
+    }
+  };
+}
+
+/**
+ * The ports over chant/lifecycle in `cwd` (default the working directory):
+ * the records at `_pr-envs/records.jsonl`, appended and pushed, and the gate
+ * ledger read without writing a pending fact. With `forge`, the note and
+ * status are posted and the sweep asks it whether a pull request is open.
+ */
+export function lifecyclePrEnvPorts(opts: { cwd?: string; forge?: PrForge; log?: (line: string) => void; warn?: (message: string) => void } = {}): PrEnvPorts {
+  const at = opts.cwd ? { cwd: opts.cwd } : undefined;
+  const warn = opts.warn ?? (() => {});
+  const forge = opts.forge;
+  return {
+    async readRecords() {
+      const { fetchLifecycle, readBlobFromPath } = await import("../lifecycle/git");
+      await fetchLifecycle(at).catch(() => false);
+      return parsePrEnvRecords(await readBlobFromPath(PR_ENV_LEDGER_DIR, PR_ENV_LEDGER_FILE, at));
+    },
+    async appendRecord(record) {
+      const { appendLedgerLine, fetchLifecycle, pushLifecycleReport } = await import("../lifecycle/git");
+      try {
+        await fetchLifecycle(at).catch(() => false);
+        await appendLedgerLine(PR_ENV_LEDGER_DIR, PR_ENV_LEDGER_FILE, JSON.stringify(record), `Pull request environment ${record.env} ${record.kind} (${record.result})`, at);
+        const pushed = await pushLifecycleReport(at);
+        if (pushed.pushWarning) warn(pushed.pushWarning);
+      } catch (err) {
+        warn(`could not record ${record.env}'s ${record.kind} on chant/lifecycle: ${messageOf(err)}`);
+      }
+    },
+    async decideGate(input) {
+      const { approvalOf, decidePrGate, readOnlyLedger } = await import("./pr-run");
+      const { gitGateLedgerPort } = await import("../op/gate");
+      const approval = approvalOf(await decidePrGate(readOnlyLedger(gitGateLedgerPort(at)), input));
+      return { status: approval.status, ...(approval.approvedBy ? { approvedBy: approval.approvedBy } : {}) };
+    },
+    ...(forge ? { publish: forgePrEnvPublisher(forge, warn) } : {}),
+    ...(forge?.pullRequestState ? { pullRequestState: (pr: number) => forge.pullRequestState!(pr) } : {}),
+    ...(opts.log ? { log: opts.log } : {}),
+    warn,
+  };
+}
+
+function messageOf(err: unknown): string {
+  return err instanceof Error ? err.message : String(err);
+}

