@intentius/chant 0.124.52 → 0.124.54

package/dist/workspace/graph-cli.js

@@ -28,6 +28,7 @@ import { existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync } from "node:fs
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { formatError } from "../cli/format.js";
+import { INSTANCE_ROLLUP_CODES } from "../instance-nodes.js";
 import { graphBox, plantability } from "./box-factory.js";
 import { composedId, composeWorkspaceGraph, readMemberIr } from "./compose-graph.js";
 import { isViewDocument, prefixView } from "../capabilities/view.js";
@@ -52,6 +53,8 @@ export const GRAPH_OUTPUT_SCHEMA_ID = "https://intentius.io/chant/schemas/worksp
  * included, and `live-at-revision` for `--live` with `--at` (#2875).
  */
 export const GRAPH_ERROR_CODES = [...WORKSPACE_ERROR_CODES, "live-at-revision"];
+/** Why a block node of an expanded terraform block stays one node: `nodes[].instanceRollup.code` (#4489). */
+export const GRAPH_INSTANCE_ROLLUP_CODES = INSTANCE_ROLLUP_CODES;
 /** Why `--live` and `--at` don't go together (#2875). */
 const LIVE_AT_REVISION = "--live reads the account as it stands now, and --at reads the source at a revision; chant workspace graph takes one of them";
 const USAGE = "chant workspace graph [dir] [--at <rev>] [--member <name>] [--kind <kind file>] [-o <file>] [--env <env>] [--live [--overlay] [--traffic <level>]] [--no-cache] [--dry-run] | chant workspace graph --composites [--at <rev>] [--member <name>] [-o <file>] | chant workspace graph --intent <path[:start-end]|path#symbol|member/node|sha> [--at <rev>] [--kind <kind file>...] [--follow-squash] [--json]";

