@intentius/chant 0.79.0 → 0.81.0

package/src/cli/handlers/run-generate.ts

@@ -0,0 +1,168 @@
+/**
+ * `chant run --generate <provider>` (#2533): the CLI for `generateOpsPipeline`
+ * (../../op/generate-pipeline.ts), the Op counterpart to `chant build
+ * --components --generate <lexicon>`.
+ *
+ * The generator is a library function with no caller of its own. A pipeline
+ * committed to a repository needs a named command that regenerates it, so a
+ * drift check (#2524 D14) can rerun that command and compare. This handler is
+ * that command and adds nothing to the generator's output beyond one header
+ * line: every file it writes is the generator's own `yaml`, byte for byte,
+ * under a first line carrying {@link GENERATED_MARKER} and the command that
+ * produced it.
+ *
+ * Where the specs come from:
+ *
+ *  - by default, every discovered Op that declares its own `schedule`, as a
+ *    bare `{ name }` spec. `generateOpsPipeline` fills the cron in from the Op
+ *    (`withOpSchedules`), so the result is exactly what a direct call with
+ *    those names returns;
+ *  - with `--spec <file>`, a JSON file holding either a `ScheduledOpSpec[]`
+ *    or `{ ops, options }`, for Ops triggered by a pull request or a push, a
+ *    finding mode, setup steps, or generator options. The file is passed to
+ *    the generator unchanged.
+ */
+
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { discoverOps } from "../../op/discover";
+import { generateOpsPipeline } from "../../op/generate-pipeline";
+import { GENERATED_MARKER } from "../../discovery/files";
+import { findWorkspaceRoot } from "../../project-root";
+import type { ComponentPipelineOptions, ScheduledOpSpec } from "../../lexicon";
+import { formatBold, formatError, formatSuccess } from "../format";
+import type { CommandContext } from "../registry";
+
+/** Where each forge reads its pipeline files from, relative to the repository root. `--output` overrides it. */
+export const DEFAULT_OP_PIPELINE_DIRS: Record<string, string> = {
+  github: ".github/workflows",
+  forgejo: ".forgejo/workflows",
+  gitlab: ".",
+};
+
+/** The first line of every file this command writes. */
+export function opPipelineHeader(provider: string, specFile?: string): string {
+  const command = `chant run --generate ${provider}${specFile ? ` --spec ${specFile}` : ""}`;
+  return `# ${GENERATED_MARKER}. Regenerate with: ${command}\n`;
+}
+
+interface SpecFile {
+  ops: ScheduledOpSpec[];
+  options?: ComponentPipelineOptions;
+}
+
+/** Read `--spec`: a `ScheduledOpSpec[]`, or `{ ops, options }`. Throws with the file named on anything else. */
+export function readOpSpecFile(path: string): SpecFile {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf-8"));
+  } catch (err) {
+    throw new Error(`--spec ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const shape = "an array of Op specs, or { \"ops\": [...], \"options\": {...} }";
+  const ops = Array.isArray(parsed) ? parsed : (parsed as { ops?: unknown } | null)?.ops;
+  if (!Array.isArray(ops)) throw new Error(`--spec ${path} must hold ${shape}`);
+  for (const [i, spec] of ops.entries()) {
+    if (typeof (spec as { name?: unknown })?.name !== "string") {
+      throw new Error(`--spec ${path}: entry ${i} has no "name". Each entry names the Op it generates a pipeline for.`);
+    }
+  }
+  const options = Array.isArray(parsed) ? undefined : (parsed as { options?: ComponentPipelineOptions }).options;
+  return { ops: ops as ScheduledOpSpec[], ...(options ? { options } : {}) };
+}
+
+export async function runOpGenerate(ctx: CommandContext): Promise<number> {
+  const { args } = ctx;
+  const provider = args.generate as string;
+  const specPath = args.opsSpec;
+
+  let ops: ScheduledOpSpec[];
+  let options: ComponentPipelineOptions | undefined;
+  if (specPath) {
+    try {
+      ({ ops, options } = readOpSpecFile(resolve(specPath)));
+    } catch (err) {
+      console.error(formatError({ message: err instanceof Error ? err.message : String(err) }));
+      return 1;
+    }
+  } else {
+    const discovered = await discoverOps();
+    if (discovered.errors.length > 0) {
+      for (const e of discovered.errors) console.error(formatError({ message: e }));
+      return 1;
+    }
+    ops = [...discovered.ops.entries()]
+      .filter(([, op]) => op.config.schedule)
+      .map(([name]) => name)
+      .sort()
+      .map((name) => ({ name }));
+    if (ops.length === 0) {
+      console.error(formatError({
+        message: "No Op declares a schedule, so there is nothing to generate",
+        hint: "Give an Op a `schedule`, or pass --spec <file.json> naming the Ops and their triggers.",
+      }));
+      return 1;
+    }
+  }
+
+  // Inside a workspace member (#2542), the files are the member's: filtered
+  // to its paths, run in its directory, named after it at the repository
+  // root's forge directory, and recorded as its generated files. The
+  // workspace module loads only when a declaration was found.
+  const found = findWorkspaceRoot(process.cwd());
+  let plan: import("../../workspace/member-pipeline").MemberOpPlan | undefined;
+  let memberPipeline: typeof import("../../workspace/member-pipeline") | undefined;
+  if (found) {
+    memberPipeline = await import("../../workspace/member-pipeline");
+    try {
+      plan = memberPipeline.planMemberOpPipelines({ projectDir: process.cwd(), found, provider, output: args.output, specFile: specPath });
+    } catch (err) {
+      console.error(formatError({ message: memberPipeline.describeError(err) }));
+      return 1;
+    }
+  }
+
+  const result = await generateOpsPipeline(ops, provider, plan ? { ...options, member: plan.member } : options);
+  if (!result.success) {
+    console.error(formatError({ message: result.error ?? "Failed to generate Op pipelines" }));
+    return 1;
+  }
+
+  if (plan && memberPipeline) {
+    const header = memberPipeline.generatedHeader(plan.command);
+    if (args.format === "json") {
+      const files = (result.files ?? []).map((f) => ({
+        name: f.name,
+        path: memberPipeline.repoRelative(plan.ctx, join(plan.outDir, f.name)),
+        content: header + f.yaml,
+      }));
+      console.log(JSON.stringify({ member: plan.member.name, files, jobs: result.jobs ?? [] }, null, 2));
+      return 0;
+    }
+    for (const path of memberPipeline.writeMemberOpPipelines(plan, result.files ?? [])) {
+      console.error(formatSuccess(`wrote ${formatBold(path)} for member ${formatBold(plan.member.name)}`));
+    }
+    return 0;
+  }
+
+  const header = opPipelineHeader(provider, specPath);
+  const outDir = args.output ?? DEFAULT_OP_PIPELINE_DIRS[provider] ?? ".";
+  const files = (result.files ?? []).map((f) => ({
+    name: f.name,
+    path: join(outDir, f.name),
+    content: header + f.yaml,
+  }));
+
+  if (args.format === "json") {
+    console.log(JSON.stringify({ files, jobs: result.jobs ?? [] }, null, 2));
+    return 0;
+  }
+
+  for (const file of files) {
+    const target = resolve(file.path);
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, file.content);
+    console.error(formatSuccess(`wrote ${formatBold(file.path)}`));
+  }
+  return 0;
+}

