@intentius/chant 0.124.45 → 0.124.48

package/dist/cli/handlers/pr.js

@@ -64,8 +64,8 @@
  * through `--forge`.
  */
 import { spawnSync } from "node:child_process";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { join, relative, resolve, sep } from "node:path";
 import { loadChantConfig, resolveAutoReleaseDisabled } from "../../config.js";
 import { resolveCommit, resolveMergeBase } from "../../components/changed-files.js";
 import { deriveFanOut, fanOutRegistry } from "../../components/fan-out-support.js";
@@ -76,7 +76,7 @@ import { blockedMembers, blockedWords, settleEarlierWaves } from "../../wave-blo
 import { readFanOutAttempt, writeFanOutAttempt } from "../../components/fan-out-record.js";
 import { componentInputDigests, progressThatCarries } from "../../components/fan-out-inputs.js";
 import { samePlanDigest } from "../../lifecycle/plan-digest.js";
-import { gateIsSealed, gitGateLedgerPort } from "../../op/gate.js";
+import { evaluateGate, gateIsSealed, gitGateLedgerPort } from "../../op/gate.js";
 import { emitGateStep, gateEventsOf, GATE_PHASE } from "../../run-event-stream.js";
 import { openCliRunEvents, refusesEventsWithJson } from "../run-events.js";
 import { openPrReportUpload, parseReportUrl, reportKey } from "../../pr-report-url.js";
@@ -94,7 +94,7 @@ import { appliedDigestOf } from "../../components/auto-release.js";
 import { withComponentEndpoint } from "../component-endpoint.js";
 import { failedRunExitCode } from "../../components/driver.js";
 import { prLoopHooksAt, runPrHooks } from "../../components/pr-hooks.js";
-import { decidePrPolicyOverride, prLoopPolicyAt, prPolicyReport, runPrPolicy, spendPrPolicyOverride } from "../../components/pr-policy.js";
+import { decidePrPolicyOverride, policyReviewOf, prLoopPolicyAt, prPolicyReport, runPrPolicy, spendPrPolicyOverride } from "../../components/pr-policy.js";
 /** Where the reports land unless `--output` says. */
 export const PR_REPORT_DIR = ".chant/pr";
 const fail = (message, hint) => {
@@ -237,10 +237,13 @@ export function placeHooks(ctx, p, stage, op) {
  * when no hook failed. A hold is logged: the pull request's gate already
  * waits for a person's approval of the digest.
  */
-export function runStageHook(p, moment, components, planned, what = "nothing was applied") {
+export async function runStageHook(p, moment, components, planned, what = "nothing was applied", env) {
     if (!p.hookPlace || components.length === 0)
         return undefined;
-    const ran = runPrHooks(p.hooks, moment, p.hookPlace, components, planned ? { members: planned.members, plans: planned.plans } : undefined);
+    const ran = await runPrHooks(p.hooks, moment, p.hookPlace, components, planned ? { members: planned.members, plans: planned.plans } : undefined, {
+        ...(env ? { env } : {}),
+        settle: (hold) => settleHeldGate(p, hold),
+    });
     p.hookOutcomes.push(...ran.outcomes);
     for (const hold of ran.holds)
         console.error(formatInfo(`${hold} held, and the pull request's gate asks for an approval of the digest either way`));
@@ -249,6 +252,46 @@ export function runStageHook(p, moment, components, planned, what = "nothing was
     p.hookFailed = `The ${ran.failed}, so ${what}.`;
     return p.hookFailed;
 }
+/**
+ * Settle a hook's hold on another gate (#4323), the way an Op waves job does:
+ * an approval of that gate and digest under its `identity.gates` rule read at
+ * base, else a pending fact for it. The plan stage writes nothing, so there
+ * it only reads.
+ */
+async function settleHeldGate(p, hold) {
+    const real = gitGateLedgerPort();
+    const ledger = p.hookPlace?.stage === "plan" ? readOnlyLedger(real) : real;
+    const port = ledger.approvalRule ? { ...ledger, approvalRule: (g) => ledger.approvalRule(g, { base: p.base }) } : ledger;
+    const op = hold.request.op ?? p.hookPlace?.op ?? "";
+    const check = await evaluateGate(port, {
+        op,
+        gate: hold.request.gate,
+        planDigest: hold.request.digest,
+        description: hold.request.description ?? `${hold.label} holds the pull request on it`,
+        fields: { ...hold.request.pending, approvalMode: "ledger", heldBy: { hook: hold.name, moment: hold.moment, ...(hold.target ? { target: hold.target } : {}) } },
+    });
+    if (check.satisfied)
+        return { status: "approved", approvedBy: check.resolution.resolvedBy, approvedAt: check.resolution.timestamp };
+    for (const { resolution: r, reason } of check.refused ?? [])
+        console.error(formatInfo(`${op} / ${hold.request.gate}: the approval by ${r.resolvedBy} at ${r.timestamp} does not count: ${reason}`));
+    return { status: "waiting" };
+}
+/**