package/src/components/pr-env-run-bundle.test.ts

@@ -0,0 +1,54 @@
+/**
+ * The pull request environment runs bundle alone (#4330 follow-up): a
+ * product that brings its own adapter and ports imports
+ * `@intentius/chant/components/pr-env-run` into one bundled file, without the
+ * gate, Ajv, js-yaml or the config loader. The ports chant uses live in
+ * ./pr-env-ports.ts. This bundles the module and reads esbuild's list of what
+ * went in.
+ */
+
+import { join } from "node:path";
+import { build } from "esbuild";
+import { describe, expect, test } from "vitest";
+import { REPO } from "../workspace/__fixtures__/contract-repo";
+
+describe("the pr-env-run bundle", () => {
+  test("holds the runs and the records, and no gate, schema checks, YAML or config loader", async () => {
+    const result = await build({
+      entryPoints: [join(REPO, "packages", "core", "src", "components", "pr-env-run.ts")],
+      bundle: true,
+      platform: "node",
+      format: "esm",
+      write: false,
+      metafile: true,
+      outdir: "out",
+      logLevel: "silent",
+    });
+    const inputs = Object.keys(result.metafile.inputs).map((i) => i.replace(/^.*?packages\//, "packages/")).sort();
+    expect(inputs).toEqual([
+      "packages/core/src/change-set.ts",
+      "packages/core/src/ci-handover.ts",
+      "packages/core/src/ci-jobs.ts",
+      "packages/core/src/components/changed-files.ts",
+      "packages/core/src/components/pr-env-run.ts",
+      "packages/core/src/components/pr-environment.ts",
+      "packages/core/src/components/pr-pipeline.ts",
+      "packages/core/src/config-environments.ts",
+      "packages/core/src/content-digest.ts",
+      "packages/core/src/declarable.ts",
+      "packages/core/src/effect-receipt.ts",
+      "packages/core/src/gated-waves.ts",
+      "packages/core/src/intrinsic.ts",
+      "packages/core/src/lifecycle/plan-digest.ts",
+      "packages/core/src/lifecycle/teardown.ts",
+      "packages/core/src/live-endpoint.ts",
+      "packages/core/src/observation.ts",
+      "packages/core/src/op/activity-runtime.ts",
+      "packages/core/src/op/emulator-lifecycle.ts",
+      "packages/core/src/plan-summary.ts",
+      "packages/core/src/pr-loop.ts",
+    ]);
+    expect(inputs.some((i) => /node_modules\/(ajv|js-yaml)\//.test(i) || i.endsWith("/op/gate.ts") || i.endsWith("/src/config.ts") || i.endsWith("/ts-loader.ts"))).toBe(false);
+    expect(result.outputFiles.reduce((n, f) => n + f.contents.byteLength, 0)).toBeLessThan(40 * 1024);
+  });
+});

package/src/components/pr-env-run.ts

@@ -16,9 +16,11 @@
  * - the report and the note ({@link renderPrEnvNote}).
  *
  * `chant components pr-env` (../cli/handlers/pr-env.ts) runs these with the
- * components adapter and the lexicons' teardown. The ports default to
- * chant/lifecycle in the working directory and the gate ledger there
- * ({@link lifecyclePrEnvPorts}).
+ * components adapter and the lexicons' teardown, and the ports over
+ * chant/lifecycle and the gate ledger in ./pr-env-ports.ts
+ * (`lifecyclePrEnvPorts`). Those ports load the gate and its schema checks,
+ * so they live apart: a product that brings its own ports bundles this
+ * module without them (pr-env-run-bundle.test.ts).
  */
 
 import { spawnSync } from "node:child_process";
@@ -29,19 +31,11 @@ import { withoutForgeTokens } from "../ci-handover";
 import type { ChantConfig } from "../config";
 import type { TeardownCandidate, TeardownHole, TeardownOutcome } from "../lexicon";
 import type { ObservationLexicon } from "../lexicon";
-import type { PrForge } from "../pr-forge";
 import {
   PR_ENV_EXIT,
   PR_ENV_GATE,
-  PR_ENV_LEDGER_DIR,
-  PR_ENV_LEDGER_FILE,
   expired,
   livePrEnvironments,
-  parsePrEnvRecords,
-  prEnvNoteMarker,
-  prEnvStatusContext,
-  prEnvStatusDescription,
-  prEnvStatusState,
   prEnvironmentName,
   renderPrEnvNote,
   teardownComplete,
@@ -425,71 +419,6 @@ export async function prEnvSweep(input: PrEnvSweepInput): Promise<{ exit: number
   return { exit, results };
 }
 
