@intentius/chant 0.80.0 → 0.81.0

package/src/cli/handlers/vendor.ts

@@ -1,61 +1,165 @@
-import { resolve } from "node:path";
-import { vendorPull, vendorCheck } from "../commands/vendor";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { vendorPull, vendorCheck, MANIFEST_FILE } from "../commands/vendor";
 import { formatError, formatSuccess, formatWarning } from "../format";
 import type { CommandContext } from "../registry";
 
 /**
- * `chant vendor [pull|check]` — pull pinned, checksummed patterns into the repo,
- * or check vendored targets against their recorded pin. Defaults to `pull`.
+ * Where the lineage lock lives (`../../workspace/lineage-lock.ts` owns the
+ * constant). Repeated here so that finding out whether a lock exists loads no
+ * workspace module: a project with only `vendor.json` must see today's
+ * `chant vendor` exactly (#2525 rule 2).
+ */
+const LOCK_FILE = ".chant/workspace.lock.json";
+
+/**
+ * `chant vendor [pull|check|migrate]` — pull pinned, checksummed patterns into
+ * the repo, check vendored targets against their pin, or move `vendor.json`
+ * into the lineage lock. Defaults to `pull`.
  *
- * The manifest (`vendor.json`) lives in the current directory.
+ * `vendor.json` and the lock both live in the current directory. With no lock,
+ * `pull` and `check` read `vendor.json` exactly as before. With a lock, its
+ * vendor scopes are pulled file by file (local edits are kept, conflicts
+ * become manual steps), and any `vendor.json` entries not yet migrated are
+ * still pulled the old way (#2540).
  */
 export async function runVendor(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
-  // `chant vendor` → pull; `chant vendor pull|check [name]`.
+  // `chant vendor` → pull; `chant vendor pull|check|migrate [name]`.
   const sub = args.path === "." ? "pull" : args.path;
   const manifestDir = resolve(".");
 
-  if (sub === "pull") {
-    try {
-      const result = await vendorPull(manifestDir, args.extraPositional);
-      if (!result.success) {
-        console.error(formatError({ message: result.output }));
-        return 1;
-      }
-      console.log(result.output);
-      console.error(formatSuccess(`Vendored ${result.pulled.length} artifact(s)`));
-      return 0;
-    } catch (err) {
-      console.error(formatError({ message: err instanceof Error ? err.message : String(err) }));
-      return 1;
-    }
-  }
-
-  if (sub === "check") {
-    try {
-      const result = vendorCheck(manifestDir);
-      console.log(result.output);
-      if (!result.drift) {
-        console.error(formatSuccess("All vendored artifacts match their pin"));
-        return 0;
-      }
-      // Drift is allowed (you may edit vendored files); fail only in CI so a
-      // pipeline catches unrecorded changes, warn locally.
-      if (process.env.CI) {
-        console.error(formatError({ message: "Vendored content drifted from the manifest pin" }));
-        return 1;
-      }
-      console.error(formatWarning({ message: "Vendored content drifted from the manifest pin (run `chant vendor pull` to re-pin)" }));
-      return 0;
-    } catch (err) {
-      console.error(formatError({ message: err instanceof Error ? err.message : String(err) }));
-      return 1;
-    }
+  try {
+    if (sub === "migrate") return await runMigrate(manifestDir);
+    const locked = await hasVendorScopes(manifestDir);
+    if (sub === "pull") return locked ? await runLockedPull(manifestDir, args.extraPositional) : await runPull(manifestDir, args.extraPositional);
+    if (sub === "check") return locked ? await runLockedCheck(manifestDir) : runCheck(manifestDir);
+  } catch (err) {
+    console.error(formatError({ message: err instanceof Error ? err.message : String(err) }));
+    return 1;
   }
 