+ * Run the `after-gate` hooks once the pull request's gate decided (#4323),
+ * whatever it decided. `CHANT_GATE_STATUS` is `approved`, or `waiting` when no
+ * approval of the digest stands; `CHANT_GATE_OP`, `CHANT_GATE` and
+ * `CHANT_GATE_DIGEST` name the gate. Returns the failure message, as
+ * {@link runStageHook} does; the caller ignores it when the gate did not let
+ * the apply through, since the stage ends there anyway.
+ */
+export function runGateHook(p, at, components) {
+    return runStageHook(p, "after-gate", components, undefined, "nothing was applied", {
+        CHANT_GATE_STATUS: at.satisfied ? "approved" : "waiting",
+        CHANT_GATE_OP: at.op,
+        CHANT_GATE: p.gate,
+        CHANT_GATE_DIGEST: at.digest,
+    });
+}
 const EMPTY_SET = () => ({ doc: composeChangeSet([]), members: [], plans: {}, outputs: {}, failed: true });
 /**
  * Plan with the plan-side hooks around it (#4288): before-observe and
@@ -256,14 +299,14 @@ const EMPTY_SET = () => ({ doc: composeChangeSet([]), members: [], plans: {}, ou
  * set, so the stage reports `plan-failed` and nothing applies.
  */
 async function hookedPlan(p, components, plan) {
-    if (runStageHook(p, "before-observe", components, undefined, "nothing was planned or applied"))
+    if (await runStageHook(p, "before-observe", components, undefined, "nothing was planned or applied"))
         return EMPTY_SET();
-    if (runStageHook(p, "before-plan", components, undefined, "nothing was planned or applied"))
+    if (await runStageHook(p, "before-plan", components, undefined, "nothing was planned or applied"))
         return EMPTY_SET();
     const set = await plan();
     if (set.failed)
         return set;
-    if (runStageHook(p, "after-plan", components, set))
+    if (await runStageHook(p, "after-plan", components, set))
         return { ...set, failed: true };
     return set;
 }
@@ -487,7 +530,9 @@ function openUpload(events, stage, pr, p) {
  * read only at the plan stage, and recorded for an override at the apply.
  */
 async function judgePolicy(p, at) {
-    const verdict = runPrPolicy(p.policy, { version: 1, stage: at.stage, op: at.op, gate: p.gate, env: p.env, pr: at.pr, base: p.base, head: p.head, changeSet: at.set.doc });
+    // The review is read only when a policy will run: a workspace with no policy makes no forge call for it.
+    const review = p.policy.settings ? await policyReviewOf(p.forge, at.pr) : undefined;
+    const verdict = runPrPolicy(p.policy, { version: 1, stage: at.stage, op: at.op, gate: p.gate, env: p.env, pr: at.pr, base: p.base, head: p.head, changeSet: at.set.doc, ...(review ? { review } : {}) });
     if (!verdict)
         return { held: false };
     const report = prPolicyReport(verdict, p.policy.base);
@@ -633,31 +678,8 @@ async function prPlan(ctx, stage) {
  * `pr-post` asks instead, reading the Ops at the target branch's commit.
  */
 async function overdueOps(forge, member) {
-    if (!forge?.scheduledRuns)
-        return [];
-    try {
-        const { discoverOps } = await import("../../op/discover.js");
-        const { scheduledWatches, checkOverdueOps } = await import("../../op/schedule-overdue.js");
-        const discovered = await discoverOps({ cwd: resolve(".") });
-        const watches = scheduledWatches([...discovered.ops.values()].map((d) => d.config));
-        if (watches.length === 0)
-            return [];
-        const top = spawnSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf-8" });
-        if (top.status !== 0)
-            return [];
-        return await checkOverdueOps({
-            watches,
-            forge,
-            repoRoot: top.stdout.trim(),
-            ...(member ? { member } : {}),
-            now: new Date(),
-            log: (line) => console.error(formatWarning({ message: line })),
-        });
-    }
-    catch (err) {
-        console.error(formatWarning({ message: `could not check the scheduled Ops, so none is reported overdue: ${err instanceof Error ? err.message : String(err)}` }));
-        return [];
-    }
+    const { overdueOpsAt } = await import("../../op/schedule-overdue.js");
+    return overdueOpsAt({ forge, cwd: resolve("."), ...(member ? { member } : {}), log: (line) => console.error(formatWarning({ message: line })) });
 }
 /** chant components pr-apply --base <ref> [--pr <n>] [--env <env>] [--gate <name>] [--forge <kind>] [--require-review] [--output <dir>] [--json] [--events-json] [--report-url <url>] */
 export function runComponentsPrApply(ctx) {
@@ -804,6 +826,10 @@ async function prApply(ctx, stage, beforeMerge) {
             return stop(prReport({ ...base, approval: { status: "pending" }, status: "refused", refusal: judged.stop.refusal, message: judged.stop.message }), judged.stop.code);
