@intentius/chant 0.57.0 → 0.59.0

package/src/cli/commands/lint.ts

@@ -4,7 +4,7 @@ import { readFileSync, writeFileSync, readdirSync, statSync } from "fs";
 import { execFileSync } from "child_process";
 import { runLint, parseDisableComments } from "../../lint/engine";
 import type { LintRule, LintDiagnostic, LintFix } from "../../lint/rule";
-import type { IntrinsicDef } from "../../lexicon";
+import type { IntrinsicDef, LexiconPlugin } from "../../lexicon";
 import { loadPlugins, resolveProjectLexicons } from "../plugins";
 import { formatStylish, formatJson, formatSarif } from "../reporters/stylish";
 import { loadLocalRules } from "../../lint/rule-loader";
@@ -13,14 +13,19 @@ import { loadComponentChecks } from "../../lint/rules/comp/index";
 import { runComponentChecks, type ComponentCheckDiagnostic } from "../../lint/component-checks";
 import { buildCapabilityRegistry } from "../../components/capability-plugin-loader";
 import type { RollbackPolicy } from "../../components/capability";
+import { coreOpChecks } from "../../lint/rules/op";
+import { loadActivityContracts } from "../../op/activity-contract-registry";
+import { runPostSynthChecks } from "../../lint/post-synth";
 import { rule } from "../../lint/declarative";
 import { watchDirectory, formatTimestamp, formatChangedFiles } from "../watch";
 import { formatError, formatInfo } from "../format";
 import { GENERATED_MARKER } from "../../discovery/files";
+import { isNoLexiconDetected } from "../../detectLexicon";
 
 // Import config loader
 import { loadConfig, resolveRulesForFile, resolveConfiguredSeverity, findProjectRoot } from "../../lint/config";
 import { loadChantConfig, resolveKnowledgeDir } from "../../config";
+import { findProjectConfig } from "../../project-root";
 import type { LintProjectConfig } from "../../lint/rule";
 import { loadOkfBundle, type OkfBundle } from "../../okf-read";
 
@@ -88,6 +93,40 @@ export async function loadPluginRules(
   return pluginRules;
 }
 
+/**
+ * The diagnostic id `chant lint` reports a lexicon it could not resolve under
+ * (chant #2222).
+ *
+ * Deliberately outside the COR/EVL/COMP/OPS families: those are *rules*, each
+ * with a `check()` the engine runs per file, a documented page, a configurable
+ * severity and a `chant-disable` escape hatch. This is none of those. It is
+ * the lint run reporting that it could not assemble the rule set the project
+ * asked for, so it is not silenceable through `rules: { ... : "off" }` or a
+ * disable comment. Silencing it would put back the exact "green on a broken
+ * project" this id exists to prevent.
+ */
+export const LEXICON_RESOLUTION_RULE_ID = "LEX001";
+
+/**
+ * Turn a lexicon-resolution failure into the error diagnostic `chant lint`
+ * reports it as. The message is the underlying error's own, unwrapped, so it
+ * is character-for-character what `chant build` prints after `error: ` for the
+ * same project (`loadPluginsOrExit`, ../main.ts): one failure, one wording.
+ *
+ * Attributed to the project's `chant.config.*` where there is one, since that
+ * is the file that names the lexicon; to the project root otherwise.
+ */
+function lexiconResolutionDiagnostic(projectRoot: string, error: Error): LintDiagnostic {
+  return {
+    file: findProjectConfig(projectRoot).configPath ?? projectRoot,
+    line: 1,
+    column: 1,
+    ruleId: LEXICON_RESOLUTION_RULE_ID,
+    severity: "error",
+    message: error.message,
+  };
+}
+
 /**
  * Load all lint rules: core COR/EVL rules, then lexicon plugin rules.
  *
@@ -100,7 +139,7 @@ export async function loadPluginRules(
  */
 async function loadAllPluginRules(
   projectPath: string,
-): Promise<{ rules: Map<string, LintRule>; intrinsics: IntrinsicDef[] }> {
+): Promise<{ rules: Map<string, LintRule>; intrinsics: IntrinsicDef[]; lexiconError?: Error }> {
   const rules = new Map<string, LintRule>();
 