   console.error(formatError({
     message: `Unknown vendor subcommand: ${sub}`,
-    hint: "Available: chant vendor pull [name], chant vendor check",
+    hint: "Available: chant vendor pull [name], chant vendor check, chant vendor migrate",
   }));
   return 1;
 }
+
+/**
+ * Whether the lock holds any vendor scope. Without a lock file this loads
+ * nothing; a lock with no vendor scope (say, one `chant init --template`
+ * wrote) leaves `chant vendor` on `vendor.json` as before.
+ */
+async function hasVendorScopes(root: string): Promise<boolean> {
+  if (!existsSync(join(root, LOCK_FILE))) return false;
+  const { readLock } = await import("../../workspace/lineage-lock");
+  const lock = readLock(root);
+  return !!lock && Object.values(lock.scopes).some((l) => l.kind === "vendor");
+}
+
+// ── vendor.json only: unchanged ──────────────────────────────────────────────
+
+async function runPull(manifestDir: string, only?: string): Promise<number> {
+  const result = await vendorPull(manifestDir, only);
+  if (!result.success) {
+    console.error(formatError({ message: result.output }));
+    return 1;
+  }
+  console.log(result.output);
+  console.error(formatSuccess(`Vendored ${result.pulled.length} artifact(s)`));
+  return 0;
+}
+
+function runCheck(manifestDir: string): number {
+  const result = vendorCheck(manifestDir);
+  console.log(result.output);
+  if (!result.drift) {
+    console.error(formatSuccess("All vendored artifacts match their pin"));
+    return 0;
+  }
+  // Drift is allowed (you may edit vendored files); fail only in CI so a
+  // pipeline catches unrecorded changes, warn locally.
+  if (process.env.CI) {
+    console.error(formatError({ message: "Vendored content drifted from the manifest pin" }));
+    return 1;
+  }
+  console.error(formatWarning({ message: "Vendored content drifted from the manifest pin (run `chant vendor pull` to re-pin)" }));
+  return 0;
+}
+
+// ── With a lineage lock ──────────────────────────────────────────────────────
+
+const MIGRATE_HINT = `${MANIFEST_FILE} entries are not in ${LOCK_FILE} yet, and pull still overwrites their targets. Run \`chant vendor migrate\` to move them.`;
+
+async function runLockedPull(root: string, only?: string): Promise<number> {
+  const lv = await import("../../workspace/lineage-vendor");
+  const hasManifest = lv.manifestPresent(root);
+  const legacy = hasManifest ? (await import("../commands/vendor")).loadManifest(root).manifest.vendored : [];
+  const legacyMatch = only ? legacy.some((e) => e.name === only) : legacy.length > 0;
+
+  const pulled = await lv.pullLockedScopes(root, only);
+  if (only && pulled.length === 0 && !legacyMatch) {
+    console.error(formatError({ message: `no vendored entry named "${only}"` }));
+    return 1;
+  }
+  const lines = pulled.map(lv.formatLockedPull);
+  let count = pulled.length;
+  if (legacyMatch) {
+    const result = await vendorPull(root, only);
+    lines.push(result.output);
+    count += result.pulled.length;
+  }
+  if (lines.length > 0) console.log(lines.join("\n"));
+  if (legacyMatch) console.error(formatWarning({ message: MIGRATE_HINT }));
+
+  const steps = pulled.reduce((n, p) => n + p.manualSteps.length, 0);
+  if (steps > 0) {
+    console.error(formatWarning({
+      message: `Vendored ${count} artifact(s); ${steps} file(s) changed both here and upstream were left as they are`,
+    }));
+    console.error("  Merge each by hand, then run `chant workspace lineage resolve <path>`.");
+    return 0;
+  }
+  console.error(formatSuccess(`Vendored ${count} artifact(s)`));
+  return 0;
+}
+
+async function runLockedCheck(root: string): Promise<number> {
+  const lv = await import("../../workspace/lineage-vendor");
+  const checks = lv.checkLockedScopes(root);
+  const lines = checks.map(lv.formatLockedCheck);
+  let drift = checks.some(lv.lockedCheckFails);
+  if (lv.manifestPresent(root)) {
+    const legacy = vendorCheck(root);
+    if (legacy.output) lines.push(legacy.output);
+    drift ||= legacy.drift;
+    console.error(formatWarning({ message: MIGRATE_HINT }));
+  }
+  if (lines.length > 0) console.log(lines.join("\n"));
+  if (!drift) {
+    console.error(formatSuccess("All vendored artifacts match their pin, or carry local edits"));
+    return 0;
+  }
+  const message = "Vendored content has open manual steps or missing targets";
+  if (process.env.CI) {
+    console.error(formatError({ message }));
+    return 1;
+  }
+  console.error(formatWarning({ message: `${message} (see \`chant workspace lineage\`)` }));
+  return 0;
+}
+
+async function runMigrate(root: string): Promise<number> {
+  const { migrateVendorManifest } = await import("../../workspace/lineage-vendor");
+  const result = await migrateVendorManifest(root);
+  for (const m of result.migrated) {
+    console.log(`  ${m.name} → ${m.target} (${m.pinned ? `${m.files} file(s)` : "unpinned"})`);
+  }
+  console.error(
+    formatSuccess(
+      `Moved ${result.migrated.length} vendored artifact(s) from ${MANIFEST_FILE} into ${LOCK_FILE}${result.lockCreated ? " (created)" : ""}; ${MANIFEST_FILE} removed`,
+    ),
+  );
+  return 0;
+}

