@intentius/chant 0.80.0 → 0.81.0

package/src/cli/main.ts

@@ -6,6 +6,7 @@ import { formatSuccess, formatError } from "./format";
 import { loadPlugins, resolveProjectLexicons } from "./plugins";
 import { resolveCommand, type CommandDef, type ParsedArgs } from "./registry";
 import { loadChantConfigUpward } from "../config";
+import { findProjectRoot, findWorkspaceRoot } from "../project-root";
 import { validateLexiconConfig, formatLexiconConfigProblems } from "../lexicon-config";
 import { armSandboxConfigEvaluation } from "../config-sandbox";
 import { armSandboxPolicyExecution } from "../lint/policy-import";
@@ -27,7 +28,7 @@ import { runCarveStatus } from "./handlers/carve-status";
 import { runLifecycleSnapshot, runLifecycleShow, runLifecycleDiff, runLifecycleRollback, runLifecyclePlan, runLifecycleAffected, runLifecycleLog, runLifecycleTeardown, runLifecycleWhoami, runLifecycleUnknown } from "./handlers/lifecycle";
 import { runComponentsStatus, runComponentsReleaseRecord, runComponentsExport, runComponentsUnknown } from "./handlers/components";
 import { runComponentsFanOut } from "./handlers/fan-out";
-import { runComponentsPromote, runComponentsRollback } from "./handlers/promote";
+import { runComponentsPromote, runComponentsRollback, runComponentsRedeploy } from "./handlers/promote";
 import { runScenarioCheck, runScenarioUnknown } from "./handlers/scenario";
 import { runGraph } from "./handlers/graph";
 import { runExplain } from "./handlers/explain";
@@ -95,6 +96,9 @@ const BOOLEAN_FLAGS = new Set([
   "--durable-requests",
   "--skip-mcp",
   "--current",
+  "--allow-code",
+  "--root-only",
+  "--generated",
 ]);
 
 /**
@@ -207,9 +211,9 @@ export function parseArgs(args: string[]): ParsedArgs {
       if (v !== "source" && v !== "live") throw new Error(`--overlay-anchor must be 'source' or 'live', got '${v}'`);
       result.overlayAnchor = v;
     } else if (arg === "--from") {
-      // Shared by `migrate --from <lexicon>`, `import --from <env>` and
-      // `components promote --from <env>`; the commands never run together,
-      // so one field carries all three.
+      // Shared by `migrate --from <lexicon>`, `import --from <env>`,
+      // `components promote --from <env>` and `init --from <repo>@<ref>`;
+      // the commands never run together, so one field carries all four.
       result.migrateFrom = args[++i];
     } else if (arg === "--kustomize") {
       // `chant import --kustomize <dir>` (#1548): render the overlay, import
@@ -298,6 +302,8 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.opsSpec = args[++i];
     } else if (arg === "--dump-outputs") {
       result.dumpOutputs = args[++i];
+    } else if (arg === "--digest-file") {
+      result.digestFile = args[++i];
     } else if (arg === "--seed-outputs") {
       (result.seedOutputs ??= []).push(args[++i]);
     } else if (arg === "--detail") {
@@ -359,6 +365,10 @@ export function parseArgs(args: string[]): ParsedArgs {
       if (!result.kind || result.kind.startsWith("-")) throw new Error("--kind needs a kind file: --kind <path>");
     } else if (arg === "--current") {
       result.current = true;
+    } else if (arg === "--require") {
+      // `chant workspace records|verify --require attested` (#2547)
+      result.require = args[++i];
+      if (!result.require || result.require.startsWith("-")) throw new Error("--require needs a provenance level: --require attested");
     } else if (arg === "--ambient") {
       result.ambient = true;
     } else if (arg === "--check-live") {
@@ -379,6 +389,7 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.component = args[++i];
     } else if (arg === "--digest") {
       result.digest = args[++i];
+      if (result.digest !== undefined) (result.digests ??= []).push(result.digest);
     } else if (arg === "--git-sha") {
       result.gitSha = args[++i];
     } else if (arg === "--run-id") {
@@ -445,6 +456,24 @@ export function parseArgs(args: string[]): ParsedArgs {
     } else if (arg === "--agent") {
       // #2508 — record the approval as an agent's rather than a person's.
       result.agent = true;
+    } else if (arg === "--allow-code") {
+      // #2550 — `chant workspace upgrade` runs a template's code migrations
+      // only when asked to.
+      result.allowCode = true;
+    } else if (arg === "--root-only") {
+      // #2537 — `chant build` and `chant lint` at a declared workspace root
+      // run on the root project alone instead of refusing with WSP000.
+      result.rootOnly = true;
+    } else if (arg === "--generated") {
+      // #2641 — `chant workspace check --generated` runs each declared
+      // generator and compares its output with the file in the tree.
+      result.generated = true;
+    } else if (arg === "--member") {
+      // #2537 — `chant workspace build|lint|audit|graph --member <name>`.
+      // Repeatable, and a comma list works too.
+      const value = args[++i];
+      if (!value || value.startsWith("-")) throw new Error("--member needs a member or group name: --member <name>");
+      result.members = [...(result.members ?? []), ...value.split(",").map((m) => m.trim()).filter(Boolean)];
     } else if (arg === "--allow-same-origin") {
       // chant#2384 — record a resolution the same-origin rule would refuse,
       // deliberately. Flagged on the record, not just accepted quietly.
@@ -488,6 +517,19 @@ export function parseArgs(args: string[]): ParsedArgs {
     i++;
   }
 