-// ── the ports chant itself uses ────────────────────────────────────────────
-
-/**
- * The note and the `chant/pr-env` status on the forge. A refusal from the
- * forge warns and never fails the run.
- */
-export function forgePrEnvPublisher(forge: PrForge, warn: (message: string) => void = () => {}): (report: PrEnvReport) => Promise<void> {
-  return async (report) => {
-    const { forgePrincipalOf } = await import("../pr-forge");
-    const note = renderPrEnvNote(report, forgePrincipalOf(forge.kind, forge.host, "<your-login>"));
-    if (report.head) {
-      try {
-        await forge.setStatus(report.head, { context: prEnvStatusContext(report.member), state: prEnvStatusState(report), description: prEnvStatusDescription(report), ...(forge.runUrl ? { url: forge.runUrl } : {}) });
-      } catch (err) {
-        warn(`could not set the ${prEnvStatusContext(report.member)} status: ${messageOf(err)}`);
-      }
-    }
-    try {
-      await forge.upsertNote(report.pr, prEnvNoteMarker(report.env, report.member), note);
-    } catch (err) {
-      warn(`could not post the note on #${report.pr}: ${messageOf(err)}`);
-    }
-  };
-}
-
-/**
- * The ports over chant/lifecycle in `cwd` (default the working directory):
- * the records at `_pr-envs/records.jsonl`, appended and pushed, and the gate
- * ledger read without writing a pending fact. With `forge`, the note and
- * status are posted and the sweep asks it whether a pull request is open.
- */
-export function lifecyclePrEnvPorts(opts: { cwd?: string; forge?: PrForge; log?: (line: string) => void; warn?: (message: string) => void } = {}): PrEnvPorts {
-  const at = opts.cwd ? { cwd: opts.cwd } : undefined;
-  const warn = opts.warn ?? (() => {});
-  const forge = opts.forge;
-  return {
-    async readRecords() {
-      const { fetchLifecycle, readBlobFromPath } = await import("../lifecycle/git");
-      await fetchLifecycle(at).catch(() => false);
-      return parsePrEnvRecords(await readBlobFromPath(PR_ENV_LEDGER_DIR, PR_ENV_LEDGER_FILE, at));
-    },
-    async appendRecord(record) {
-      const { appendLedgerLine, fetchLifecycle, pushLifecycleReport } = await import("../lifecycle/git");
-      try {
-        await fetchLifecycle(at).catch(() => false);
-        await appendLedgerLine(PR_ENV_LEDGER_DIR, PR_ENV_LEDGER_FILE, JSON.stringify(record), `Pull request environment ${record.env} ${record.kind} (${record.result})`, at);
-        const pushed = await pushLifecycleReport(at);
-        if (pushed.pushWarning) warn(pushed.pushWarning);
-      } catch (err) {
-        warn(`could not record ${record.env}'s ${record.kind} on chant/lifecycle: ${messageOf(err)}`);
-      }
-    },
-    async decideGate(input) {
-      const { approvalOf, decidePrGate, readOnlyLedger } = await import("./pr-run");
-      const { gitGateLedgerPort } = await import("../op/gate");
-      const approval = approvalOf(await decidePrGate(readOnlyLedger(gitGateLedgerPort(at)), input));
-      return { status: approval.status, ...(approval.approvedBy ? { approvedBy: approval.approvedBy } : {}) };
-    },
-    ...(forge ? { publish: forgePrEnvPublisher(forge, warn) } : {}),
-    ...(forge?.pullRequestState ? { pullRequestState: (pr: number) => forge.pullRequestState!(pr) } : {}),
-    ...(opts.log ? { log: opts.log } : {}),
-    warn,
-  };
-}
-
 // ── a teardown command ─────────────────────────────────────────────────────
 
 /** `ci.prEnvironment.teardown` (#4330): a command that tears down what no lexicon does. */

package/src/components/pr-environment.ts

@@ -39,7 +39,8 @@
  * as a lexicon does.
  */
 
-import { environmentEndpoint, environmentName, isEnvironmentPattern, isOwnershipParamRef, matchesDeclaredEnvironment, resolveOwnershipStack, type ChantConfig, type EnvironmentDeclaration } from "../config";
+import type { ChantConfig } from "../config";
+import { environmentEndpoint, environmentName, isEnvironmentPattern, isOwnershipParamRef, matchesDeclaredEnvironment, resolveOwnershipStack, type EnvironmentDeclaration } from "../config-environments";
 import type { OwnershipMarker } from "../ownership";
 import { executeTeardown, planTeardown, type TeardownPlan, type TeardownPlanEntry, type TeardownReport } from "../lifecycle/teardown";
 import type { ObservationLexicon, TeardownCandidate, TeardownEnumeration, TeardownExecution } from "../lexicon";