package/src/cli/handlers/run.test.ts

@@ -1157,6 +1157,53 @@ describe("runOpComponents", () => {
       vi.restoreAllMocks();
     });
 
+    test("--digest-file writes <component>=<digest> for each release the run recorded (#2602)", async () => {
+      runComponentsMock.mockResolvedValue({
+        success: true,
+        selected: ["svc", "infra"],
+        run: {
+          order: ["svc", "infra"],
+          waves: [["svc", "infra"]],
+          results: [
+            { component: "svc", ok: true, status: "ok", records: [] },
+            { component: "infra", ok: true, status: "ok", records: [] },
+          ],
+          ok: true,
+          status: "ok",
+        },
+      });
+      maybeRecordAutoReleaseMock.mockImplementation(async (info: { component: string }) =>
+        info.component === "svc"
+          ? { recorded: true, commit: "a".repeat(40), record: { version: 1, component: "svc", env: "staging", digest: "sha256:abc", gitSha: "x", runId: "local-1", timestamp: "t", actor: "a" } }
+          : { recorded: false, reason: "no-digest" });
+      writeFileSyncMock.mockClear();
+      vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+
+      const exit = await runOpComponents({ args: makeArgs({ path: "all", env: "staging", digestFile: "out/svc.digest" }), plugins: [], serializers: [] });
+
+      expect(exit).toBe(0);
+      const call = writeFileSyncMock.mock.calls.find(([path]) => String(path).endsWith("out/svc.digest"));
+      expect(call?.[1]).toBe("svc=sha256:abc\n");
+      vi.restoreAllMocks();
+    });
+
+    test("--digest-file is written empty when nothing was recorded (#2602)", async () => {
+      runComponentsMock.mockResolvedValue({
+        success: true,
+        selected: ["svc"],
+        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" },
+      });
+      maybeRecordAutoReleaseMock.mockResolvedValue({ recorded: false, reason: "opted-out" });
+      writeFileSyncMock.mockClear();
+      vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+
+      await runOpComponents({ args: makeArgs({ path: "svc", digestFile: "svc.digest" }), plugins: [], serializers: [] });
+
+      const call = writeFileSyncMock.mock.calls.find(([path]) => String(path).endsWith("svc.digest"));
+      expect(call?.[1]).toBe("");
+      vi.restoreAllMocks();
+    });
+
     test("a release-write error is surfaced as a warning but does not change the exit code", async () => {
       runComponentsMock.mockResolvedValue({
         success: true,