   // Load core COR/EVL rules directly
@@ -108,16 +147,47 @@ async function loadAllPluginRules(
     rules.set(r.id, r);
   }
 
-  // Resolve project lexicons (e.g. ["aws"]) from config or detection
+  // Resolve project lexicons (e.g. ["aws"]) from config or detection, then
+  // load their plugins.
+  //
+  // chant #2222: a failure in either step is handed back to `lintCommand`
+  // (which reports it as {@link LEXICON_RESOLUTION_RULE_ID}) rather than
+  // swallowed or thrown. Both steps fail on the same project state: a
+  // `chant.config.ts` that names a lexicon whose package is not installed
+  // throws out of `loadPlugins`, and one that *imports* that package throws
+  // out of `resolveProjectLexicons` before the names are ever read. Before
+  // this, the first case crashed `chant lint` with a stack trace and the
+  // second was caught here and discarded, so `chant lint` printed "No
+  // problems found" and exited 0 on a project `chant build` refuses to
+  // build. A CI job that lints before it builds reported green on a project
+  // whose lexicon was missing.
+  //
+  // The one failure that stays quiet is the one the original `catch` was
+  // written for and named in its comment: a project that declares no
+  // `lexicons` and imports none from its source files, where the detection
+  // fallback throws `NO_LEXICON_DETECTED_MESSAGE`. That project lints under
+  // the core rules alone and always has. It is told apart by the exported
+  // sentinel rather than by a string literal copied to this file, so the two
+  // cannot drift apart.
   let lexiconNames: string[] = [];
+  let lexiconError: Error | undefined;
   try {
     lexiconNames = await resolveProjectLexicons(projectPath);
-  } catch {
-    // No lexicons detected — core rules only
+  } catch (err) {
+    if (!isNoLexiconDetected(err)) {
+      lexiconError = err instanceof Error ? err : new Error(String(err));
+    }
   }
 
   // Load only project lexicon plugins (no "chant" injection)
-  const plugins = await loadPlugins(lexiconNames);
+  let plugins: LexiconPlugin[] = [];
+  if (!lexiconError) {
+    try {
+      plugins = await loadPlugins(lexiconNames);
+    } catch (err) {
+      lexiconError = err instanceof Error ? err : new Error(String(err));
+    }
+  }
 
   // chant #1106 — the same plugins' registered intrinsics (`Ref`, `GetAtt`,
   // ...), so EVL001 can answer "does this call fold?" exactly like fold()
@@ -147,7 +217,7 @@ async function loadAllPluginRules(
     rules.set(r.id, r);
   }
 
-  return { rules, intrinsics };
+  return { rules, intrinsics, ...(lexiconError ? { lexiconError } : {}) };
 }
 
 /**
@@ -420,6 +490,113 @@ async function runComponentCheckDiagnostics(
   return { diagnostics, suppressed };
 }
 
