@intentius/chant 0.80.0 → 0.81.0

package/src/components/promote.ts

@@ -17,6 +17,9 @@
  *    before anything after it runs;
  *  - gates, apply, verify and every other step run exactly as a normal deploy
  *    to the target environment would run them, so the target's gates apply.
+ *    A gate approval is bound to the target environment, the transformed
+ *    composition and the digest being deployed (#2574), so an approval for a
+ *    plain deploy or for another release does not pass it.
  *
  * A composition the transform cannot pin to one recorded digest is refused
  * before anything runs: one with no publish step (nothing would carry the
@@ -27,7 +30,9 @@
  * A rollback (#2531) is the same run against one environment's own earlier
  * release. There the publish step is replaced by the recorded digest rather
  * than run, since the environment already received that artifact when the
- * release was first deployed (see `withoutBuildSteps`'s `pinDigest`).
+ * release was first deployed (see `withoutBuildSteps`'s `pinDigest`). A
+ * redeploy (#2604) is a rollback to the release the ledger already records as
+ * current, for an environment a failed deploy left running something else.
  *
  * The driver stays capability-agnostic. The two kind lists below are data, in
  * the same spirit as `DEPLOY_UNIT_RULES` (./deploy-units.ts).
@@ -114,12 +119,41 @@ export function selectRelease(
   return { record: latestPerComponent(matching).get(component)! };
 }
 
+/**
+ * Read `--digest <component>=<digest>` values (#2602) into a component-to-
+ * digest map. A value with no `=` is left to the single-component form
+ * (`--component <name> --digest <digest>`), so it is an error here. An empty
+ * digest is an error too: a generated promote job passes one when the job that
+ * deployed the component recorded no release, and promoting whatever is
+ * latest instead is the thing the pin is there to prevent.
+ */
+export function parseDigestPins(values: string[]): { pins: Record<string, string> } | { error: string } {
+  const pins: Record<string, string> = {};
+  for (const value of values) {
+    const at = value.indexOf("=");
+    if (at < 0) return { error: "--digest picks one release of one component, so it needs --component <name>, or the form <component>=<digest>" };
+    const component = value.slice(0, at);
+    const digest = value.slice(at + 1);
+    if (component === "") return { error: `--digest ${value} names no component` };
+    if (digest === "") {
+      return { error: `--digest ${value} names no digest; the run that deployed "${component}" recorded no release for it` };
+    }
+    if (component in pins && pins[component] !== digest) {
+      return { error: `--digest pins "${component}" twice, to ${pins[component]} and ${digest}` };
+    }
+    pins[component] = digest;
+  }
+  return { pins };
+}
+
 /**
  * Decide which releases a promote deploys. With `component`, exactly that
- * component's latest source release (or the one recording `digest`). Without
- * it, the latest source release of every component this checkout declares;
- * a recorded component the checkout no longer declares is reported and left
- * alone, since there is no composition to deploy it with.
+ * component's latest source release (or the one recording `digest`). With
+ * `pins` (#2602), exactly the pinned components, each at the source release
+ * recording its pinned digest. Otherwise, the latest source release of every
+ * component this checkout declares; a recorded component the checkout no
+ * longer declares is reported and left alone, since there is no composition
+ * to deploy it with.
  */
 export function planPromotion(input: {
   from: string;
@@ -129,13 +163,29 @@ export function planPromotion(input: {
   declared: string[];
   component?: string;
   digest?: string;
+  /** Component name to the digest to promote for it, from `--digest <component>=<digest>`. */
+  pins?: Record<string, string>;
 }): PromotionPlan | { error: string } {
-  const { from, to, sourceRecords, declared, component, digest } = input;
+  const { from, to, sourceRecords, declared, component, digest, pins } = input;
   if (from === to) return { error: `--from and --to name the same environment ("${from}")` };
   if (digest !== undefined && component === undefined) {
     return { error: "--digest picks one release of one component, so it needs --component <name>" };
   }
 