         const decided = await decideApplyGate(p, { op, pr, set, events, held: judged.held, ...(green ? { green } : {}) });
         approval = decided.approval;
+        // #4323: the after-gate hooks hear the decision, a refusal too; only a failure that would have applied changes the outcome.
+        const afterGate = await runGateHook(p, { op, digest: set.doc.digest, satisfied: decided.satisfied }, p.plan.order);
+        if (afterGate && decided.satisfied)
+            return stop(prReport({ ...base, approval, status: "failed", message: afterGate }), 1);
         if (!decided.satisfied)
             return stop(prReport({ ...base, approval, status: "refused", refusal: decided.refusal, message: decided.message }), GATED_EXIT_CODE);
         via = decided.via;
@@ -859,7 +885,7 @@ async function prApply(ctx, stage, beforeMerge) {
     recordAttempt();
     // #4288: the before-apply hooks, once the gate and the review let the apply through.
     const toApply = (resumed?.plan ?? p.plan).order.filter((name) => !completedSoFar.has(name));
-    const beforeFailed = runStageHook(p, "before-apply", toApply);
+    const beforeFailed = await runStageHook(p, "before-apply", toApply);
     if (beforeFailed)
         return stop(prReport({ ...base, approval, status: "failed", message: beforeFailed }), 1);
     // #3999: a round planned after an upstream applied waits on a gate of its
@@ -919,7 +945,7 @@ async function prApply(ctx, stage, beforeMerge) {
     });
     recordAttempt();
     // #4288: the after-apply hooks, for the components that applied.
-    const afterFailed = runStageHook(p, "after-apply", toApply.filter((name) => applied.run.completed.includes(name)), undefined, "the apply counts as failed though its components applied");
+    const afterFailed = await runStageHook(p, "after-apply", toApply.filter((name) => applied.run.completed.includes(name)), undefined, "the apply counts as failed though its components applied");
     await recordAutoReleasesForRun(applied.run.results, p.env, release.runId, resolveAutoReleaseDisabled(p.config, args.noReleaseRecord), release.runOrigin, undefined, undefined, prAppliedDigests(p, applied.members));
     const report = prReport({
         ...base,
@@ -1694,6 +1720,10 @@ async function prApplyWaves(ctx, p, at) {
             return stop(report({ status: "refused", refusal: judged.stop.refusal, message: judged.stop.message }), judged.stop.code);
         const decided = await decideApplyGate(p, { op, pr, set, events, held: judged.held, ...(green ? { green } : {}) });
         approval = decided.approval;
+        // #4323: the after-gate hooks hear the decision, a refusal too.
+        const afterGate = await runGateHook(p, { op, digest: set.doc.digest, satisfied: decided.satisfied }, p.plan.order);
+        if (afterGate && decided.satisfied)
+            return stop(report({ status: "failed", message: afterGate }), 1);
         if (!decided.satisfied)
             return stop(report({ status: "refused", refusal: decided.refusal, message: decided.message }), GATED_EXIT_CODE);
         via = decided.via;
@@ -1849,7 +1879,7 @@ async function prApplyWaves(ctx, p, at) {
             }
         }
         // #4288: the wave's apply-side hooks, around its apply.
-        const waveBefore = runStageHook(p, "before-apply", wavePlan.order, undefined, `nothing in wave ${k} was applied`);
+        const waveBefore = await runStageHook(p, "before-apply", wavePlan.order, undefined, `nothing in wave ${k} was applied`);
         if (waveBefore) {
             setWave({ ...entry, status: "failed" });
             return stop(report({ status: "failed", message: waveBefore }), 1);
@@ -1890,7 +1920,7 @@ async function prApplyWaves(ctx, p, at) {
             if (outputs)
                 outputsSoFar[name] = outputs;
         }
-        const waveAfter = runStageHook(p, "after-apply", wavePlan.order.filter((name) => applied.run.completed.includes(name)), undefined, `wave ${k} counts as failed though its components applied`);
+        const waveAfter = await runStageHook(p, "after-apply", wavePlan.order.filter((name) => applied.run.completed.includes(name)), undefined, `wave ${k} counts as failed though its components applied`);
         setWave({ ...entry, status: applied.status === "applied" && !waveAfter ? "applied" : "failed" });
         await recordAutoReleasesForRun(applied.run.results, p.env, at.release.runId, resolveAutoReleaseDisabled(p.config, args.noReleaseRecord), at.release.runOrigin, undefined, undefined, prAppliedDigests(p, applied.members));
         if (applied.status !== "applied") {
@@ -1928,6 +1958,7 @@ function writeWaveChangeSet(ctx, wave, doc, upload) {