+/**
+ * Run the OPS* Op-model post-synth checks (#2122, epic #2114 sub-issue 6 —
+ * OPS012/OPS013/OPS014, ported from a hosting lexicon's own
+ * TMP012/TMP013/TMP014) over every `*.op.ts` file under the lint target and
+ * merge them into the same diagnostics/suppressed lists `chant lint` already
+ * reports through, the same treatment {@link runComponentCheckDiagnostics}
+ * above gives COMP*.
+ *
+ * Deliberately scoped DOWNWARD from `infraPath` — the same scan
+ * `getTypeScriptFiles` already ran to build `files` — rather than
+ * `../../op/discover.ts`'s `discoverOps`, which walks UP to the nearest
+ * project root (or the git root, absent a config file) precisely because a
+ * real project's `ops/` convention sits outside `sourceDir`. That upward
+ * walk is right for `chant run`/`chant build`, which always operate on one
+ * whole project; it is wrong here, because `chant lint <path>` (and every
+ * fixture-scoped test that calls this file's `lintCommand`) may point at a
+ * directory with no `chant.config.*` above it short of this repo's own git
+ * root — which would make this check import every `*.op.ts` file in the
+ * entire monorepo on every such call. Scanning only under `infraPath`, like
+ * every other check in this function, keeps this check's cost proportional
+ * to the target the caller actually asked to lint.
+ *
+ * Each `*.op.ts` file's default export is imported directly and used as-is
+ * (it is already the `Declarable` `OpResource` instance `Op()` built) — no
+ * serializer and no lexicon plugin needed, since OPS012/OPS013/OPS014 only
+ * ever read `ctx.entities`, never `ctx.outputs`. That's what lets this fire
+ * even on a project with no lexicons configured at all.
+ *
+ * The project's configured lexicon NAMES are read, though (chant #2101), to
+ * resolve the activity contracts each one declares at
+ * `@intentius/chant-lexicon-<name>/op/activity-contracts` — one dynamic
+ * import per lexicon, no plugin load. Without them a step calling a
+ * lexicon's activity is flagged for the absence of a contract that lexicon
+ * does declare, which is the whole point of OPS013 firing outside a build.
+ *
+ * Reported at `1:1` in the file the Op was declared in, the same whole-file
+ * convention COMP* diagnostics use — a post-synth finding carries no real
+ * line/column (../../lint/post-synth.ts's `PostSynthDiagnostic` doc) and
+ * there's no per-file disable-directive suppression for the same reason
+ * (that doc again), so this reads only `lint.rules` severity overrides, not
+ * `chant-disable` comments.
+ */
+async function runOpCheckDiagnostics(
+  infraPath: string,
+  files: string[],
+): Promise<{ diagnostics: LintDiagnostic[]; suppressed: Array<LintDiagnostic & { reason?: string }> }> {
+  const config = loadConfig(findProjectRoot(infraPath));
+  const opFiles = files.filter((f) => f.endsWith(".op.ts"));
+  if (opFiles.length === 0) return { diagnostics: [], suppressed: [] };
+
+  const entities = new Map<string, unknown>();
+  const fileByOpName = new Map<string, string>();
+  for (const filePath of opFiles) {
+    try {
+      const mod: unknown = await import(filePath);
+      const entity = (mod as { default?: unknown }).default;
+      if (!entity || typeof entity !== "object") continue;
+      const opConfig = (entity as { props?: unknown }).props as { name?: unknown; phases?: unknown } | undefined;
+      if (!opConfig || typeof opConfig.name !== "string" || !Array.isArray(opConfig.phases)) continue;
+      entities.set(opConfig.name, entity);
+      fileByOpName.set(opConfig.name, filePath);
+    } catch {
+      // A file that fails to import is somebody else's problem — a syntax
+      // error surfaces through the AST rule pass over the same file instead
+      // of crashing this one.
+      continue;
+    }
+  }
+
+  if (entities.size === 0) return { diagnostics: [], suppressed: [] };
+
+  const lexiconNames = await resolveProjectLexicons(infraPath).catch(() => [] as string[]);
+  const activityContracts = await loadActivityContracts(lexiconNames);
+
+  const raw = runPostSynthChecks(
+    coreOpChecks(),
+    {
+      outputs: new Map(),
+      entities: entities as Map<string, never>,
+      warnings: [],
+      errors: [],
+      sourceFileCount: opFiles.length,
+    },
+    undefined,
+    { activityContracts },
+  );
+
+  const diagnostics: LintDiagnostic[] = [];
+  const suppressed: Array<LintDiagnostic & { reason?: string }> = [];
+
+  for (const d of raw) {
+    const resolved = resolveConfiguredSeverity(config.rules, d.checkId, d.severity);
+    if (resolved.severity === "off") continue;
+
+    diagnostics.push({
+      file: (d.entity && fileByOpName.get(d.entity)) ?? infraPath,
+      line: 1,
+      column: 1,
+      ruleId: d.checkId,
+      severity: resolved.severity,
+      message: d.message,
+    });
+  }
+
+  return { diagnostics, suppressed };
+}
+
 /**
  * Apply fixes to a file
  */
@@ -523,6 +700,13 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
   diagnostics.push(...componentResult.diagnostics);
   suppressed.push(...componentResult.suppressed);
 