+  if (pins !== undefined && Object.keys(pins).length > 0) {
+    if (component !== undefined) {
+      return { error: "--digest <component>=<digest> names its own component, so it does not take --component" };
+    }
+    const items: PromotionItem[] = [];
+    for (const [name, pinned] of Object.entries(pins).sort(([a], [b]) => a.localeCompare(b))) {
+      if (!declared.includes(name)) return { error: `component "${name}" is not declared in this checkout` };
+      const picked = selectRelease(sourceRecords, name, from, pinned);
+      if ("error" in picked) return picked;
+      items.push({ component: name, digest: picked.record.digest, source: picked.record });
+    }
+    return { from, to, items, notPromoted: [] };
+  }
+
   if (component !== undefined) {
     if (!declared.includes(component)) {
       return { error: `component "${component}" is not declared in this checkout` };
@@ -197,6 +247,36 @@ export function planRollback(input: {
   return { from: env, to: env, items: [{ component, digest: target.digest, source: target }], notPromoted: [] };
 }
 
+/**
+ * Decide what a redeploy deploys: the release of `component` the ledger in
+ * `env` records as current. A deploy that fails partway records nothing, so
+ * after one the ledger still names the last good release while the
+ * environment may be running part of the failed one. `digest`, when given,
+ * has to be that current digest. It guards against a deploy recorded since
+ * the caller last looked; any earlier release is a rollback.
+ */
+export function planRedeploy(input: {
+  env: string;
+  records: ReleaseRecord[];
+  declared: string[];
+  component: string;
+  digest?: string;
+}): PromotionPlan | { error: string } {
+  const { env, records, declared, component, digest } = input;
+  if (!declared.includes(component)) {
+    return { error: `component "${component}" is not declared in this checkout` };
+  }
+  const current = latestPerComponent(records.filter((r) => r.component === component)).get(component);
+  if (!current) return { error: `no release of "${component}" is recorded in "${env}"` };
+  if (digest !== undefined && digest !== current.digest) {
+    return {
+      error: `${digest} is not the current release of "${component}" in "${env}" (that is ${current.digest}); ` +
+        `use \`chant components rollback ${env} --component ${component} --digest ${digest}\` to restore an earlier release`,
+    };
+  }
+  return { from: env, to: env, items: [{ component, digest: current.digest, source: current }], notPromoted: [] };
+}
+
 function isGate(step: DriverStep | DriverGate | DriverPhase): step is DriverGate {
   return (step as { kind?: unknown }).kind === "gate";
 }
@@ -243,6 +323,17 @@ export function promoteArchivePaths(component: DriverComponent): string[] {
   return paths;
 }
 
+/**
+ * Whether `component`'s deploy has a publish step (#2602). Only such a
+ * component records a release when it deploys, so only its release can be
+ * promoted; a generated pipeline pins exactly these components' digests.
+ */
+export function hasPublishStep(component: DriverComponent): boolean {
+  const walk = (steps: Array<DriverStep | DriverGate | DriverPhase>): boolean =>
+    steps.some((step) => isPhase(step) ? walk(step.steps) : !isGate(step) && PUBLISH_STEP_KINDS.includes(step.kind));
+  return walk(component.deploy);
+}
+
 /** A component's composition with its build-time steps taken out. */
 export interface PromotableComponent {
   component: DriverComponent;
@@ -270,7 +361,7 @@ export const recordedDigestCapability: Capability<{ digest: string }, { digest:
  * check that what is left can be pinned to one recorded digest. A phase left
  * with nothing to run is dropped. `rollback` phases are untouched.
  *
- * With `pinDigest` (a rollback, #2531), the publish step is replaced too, by a
+ * With `pinDigest` (a rollback, #2531, or a redeploy, #2604), the publish step is replaced too, by a
  * {@link RECORDED_DIGEST_KIND} step carrying that digest: the environment
  * already received the artifact when the release being restored was
  * deployed, and the archive it came from is usually long gone. Only the
@@ -279,9 +370,9 @@ export const recordedDigestCapability: Capability<{ digest: string }, { digest:
  */
 export function withoutBuildSteps(
   component: DriverComponent,
-  opts: { pinDigest?: string } = {},
+  opts: { pinDigest?: string; verb?: string } = {},
 ): PromotableComponent | { error: string } {
-  const verb = opts.pinDigest === undefined ? "a promote" : "a rollback";
+  const verb = opts.verb ?? (opts.pinDigest === undefined ? "a promote" : "a rollback");
   const removed: string[] = [];
   /** Phases a build step was removed from, and whether anything else is left in them. */
   const emptied = new Map<string, boolean>();
@@ -466,6 +557,9 @@ export async function runPromotion(options: RunPromotionOptions): Promise<Driver
     return await runInterpretDriver(targets, checkPublishedDigest(options.registry, expected), {
       env: plan.to,
       componentOutputs: options.componentOutputs ?? {},
+      // #2574: a gate approval for this promote or rollback is bound to the
+      // release it deploys, as well as the environment and composition.
+      releases: expected,
       ...(options.onProgress ? { onProgress: options.onProgress } : {}),
       ...(options.gates ? { gates: options.gates } : {}),
       ...(options.now ? { now: options.now } : {}),
@@ -485,7 +579,7 @@ export function gateApprover(result: DriverComponentResult | undefined): string
   return approver;
 }
 