package/dist/workspace/graph.schema.json

@@ -394,6 +394,13 @@
           ],
           "description": "What the per-member cache keys this read on (#2876): sha256 over the member's files and install state, or over the commit id with --at. Present on composed members; null for a live read or when no stamp could be taken. Two reads of a member with equal stamps read the same source."
         },
+        "rootReads": {
+          "type": "object",
+          "description": "Added in contract 1 by #4452. With --live: which read answered each of the member's roots, the member IR's rootReads as its chant wrote it, keyed by the lexicon's root key (terraform uses terraform.roots.<root>), unprefixed. The read that answered is fellBackTo when set, else depth. Absent when the member's IR had none, including a member read by a chant before #4452.",
+          "additionalProperties": {
+            "$ref": "#/$defs/rootRead"
+          }
+        },
         "meta": {
           "type": "object",
           "description": "The member IR's whole-read facts."
@@ -548,6 +555,45 @@
         "runtimeOwner": {
           "type": "string"
         },
+        "instanceOf": {
+          "type": "string",
+          "description": "Added in contract 1 by #4454. On an instance node of a count or for_each block: the block node's id, prefixed like the ids. The instance node's id is that id followed by instanceKey (<member>/<block>[0]); the block node stays and is the rollup."
+        },
+        "instanceKey": {
+          "type": "string",
+          "description": "Added in contract 1 by #4454. With instanceOf: the block's own instance key as the engine prints it, [0] or [\"a\"]. Absent on an instance only an expanded module call makes (#4486)."
+        },
+        "instanceScope": {
+          "type": "string",
+          "description": "Added in contract 1 by #4486. With instanceOf, under an expanded module call: the module path as the engine prints it, module.app[0]. The id then carries the key on the call's segment, <member>/<root>/module.app[0]/aws_eip.pool[1]."
+        },
+        "instanceRollup": {
+          "type": "object",
+          "description": "Added in contract 1 by #4489, written by chant 0.124.54 and newer. On a block node whose count or for_each the declared graph cannot count: why it stays one node, with no instance nodes under it. Absent on a block that is not expanded and on one whose instances are listed. The read contract lists every form that is rolled up and its code.",
+          "required": ["code", "argument", "expression"],
+          "properties": {
+            "code": {
+              "type": "string",
+              "enum": ["instances-each-value", "instances-merge", "instances-value-unknown", "instances-form-unread", "instances-over-limit", "instances-module-uncounted"]
+            },
+            "argument": {
+              "type": "string",
+              "enum": ["count", "for_each"]
+            },
+            "expression": {
+              "type": "string",
+              "description": "The count or for_each expression as written, without the ${ } around it. With call, the module call's."
+            },
+            "call": {
+              "type": "string",
+              "description": "With instances-module-uncounted: the module call that could not be counted, module.app or module.app.module.db."
+            }
+          }
+        },
+        "facts": {
+          "type": "object",
+          "description": "Added in contract 1 by #4529, written by chant 0.124.54 and newer. What an ownership engine observed about the node: ownership, markers, ownedBy, cloudIds, recordVersions and observedAt, each optional, in the shape of EngineFacts (packages/core/src/graph-schema/graph.schema.json). Set on a Pulumi member on plunge from its checked-in engine-graph.json. Never read for a decision."
+        },
         "nested": {
           "type": "string",
           "description": "For a node read through a nested workspace (#2551): the nested workspace's member it belongs to. `member` is then the outer member, and the id is `<member>/<nested>/<id>`."
@@ -605,6 +651,10 @@
           "type": "boolean",
           "description": "Added in contract 1 by #3922. True when the edge leaves the pipeline `from` belongs to (#3910): a reusable-workflow call, a `workflow_run` trigger, a GitLab child or multi-project trigger, an include. Absent on every in-pipeline edge."
         },
+        "grain": {
+          "enum": ["block", "instance", "property"],
+          "description": "Added in contract 1 by #4529, written by chant 0.124.54 and newer. What the edge joins: two blocks, two instances, or a property of one instance to another. A Pulumi member's dependencies and parent edges are instance; a plunge member's property edges are property. Absent when the source does not say."
+        },
         "member": {
           "type": "string"
         }
@@ -1620,6 +1670,28 @@
           }
         }
       }
+    },
+    "rootRead": {
+      "type": "object",
+      "description": "Which read answered one root (#4452), as packages/core/src/observation.ts RootRead. depth is the read asked for (plan for a plan-depth root, live+plan for a live root at the plan depth). fellBackTo is set only when that read failed: the read that answered instead (live is live-plan alone, for a live root), or declared when none did. reason is a short machine-stable cause such as no-credentials, needs-init, backend-unreachable or plan-failed, not prose to match on.",
+      "required": [
+        "depth"
+      ],
+      "properties": {
+        "depth": {
+          "type": "string"
+        },
+        "fellBackTo": {
+          "enum": [
+            "state",
+            "live",
+            "declared"
+          ]
+        },
+        "reason": {
+          "type": "string"
+        }
+      }
     }
   }
 }

package/dist/workspace/init.d.ts

@@ -8,7 +8,11 @@
  *
  * - each outermost chant project (a chant.config.ts or .json) becomes a
  *   `chant` member, and the root's own config makes a root member `"."`;
- * - each nested declaration becomes a `workspace` member;
+ * - each nested declaration becomes a `workspace` member; one under an
+ *   examples-style directory does too, with a `because` saying where it sits
+ *   (#4499), and the example group's glob leaves its directory out, unless
+ *   it sits inside another package or project, where it stays an example
+ *   since only the root member contains other members;
  * - each other npm package, from the npm workspaces or any other
  *   package.json, becomes an `other` member with a `because`;
  * - projects under an `examples`, `test` or `fixtures`-style directory become