+  // Run the OPS* Op-model post-synth checks (#2122) over every `*.op.ts`
+  // file under the lint target — see runOpCheckDiagnostics's doc for why
+  // this needs no lexicon or build to fire.
+  const opResult = await runOpCheckDiagnostics(infraPath, files);
+  diagnostics.push(...opResult.diagnostics);
+  suppressed.push(...opResult.suppressed);
+
   // Apply fixes if requested
   if (options.fix) {
     // Group fixes by file
@@ -570,6 +754,20 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
     const postComponentResult = await runComponentCheckDiagnostics(infraPath, options.sandbox, options.buildParams);
     diagnostics.push(...postComponentResult.diagnostics);
     suppressed.push(...postComponentResult.suppressed);
+
+    // OPS* checks have no `.fix` either; re-run for the same consistency
+    // reason as the COMP* re-run just above.
+    const postOpResult = await runOpCheckDiagnostics(infraPath, files);
+    diagnostics.push(...postOpResult.diagnostics);
+    suppressed.push(...postOpResult.suppressed);
+  }
+
+  // chant #2222: a lexicon the project declared but this run could not
+  // resolve. Appended here, after the `--fix` re-lint block above has finished
+  // reassigning `diagnostics`, so it survives every path; it is a property of
+  // the run, not of any file a fix could touch.
+  if (loaded.lexiconError) {
+    diagnostics.push(lexiconResolutionDiagnostic(projectRoot, loaded.lexiconError));
   }
 
   // Count errors and warnings

package/src/cli/commands/onboard.test.ts

@@ -72,6 +72,53 @@ jobs:
         run: npm run --prefix lexicons/k8s prepack
 `;
 