-/** What a promote or rollback knows about its own run, for the records it writes. */
+/** What a promote, rollback or redeploy knows about its own run, for the records it writes. */
 export interface DeployRunInfo {
   runId: string;
   runOrigin?: RunOrigin;
@@ -494,8 +588,8 @@ export interface DeployRunInfo {
   approver?: string;
 }
 
-/** The fields a promote and a rollback record share: the artifact is the earlier release's own. */
-function redeployRecord(item: PromotionItem, env: string, run: DeployRunInfo): ReleaseRecordInput {
+/** The fields a promote, a rollback and a redeploy record share: the artifact is the earlier release's own. */
+function sharedRecord(item: PromotionItem, env: string, run: DeployRunInfo): ReleaseRecordInput {
   const { source } = item;
   return {
     component: item.component,
@@ -512,7 +606,7 @@ function redeployRecord(item: PromotionItem, env: string, run: DeployRunInfo): R
   };
 }
 
-/** Name an earlier record the way `promotedFrom` and `restores` do. */
+/** Name an earlier record the way `promotedFrom`, `restores` and `redeploys` do. */
 function refTo(record: ReleaseRecord) {
   return { env: record.env, runId: record.runId, timestamp: record.timestamp };
 }
@@ -524,7 +618,7 @@ function refTo(record: ReleaseRecord) {
  * release.
  */
 export function promotionRecord(item: PromotionItem, to: string, run: DeployRunInfo): ReleaseRecordInput {
-  return { ...redeployRecord(item, to, run), promotedFrom: refTo(item.source) };
+  return { ...sharedRecord(item, to, run), promotedFrom: refTo(item.source) };
 }
 
 /**
@@ -533,5 +627,15 @@ export function promotionRecord(item: PromotionItem, to: string, run: DeployRunI
  * release.
  */
 export function rollbackRecord(item: PromotionItem, env: string, run: DeployRunInfo): ReleaseRecordInput {
-  return { ...redeployRecord(item, env, run), restores: refTo(item.source) };
+  return { ...sharedRecord(item, env, run), restores: refTo(item.source) };
+}
+
+/**
+ * The release record a successful redeploy appends. It carries the current
+ * release's artifact identities, as a rollback's carries the restored one's;
+ * `redeploys` names that release. The environment's current digest does not
+ * change, and the record says when it was last put back.
+ */
+export function redeployRecord(item: PromotionItem, env: string, run: DeployRunInfo): ReleaseRecordInput {
+  return { ...sharedRecord(item, env, run), redeploys: refTo(item.source) };
 }

package/src/components/sandbox/driver.ts

@@ -1,5 +1,6 @@
 import { join, resolve } from "node:path";
 import { params as currentBuildParams } from "../../params";
+import { sendFunctionSource } from "../../discovery/sandbox/driver";
 