 }
 /**
  * chant components pr-post --pr <n> --head <sha> --env <env> --forge <kind> [--member <name>] [--output <dir>] [--result <result>] (#4295)
+ * chant components pr-post --open --env <env> --forge gitlab [--branch <branch>] [--member <name>] [--output <dir>] (#4328)
  *
  * Post the plan note and the `chant/plan` status from the report a plan job
  * wrote with `pr-plan --no-status`, in a job that runs none of the change's
@@ -1938,6 +1969,8 @@ function writeWaveChangeSet(ctx, wave, doc, upload) {
  */
 export async function runComponentsPrPost(ctx) {
     const { args } = ctx;
+    if (args.open)
+        return runComponentsPrPostOpen(ctx);
     if (args.pr === undefined)
         return fail("pr-post needs the pull or merge request: --pr <n>");
     if (!args.head || !/^[0-9a-f]{40}$/.test(args.head))
@@ -1975,3 +2008,74 @@ export async function runComponentsPrPost(ctx) {
     console.error(formatInfo(`pr-post: ${prStatusContext("plan", member)} ${posted.state}: ${posted.description}${posted.noted ? "; note posted" : ""}`));
     return 0;
 }
+/**
+ * `pr-post --open` (#4328): in a pipeline of the target branch on GitLab,
+ * post the plan note and status of every open merge request into it whose
+ * plan job settled, reading each report from the plan job's artifacts
+ * (`postOpenPlanReports`, ../../pr-post.ts). The branch is `--branch`, else
+ * the pipeline's own (`CI_COMMIT_BRANCH`). The plan job is `plan`, or
+ * `<member>-plan` with `--member`, as the gitlab lexicon names it, and the
+ * artifact path is `--output` from the repository root. It exits 0 once it
+ * has posted, as `pr-post` does.
+ */
+async function runComponentsPrPostOpen(ctx) {
+    const { args } = ctx;
+    if (args.pr !== undefined || args.head)
+        return fail("pr-post --open finds each merge request and its head itself, so it takes no --pr or --head");
+    if (!args.env)
+        return fail("pr-post needs the environment the plan was for: --env <env>");
+    if (args.forge !== "gitlab")
+        return fail("pr-post --open is for a GitLab pipeline of the target branch: --forge gitlab");
+    if (args.members && args.members.length > 1)
+        return fail(`pr-post takes one --member, not ${args.members.join(", ")}`);
+    const branch = args.branch ?? process.env.CI_COMMIT_BRANCH;
+    if (!branch)
+        return fail("pr-post --open posts for the merge requests into a branch: run it in a branch pipeline, or pass --branch <branch>");
+    let forge;
+    try {
+        forge = forgeFromEnv("gitlab");
+    }
+    catch (err) {
+        return fail(err instanceof Error ? err.message : String(err));
+    }
+    const top = spawnSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf-8" });
+    if (top.status !== 0)
+        return fail("pr-post --open reads the plan report's path from the repository root, and this directory is not in a git repository");
+    const member = args.members?.[0];
+    const artifactDir = relative(realpathSync(top.stdout.trim()), resolve(args.output ?? PR_REPORT_DIR)).split(sep).join("/");
+    const { postOpenPlanReports } = await import("../../pr-post.js");
+    const { gitlabPlanJobName } = await import("../../components/pr-pipeline.js");
+    let done;
+    try {
+        done = await postOpenPlanReports({
+            forge,
+            branch,
+            job: gitlabPlanJobName(member),
+            artifactDir,
+            env: args.env,
+            ...(member ? { member } : {}),
+            // #4289: the Ops at the commit this pipeline checked out, the target branch's.
+            overdue: () => overdueOps(forge, member),
+        });
+    }
+    catch (err) {
+        return fail(err instanceof Error ? err.message : String(err));
+    }
+    for (const message of done.warnings)
+        console.error(formatWarning({ message }));
+    for (const p of done.posts) {
+        if (p.skipped) {
+            console.error(formatInfo(`pr-post: !${p.pr}: ${p.skipped}`));
+            continue;
+        }
+        const posted = p.posted;
+        for (const message of posted.warnings)
+            console.error(formatWarning({ message: `!${p.pr}: ${message}` }));
+        if (posted.refused)
+            console.error(formatWarning({ message: `!${p.pr}: the plan report was not used: ${posted.refused}` }));
+        console.error(formatInfo(`pr-post: !${p.pr} ${prStatusContext("plan", member)} ${posted.state}: ${posted.description}${posted.noted ? "; note posted" : ""}`));
+    }
+    if (done.posts.length === 0)
+        console.error(formatInfo(`pr-post: no open merge request into ${branch} has a ${gitlabPlanJobName(member)} job`));
+    return 0;
+}