+// Mirrors the real chant.yml's check + test jobs: a comment (the cedar note)
+// sitting mid-list splits what would otherwise be one contiguous run of
+// prepack lines into two groups of 2+, so the old grouping wrote the new
+// lexicon's line twice per job (#2098).
+const ciContentWithMidListComment = `name: chant
+on: [push]
+jobs:
+  check:
+    steps:
+      - name: Generate lexicon artifacts
+        run: |
+          npm run --prefix lexicons/aws prepack
+          npm run --prefix lexicons/gitlab prepack
+          # cedar generates from the project's own .cedarschema, falling
+          # back to the schema bundled at src/spec/default-schema.cedarschema
+          # so a clean checkout still produces a surface to gate (#1650).
+          npm run --prefix lexicons/cedar prepack
+          npm run --prefix lexicons/k8s prepack
+      - name: Run tests
+        run: npx vitest run
+
+  test:
+    steps:
+      - name: Generate lexicon artifacts
+        run: |
+          npm run --prefix lexicons/aws prepack
+          npm run --prefix lexicons/gitlab prepack
+          # cedar generates from the project's own .cedarschema, falling
+          # back to the schema bundled at src/spec/default-schema.cedarschema
+          # so a clean checkout still produces a surface to gate (#1650).
+          npm run --prefix lexicons/cedar prepack
+          npm run --prefix lexicons/k8s prepack
+      - name: Run tests
+        run: npx vitest run
+
+  validate:
+    steps:
+      - name: Generate and validate AWS lexicon
+        run: npm run --prefix lexicons/aws prepack
+
+      - name: Generate and validate GitLab lexicon
+        run: npm run --prefix lexicons/gitlab prepack
+
+      - name: Generate and validate K8s lexicon
+        run: npm run --prefix lexicons/k8s prepack
+`;
+
 const publishContent = `name: publish
 on:
   push:
@@ -217,6 +264,34 @@ describe("onboardCommand", () => {
     const docker = readFileSync(join(root, "test/Dockerfile.smoke"), "utf-8");
     expect(docker.match(/terraform/g)?.length).toBe(1);
   });
+
+  test("a comment mid-list in check/test run blocks does not split the group: one insertion per block (#2098)", () => {
+    writeFileSync(join(root, ".github/workflows/chant.yml"), ciContentWithMidListComment);
+
+    const result = onboardCommand({ name: "terraform", root });
+    expect(result.patched).toContain("chant.yml (prepack + validate)");
+
+    const ci = readFileSync(join(root, ".github/workflows/chant.yml"), "utf-8");
+    // check + test + validate: exactly one new line per job, not two per job
+    // from the comment splitting the run: | block into two groups.
+    expect(ci.match(/lexicons\/terraform prepack/g)?.length).toBe(3);
+
+    const [checkBlock, rest] = ci.split("  test:");
+    const [testBlock, validateBlock] = rest.split("  validate:");
+
+    expect(checkBlock.match(/lexicons\/terraform prepack/g)?.length).toBe(1);
+    expect(testBlock.match(/lexicons\/terraform prepack/g)?.length).toBe(1);
+    expect(validateBlock.match(/lexicons\/terraform prepack/g)?.length).toBe(1);
+
+    // The new line lands after the block's last prepack line (k8s, past the
+    // comment), not right after the comment's first half of the group.
+    expect(checkBlock).toContain(
+      "          npm run --prefix lexicons/k8s prepack\n          npm run --prefix lexicons/terraform prepack\n",
+    );
+    expect(testBlock).toContain(
+      "          npm run --prefix lexicons/k8s prepack\n          npm run --prefix lexicons/terraform prepack\n",
+    );
+  });
 });
 
 describe("root tsconfig.json paths (#1614)", () => {

package/src/cli/commands/onboard.ts

@@ -5,6 +5,7 @@ import { formatSuccess, formatError, formatWarning } from "../format";
 
 export interface OnboardOptions {
   name: string;
+  /** Run `chant dev check-lexicon` and print its full output (see `printOnboardResult`). */
   verbose?: boolean;
   /** Monorepo root to patch. Defaults to the root this module lives in. */
   root?: string;
@@ -14,6 +15,7 @@ export interface OnboardResult {
   success: boolean;
   patched: string[];
   skipped: string[];
+  verbose?: boolean;
   error?: string;
 }
 
@@ -41,6 +43,13 @@ function isPrepackLine(line: string): boolean {
   return PREPACK_LINE.test(line);
 }
 
+/** A YAML comment line, e.g. the cedar note sitting mid-list in chant.yml. */
+const COMMENT_LINE = /^\s*#/;
+
+function isCommentLine(line: string): boolean {
+  return COMMENT_LINE.test(line);
+}
+
 function hasPrepackLine(lines: string[], name: string): boolean {
   return lines.some((l) => isPrepackLine(l) && l.includes(`lexicons/${name} prepack`));
 }
@@ -137,27 +146,46 @@ export function patchRootTsconfigPaths(root: string, name: string): PatchResult
 
 /**
  * Insert a new prepack line after the last prepack line in each contiguous group
- * of 2+ lines. Single standalone lines (like YAML `run:` values) are ignored.
- * Used for multi-line `run: |` blocks in workflows.
+ * of 2+ prepack lines. Single standalone lines (like YAML `run:` values) are
+ * ignored. Used for multi-line `run: |` blocks in workflows.
+ *
+ * A comment line between two prepack lines (the cedar note in chant.yml's
+ * check and test jobs) does not end the group: it is skipped when scanning,
+ * so the block still gets exactly one insertion, anchored after its last
+ * real prepack line rather than after the comment (#2098).
  */
 function insertPrepackInContiguousGroups(lines: string[], name: string): boolean {
   if (hasPrepackLine(lines, name)) return false;
 