+  // #2603 — `--promote-to` (#2575) adds a job to the pipeline that generate
+  // mode synthesizes; no other command or mode reads it. Checked here, once
+  // the whole command line is known, rather than in the build handler, so
+  // `chant build --promote-to prod` and `chant run --promote-to prod` both
+  // fail instead of running as if the flag were absent. A lexicon-mounted
+  // command that takes its own `--promote-to` still gets it: `main` tries the
+  // plugin commands before rethrowing a parse error.
+  if (result.promoteTo && !(result.command === "build" && result.components && result.generate)) {
+    throw new Error(
+      "--promote-to needs build --components --generate <lexicon>: it adds a promote job to the generated CI pipeline, and only generate mode emits one.",
+    );
+  }
+
   return result;
 }
 
@@ -506,6 +548,10 @@ Usage:
 
 Commands:
   init                  Initialize a new chant project
+                        (--from <repo>@<ref>[#<member>] copies a template
+                        repository and records its lineage; --param
+                        <name>=<value> sets a parameter the template's
+                        chant.template.json declares, repeatable)
   init lexicon <name>   Scaffold a new lexicon plugin project
   build                 Build infrastructure from specification files
                         (--components --generate github|gitlab|forgejo:
@@ -513,7 +559,10 @@ Commands:
                          pipeline that triggers each discovered component's
                          own deploy in wave order, instead of a normal
                          lexicon build)
+                        At a declared workspace root it refuses with WSP000;
+                        --root-only builds the root project alone
   lint                  Check specifications for issues
+                        (at a declared workspace root: WSP000 unless --root-only)
   list                  List discovered entities
   describe              Show the effective config for one component
   explain               Summarize discovered entities (--format markdown|json|okf;
@@ -521,6 +570,8 @@ Commands:
                         concept per entity + index.md; -o <dir> writes the
                         bundle tree, otherwise JSON path→content on stdout)
   vendor                Pull pinned, checksummed patterns into your repo
+                        (pull [name] | check | migrate; migrate moves
+                        vendor.json into .chant/workspace.lock.json)
   import                Import external template into TypeScript
                         (--agents re-expresses this machine's agent config as
                          chant code instead of reading a template file)
@@ -639,12 +690,75 @@ Ops:
                         predicts the account. The level reaches the engine
                         verbatim; without the flag nothing is asked (#2377)
 