package/dist/cli/handlers/query.d.ts

@@ -1,6 +1,11 @@
 import type { CommandContext } from "../registry.js";
 import type { QueryLedger } from "../../lifecycle/query.js";
-/** The ledgers `chant query` reads from `cwd`: every member's in a workspace, else the project's own. */
-export declare function queryLedgers(cwd: string, members?: readonly string[]): Promise<QueryLedger[]>;
+/**
+ * The ledgers `chant query` and `chant ledger` read from `cwd`: every
+ * member's in a workspace, else the project's own. With `at`, a commit of
+ * `chant/lifecycle` (`chant ledger --at`, #4363), each is read as that commit
+ * held it rather than at the branch tip.
+ */
+export declare function queryLedgers(cwd: string, members?: readonly string[], at?: string): Promise<QueryLedger[]>;
 export declare function runQueryCommand(ctx: CommandContext): Promise<number>;
 //# sourceMappingURL=query.d.ts.map

package/dist/cli/handlers/query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/query.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKzD,yGAAyG;AACzG,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAuBnG;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B1E"}
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/query.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKzD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA8BhH;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B1E"}

package/dist/cli/handlers/query.js

@@ -14,12 +14,24 @@ import { resolve } from "node:path";
 import { formatError, formatWarning } from "../format.js";
 import { findWorkspaceRoot } from "../../project-root.js";
 const USAGE = 'chant query "<sql>" [dir] [--member <name>] [--json]';
-/** The ledgers `chant query` reads from `cwd`: every member's in a workspace, else the project's own. */
-export async function queryLedgers(cwd, members) {
+/**
+ * The ledgers `chant query` and `chant ledger` read from `cwd`: every
+ * member's in a workspace, else the project's own. With `at`, a commit of
+ * `chant/lifecycle` (`chant ledger --at`, #4363), each is read as that commit
+ * held it rather than at the branch tip.
+ */
+export async function queryLedgers(cwd, members, at) {
     const { gitLedgerReadPort } = await import("../../lifecycle/git.js");
     const found = findWorkspaceRoot(cwd);
+    const atPort = at === undefined ? undefined : await (async () => {
+        const { resolveLedgerRevision, revisionLedgerReadPort } = await import("../../lifecycle/ledger-read.js");
+        const { memberLedgerPrefix } = await import("../../lifecycle/member-ledger.js");
+        const repo = found?.dir ?? cwd;
+        const commit = resolveLedgerRevision(repo, at);
+        return (member) => revisionLedgerReadPort(repo, commit, member === null ? "" : memberLedgerPrefix([member]));
+    })();
     if (!found)
-        return [{ member: null, port: gitLedgerReadPort({ cwd }) }];
+        return [{ member: null, port: atPort ? atPort(null) : gitLedgerReadPort({ cwd }) }];
     // Workspace code loads only when there is a workspace, so a level-0 project never pays for it.
     const { readDeclaration, WorkspaceReadError } = await import("../../workspace/declaration.js");
     const { workingTree } = await import("../../workspace/tree.js");
@@ -41,7 +53,7 @@ export async function queryLedgers(cwd, members) {
     }
     return declaration.members
         .filter((m) => !wanted || wanted.has(m.name))
-        .map((m) => ({ member: m.name, port: gitLedgerReadPort({ cwd: found.dir, member: m.dir === "." ? "." : m.name }) }));
+        .map((m) => ({ member: m.name, port: atPort ? atPort(m.dir === "." ? null : m.name) : gitLedgerReadPort({ cwd: found.dir, member: m.dir === "." ? "." : m.name }) }));
 }
 export async function runQueryCommand(ctx) {
     const { args } = ctx;