package/src/cli/handlers/run.ts

@@ -1,3 +1,4 @@
+import { lexiconNames } from "../../lexicon-module";
 import { resolve, dirname } from "node:path";
 import { writeFileSync, mkdirSync, readFileSync } from "node:fs";
 import { loadChantConfig, resolveAutoReleaseDisabled, type ChantConfig } from "../../config";
@@ -5,8 +6,8 @@ import { discoverOps } from "../../op/discover";
 import type { OpConfig } from "../../op/types";
 import { loadActivities, loadProfiles } from "../../op/activity-registry";
 import { runOpLocally, findPolicyGateStep, OpRunFailure, type StepRecord } from "../../op/local-executor";
-import { approveCommand } from "../../op/gate";
-import { writeGatedRunSummary, type GatedRunSummary } from "../../op/gate-summary";
+import { approveCommand, describeGateMismatch } from "../../op/gate";
+import { summaryLedgerPrefix, writeGatedRunSummary, type GatedRunSummary } from "../../op/gate-summary";
 import { createLocalOpRuntime } from "../../op/runtimes/local";
 import type { OpRuntimeProvider, OpRunStatus } from "../../op/runtime";
 import { renderHuman, renderJson } from "../../op/local-output";
@@ -20,6 +21,8 @@ import { ndjsonProgressSink } from "../../components/run-progress";
 import { maybeRecordAutoRelease } from "../../components/auto-release";
 import { maybePersistBuildManifest } from "../../components/manifest-persistence";
 import type { DriverComponentResult } from "../../components/driver";
+import type { ReleaseRecord } from "../../lifecycle/release-ledger";
+import { runOpGenerate } from "./run-generate";
 
 /**
  * The exit code a run that stopped at an unapproved gate uses (#2119).
@@ -124,7 +127,7 @@ async function resolveOpRuntime(ctx: CommandContext): Promise<OpRuntimeProvider
   // long wait to be told a name is wrong.
   let configured: string[] = [];
   try {
-    configured = (await loadChantConfig(resolve("."))).config.lexicons ?? [];
+    configured = lexiconNames((await loadChantConfig(resolve("."))).config.lexicons ?? []);
   } catch {
     // No/unreadable chant.config.ts — the error below says so by listing nothing.
   }
@@ -524,6 +527,16 @@ function refusesPolicyGateUnderSandbox(ctx: CommandContext, config: OpConfig, op
 }
 