-Workspace (first-test slice, #2546):
-  workspace records --kind <kind file> [--current] [--at <rev>] [--json]
+Workspace (level 1, #2524):
+  workspace init [dir]  Propose a chant.workspace.json from the projects and
+                        packages already in the repository, print it with the
+                        directories that would leave the root project, and
+                        write it only on confirmation (--yes writes without
+                        asking; --name <name> names the workspace; --verbose
+                        lists every file leaving the root project)
+  workspace ls [dir]    List the declaration's members and example groups.
+                        A member that can't be read is listed with a reason
+                        code and still exits 0. --at <rev> reads a commit's
+                        git objects; --json prints the read-contract document
+  workspace status <env> [dir] [--compare-to <env>] [--json]
+                        Each member's latest release in <env>, as digest and
+                        git SHA, read from its ledger on the local
+                        chant/lifecycle branch (_members/<member>/ or the flat
+                        layout). --compare-to <env> shows a second environment
+                        beside it and marks the members whose digests differ.
+                        Read only; never fetches. --json prints the
+                        read-contract document
+  workspace records --kind <kind file> [--current] [--at <rev>] [--base <rev>] [--require attested] [--json]
                         Read the records a record kind locates, validated
                         against its schema, with reason codes for invalid
                         ones. --current leaves out superseded records; --at
-                        reads a commit's git objects. Needs no workspace file
+                        reads a commit's git objects. Needs no workspace file.
+                        Each record reports its provenance level, judged by
+                        the signers at --base (default: the target branch);
+                        --require attested exits 2 if any record is not
+                        attested
+  workspace verify [--base <rev>] [--head <rev>] [--require attested]
+                        Check the commits in base..head against the signers
+                        and roles read from base. A change to the signers file
+                        or .chant/trust.json needs a signature by a signer
+                        trusted at base. Does nothing without a signers file
+  workspace lineage [--json]
+                        Show each scope in .chant/workspace.lock.json: its
+                        template and pin, locally edited files and open
+                        manual steps. Needs no workspace file
+  workspace lineage resolve <path>
+                        Close a manual step once the file is merged by hand
+  workspace upgrade [<scope>] [--to <ref>] [--allow-code] [--dry-run] [--output <file>]
+                        Bring a lineage scope to a newer template version: fetch
+                        it, migrate and merge per file in a worktree, run build,
+                        lint and workspace check there, then gate on the digest
+                        of the patch (chant approve workspace-upgrade <scope>).
+                        A second run with the approval applies the patch
+  workspace check [--at <rev>] [--json] [--format stylish|json|sarif] [--generated]
+                        Fail on an unreadable lineage lock or an open manual
+                        step, and, in a declared workspace, on a WSP check of
+                        the declaration, member ledgers, pipelines or
+                        generated files. --generated runs declared generators
+                        and compares their output. Needs no workspace file.
+                        --at reads a commit's git objects; --format json
+                        prints the read-contract document
+  workspace build [dir] [--member <name>] [-o <dir>] [--dry-run]
+                        Build every chant member and example project, each with
+                        its own chant, one process per toolchain. -o <dir>
+                        writes <dir>/<member>.json; --member narrows the run;
+                        --dry-run prints which chant runs which project
+  workspace lint [dir] [--format stylish|json|sarif] [--member <name>]
+                        Lint every chant member and example project with its
+                        own chant; sarif writes one run per member
+  workspace audit [dir] [--json] [--member <name>]
+                        Audit each chant member with its own .chant-audit.json;
+                        every finding carries a member field
+  workspace graph [dir] [--at <rev>] [--member <name>] [-o <file>]
+                        Compose each chant member's chant graph into one IR,
+                        with <member>/<id> ids and groups.byMember: the
+                        read-contract document. --at <rev> runs each member's
+                        source as it was at that commit
 
 Lifecycle (alias: lc):
   lifecycle snapshot <env>  Query API, save metadata to orphan branch
@@ -710,6 +824,10 @@ Component release ledger + status:
                             from its recorded digest (--component <name>
                             [--digest <sha256:...>]; defaults to the release
                             before the current one; --dry-run prints the plan)
+  components redeploy <env> Redeploy the release an environment's ledger
+                            records as current, after a deploy that failed
+                            partway (--component <name> [--digest <sha256:...>];
+                            --dry-run prints the plan; gates still apply)
 
 Lexicon development:
   dev generate          Generate lexicon artifacts (+ validate + coverage)
@@ -752,7 +870,8 @@ Options:
                         re-evaluates for that environment (build + graph), and
                         drives organizational policy. Must be in chant.config
                         \`environments\` when declared.
-  -t, --template <name> Init template (e.g. node-pipeline, docker-build)
+  -t, --template <name> Init template (e.g. node-pipeline, docker-build);
+                        records its lineage in .chant/workspace.lock.json
   --skill <name>        Init: install only this skill from the lexicon
   --skip-mcp            Init: scaffold without writing the project's .mcp.json
   --fix                 Auto-fix fixable issues (lint command)
@@ -824,18 +943,23 @@ Options:
                         docs). Default: off (also settable via
                         chant.config.ts's build.sandbox: true; #1045)
   --param <name=value>  (build, graph, run --components, components fan-out,
-                        components promote, components rollback) Bind a
+                        components promote, components rollback,
+                        components redeploy) Bind a
                         declared build-time parameter (chant.config.ts's buildParams)
                         to a value, for source to read as params.<name>
                         (#1064) instead of process.env — repeatable.
                         Distinct from the AWS lexicon's deploy-time
                         Parameter(): this resolves before synthesis, so it
                         can change which resources are produced at all.
-                        Highest precedence.
+                        Highest precedence. With init --from, it sets a
+                        template parameter that the template's
+                        chant.template.json declares instead (#2627).
   --params-file <path>  (build, graph, run --components, components fan-out,
-                        components promote, components rollback) JSON file
+                        components promote, components rollback,
+                        components redeploy) JSON file
                         of { "name": value } build-time parameter values
                         (#1064). Second precedence, after --param.
+                        init --from refuses it: pass --param instead.
 