package/dist/cli/handlers/release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAyBlD,0HAA0H;AAC1H,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uFAAuF;IACvF,YAAY,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,EAAE,CASX;AAED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAG3D;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAqPxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4G5E;AAQD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsC/E;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BzE;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyC3E;AAED,gHAAgH;AAChH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB5E;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5E;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsD5E"}
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAyBlD,0HAA0H;AAC1H,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uFAAuF;IACvF,YAAY,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,EAAE,CASX;AAED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAG3D;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwPxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4G5E;AAQD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsC/E;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BzE;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyC3E;AAED,gHAAgH;AAChH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB5E;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5E;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsD5E"}

package/dist/cli/handlers/release.js

@@ -155,9 +155,12 @@ export async function runReleaseCut(ctx) {
             const { scopeSource } = await import("../../workspace/write-scope.js");
             const { releaseRuleFrom } = await import("../../workspace/identity.js");
             const source = scopeSource(cwd);
-            trunk = ws.resolveTrunk(top, source.declaration?.ci?.green?.branch ?? null);
+            const greenDecl = source.declaration?.ci?.green ?? null;
+            const primary = ws.resolveTrunk(top, greenDecl?.branch ?? null);
+            trunk = primary;
             try {
-                ws.checkOnTrunk(top, commit, trunk);
+                // #4325: a commit of a branch ci.green also judges (one ci.branches routes members to) is cut like trunk's.
+                trunk = ws.checkOnGreenBranches(top, commit, primary, (greenDecl?.branches ?? []).slice(1));
             }
             catch (err) {
                 // #4168 4.3: a commit of a pushed compose branch is cut too, and the cut records what it carries.
@@ -553,7 +556,7 @@ export async function runReleaseVerify(ctx) {
  */
 export async function runReleaseCandidates(ctx) {
     const { releaseCandidatesDocument } = await import("../../workspace/release-candidates.js");
-    const doc = await releaseCandidatesDocument({ cwd: resolve("."), ...(ctx.args.env ? { env: ctx.args.env } : {}) });
+    const doc = await releaseCandidatesDocument({ cwd: resolve("."), ...(ctx.args.env ? { env: ctx.args.env } : {}), ...(ctx.args.branch ? { branch: ctx.args.branch } : {}) });
     if (ctx.args.json) {
         console.log(JSON.stringify(doc, null, 2));
         return "error" in doc ? 1 : 0;