-  // Identify contiguous groups of prepack lines
-  const groups: { start: number; end: number }[] = [];
+  // Identify contiguous groups of prepack lines, treating comment lines
+  // inside a group as pass-through rather than a boundary.
+  const groups: { lastPrepackIdx: number; count: number }[] = [];
   let groupStart = -1;
-  for (let i = 0; i <= lines.length; i++) {
-    const isPrepack = i < lines.length && isPrepackLine(lines[i]);
-    if (isPrepack && groupStart === -1) {
-      groupStart = i;
-    } else if (!isPrepack && groupStart !== -1) {
-      groups.push({ start: groupStart, end: i - 1 });
-      groupStart = -1;
+  let lastPrepackIdx = -1;
+  let count = 0;
+
+  const closeGroup = () => {
+    if (groupStart !== -1) groups.push({ lastPrepackIdx, count });
+    groupStart = -1;
+    count = 0;
+  };
+
+  for (let i = 0; i < lines.length; i++) {
+    if (isPrepackLine(lines[i])) {
+      if (groupStart === -1) groupStart = i;
+      lastPrepackIdx = i;
+      count++;
+    } else if (isCommentLine(lines[i])) {
+      // Skip: does not extend a group on its own, and does not close one.
+      continue;
+    } else {
+      closeGroup();
     }
   }
+  closeGroup();
 
-  // Only insert into groups of 2+ lines (multi-line blocks, not standalone steps)
-  const insertAfter = groups.filter((g) => g.end > g.start).map((g) => g.end);
+  // Only insert into groups of 2+ prepack lines (multi-line blocks, not standalone steps)
+  const insertAfter = groups.filter((g) => g.count > 1).map((g) => g.lastPrepackIdx);
 
   if (insertAfter.length === 0) return false;
 
@@ -332,7 +360,7 @@ export function onboardCommand(options: OnboardOptions): OnboardResult {
     patchDockerfile(join(root, "test/Dockerfile.smoke-npm"), options.name),
   );
 
-  return { success: true, patched, skipped };
+  return { success: true, patched, skipped, verbose: options.verbose };
 }
 
 /**
@@ -365,20 +393,23 @@ export async function printOnboardResult(result: OnboardResult, name: string): P
   console.log(`     (must depend on @intentius/chant-lexicon-${name} for workspace resolution)`);
   console.log(`  2. Add smoke tests to test/integration.sh`);
   console.log(`  3. Run: npm install (to update workspace links)`);
-  console.log(`  4. First npm publish: tag with v<version> and push`);
+  console.log(`  4. First release: just release-lexicon ${name} patch`);
   console.log(`  5. Run: chant dev check-lexicon lexicons/${name} (to see completeness status)`);
   console.log(formatWarning({
     message: "First-time scoped packages may publish as private despite --access public",
   }));
   console.log(`     Check https://www.npmjs.com/org/intentius and toggle visibility if needed`);
 
-  // Run check-lexicon if the lexicon directory exists
-  const lexiconDir = join(findRepoRoot(), "lexicons", name);
-  if (existsSync(lexiconDir)) {
-    console.log("");
-    console.log("Lexicon completeness:");
-    const { checkLexicon, printCheckResult } = await import("./check-lexicon");
-    const checkResult = await checkLexicon(lexiconDir);
-    printCheckResult(checkResult, false);
+  // Under --verbose, run check-lexicon now instead of leaving step 5 to the
+  // author, printing the full tier 1/2/3 detail rather than just the summary above.
+  if (result.verbose) {
+    const lexiconDir = join(findRepoRoot(), "lexicons", name);
+    if (existsSync(lexiconDir)) {
+      console.log("");
+      console.log("Lexicon completeness:");
+      const { checkLexicon, printCheckResult } = await import("./check-lexicon");
+      const checkResult = await checkLexicon(lexiconDir);
+      printCheckResult(checkResult, false);
+    }
   }
 }