 Examples:
   chant build ./infra/
@@ -969,6 +1093,47 @@ async function loadPluginsOrExit(path: string): Promise<import("../lexicon").Lex
   return plugins;
 }
 
+/** Whether `def` must run without evaluating the project's `chant.config.ts` (chant#2591). */
+function commandRunsNoConfig(def: CommandDef, args: ParsedArgs): boolean {
+  return typeof def.runsNoConfig === "function" ? def.runsNoConfig(args) : def.runsNoConfig === true;
+}
+
+/**
+ * Run one level-0 command line in this process and return its exit code
+ * (#2537). `chant workspace member-run` calls it once per member, from inside
+ * the member's directory, so each member is built, linted, audited or graphed
+ * as `chant <verb> .` would do it there, while members that share a toolchain
+ * share one process. It is main()'s dispatch without the help, the root
+ * refusal and the lexicon command groups: the config is loaded, `--env` is
+ * checked, plugins are loaded when the command needs them, and the handler
+ * runs. A `process.exit` inside (loadPluginsOrExit's, say) is the caller's to
+ * catch.
+ */
+export async function runCommandInProcess(argv: string[]): Promise<number> {
+  const args = parseArgs(argv);
+  const match = resolveCommand(args, commandRegistry);
+  if (!match) {
+    console.error(formatError({ message: `Unknown command: ${args.command}` }));
+    return 1;
+  }
+  if (args.env) process.env[ENV_VAR] = args.env;
+  let loadedConfig;
+  try {
+    // chant#2618 — `workspace audit` reaches `audit` through here, once per
+    // member. A `runsNoConfig` command skips the load, as it does in main().
+    if (!commandRunsNoConfig(match.def, args)) loadedConfig = await loadChantConfigUpward(resolve(args.path));
+  } catch {
+    // A project with no config is the handler's to report, as in main().
+  }
+  const envErr = unknownEnvError(args.env, loadedConfig?.config.environments);
+  if (envErr) {
+    console.error(formatError({ message: envErr, hint: "Declare it in chant.config `environments`, or omit --env." }));
+    return 1;
+  }
+  const plugins = match.def.requiresPlugins ? await loadPluginsOrExit(match.compound ? "." : args.path) : [];
+  return match.def.handler({ args, plugins, serializers: plugins.map((p) => p.serializer) });
+}
+
 // ── Command registry ──────────────────────────────────────────────
 