package/dist/workspace/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/workspace/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAetD,OAAO,EAAmC,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAI7E,mHAAmH;AACnH,eAAO,MAAM,QAAQ,YAAI,UAAU,EAAE,KAAK,EAAE,OAAO,CAAU,CAAC;AAC9D,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,uDAAuD;AACvD,eAAO,MAAM,YAAY,iCAAiC,CAAC;AAE3D,yFAAyF;AACzF,eAAO,MAAM,aAAa,uCAAuC,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGjG;AAoBD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,uGAAuG;IACvG,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;CAC5C;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,OAAO,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;IAClH,kFAAkF;IAClF,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC3D,qEAAqE;IACrE,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAiDD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQhD;AAuDD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAkBvI;AASD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,aAAa,EAAE,CAuB1H;AA+GD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,QAAQ,CA+GxF;AA4ED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6E3E"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/workspace/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAetD,OAAO,EAAmC,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAI7E,mHAAmH;AACnH,eAAO,MAAM,QAAQ,YAAI,UAAU,EAAE,KAAK,EAAE,OAAO,CAAU,CAAC;AAC9D,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,uDAAuD;AACvD,eAAO,MAAM,YAAY,iCAAiC,CAAC;AAE3D,yFAAyF;AACzF,eAAO,MAAM,aAAa,uCAAuC,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGjG;AAoBD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,uGAAuG;IACvG,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;CAC5C;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,OAAO,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;IAClH,kFAAkF;IAClF,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC3D,qEAAqE;IACrE,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAiDD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQhD;AAuDD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAkBvI;AASD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,aAAa,EAAE,CAuB1H;AAqID,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,QAAQ,CA+HxF;AA4ED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6E3E"}

package/dist/workspace/init.js

@@ -8,7 +8,11 @@
  *
  * - each outermost chant project (a chant.config.ts or .json) becomes a
  *   `chant` member, and the root's own config makes a root member `"."`;
- * - each nested declaration becomes a `workspace` member;
+ * - each nested declaration becomes a `workspace` member; one under an
+ *   examples-style directory does too, with a `because` saying where it sits
+ *   (#4499), and the example group's glob leaves its directory out, unless
+ *   it sits inside another package or project, where it stays an example
+ *   since only the root member contains other members;
  * - each other npm package, from the npm workspaces or any other
  *   package.json, becomes an `other` member with a `because`;
  * - projects under an `examples`, `test` or `fixtures`-style directory become
@@ -291,7 +295,27 @@ function exampleGlobs(tree, matches, memberDirs) {
         else
             explicit.push(...ms);
     }
-    const safe = (glob) => expandGlob(tree, glob).every((d) => !memberDirs.some((m) => m !== "" && isInside(m, d)) && (matches.includes(d) || !holdsChantProject(tree, d)));
+    const blocked = (d) => memberDirs.some((m) => m !== "" && isInside(m, d)) || (!matches.includes(d) && holdsChantProject(tree, d));
+    const safe = (glob) => expandGlob(tree, glob).every((d) => !blocked(d));
+    /**
+     * `<prefix>/*` when it is safe, else `<prefix>/!(a|b)` leaving out the
+     * directories that block it (a workspace member under an examples
+     * directory, #4499), when that is safe and still covers every match the
+     * prefix's parents hold. Undefined when neither works.