 export async function runOp(ctx: CommandContext): Promise<number> {
+  if (ctx.args.generate) {
+    if (ctx.args.components) {
+      console.error(formatError({
+        message: "`chant run --components --generate` is not a command",
+        hint: "Generate a component pipeline with `chant build --components --generate <lexicon>`, or Op pipelines with `chant run --generate <provider>`.",
+      }));
+      return 1;
+    }
+    return runOpGenerate(ctx);
+  }
   if (ctx.args.components && ctx.args.report) {
     console.error(formatError({
       message: "--report is not supported with --components",
@@ -576,13 +589,16 @@ export async function runOp(ctx: CommandContext): Promise<number> {
  * ledger for work `chant run --components` records. Each result is filtered on
  * its own `ok`, so a fan-out that partly succeeded records exactly the
  * components that did.
+ *
+ * Returns the records it wrote, for `--digest-file` (#2602).
  */
 export async function recordAutoReleasesForRun(
   results: DriverComponentResult[],
   env: string,
   runId: string,
   disabled: boolean,
-): Promise<void> {
+): Promise<ReleaseRecord[]> {
+  const recorded: ReleaseRecord[] = [];
   for (const componentResult of results) {
     if (!componentResult.ok) continue;
     const outcome = await maybeRecordAutoRelease(
@@ -602,6 +618,7 @@ export async function recordAutoReleasesForRun(
         message: `release record for "${componentResult.component}"@${env} was not recorded: ${outcome.error}`,
       }));
     } else if (outcome.recorded) {
+      recorded.push(outcome.record);
       console.error(formatInfo(
         `Recorded release: ${formatBold(componentResult.component)}@${env} -> ${outcome.record.digest} (commit ${outcome.commit.slice(0, 7)})`,
       ));
@@ -621,6 +638,7 @@ export async function recordAutoReleasesForRun(
       ));
     }
   }
+  return recorded;
 }
 
 // ── chant run --components <name|all> ────────────────────────────────────────
@@ -748,7 +766,12 @@ export async function runOpComponents(ctx: CommandContext): Promise<number> {
     console.error(formatWarning({
       message: `component "${result.gated.component}" is gated on "${gate.gate}" — pending approval`,
     }));
-    console.error(formatInfo(`approve : ${approveCommand(gate.op, gate.gate)}`));
+    // #2574: an approval stands, but for another plan or for none. Say so,
+    // with the command that replaces it.
+    if (result.gated.mismatch) {
+      console.error(formatWarning({ message: describeGateMismatch(gate.op, gate.gate, result.gated.mismatch) }));
+    }
+    console.error(formatInfo(`approve : ${approveCommand(gate.op, gate.gate, gate.environment)}`));
     if (gate.url) console.error(formatInfo(`approve at: ${gate.url}`));
     console.error(formatInfo(`expires : ${gate.expiresAt}`));
     // #2310: this run's own append reached only the local chant/lifecycle
@@ -770,6 +793,8 @@ export async function runOpComponents(ctx: CommandContext): Promise<number> {
         ...(gate.url ? { url: gate.url } : {}),
         ...(result.gated.pushed === false ? { pushed: false, pushWarning: result.gated.pushWarning } : {}),
         ...(gate.planDigest ? { planDigest: gate.planDigest } : {}),
+        ...(await summaryLedgerPrefix()),
+        ...(gate.environment ? { environment: gate.environment } : {}),
       },
       gatedExit,
     );
@@ -778,7 +803,16 @@ export async function runOpComponents(ctx: CommandContext): Promise<number> {
 
   if (result.success && result.run) {
     const disabled = resolveAutoReleaseDisabled(config, ctx.args.noReleaseRecord);
-    await recordAutoReleasesForRun(result.run.results, env, `local-${Date.now()}`, disabled);
+    const recorded = await recordAutoReleasesForRun(result.run.results, env, `local-${Date.now()}`, disabled);
+    // `--digest-file` (#2602): the releases this run recorded, one
+    // `<component>=<digest>` line each, the form `chant components promote
+    // --digest` takes. A generated promote job reads it to promote exactly
+    // what this job built, not whatever is latest in the environment.
+    if (ctx.args.digestFile) {
+      const digestPath = resolve(ctx.args.digestFile);
+      mkdirSync(dirname(digestPath), { recursive: true });
+      writeFileSync(digestPath, recorded.map((r) => `${r.component}=${r.digest}\n`).join(""));
+    }
   }
 
   return result.success ? 0 : 1;
@@ -891,6 +925,7 @@ export async function runOpOnRuntime(ctx: CommandContext): Promise<number> {
               ? { pushed: false, pushWarning: status.result.gatePushWarning }
               : {}),
             ...(pending?.planDigest ? { planDigest: pending.planDigest } : {}),
+            ...(await summaryLedgerPrefix()),
           },
           gatedExit,
         );

package/src/cli/handlers/vendor.ts

@@ -1,61 +1,165 @@
-import { resolve } from "node:path";
-import { vendorPull, vendorCheck } from "../commands/vendor";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { vendorPull, vendorCheck, MANIFEST_FILE } from "../commands/vendor";
 import { formatError, formatSuccess, formatWarning } from "../format";
 import type { CommandContext } from "../registry";
 