 /**
@@ -989,8 +1154,10 @@ export const commandRegistry: CommandDef[] = [
   { name: "describe", handler: runDescribe },
   { name: "explain", handler: runExplain },
   { name: "search", handler: runSearch },
-  { name: "import", handler: runImport },
-  { name: "audit", handler: runAudit },
+  // chant#2591 — `import --agents` and `audit` read chant.config statically
+  // and never evaluate it (chant#2589 for audit, which audits code it must not run).
+  { name: "import", handler: runImport, runsNoConfig: (args) => args.agents === true },
+  { name: "audit", handler: runAudit, runsNoConfig: true },
   { name: "migrate", handler: runMigrate },
   // Read-only Terraform peelability advisor (#214). Compound so "advise" lands
   // in args.path; the estate dir comes from --from. No plugins, no project.
@@ -1009,7 +1176,7 @@ export const commandRegistry: CommandDef[] = [
   // Status read over a tree of carve manifests (#2038): the contract a
   // renderer replaces its own walk-and-guess discovery with. Read-only.
   { name: "carve status", handler: runCarveStatus },
-  { name: "init", handler: runInit },
+  { name: "init", handler: runInit, runsNoConfig: true },
   { name: "init lexicon", handler: runInitLexicon },
 { name: "update", handler: runUpdate },
   { name: "doctor", handler: runDoctor },
@@ -1017,7 +1184,7 @@ export const commandRegistry: CommandDef[] = [
   // Dev subcommands
   { name: "dev generate", requiresPlugins: true, handler: runDevGenerate },
   { name: "dev publish", requiresPlugins: true, handler: runDevPublish },
-  { name: "dev onboard", handler: runDevOnboard },
+  { name: "dev onboard", handler: runDevOnboard, runsNoConfig: true },
   { name: "dev check-lexicon", handler: runDevCheckLexicon },
   { name: "dev surface-diff", handler: runDevSurfaceDiff },
   { name: "dev pinned-upgrade", handler: runDevPinnedUpgrade },
@@ -1043,6 +1210,23 @@ export const commandRegistry: CommandDef[] = [
   // Workspace reads (#2524). Imported on first use, so a level-0 command never
   // loads anything under workspace/ (#2525 rule 5, pinned by #2526's goldens).
   { name: "workspace records", handler: async (ctx) => (await import("../workspace/records-cli")).runWorkspaceRecords(ctx) },
+  { name: "workspace init", handler: async (ctx) => (await import("../workspace/init")).runWorkspaceInit(ctx) },
+  { name: "workspace ls", handler: async (ctx) => (await import("../workspace/ls")).runWorkspaceLs(ctx) },
+  { name: "workspace status", handler: async (ctx) => (await import("../workspace/status")).runWorkspaceStatus(ctx) },
+  { name: "workspace lineage", handler: async (ctx) => (await import("../workspace/lineage-cli")).runWorkspaceLineage(ctx) },
+  { name: "workspace upgrade", handler: async (ctx) => (await import("../workspace/lineage-upgrade-cli")).runWorkspaceUpgrade(ctx) },
+  // #2641 — workspace check reads member configs statically and never runs one.
+  { name: "workspace check", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/lineage-check")).runWorkspaceCheck(ctx) },
+  // #2537 — per-member commands. Each member runs under its own chant, one
+  // process per toolchain identity; `member-run` is that process's entry.
+  { name: "workspace build", handler: async (ctx) => (await import("../workspace/member-commands")).runWorkspaceMembers(ctx, "build") },
+  { name: "workspace lint", handler: async (ctx) => (await import("../workspace/member-commands")).runWorkspaceMembers(ctx, "lint") },
+  // chant#2618 — audit runs no project code, at the workspace level too.
+  { name: "workspace audit", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/member-commands")).runWorkspaceMembers(ctx, "audit") },
+  { name: "workspace graph", handler: async (ctx) => (await import("../workspace/member-commands")).runWorkspaceMembers(ctx, "graph") },
+  // Each unit decides for itself whether its config is loaded (runCommandInProcess).
+  { name: "workspace member-run", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/member-run")).runWorkspaceMemberRun(ctx, runCommandInProcess) },
+  { name: "workspace verify", handler: async (ctx) => (await import("../workspace/trust/verify-cli")).runWorkspaceVerify(ctx) },
 
   // State subcommands
   { name: "lifecycle snapshot", requiresPlugins: true, handler: runLifecycleSnapshot },
@@ -1067,6 +1251,7 @@ export const commandRegistry: CommandDef[] = [
   { name: "components export", handler: runComponentsExport },
   { name: "components promote", handler: runComponentsPromote },
   { name: "components rollback", handler: runComponentsRollback },
+  { name: "components redeploy", handler: runComponentsRedeploy },
 
   // Local emulators of configured lexicons (#920). Compound so the action word
   // lands in args.path (not consumed as a project dir) and projectPath is forced ".".
@@ -1147,10 +1332,16 @@ async function main(): Promise<void> {
   // subdirectory build/command (`chant build src/<stack> --env prod`) the
   // declared `environments` almost always live in the root `chant.config.ts`,
   // not `args.path` itself.
+  //
+  // chant#2591 — a command marked `runsNoConfig` skips this load: it must not
+  // run the project's `chant.config.ts` (see `CommandDef.runsNoConfig`). Such a
+  // command gets no `--env` check against the declared environments either.
+  const earlyMatch = resolveCommand(args, commandRegistry);
+  const runsNoConfig = earlyMatch != null && commandRunsNoConfig(earlyMatch.def, args);
   const projectPath0 = resolve(args.path === "." ? "." : args.path);
   let loadedConfig;
   try {
-    loadedConfig = await loadChantConfigUpward(projectPath0);
+    if (!runsNoConfig) loadedConfig = await loadChantConfigUpward(projectPath0);
     initRuntime();
   } catch {
     // Config may not exist yet (e.g. `chant init`)
@@ -1164,7 +1355,7 @@ async function main(): Promise<void> {
     process.exit(1);
   }
 