 /**
  * chant #1051 — generates the source of the "driver" module that runs INSIDE
@@ -60,15 +61,14 @@ export function generateComponentDriverSource(options: GenerateComponentDriverOp
     `import { collectComponents } from ${lit(DISCOVER_MODULE)};`,
     `import { classifyChildError } from ${lit(CHILD_ERRORS_MODULE)};`,
     `import { setBuildParams } from ${lit(PARAMS_MODULE)};`,
+    `import { writeSync } from "node:fs";`,
     ``,
     // chant #1108 — snapshot of the parent's resolved build-time parameter
     // values (scalars only), bound before any component file is imported.
     `setBuildParams(${lit({ ...currentBuildParams })});`,
     ``,
-    `function send(payload) {`,
-    `  if (typeof process.send === "function") process.send(payload);`,
-    `  else console.log(JSON.stringify(payload));`,
-    `}`,
+    // chant#2461 — awaits the send and fails loudly if it cannot be delivered.
+    ...sendFunctionSource(),
     ``,
     `async function main() {`,
     `  const modules = [];`,
@@ -114,12 +114,12 @@ export function generateComponentDriverSource(options: GenerateComponentDriverOp
     `  for (const [name, discovered] of collected.components) {`,
     `    components.push({ name, component: discovered.component, exportName: discovered.exportName, filePath: discovered.filePath });`,
     `  }`,
-    `  send({ components, errors });`,
+    `  await send({ components, errors });`,
     `}`,
     ``,
-    `main().catch((err) => {`,
-    `  send({ components: [], errors: [classifyChildError("", err).toJSON()], fatal: true });`,
-    `});`,
+    `main().catch((err) =>`,
+    `  send({ components: [], errors: [classifyChildError("", err).toJSON()], fatal: true }),`,
+    `);`,
   );
 
   return lines.join("\n");

package/src/components/sandbox/run.ts

@@ -3,6 +3,7 @@ import { realpathSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import { bundleDriver } from "../../discovery/sandbox/bundle";
 import { classifyChildError } from "../../discovery/sandbox/child-errors";
+import { settleOnExitAfterChannelDrains } from "../../discovery/sandbox/fork";
 import { DiscoveryError, type DiscoveryErrorType } from "../../errors";
 import type { Component } from "../component";
 import type { DiscoveredComponent } from "../discover";
@@ -163,7 +164,9 @@ function runChildProcess(
       reject(err);
     });
 
-    child.on("exit", (code, signal) => {
+    // chant#2461 — a payload can still be in the IPC socket when the exit is
+    // handled; see settleOnExitAfterChannelDrains.
+    settleOnExitAfterChannelDrains(child, (code, signal) => {
       if (settled) return;
       settled = true;
       clearTimeout(timeout);

package/src/components/verbs/build-archive.ts

@@ -55,6 +55,8 @@
 
 import type { ArtifactReproducibility, ProvenanceLink } from "./reproducibility";
 import { defaultReproducibility } from "./reproducibility";
+import { contentDigest } from "../../content-digest";
+import { canonicalJson } from "../../effect-receipt";
 
 export type BuildArchiveEntryKind = "image" | "template" | "asset" | "sbom";
 
@@ -129,6 +131,12 @@ export interface BuildArchiveManifest {
    * changed contents, not merely a re-run.
    */
   manifestDigest: string;
+  /**
+   * Set on read, never written: `["legacy-digest"]` when a manifest
+   * persisted on `chant/lifecycle` holds digests from the 32-bit hash chant
+   * used before real SHA-256 (#2514). See ../../lifecycle/legacy-digest.ts.
+   */
+  flags?: Array<"legacy-digest">;
 }
 
 /**
@@ -147,30 +155,28 @@ const DEFAULT_MEDIA_TYPES: Record<BuildArchiveEntryKind, string> = {
 };
 