 /**
- * `chant vendor [pull|check]` — pull pinned, checksummed patterns into the repo,
- * or check vendored targets against their recorded pin. Defaults to `pull`.
+ * Where the lineage lock lives (`../../workspace/lineage-lock.ts` owns the
+ * constant). Repeated here so that finding out whether a lock exists loads no
+ * workspace module: a project with only `vendor.json` must see today's
+ * `chant vendor` exactly (#2525 rule 2).
+ */
+const LOCK_FILE = ".chant/workspace.lock.json";
+
+/**
+ * `chant vendor [pull|check|migrate]` — pull pinned, checksummed patterns into
+ * the repo, check vendored targets against their pin, or move `vendor.json`
+ * into the lineage lock. Defaults to `pull`.
  *
- * The manifest (`vendor.json`) lives in the current directory.
+ * `vendor.json` and the lock both live in the current directory. With no lock,
+ * `pull` and `check` read `vendor.json` exactly as before. With a lock, its
+ * vendor scopes are pulled file by file (local edits are kept, conflicts
+ * become manual steps), and any `vendor.json` entries not yet migrated are
+ * still pulled the old way (#2540).
  */
 export async function runVendor(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
-  // `chant vendor` → pull; `chant vendor pull|check [name]`.
+  // `chant vendor` → pull; `chant vendor pull|check|migrate [name]`.
   const sub = args.path === "." ? "pull" : args.path;
   const manifestDir = resolve(".");
 
-  if (sub === "pull") {
-    try {
-      const result = await vendorPull(manifestDir, args.extraPositional);
-      if (!result.success) {
-        console.error(formatError({ message: result.output }));
-        return 1;
-      }
-      console.log(result.output);
-      console.error(formatSuccess(`Vendored ${result.pulled.length} artifact(s)`));
-      return 0;
-    } catch (err) {
-      console.error(formatError({ message: err instanceof Error ? err.message : String(err) }));
-      return 1;
-    }
-  }
-
-  if (sub === "check") {
-    try {
-      const result = vendorCheck(manifestDir);
-      console.log(result.output);
-      if (!result.drift) {
-        console.error(formatSuccess("All vendored artifacts match their pin"));
-        return 0;
-      }
-      // Drift is allowed (you may edit vendored files); fail only in CI so a
-      // pipeline catches unrecorded changes, warn locally.
-      if (process.env.CI) {
-        console.error(formatError({ message: "Vendored content drifted from the manifest pin" }));
-        return 1;
-      }
-      console.error(formatWarning({ message: "Vendored content drifted from the manifest pin (run `chant vendor pull` to re-pin)" }));
-      return 0;
-    } catch (err) {
-      console.error(formatError({ message: err instanceof Error ? err.message : String(err) }));
-      return 1;
-    }
+  try {
+    if (sub === "migrate") return await runMigrate(manifestDir);
+    const locked = await hasVendorScopes(manifestDir);
+    if (sub === "pull") return locked ? await runLockedPull(manifestDir, args.extraPositional) : await runPull(manifestDir, args.extraPositional);
+    if (sub === "check") return locked ? await runLockedCheck(manifestDir) : runCheck(manifestDir);
+  } catch (err) {
+    console.error(formatError({ message: err instanceof Error ? err.message : String(err) }));
+    return 1;
   }
 