-  const match = resolveCommand(args, commandRegistry);
+  const match = earlyMatch;
   if (!match) {
     // chant #1078 — not one of core's own commands; check whether a lexicon
     // mounted a command group under this name before giving up. This is the
@@ -1182,6 +1373,28 @@ async function main(): Promise<void> {
     process.exit(1);
   }
 
+  // #2537 (#2524 D0) — at the root of a declared workspace, `build` and
+  // `lint` refuse with WSP000 unless `--root-only` or `rootOnly: true` says
+  // to run on the root project alone. Both lookups only test whether files
+  // exist; the workspace code loads only when this project is a declared root.
+  if (match.def.name === "build" || match.def.name === "lint") {
+    const target = resolve(args.path);
+    const workspace = findWorkspaceRoot(target);
+    if (workspace && findProjectRoot(target) === workspace.dir) {
+      const { guardRootCommand } = await import("../workspace/root-refusal");
+      const refused = guardRootCommand({
+        verb: match.def.name,
+        target,
+        workspaceDir: workspace.dir,
+        rootOnly: args.rootOnly === true || loadedConfig?.config.rootOnly === true,
+      });
+      if (refused !== undefined) {
+        await flushAndExit(refused);
+        return;
+      }
+    }
+  }
+
   // For compound commands (e.g. "run list", "lifecycle plan <env>"), the first
   // positional is a subcommand argument — an environment, op, or lexicon name —
   // not a project path. Plugins always load from the cwd; the handler reads its

package/src/cli/plugins.ts

@@ -1,29 +1,29 @@
-import { importLexiconModule, lexiconModulePath, lexiconNames } from "../lexicon-module";
+import { importLexiconModule, lexiconModulePath, lexiconNames, registerLexiconDeclarations } from "../lexicon-module";
+import { readLexiconDeclarationsStatically, type StaticLexiconRead } from "../config-static";
+export { unknownPathLexiconsNotice } from "../config-static";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 import { isLexiconPlugin, type LexiconPlugin } from "../lexicon";
-import { loadChantConfig, loadChantConfigUpward } from "../config";
-import { findProjectConfig } from "../project-root";
+import { loadChantConfigUpward } from "../config";
 import { findInfraFiles, detectLexicons } from "../index";
 import { checkConflicts, describeConflict } from "./conflict-check";
 
 /**
- * chant#2578 — load the chant.config nearest `dir` (walking up) so the
- * lexicons it declares by path are recorded (../lexicon-module.ts), for a
- * command that does not otherwise read the config. With no config there is
- * nothing to record. A config that fails to load records nothing either, and
- * the command keeps its package behaviour; the commands that need a valid
- * config report its errors themselves.
+ * chant#2591 — record the lexicons the chant.config nearest `dir` declares by
+ * path (../lexicon-module.ts), for a command that does not otherwise read the
+ * config: `init --force`, `dev onboard` and `import --agents`.
+ *
+ * The config is read statically (../config-static.ts) and never evaluated,
+ * so these commands run no project code to learn it. When the `lexicons`
+ * value cannot be read that way, nothing is recorded, every lexicon keeps its
+ * package behaviour, and the returned read carries the reason; the caller
+ * prints {@link unknownPathLexiconsNotice} for it.
  */
-export async function recordProjectLexicons(dir: string): Promise<void> {
-  const { dir: projectDir, configPath } = findProjectConfig(dir);
-  if (configPath === undefined) return;
-  try {
-    await loadChantConfig(projectDir);
-  } catch {
-    // See above: an unloadable config changes nothing here.
-  }
+export function recordProjectLexicons(dir: string): StaticLexiconRead {
+  const read = readLexiconDeclarationsStatically(dir);
+  if (read.status === "read") registerLexiconDeclarations(read.entries, dirname(read.configPath));
+  return read;
 }
 