package/src/cli/handlers/build.test.ts

@@ -6,7 +6,7 @@
  * `buildParams`, so a `*.component.ts` file reading `params.<name>` always
  * saw `{}` under `chant build --components --generate`, exactly like `chant
  * run --components` (see ../handlers/run.test.ts's "build-time parameters"
- * describe block for the equivalent local/`--temporal` coverage).
+ * describe block for the equivalent local-run coverage).
  *
  * Mocks `generateComponentsPipeline` and `loadChantConfigUpward` (chant
  * #1117 — `runGenerateComponents` walks up to the project root now, same as
@@ -149,3 +149,83 @@ describe("runBuild --components --generate (chant #1108 build-time parameters)",
     expect(generateComponentsPipelineMock).not.toHaveBeenCalled();
   });
 });
+
+/**
+ * chant #2060. `chant build --components --generate --format json` forwarded
+ * only `{ stages, jobs, yaml }`, dropping `result.env` even though the
+ * generator (#2046, PR #2050) resolves and returns it. A consumer reading the
+ * structured output (behold does) had no environment identity except by
+ * parsing the YAML back, which #2046 was meant to retire.
+ */
+describe("runBuild --components --generate --format json (chant #2060 env passthrough)", () => {
+  beforeEach(() => {
+    generateComponentsPipelineMock.mockReset();
+    loadChantConfigUpwardMock.mockReset().mockResolvedValue({ config: {} });
+  });
+
+  test("--format json includes result.env alongside stages, jobs and yaml", async () => {
+    generateComponentsPipelineMock.mockResolvedValue({
+      success: true,
+      yaml: "name: chant-components-prod\nenv:\n  CHANT_ENV: prod\n",
+      stages: ["deploy"],
+      jobs: [{ jobName: "deploy-web", component: "web", stage: "deploy", needs: [] }],
+      env: "prod",
+    });
+    const stdout: string[] = [];
+    vi.spyOn(console, "log").mockImplementation((s: string) => { stdout.push(s); });
+
+    const exit = await runBuild({
+      args: makeArgs({ format: "json", env: "prod" }),
+      plugins: [],
+      serializers: [],
+    });
+
+    expect(exit).toBe(0);
+    expect(stdout).toHaveLength(1);
+    const printed = JSON.parse(stdout[0]);
+    expect(printed).toEqual({
+      stages: ["deploy"],
+      jobs: [{ jobName: "deploy-web", component: "web", stage: "deploy", needs: [] }],
+      yaml: "name: chant-components-prod\nenv:\n  CHANT_ENV: prod\n",
+      env: "prod",
+    });
+    vi.restoreAllMocks();
+  });
+
+  test("--format json omits env when the generator's result carries none", async () => {
+    generateComponentsPipelineMock.mockResolvedValue({
+      success: true,
+      yaml: "stages: []",
+      stages: [],
+      jobs: [],
+    });
+    const stdout: string[] = [];
+    vi.spyOn(console, "log").mockImplementation((s: string) => { stdout.push(s); });
+
+    const exit = await runBuild({ args: makeArgs({ format: "json" }), plugins: [], serializers: [] });
+
+    expect(exit).toBe(0);
+    const printed = JSON.parse(stdout[0]);
+    expect(printed).toEqual({ stages: [], jobs: [], yaml: "stages: []" });
+    expect(printed).not.toHaveProperty("env");
+    vi.restoreAllMocks();
+  });
+
+  test("the default text format is unchanged: env is not forwarded and only the raw yaml is printed", async () => {
+    generateComponentsPipelineMock.mockResolvedValue({
+      success: true,
+      yaml: "name: chant-components-prod\nenv:\n  CHANT_ENV: prod\n",
+      stages: ["deploy"],
+      jobs: [{ jobName: "deploy-web", component: "web", stage: "deploy", needs: [] }],
+      env: "prod",
+    });
+    const stdout: string[] = [];
+    vi.spyOn(console, "log").mockImplementation((s: string) => { stdout.push(s); });
+
+    const exit = await runBuild({ args: makeArgs({ env: "prod" }), plugins: [], serializers: [] });
+
+    expect(exit).toBe(0);
+    expect(stdout).toEqual(["name: chant-components-prod\nenv:\n  CHANT_ENV: prod\n"]);
+    vi.restoreAllMocks();
+  });
+});