+     */
+    const lastSegment = (prefix, parents) => {
+        const all = `${prefix}/*`;
+        if (safe(all))
+            return all;
+        const names = [...new Set(expandGlob(tree, all).filter(blocked).map((d) => d.slice(d.lastIndexOf("/") + 1)))].sort();
+        if (names.length === 0 || names.some((n) => /[*?[\]{}()!+@|]/.test(n)))
+            return undefined;
+        const glob = `${prefix}/!(${names.join("|")})`;
+        if (!safe(glob))
+            return undefined;
+        const reached = new Set(expandGlob(tree, glob));
+        return matches.every((m) => !parents.includes(dirOf(m)) || reached.has(m)) ? glob : undefined;
+    };
     const globs = [];
     const left = new Set(wide);
     // Try every one-segment wildcard, largest merge first.
@@ -305,14 +329,22 @@ function exampleGlobs(tree, matches, memberDirs) {
     }
     for (const [pattern, parents] of [...candidates].sort((a, b) => b[1].length - a[1].length)) {
         const open = parents.filter((p) => left.has(p));
-        if (open.length < 2 || !safe(`${pattern}/*`))
+        if (open.length < 2)
+            continue;
+        const glob = lastSegment(pattern, open);
+        if (glob === undefined)
             continue;
-        globs.push(`${pattern}/*`);
+        globs.push(glob);
         for (const p of open)
             left.delete(p);
     }
-    for (const p of left)
-        globs.push(`${p}/*`);
+    for (const p of left) {
+        const glob = lastSegment(p, [p]);
+        if (glob !== undefined)
+            globs.push(glob);
+        else
+            explicit.push(...(byParent.get(p) ?? []));
+    }
     // Explicit matches a glob already covers need no entry of their own.
     const covered = new Set(globs.flatMap((g) => expandGlob(tree, g)));
     for (const m of explicit)
@@ -372,7 +404,13 @@ export function proposeWorkspace(root, options = {}) {
     const configDirs = new Set([...dirsWith((n) => CONFIG_FILES.has(n))].filter((d) => !SCAFFOLDING.test(d)));
     const declDirs = dirsWith((n) => DECLARATION_FILES.includes(n));
     const pkgDirs = dirsWith((n) => n === "package.json");
-    const nested = outermost([...declDirs].filter((d) => d !== ""));
+    // A declaration under an examples-style directory is a `workspace` member
+    // too (#4499, ruled), with a note saying where it sits. Plain projects
+    // there stay examples. Only the root member contains other members, so one
+    // that sits inside another package or project (a lexicon shipping a whole
+    // workspace as an example, chant#4468) stays an example of its group.
+    const insideAnother = (d) => [...pkgDirs, ...configDirs, ...declDirs].some((o) => o !== "" && o !== d && isInside(d, o));
+    const nested = outermost([...declDirs].filter((d) => d !== "" && !(exampleMatch(d) && insideAnother(d))));
     const notNested = (d) => !nested.some((n) => isInside(d, n));
     const projects = outermost([...configDirs].filter((d) => d !== "" && notNested(d)));
     const matches = new Set();
@@ -434,8 +472,16 @@ export function proposeWorkspace(root, options = {}) {
     const entries = [];
     if (configDirs.has(""))
         entries.push({ sort: "", name: uniqueName(memberName(tree, "", name), taken), dir: ".", kind: "chant" });
-    for (const d of nested)
-        entries.push({ sort: d, name: uniqueName(memberName(tree, d, name), taken), dir: d, kind: "workspace" });
+    for (const d of nested) {
+        const ex = exampleMatch(d);
+        entries.push({
+            sort: d,
+            name: uniqueName(memberName(tree, d, name), taken),
+            dir: d,
+            kind: "workspace",
+            ...(ex ? { because: `a workspace of its own under ${ex.parent}, an examples directory; a workspace is a member, never an example` } : {}),
+        });
+    }
     for (const d of chantMembers)
         entries.push({ sort: d, name: uniqueName(memberName(tree, d, name), taken), dir: d, kind: "chant" });
     for (const d of packages) {