 /**

package/src/cli/registry.ts

@@ -129,6 +129,8 @@ export interface ParsedArgs {
    * ignore it.
    */
   namespace?: string;
+  /** `chant workspace upgrade --allow-code` (#2550) — run migrations whose body is the template's own code. */
+  allowCode?: boolean;
   /** `chant lifecycle rollback --dry-run` — compute the rollback delta and print it; open no PR, push nothing, leave no branch. */
   dryRun?: boolean;
   /** `chant lifecycle teardown <env> --yes` — execute the planned deletion
@@ -283,6 +285,25 @@ export interface ParsedArgs {
   kind?: string;
   /** `chant workspace records --current` (#2546): leave out records a closed record supersedes. */
   current?: boolean;
+  /** `chant workspace records|verify --require attested` (#2547): the provenance level a gate requires. */
+  require?: string;
+  /**
+   * `chant build --root-only` and `chant lint --root-only` (#2537): run on the
+   * root project of a declared workspace, members left out, instead of
+   * refusing with `WSP000`.
+   */
+  rootOnly?: boolean;
+  /**
+   * `chant workspace check --generated` (#2641): run each declared generator
+   * and compare its output with the file in the tree. Off by default, since
+   * generators run member code.
+   */
+  generated?: boolean;
+  /**
+   * `chant workspace build|lint|audit|graph --member <name>` (#2537): run only
+   * the named members or example groups. Repeatable, and a comma list works too.
+   */
+  members?: string[];
   /**
    * `chant search "<q>" --ambient --live --env <name>` (#1278) — also report
    * resources of a kind this estate manages that exist in the account without
@@ -325,6 +346,8 @@ export interface ParsedArgs {
   component?: string;
   /** `chant components release record --digest <sha256:...>` (#568) — artifact digest to record, joining this release to the build archive/ledger. Also `chant components export --digest <manifestDigest>` (#929) — a build archive manifest digest to export directly, bypassing env/component resolution. */
   digest?: string;
+  /** Every `--digest` value, in order (#2602). `chant components promote --digest <component>=<sha256:...>` is repeatable, one per component; the other commands read the single {@link digest}. */
+  digests?: string[];
   /** `chant components release record --git-sha <sha>` (#568) — git commit the deploy was built from. */
   gitSha?: string;
   /** `chant components release record --run-id <id>` (#568) — orchestrator/CI run identifier. */
@@ -341,6 +364,8 @@ export interface ParsedArgs {
   noReleaseRecord?: boolean;
   /** `chant run --components <name> --dump-outputs <file>` — after the run, write the accumulated cross-component/cross-stack outputs (JSON, keyed by component name) to `<file>`, for a downstream job to `--seed-outputs`. */
   dumpOutputs?: string;
+  /** `chant run --components <name> --digest-file <file>` (#2602) — after a successful run, write one `<component>=<digest>` line per release the run recorded to `<file>`, the form `chant components promote --digest` takes, so a generated promote job promotes exactly the release its pipeline run built. Written empty when nothing was recorded. */
+  digestFile?: string;
   /** `chant run --components <name> --seed-outputs <file>` (repeatable) — before the run, load each JSON outputs file (as written by `--dump-outputs`) and seed cross-component/cross-stack resolution with it, so a `stackOutput()`/`@<dep>.publish.*` reference to a component that ran in an earlier job resolves. */
   seedOutputs?: string[];
   /** `chant build --fold` (#1022/#1023, epic #1019) — opt-in: fold source modules statically instead of importing/running them; folds resource constructors and composite factory calls, falling back to run per-file for anything the folder can't represent (a cross-file-only reference, a re-export, `export default`, …). Also settable project-wide via `chant.config.ts`'s `build.fold: true`; the flag always wins when set. Default (flag omitted): the existing run path, unchanged. */
@@ -401,6 +426,13 @@ export interface CommandDef {
   name: string;
   /** If true, load lexicon plugins before calling handler */
   requiresPlugins?: boolean;
+  /**
+   * chant#2591, chant#2589 — the command never evaluates the project's
+   * `chant.config.ts`, so `main` does not load it before dispatch either. Such
+   * a command reads what it needs from the config statically
+   * (../config-static.ts). A function decides per invocation.
+   */
+  runsNoConfig?: boolean | ((args: ParsedArgs) => boolean);
   /** Command handler — returns exit code */
   handler: (ctx: CommandContext) => Promise<number>;
 }