package/dist/cli/handlers/search-count.d.ts

@@ -0,0 +1,89 @@
+import type { GraphIR, IRNode } from "../../graph-ir.js";
+import { terraformType } from "../../graph-effective.js";
+export { terraformType };
+/**
+ * `chant search --count-by <kind|module|attr:<name>>` (#4360): grouped counts
+ * over the matched set, one line per group, instead of one row per match.
+ *
+ * An agent asking "how many resources of each type does each module own" used
+ * to run one search per value, or read every row and count them itself. The
+ * second is the token cost `search` exists to avoid.
+ *
+ * Every matched node lands in exactly one group. A node with no value for the
+ * grouped dimension is counted under `(none)`, never dropped, so the groups
+ * always add up to the total line.
+ */
+export type CountBy = {
+    by: "kind";
+} | {
+    by: "module";
+} | {
+    by: "attr";
+    name: string;
+};
+/** The group a node with no value for the grouped dimension is counted under. */
+export declare const NONE_GROUP = "(none)";
+/** The module group of a Terraform block declared in the root module itself. */
+export declare const ROOT_MODULE_GROUP = "(root)";
+/** Parse a `--count-by` value, or say what the accepted spellings are. */
+export declare function parseCountBy(raw: string): CountBy | {
+    error: string;
+    hint: string;
+};
+/**
+ * The group one node belongs to.
+ *
+ * `module` on a Terraform node is its call chain. When the graph holds more
+ * than one Terraform root, the chain is prefixed with the root (`app/(root)`,
+ * `net/module.vpc`): `module.vpc` in two roots is two modules, applied
+ * separately, and counting them as one would add up resources that never sit
+ * in the same state. A node of another lexicon groups under the composite that
+ * expanded it, chant's own unit of reuse, or `(none)`.
+ */
+export declare function groupOf(n: IRNode, countBy: CountBy, multiRoot?: boolean): string;
+/** Whether the graph holds blocks from more than one Terraform root. */
+export declare function hasManyTerraformRoots(ir: GraphIR): boolean;
+/** Count `matches` per group, sorted by count (highest first) and then by name. */
+export declare function countGroups(matches: IRNode[], countBy: CountBy, multiRoot?: boolean): Array<{
+    group: string;
+    count: number;
+}>;
+/**
+ * The groups with the ids of the matches in each, in match order (#4382), in
+ * the order {@link countGroups} gives. `count` is always `ids.length`. A
+ * reader that draws the groups (behold#922) lights each group's nodes from
+ * `ids`, so it never has to read a node's group itself.
+ */
+export declare function groupMembers(matches: IRNode[], countBy: CountBy, multiRoot?: boolean): Array<{
+    group: string;
+    count: number;
+    ids: string[];
+}>;
+/** `--count-by` with `--json`: the groups, in printed order, each with its matched ids, and the total they add up to. */
+export interface CountsJson {
+    query: string;
+    source: unknown;
+    countBy: string;
+    groups: Array<{
+        group: string;
+        count: number;
+        ids: string[];
+    }>;
+    total: number;
+    liveFailures?: string[];
+}
+export declare function countsJson(query: string, source: unknown, groups: Array<{
+    group: string;
+    count: number;
+    ids: string[];
+}>, countBy: CountBy, liveFailures?: string[]): CountsJson;
+/**
+ * Render grouped counts: one `<count>  <group>` line per group, counts right
+ * aligned, then the total. The total is the number of matches, which is the
+ * sum of the group counts by construction.
+ */
+export declare function formatCounts(groups: Array<{
+    group: string;
+    count: number;
+}>, countBy: CountBy): string[];
+//# sourceMappingURL=search-count.d.ts.map

package/dist/cli/handlers/search-count.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-count.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/search-count.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAItD,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,OAAO,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF,iFAAiF;AACjF,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAUnF;AAiCD;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,UAAQ,GAAG,MAAM,CAQ9E;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAI1D;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,UAAQ,GAAG,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAE3H;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,UAAQ,GAAG,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAW3I;AAED,yHAAyH;AACzH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAgB,UAAU,CACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,EAC9D,OAAO,EAAE,OAAO,EAChB,YAAY,GAAE,MAAM,EAAO,GAC1B,UAAU,CASZ;AAOD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAMxG"}