package/dist/workspace/ledger.schema.json

@@ -102,7 +102,7 @@
     },
     "row": {
       "type": "object",
-      "description": "One row, keyed by column. Every row starts with member: the workspace member whose ledger it came from, or null outside a workspace. A value is a string, a number, a boolean, an object or array (a JSON column), or null.",
+      "description": "One row, keyed by column. Every row starts with member: the workspace member whose ledger it came from, or null outside a workspace. A value is a string, a number, a boolean, an object or array (a JSON column), or null. A runs row's root_member, added within version 1 by #4500, written by chant 0.124.54 and newer, is the member whose directory holds the terraform root a TerraformApplyOp run applied, or null when that is unknown (another kind of run, or a run whose Init step failed before it resolved the root, #4508; a failed terraform init still names it, #4512); a row from an older chant lacks it. A resources row's marker_stack, marker_env, engine_ownership and engine_owned_by, added within version 1 by #4534, written by chant 0.124.54 and newer, are the stack and env the resource's chant marker names and an ownership engine's verdict and what bound the node (never read for a decision), or null when unknown; a row from an older chant lacks them.",
       "required": [
         "member"
       ],

package/dist/workspace/nested-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nested-graph.d.ts","sourceRoot":"","sources":["../../src/workspace/nested-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAA8B,KAAK,cAAc,EAAqB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE1H,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEpE,8CAA8C;AAC9C,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,cAAc,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC9F;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,wBAAwB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElI,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAc1G;AAeD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAwBnI;AAED,uEAAuE;AACvE,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EACzB,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,SAAS,GAAG,SAAqB,GAC3C,OAAO,CAAC,UAAU,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAS1C;AAED,yGAAyG;AACzG,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE7D;AAYD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA0E5H"}
+{"version":3,"file":"nested-graph.d.ts","sourceRoot":"","sources":["../../src/workspace/nested-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAA8B,KAAK,cAAc,EAAqB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE1H,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEpE,8CAA8C;AAC9C,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,cAAc,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC9F;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,wBAAwB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElI,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAc1G;AAeD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAwBnI;AAED,uEAAuE;AACvE,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EACzB,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,SAAS,GAAG,SAAqB,GAC3C,OAAO,CAAC,UAAU,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAS1C;AAED,yGAAyG;AACzG,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE7D;AAYD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA2E5H"}

package/dist/workspace/nested-graph.js

@@ -125,6 +125,8 @@ export function foldNested(graph, member, inner) {
             n.compositeInstance = prefixed(outer, node.compositeInstance);
         if (node.runtimeOwner)
             n.runtimeOwner = prefixed(outer, node.runtimeOwner);
+        if (node.instanceOf)
+            n.instanceOf = prefixed(outer, node.instanceOf);
         if (node.compositeParent)
             n.compositeParent = node.compositeParent;
         // sourceLoc is relative to the member's directory: the outer member's is the nested root.

package/dist/workspace/pr-report.schema.json

@@ -198,7 +198,7 @@
           "member": { "type": "string", "description": "The member's name in the change set: the root, for a terraform-family step." },
           "component": { "type": "string" },
           "planDigest": { "type": ["string", "null"], "description": "What a gate on this member alone binds. null when it failed to plan." },
-          "status": { "enum": ["planned", "plan-failed", "applied", "failed", "blocked", "waiting"], "description": "waiting (#3999): held back because its plan read an upstream output that applied as another value, or was known only after apply; it waits on an approval of its plan in rounds." },
+          "status": { "enum": ["planned", "plan-failed", "applied", "failed", "blocked", "waiting", "not-started"], "description": "waiting (#3999): held back because its plan read an upstream output that applied as another value, or was known only after apply; it waits on an approval of its plan in rounds. not-started (ws-107, #4440, written by chant 0.124.54 and newer): a member of a group whose apply stopped before its part began." },