package/src/cli/main.test.ts

@@ -269,6 +269,18 @@ describe("parseArgs", () => {
     expect(result.actor).toBe("alice");
   });
 
+  test("--digest repeats for components promote, and --digest-file is parsed (#2602)", () => {
+    const promote = parseArgs([
+      "components", "promote", "--from", "staging", "--to", "prod",
+      "--digest", "api=sha256:a", "--digest", "web=sha256:w",
+    ]);
+    expect(promote.digests).toEqual(["api=sha256:a", "web=sha256:w"]);
+    expect(promote.digest).toBe("web=sha256:w");
+
+    const run = parseArgs(["run", "--components", "api", "--env", "staging", "--digest-file", "api.digest"]);
+    expect(run.digestFile).toBe("api.digest");
+  });
+
   test("parses --compare-to and --live for components status", () => {
     const result = parseArgs(["components", "status", "prod", "--compare-to", "staging", "--live", "--json"]);
     expect(result.command).toBe("components");
@@ -306,6 +318,17 @@ describe("parseArgs", () => {
     expect(() => parseArgs(["build", "--promote-to", "--env", "x"])).toThrow(/--promote-to needs an environment/);
   });
 
+  test("--promote-to outside build --components --generate is refused, naming the flags it needs (#2603)", () => {
+    const needs = /--promote-to needs build --components --generate <lexicon>/;
+    expect(() => parseArgs(["build", "--promote-to", "prod"])).toThrow(needs);
+    expect(() => parseArgs(["build", "--components", "--promote-to", "prod"])).toThrow(needs);
+    expect(() => parseArgs(["build", "--generate", "github", "--promote-to", "prod"])).toThrow(needs);
+    expect(() => parseArgs(["run", "--components", "all", "--generate", "github", "--promote-to", "prod"])).toThrow(needs);
+    expect(() => parseArgs(["components", "promote", "--from", "staging", "--promote-to", "prod"])).toThrow(needs);
+    // Flag order does not matter: the check runs once the whole line is parsed.
+    expect(parseArgs(["build", "--promote-to", "prod", "--generate", "gitlab", "--components"]).promoteTo).toBe("prod");
+  });
+
   test("parses --no-release-record for run --components", () => {
     const result = parseArgs(["run", "--components", "search-service", "--env", "staging", "--no-release-record"]);
     expect(result.components).toBe(true);
@@ -653,7 +676,7 @@ describe("workspace records (#2546)", () => {
 
   test("resolves to the records command, and anything else under workspace to its fallback", () => {
     expect(resolveCommand(parseArgs(["workspace", "records", "--kind", "k.mjs"]), commandRegistry)?.def.name).toBe("workspace records");
-    expect(resolveCommand(parseArgs(["workspace", "ls"]), commandRegistry)?.def.name).toBe("workspace");
+    expect(resolveCommand(parseArgs(["workspace", "no-such-subcommand"]), commandRegistry)?.def.name).toBe("workspace");
   });
 
   // #2525 rule 5: the workspace code loads only when a workspace command runs.
@@ -665,6 +688,54 @@ describe("workspace records (#2546)", () => {
   });
 });
 