package/src/cli/handlers/build.ts

@@ -63,7 +63,21 @@ async function runGenerateComponents(ctx: CommandContext): Promise<number> {
 
   const yaml = result.yaml ?? "";
   if (args.format === "json") {
-    console.log(JSON.stringify({ stages: result.stages, jobs: result.jobs, yaml }, null, 2));
+    console.log(
+      JSON.stringify(
+        {
+          stages: result.stages,
+          jobs: result.jobs,
+          yaml,
+          // The environment the generated pipeline deploys (#2046), the
+          // generator's own resolution, forwarded rather than left for a
+          // consumer to re-derive by parsing the YAML back (#2060).
+          ...(result.env ? { env: result.env } : {}),
+        },
+        null,
+        2,
+      ),
+    );
   } else if (args.output) {
     const outputPath = resolve(args.output);
     mkdirSync(dirname(outputPath), { recursive: true });

package/src/cli/handlers/graph.test.ts

@@ -233,14 +233,14 @@ describe("runGraph", () => {
         filePath: file,
       });
 
-      test("an op discoverOps finds at the project root becomes a Temporal::Op node", async () => {
+      test("an op discoverOps finds at the project root becomes a Chant::Op node", async () => {
         lintClean(); discovered();
         discoverOpsMock.mockResolvedValue({ ops: new Map([["deploy", rootOp("/proj/deploy.op.ts")]]), errors: [] });
         const exit = await runGraph({ args: makeArgs({ format: "ir", path: "/proj", detail: 3 }), plugins: [], serializers: [] });
         expect(exit).toBe(0);
         const ir = JSON.parse(stdoutBuf.join("\n"));
         const node = ir.nodes.find((n: { id: string }) => n.id === "deploy");
-        expect(node).toMatchObject({ kind: "Temporal::Op", lexicon: "temporal", sourceLoc: { file: "deploy.op.ts" } });
+        expect(node).toMatchObject({ kind: "Chant::Op", lexicon: "chant", sourceLoc: { file: "deploy.op.ts" } });
         expect(node.attrs.phases[0].name).toBe("Apply");
         expect(node.attrs.depends).toEqual(["infra"]);
       });
@@ -248,7 +248,7 @@ describe("runGraph", () => {
       test("an op discovery already loaded from sourceDir is not added twice", async () => {
         lintClean();
         const entities = sampleEntities();
-        entities.set("deploy", decl({ lexicon: "temporal", entityType: "Temporal::Op", props: { name: "deploy", phases: [] } }));
+        entities.set("deploy", decl({ lexicon: "chant", entityType: "Chant::Op", props: { name: "deploy", phases: [] } }));
         discoverMock.mockResolvedValue({ entities, errors: [], dependencies: new Map(), sourceFiles: ["/proj/src/deploy.op.ts"] });
         discoverOpsMock.mockResolvedValue({ ops: new Map([["deploy", rootOp("/proj/src/deploy.op.ts")]]), errors: [] });
         const exit = await runGraph({ args: makeArgs({ format: "ir", path: "/proj", detail: 3 }), plugins: [], serializers: [] });