           "counts": {
             "type": "object",
             "required": ["create", "update", "replace", "delete"],
@@ -240,7 +240,56 @@
             }
           },
           "round": { "type": "integer", "minimum": 2, "description": "Apply stage (#3999): the round whose plan it applied or waits on, when not the first. planDigest and counts are that round's." },
-          "held": { "type": "string", "description": "Apply stage (#3999): why the first round's plan did not apply." }
+          "held": { "type": "string", "description": "Apply stage (#3999): why the first round's plan did not apply." },
+          "group": { "type": "integer", "minimum": 0, "description": "Added within contract version 1 by #4446, written by chant 0.124.54 and newer. The index in groups of the group the member planned and applied with. Absent when it is in no group." },
+          "groupOutcome": {
+            "enum": ["applied", "partial", "failed", "not-started", "no-changes"],
+            "description": "Added within contract version 1 by #4446, written by chant 0.124.54 and newer. Apply stage: how the member's part of its group's apply ended, as the capability said. applied and no-changes give status applied, and what applied stays applied; partial and failed give status failed; not-started gives status not-started. pr-apply --resume plans partial, failed and not-started members again. Absent when the group did not run."
+          }
+        }
+      }
+    },
+    "groups": {
+      "type": "array",
+      "description": "Added within contract version 1 by #4446, written by chant 0.124.54 and newer. The groups of components one capability planned and applied as one (ws-107), in plan order of their first member. On a resumed apply, what is left of each approved group, grouped again. Absent when none formed.",
+      "items": {
+        "type": "object",
+        "required": ["capability", "components", "wave", "digest"],
+        "additionalProperties": false,
+        "properties": {
+          "capability": { "type": "string", "description": "The kind of the capability every member's one step names, such as terraform-apply." },
+          "components": { "type": "array", "minItems": 2, "items": { "type": "string" }, "description": "The members, by component, in apply order: upstreams first." },
+          "wave": { "type": "integer", "minimum": 1, "description": "The 1-based wave of selection.waves the group ran in." },
+          "digest": { "type": ["string", "null"], "description": "The group digest folded into each member's planDigest. null when the group failed to plan." },
+          "error": { "type": "string", "description": "Why the group failed to plan. Every member is then plan-failed." },
+          "reads": {
+            "type": "array",
+            "description": "Each read of another member that its plan did not know, which the group's apply computes, sorted by component then ref. Absent when none.",
+            "items": {
+              "type": "object",
+              "required": ["component", "ref"],
+              "additionalProperties": false,
+              "properties": {
+                "component": { "type": "string", "description": "The member that reads." },
+                "ref": { "type": "string", "description": "What it reads, as <component>.<output>." }
+              }
+            }
+          }
+        }
+      }
+    },
+    "fallbacks": {
+      "type": "array",
+      "description": "Added within contract version 1 by #4446, written by chant 0.124.54 and newer. Each component in the change whose capability declares planGroup and runGroup, that a read joins to another such component of its kind, and that ended in no group, sorted by component. Absent when none.",
+      "items": {
+        "type": "object",
+        "required": ["component", "capability", "kind", "reason"],
+        "additionalProperties": false,
+        "properties": {
+          "component": { "type": "string" },
+          "capability": { "type": "string", "description": "The kind of the capability its step names." },
+          "kind": { "type": "string", "description": "Why, as a kind: core's steps (its deploy has more than one step), split (a component outside the group lies on a dependency path between it and the rest), alone (the capability dropped the other members of its group and a group of one is no group), cycle (placing the group would order two groups each before the other) or error (the capability's groupFallback threw), or the capability's own, for the whole group or for each member it drops. off: the capability's setting turns grouping off; the note does not print it." },
+          "reason": { "type": "string", "description": "The reason as printed." }
         }
       }
     },