   console.error(formatError({
     message: `Unknown vendor subcommand: ${sub}`,
-    hint: "Available: chant vendor pull [name], chant vendor check",
+    hint: "Available: chant vendor pull [name], chant vendor check, chant vendor migrate",
   }));
   return 1;
 }
+
+/**
+ * Whether the lock holds any vendor scope. Without a lock file this loads
+ * nothing; a lock with no vendor scope (say, one `chant init --template`
+ * wrote) leaves `chant vendor` on `vendor.json` as before.
+ */
+async function hasVendorScopes(root: string): Promise<boolean> {
+  if (!existsSync(join(root, LOCK_FILE))) return false;
+  const { readLock } = await import("../../workspace/lineage-lock");
+  const lock = readLock(root);
+  return !!lock && Object.values(lock.scopes).some((l) => l.kind === "vendor");
+}
+
+// ── vendor.json only: unchanged ──────────────────────────────────────────────
+
+async function runPull(manifestDir: string, only?: string): Promise<number> {
+  const result = await vendorPull(manifestDir, only);
+  if (!result.success) {
+    console.error(formatError({ message: result.output }));
+    return 1;
+  }
+  console.log(result.output);
+  console.error(formatSuccess(`Vendored ${result.pulled.length} artifact(s)`));
+  return 0;
+}
+
+function runCheck(manifestDir: string): number {
+  const result = vendorCheck(manifestDir);
+  console.log(result.output);
+  if (!result.drift) {
+    console.error(formatSuccess("All vendored artifacts match their pin"));
+    return 0;
+  }
+  // Drift is allowed (you may edit vendored files); fail only in CI so a
+  // pipeline catches unrecorded changes, warn locally.
+  if (process.env.CI) {
+    console.error(formatError({ message: "Vendored content drifted from the manifest pin" }));
+    return 1;
+  }
+  console.error(formatWarning({ message: "Vendored content drifted from the manifest pin (run `chant vendor pull` to re-pin)" }));
+  return 0;
+}
+
+// ── With a lineage lock ──────────────────────────────────────────────────────
+
+const MIGRATE_HINT = `${MANIFEST_FILE} entries are not in ${LOCK_FILE} yet, and pull still overwrites their targets. Run \`chant vendor migrate\` to move them.`;
+
+async function runLockedPull(root: string, only?: string): Promise<number> {
+  const lv = await import("../../workspace/lineage-vendor");
+  const hasManifest = lv.manifestPresent(root);
+  const legacy = hasManifest ? (await import("../commands/vendor")).loadManifest(root).manifest.vendored : [];
+  const legacyMatch = only ? legacy.some((e) => e.name === only) : legacy.length > 0;
+
+  const pulled = await lv.pullLockedScopes(root, only);
+  if (only && pulled.length === 0 && !legacyMatch) {
+    console.error(formatError({ message: `no vendored entry named "${only}"` }));
+    return 1;
+  }
+  const lines = pulled.map(lv.formatLockedPull);
+  let count = pulled.length;
+  if (legacyMatch) {
+    const result = await vendorPull(root, only);
+    lines.push(result.output);
+    count += result.pulled.length;
+  }
+  if (lines.length > 0) console.log(lines.join("\n"));
+  if (legacyMatch) console.error(formatWarning({ message: MIGRATE_HINT }));
+
+  const steps = pulled.reduce((n, p) => n + p.manualSteps.length, 0);
+  if (steps > 0) {
+    console.error(formatWarning({
+      message: `Vendored ${count} artifact(s); ${steps} file(s) changed both here and upstream were left as they are`,
+    }));
+    console.error("  Merge each by hand, then run `chant workspace lineage resolve <path>`.");
+    return 0;
+  }
+  console.error(formatSuccess(`Vendored ${count} artifact(s)`));
+  return 0;
+}
+
+async function runLockedCheck(root: string): Promise<number> {
+  const lv = await import("../../workspace/lineage-vendor");
+  const checks = lv.checkLockedScopes(root);
+  const lines = checks.map(lv.formatLockedCheck);
+  let drift = checks.some(lv.lockedCheckFails);
+  if (lv.manifestPresent(root)) {
+    const legacy = vendorCheck(root);
+    if (legacy.output) lines.push(legacy.output);
+    drift ||= legacy.drift;
+    console.error(formatWarning({ message: MIGRATE_HINT }));
+  }
+  if (lines.length > 0) console.log(lines.join("\n"));
+  if (!drift) {
+    console.error(formatSuccess("All vendored artifacts match their pin, or carry local edits"));
+    return 0;
+  }
+  const message = "Vendored content has open manual steps or missing targets";
+  if (process.env.CI) {
+    console.error(formatError({ message }));
+    return 1;
+  }
+  console.error(formatWarning({ message: `${message} (see \`chant workspace lineage\`)` }));
+  return 0;
+}
+
+async function runMigrate(root: string): Promise<number> {
+  const { migrateVendorManifest } = await import("../../workspace/lineage-vendor");
+  const result = await migrateVendorManifest(root);
+  for (const m of result.migrated) {
+    console.log(`  ${m.name} → ${m.target} (${m.pinned ? `${m.files} file(s)` : "unpinned"})`);
+  }
+  console.error(
+    formatSuccess(
+      `Moved ${result.migrated.length} vendored artifact(s) from ${MANIFEST_FILE} into ${LOCK_FILE}${result.lockCreated ? " (created)" : ""}; ${MANIFEST_FILE} removed`,
+    ),
+  );
+  return 0;
+}