 /**
- * Deterministic content digest over arbitrary string content. Same shape as
- * the FNV-ish fake digest `MockCloudExecutor` uses, so tests can assert on it
- * without a real `sha256` implementation. Exported so callers that need to
- * digest content that never goes through the `CloudExecutor` (e.g. a
- * synthesized template's serialized bytes, see ./build.ts's
- * `addArchiveTemplate`) share this one algorithm rather than each defining
- * their own. Production `image`/`asset` entries instead carry the real
- * digest their producing capability already computed (e.g. `docker-build`'s
- * `executor.docker.build` digest).
+ * The content digest every entry chant computes itself carries: real
+ * SHA-256 over the UTF-8 bytes of its input (../../content-digest.ts,
+ * chant #2514). Callers that digest content that never goes through the
+ * `CloudExecutor` (a synthesized template's serialized bytes, see ./build.ts's
+ * `addArchiveTemplate`, or an SBOM) use it. Production `image`/`asset`
+ * entries instead carry the digest their producing capability already
+ * computed (e.g. `docker-build`'s `executor.docker.build` digest).
  */
-export function contentDigest(input: string): string {
-  let hash = 0;
-  for (let i = 0; i < input.length; i++) {
-    hash = (Math.imul(hash, 31) + input.charCodeAt(i)) | 0;
-  }
-  const hex = Math.abs(hash).toString(16).padStart(8, "0");
-  return `sha256:${hex.repeat(8).slice(0, 64)}`;
-}
+export { contentDigest };
 
-/** Compute the aggregate `manifestDigest` over a set of entries — sorted by path so entry order never changes the digest, only content does. */
+/**
+ * Compute the aggregate `manifestDigest` over a set of entries. Each entry
+ * contributes its `kind`, `path` and `digest`; entries are sorted by path
+ * (UTF-16 code units, the order `canonicalJson` sorts keys in) so entry order
+ * never changes the digest, only content does. The list is hashed as
+ * `canonicalJson`, so no path or digest can be read as a field separator.
+ */
 export function computeManifestDigest(contents: BuildArchiveEntry[]): string {
-  const sorted = [...contents].sort((a, b) => a.path.localeCompare(b.path));
-  const canonical = sorted.map((e) => `${e.kind}:${e.path}:${e.digest}`).join("\n");
-  return contentDigest(canonical);
+  const sorted = contents
+    .map((e) => ({ kind: e.kind, path: e.path, digest: e.digest }))
+    .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  return contentDigest(canonicalJson(sorted));
 }
 
 /** Start a new, empty manifest for `component`. Entries are added with `addArchiveEntry`. */

package/src/components/verbs/run-agent.ts

@@ -237,7 +237,7 @@
  *    `externalParameters`, never replacing it), not a shape break.
  */
 
-import { createHash } from "node:crypto";
+import { contentDigest } from "../../content-digest";
 import type { Capability, DeployContext } from "../capability";
 import type { ProvenanceLink } from "./reproducibility";
 import type { BuildArchiveEntry } from "./build-archive";
@@ -555,10 +555,8 @@ export function createRunAgentCapability(
 const PROMPT_PATH = "/work/prompt";
 const OUTPUT_PATH = "/work/output";
 
-/** `sha256:<hex>` over a string, prefixed the same way ./build-archive.ts's `contentDigest` and ./build.ts's zip/jar digests are. */
-function sha256Digest(content: string): string {
-  return `sha256:${createHash("sha256").update(content, "utf8").digest("hex")}`;
-}
+/** `sha256:<hex>` over a string: ../../content-digest.ts's `contentDigest`, the same digest ./build-archive.ts uses. */
+const sha256Digest = contentDigest;
 
 const EMPTY_DIGEST = sha256Digest("");
 