package/dist/workspace/promote-waves.d.ts

@@ -0,0 +1,112 @@
+/**
+ * `chant workspace promote --all` (#4461): adopt a workspace of plain
+ * Terraform roots into choudoufu in waves, a canary first.
+ *
+ * Each root goes through {@link promoteCommand} on its own, so each root has
+ * its own gate, `workspace-promote/<member>`, whose digest binds that root's
+ * own `live-import` report. A root that fails leaves every other root as it
+ * was: its staging ran in a worktree, and nothing of it reached the tree.
+ *
+ * The order:
+ *
+ * - The canary (`--canary <member>`, else the first candidate in declaration
+ *   order) is wave 1. Unless every canary lands, no other wave runs.
+ * - The rest follow in declaration order, `--wave-size` roots a wave. Every
+ *   root of a wave is tried even when one of them fails, and the next wave
+ *   runs only when the whole wave landed.
+ *
+ * A root lands when it was applied, was already promoted, or (under
+ * `--dry-run`) staged cleanly. A gated root has not landed: approve its gate
+ * and run the same command again. Roots already of kind `choudoufu` report
+ * `already-promoted` and are not staged again, so a re-run over a workspace
+ * that has landed is a no-op. A root whose kind was written but whose
+ * `live-import -approve` failed is kind `choudoufu` with a pending stamp
+ * (#4485): a re-run retries the stamp, and the root lands once it passes or
+ * stays `stamp-failed` with the command to run.
+ *
+ * Before a root is staged its state is checked: `live-import` reads a local
+ * tfstate of format version 4, so a missing state under a remote backend, or
+ * a state of another version, refuses that root by name.
+ */
+import type { GateLedgerPort } from "../op/gate.js";
+import { type PromoteRunner } from "./promote.js";
+export declare const DEFAULT_WAVE_SIZE = 5;
+export type WaveRootOutcome = 
+/** Staged, approved, kind written and markers stamped. */
+"applied"
+/** Already of kind choudoufu (or above): nothing to do. */
+ | "already-promoted"
+/** `--dry-run`: staged and checked, no gate recorded. */
+ | "dry-run"
+/** A gate is pending for this root's digest. */
+ | "gated"
+/** live-check or the live-import report failed in staging. */
+ | "checks-failed"
+/** The state is not a local v4 tfstate. */
+ | "refused"
+/** The kind was written but `live-import -approve` failed. */
+ | "stamp-failed"
+/** Anything else that stopped the root (uncommitted changes, a patch that no longer applies). */
+ | "failed"
+/** An earlier wave did not land. */
+ | "not-run";
+export interface WaveRootResult {
+    member: string;
+    wave: number;
+    canary: boolean;
+    outcome: WaveRootOutcome;
+    kind: string;
+    state?: string;
+    digest?: string;
+    reportDigest?: string;
+    /** From the report: instances eligible for stamping, of the total. */
+    eligible?: {
+        stampable: number;
+        total: number;
+    };
+    /** From the report: instances outside the admitted type set, never stamped. */
+    unadmitted?: number;
+    /** From the stamp report under -approve. */
+    stamped?: {
+        newly: number;
+        already: number;
+        failed: number;
+    };
+    reason?: string;
+}
+export interface WavesSummary {
+    outcome: "landed" | "gated" | "failed" | "dry-run";
+    exitCode: number;
+    waves: string[][];
+    roots: WaveRootResult[];
+}
+export interface PromoteWavesOptions {
+    root: string;
+    /** Every terraform member, and every choudoufu member (which reports already-promoted). */
+    all?: boolean;
+    /** `--state <member>=<path>`, repeatable. Without `all`, the members named here are the set. */
+    states?: Record<string, string>;
+    /** `--state-dir <dir>`: a member's state is `<dir>/<member>.tfstate`. */
+    stateDir?: string;
+    canary?: string[];
+    waveSize?: number;
+    dryRun?: boolean;
+    json?: boolean;
+    /** For tests. */
+    runner?: PromoteRunner;
+    ledger?: GateLedgerPort;
+    now?: string;
+}
+/** Parse `--state <member>=<path>` values. */
+export declare function parseStateMappings(values: readonly string[]): Record<string, string>;
+/** The waves: the canaries first, then the rest in declaration order, `size` at a time. */
+export declare function planWaves(candidates: readonly string[], canary: readonly string[], size: number): string[][];
+/** The backend a root's .tf files declare, or undefined for none or `local`. */
+export declare function remoteBackend(dir: string): string | undefined;
+/**
+ * Why `state` cannot feed `live-import` for `member`, or undefined when it
+ * can: it must be a local tfstate of format version 4.
+ */
+export declare function stateRefusal(member: string, memberDir: string, state: string): string | undefined;
+export declare function promoteWavesCommand(opts: PromoteWavesOptions): Promise<WavesSummary>;
+//# sourceMappingURL=promote-waves.d.ts.map

package/dist/workspace/promote-waves.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promote-waves.d.ts","sourceRoot":"","sources":["../../src/workspace/promote-waves.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,EAA2H,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAGxK,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,MAAM,MAAM,eAAe;AACzB,0DAA0D;AACxD,SAAS;AACX,2DAA2D;GACzD,kBAAkB;AACpB,yDAAyD;GACvD,SAAS;AACX,gDAAgD;GAC9C,OAAO;AACT,8DAA8D;GAC5D,eAAe;AACjB,2CAA2C;GACzC,SAAS;AACX,8DAA8D;GAC5D,cAAc;AAChB,iGAAiG;GAC/F,QAAQ;AACV,oCAAoC;GAClC,SAAS,CAAC;AAId,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IAClB,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iBAAiB;IACjB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUpF;AAED,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CAU5G;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc7D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAsBjG;AAqBD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CA+I1F"}