package/dist/cli/handlers/search-count.js

@@ -0,0 +1,132 @@
+import { terraformType } from "../../graph-effective.js";
+// The one reading of a terraform node's type lives with the folds that also
+// select on it, so `--count-by kind` and `kind:` cannot disagree (#4366).
+export { terraformType };
+/** The group a node with no value for the grouped dimension is counted under. */
+export const NONE_GROUP = "(none)";
+/** The module group of a Terraform block declared in the root module itself. */
+export const ROOT_MODULE_GROUP = "(root)";
+/** Parse a `--count-by` value, or say what the accepted spellings are. */
+export function parseCountBy(raw) {
+    const value = raw.trim();
+    if (value === "kind")
+        return { by: "kind" };
+    if (value === "module")
+        return { by: "module" };
+    const attr = /^attr:(.+)$/.exec(value);
+    if (attr && attr[1].trim())
+        return { by: "attr", name: attr[1].trim() };
+    return {
+        error: `--count-by "${raw}" is not a grouping`,
+        hint: "group by one of: --count-by kind, --count-by module, --count-by attr:<name>",
+    };
+}
+/** A Terraform node's root name, from its attrs or the first segment of its id. */
+function terraformRoot(n) {
+    const attrs = (n.attrs ?? {});
+    if (typeof attrs.root === "string")
+        return attrs.root;
+    const slash = n.id.indexOf("/");
+    return slash === -1 ? "" : n.id.slice(0, slash);
+}
+/**
+ * The module a Terraform node sits in: its call chain as Terraform writes it
+ * (`module.cdn`, `module.cdn.module.bucket`), or `(root)` for a block of the
+ * root module itself. The chain is on `attrs.callers`; an entity key
+ * `<root>/module.cdn/<address>` carries the same chain when it is absent.
+ */
+function terraformModule(n) {
+    const attrs = (n.attrs ?? {});
+    const callers = Array.isArray(attrs.callers)
+        ? attrs.callers.filter((c) => typeof c === "string")
+        : n.id.split("/").slice(1, -1);
+    return callers.length === 0 ? ROOT_MODULE_GROUP : callers.join(".");
+}
+/** An attribute's value as a group name, matched by exact name and then case-insensitively, as `--show` does. */
+function attrGroup(n, name) {
+    const attrs = (n.attrs ?? {});
+    const key = name in attrs ? name : Object.keys(attrs).find((k) => k.toLowerCase() === name.toLowerCase());
+    const v = key === undefined ? undefined : attrs[key];
+    if (v === undefined || v === null || v === "")
+        return NONE_GROUP;
+    return typeof v === "object" ? JSON.stringify(v) : String(v);
+}
+/**
+ * The group one node belongs to.
+ *
+ * `module` on a Terraform node is its call chain. When the graph holds more
+ * than one Terraform root, the chain is prefixed with the root (`app/(root)`,
+ * `net/module.vpc`): `module.vpc` in two roots is two modules, applied
+ * separately, and counting them as one would add up resources that never sit
+ * in the same state. A node of another lexicon groups under the composite that
+ * expanded it, chant's own unit of reuse, or `(none)`.
+ */
+export function groupOf(n, countBy, multiRoot = false) {
+    if (countBy.by === "kind")
+        return terraformType(n) ?? (n.kind || NONE_GROUP);
+    if (countBy.by === "attr")
+        return attrGroup(n, countBy.name);
+    if (n.lexicon === "terraform") {
+        const module = terraformModule(n);
+        return multiRoot ? `${terraformRoot(n) || NONE_GROUP}/${module}` : module;
+    }
+    return n.compositeParent || NONE_GROUP;
+}
+/** Whether the graph holds blocks from more than one Terraform root. */
+export function hasManyTerraformRoots(ir) {
+    const roots = new Set();
+    for (const n of ir.nodes)
+        if (n.lexicon === "terraform")
+            roots.add(terraformRoot(n));
+    return roots.size > 1;
+}
+/** Count `matches` per group, sorted by count (highest first) and then by name. */
+export function countGroups(matches, countBy, multiRoot = false) {
+    return groupMembers(matches, countBy, multiRoot).map(({ group, count }) => ({ group, count }));
+}
+/**
+ * The groups with the ids of the matches in each, in match order (#4382), in
+ * the order {@link countGroups} gives. `count` is always `ids.length`. A
+ * reader that draws the groups (behold#922) lights each group's nodes from
+ * `ids`, so it never has to read a node's group itself.
+ */
+export function groupMembers(matches, countBy, multiRoot = false) {
+    const ids = new Map();
+    for (const n of matches) {
+        const g = groupOf(n, countBy, multiRoot);
+        const list = ids.get(g);
+        if (list)
+            list.push(n.id);
+        else
+            ids.set(g, [n.id]);
+    }
+    return [...ids]
+        .map(([group, members]) => ({ group, count: members.length, ids: members }))
+        .sort((a, b) => b.count - a.count || (a.group < b.group ? -1 : a.group > b.group ? 1 : 0));
+}
+export function countsJson(query, source, groups, countBy, liveFailures = []) {
+    return {
+        query,
+        source,
+        countBy: countByLabel(countBy),
+        groups,
+        total: groups.reduce((sum, g) => sum + g.count, 0),
+        ...(liveFailures.length > 0 ? { liveFailures } : {}),
+    };
+}
+/** The label a `--count-by` value is printed with on the total line. */
+function countByLabel(countBy) {
+    return countBy.by === "attr" ? `attr:${countBy.name}` : countBy.by;
+}
+/**
+ * Render grouped counts: one `<count>  <group>` line per group, counts right
+ * aligned, then the total. The total is the number of matches, which is the
+ * sum of the group counts by construction.
+ */
+export function formatCounts(groups, countBy) {
+    const total = groups.reduce((sum, g) => sum + g.count, 0);
+    const width = String(groups[0]?.count ?? 0).length;
+    const lines = groups.map((g) => `${String(g.count).padStart(width)}  ${g.group}`);
+    lines.push(`— ${total} total · ${groups.length} group${groups.length === 1 ? "" : "s"} by ${countByLabel(countBy)}`);
+    return lines;
+}