+describe("workspace init and ls (#2534)", () => {
+  test("resolve to their commands in the one workspace group, with the directory as extra positional", () => {
+    const ls = parseArgs(["workspace", "ls", "examples", "--at", "HEAD", "--json"]);
+    expect(ls).toMatchObject({ command: "workspace", path: "ls", extraPositional: "examples", at: "HEAD", json: true });
+    expect(resolveCommand(ls, commandRegistry)?.def.name).toBe("workspace ls");
+    const init = parseArgs(["workspace", "init", "--name", "acme", "--yes"]);
+    expect(init).toMatchObject({ command: "workspace", path: "init", selectName: "acme", yes: true });
+    expect(resolveCommand(init, commandRegistry)?.def.name).toBe("workspace init");
+    expect(commandRegistry.filter((c) => c.name === "workspace" || c.name.startsWith("workspace ")).map((c) => c.name).sort()).toEqual([
+      "workspace",
+      "workspace audit",
+      "workspace build",
+      "workspace check",
+      "workspace graph",
+      "workspace init",
+      "workspace lineage",
+      "workspace lint",
+      "workspace ls",
+      "workspace member-run",
+      "workspace records",
+      "workspace status",
+      "workspace upgrade",
+      "workspace verify",
+    ]);
+  });
+
+  test("load their modules only when they run", () => {
+    const source = readFileSync(join(import.meta.dirname, "main.ts"), "utf-8");
+    expect(source).toMatch(/await import\("\.\.\/workspace\/init"\)/);
+    expect(source).toMatch(/await import\("\.\.\/workspace\/ls"\)/);
+  });
+});
+
+describe("workspace status (#2544)", () => {
+  test("takes the environment as extra positional, a directory after it, and --compare-to", () => {
+    const status = parseArgs(["workspace", "status", "staging", "apps", "--compare-to", "prod", "--json"]);
+    expect(status).toMatchObject({ command: "workspace", path: "status", extraPositional: "staging", extraPositional2: "apps", compareTo: "prod", json: true });
+    expect(resolveCommand(status, commandRegistry)?.def.name).toBe("workspace status");
+    // --compare-to --live parses, so the command can say live isn't read yet.
+    expect(parseArgs(["workspace", "status", "prod", "--compare-to", "--live"]).compareTo).toBe("--live");
+  });
+
+  test("loads its module only when it runs", () => {
+    const source = readFileSync(join(import.meta.dirname, "main.ts"), "utf-8");
+    expect(source).toMatch(/await import\("\.\.\/workspace\/status"\)/);
+  });
+});
+
 describe("waitForStreamDrain", () => {
   // Minimal writable stub — just the surface waitForStreamDrain reads.
   function fakeStream(len: number): NodeJS.WriteStream & { writableLength: number } {
@@ -711,3 +782,36 @@ describe("waitForStreamDrain", () => {
     await expect(p).resolves.toBeUndefined();
   });
 });
+
+describe("per-member commands and the root refusal (#2537)", () => {
+  test("--root-only is a boolean, and --member repeats and splits on commas", () => {
+    expect(parseArgs(["build", "--root-only"]).rootOnly).toBe(true);
+    expect(parseArgs(["lint", "src"]).rootOnly).toBeUndefined();
+    expect(() => parseArgs(["build", "--root-only=yes"])).toThrow();
+    const args = parseArgs(["workspace", "lint", "--member", "api,web", "--member", "examples", "--format", "sarif"]);
+    expect(args).toMatchObject({ command: "workspace", path: "lint", members: ["api", "web", "examples"], format: "sarif" });
+    expect(() => parseArgs(["workspace", "build", "--member"])).toThrow(/--member needs a member or group name/);
+  });
+
+  test("workspace build, lint, audit and graph resolve to their commands", () => {
+    for (const verb of ["build", "lint", "audit", "graph"]) {
+      expect(resolveCommand(parseArgs(["workspace", verb, "some/dir"]), commandRegistry)?.def.name).toBe(`workspace ${verb}`);
+    }
+  });
+
+  test("the refusal and the per-member code load only when used", () => {
+    const source = readFileSync(join(import.meta.dirname, "main.ts"), "utf-8");
+    expect(source).toMatch(/await import\("\.\.\/workspace\/root-refusal"\)/);
+    expect(source).toMatch(/await import\("\.\.\/workspace\/member-commands"\)/);
+    expect(source).toMatch(/await import\("\.\.\/workspace\/member-run"\)/);
+  });
+});
+
+describe("chant workspace check --generated (#2641)", () => {
+  test("is a boolean flag, distinct from --generate <lexicon>", () => {
+    expect(parseArgs(["workspace", "check", "--generated", "--json"])).toMatchObject({ command: "workspace", path: "check", generated: true, json: true });
+    expect(parseArgs(["workspace", "check"]).generated).toBeUndefined();
+    expect(parseArgs(["build", "--generate", "github"]).generated).toBeUndefined();
+    expect(() => parseArgs(["workspace", "check", "--generated=yes"])).toThrow();
+  });
+});