package/src/config-static.test.ts

@@ -0,0 +1,136 @@
+/**
+ * chant#2591 — the static reader of a config's `lexicons`: what it reads, and
+ * what it reports as unreadable instead of running the config.
+ */
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { existsSync, mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { readConfigFieldsStatically, readLexiconDeclarationsStatically, unknownPathLexiconsNotice } from "./config-static";
+
+let dir: string;
+
+beforeEach(() => {
+  dir = realpathSync(mkdtempSync(join(tmpdir(), "chant-2591-static-")));
+  // A project boundary, so the upward walk stops here.
+  writeFileSync(join(dir, "package.json"), "{}");
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+function readTs(source: string) {
+  writeFileSync(join(dir, "chant.config.ts"), source);
+  return readLexiconDeclarationsStatically(dir);
+}
+
+const SITE = { name: "site", module: "./lexicon/index.ts" };
+
+describe("readable configs", () => {
+  test.each([
+    ["an object literal default export", `export default { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }] };`],
+    [
+      "satisfies and a type import",
+      `import type { ChantConfig } from "@intentius/chant";\nexport default { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }] } satisfies ChantConfig;`,
+    ],
+    [
+      "a const alias",
+      `const config = { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }], sourceDir: "src" };\nexport default config;`,
+    ],
+    ["a named config export", `export const config = { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }] };`],
+    ["named exports", `export const lexicons = ["aws", { name: "site", module: "./lexicon/index.ts" }];\nexport const sourceDir = "src";`],
+    [
+      "consts, a spread and a template",
+      `const dir = "lexicon";\nconst base = ["aws"];\nexport default { lexicons: [...base, { name: "site", module: \`./\${dir}/index.ts\` }] };`,
+    ],
+    [
+      "a spread config",
+      `const shared = { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }] };\nexport default { ...shared, sourceDir: "src" };`,
+    ],
+    [
+      "other keys that are not readable",
+      `import { plugin } from "./rules";\nexport default { lexicons: ["aws", { name: "site", module: "./lexicon/index.ts" }], lint: { plugins: [plugin()] } };`,
+    ],
+  ])("%s", (_label, source) => {
+    const read = readTs(source);
+    expect(read).toEqual({ status: "read", configPath: join(dir, "chant.config.ts"), entries: ["aws", SITE] });
+  });
+
+  test("a same-file function the fold subset covers is interpreted, not run", () => {
+    const read = readTs(`const pick = (extra) => ["aws", extra];\nexport default { lexicons: pick("k8s") };`);
+    expect(read).toMatchObject({ status: "read", entries: ["aws", "k8s"] });
+  });
+
+  test("a config with no lexicons reads as none", () => {
+    expect(readTs(`export default { sourceDir: "src" };`)).toMatchObject({ status: "read", entries: [] });
+  });
+
+  test("chant.config.json is parsed", () => {
+    writeFileSync(join(dir, "chant.config.json"), JSON.stringify({ lexicons: ["aws", SITE] }));
+    expect(readLexiconDeclarationsStatically(dir)).toMatchObject({ status: "read", entries: ["aws", SITE] });
+  });
+
+  test("the walk goes up from a subdirectory", () => {
+    writeFileSync(join(dir, "chant.config.ts"), `export default { lexicons: [{ name: "site", module: "./lexicon/index.ts" }] };`);
+    mkdirSync(join(dir, "src", "deep"), { recursive: true });
+    expect(readLexiconDeclarationsStatically(join(dir, "src", "deep"))).toMatchObject({ status: "read", entries: [SITE] });
+  });
+
+  test("no config", () => {
+    expect(readLexiconDeclarationsStatically(dir)).toEqual({ status: "no-config" });
+  });
+});
+
+describe("unreadable configs are reported, never run", () => {
+  test.each([
+    ["an imported binding", `import { lexicons } from "./shared";\nexport default { lexicons };`, /lexicons/],
+    ["process.env", `export default { lexicons: process.env.CI ? ["aws"] : ["aws", "k8s"] };`, /process/],
+    ["a call as the default export", `export default defineConfig({ lexicons: ["aws"] });`, /not an object literal/],
+    ["a re-export", `export { default } from "./base";`, /export/],
+    ["an imported function in lexicons", `import { pick } from "./pick";\nexport default { lexicons: pick() };`, /line 4: .*pick/],
+    ["entries of the wrong shape", `export default { lexicons: [{ name: "site" }] };`, /not a list of lexicon entries/],
+  ])("%s", (_label, source, reason) => {
+    const marker = join(dir, "ran");
+    const read = readTs(`import { writeFileSync } from "node:fs";\nwriteFileSync(${JSON.stringify(marker)}, "x");\n${source}`);
+    expect(read.status).toBe("unknown");
+    expect(read.status === "unknown" && read.reason).toMatch(reason);
+    expect(unknownPathLexiconsNotice(read)).toContain("is unknown here and is treated as a package");
+    expect(existsSync(marker)).toBe(false);
+  });
+
+  test("a readable config has no notice", () => {
+    expect(unknownPathLexiconsNotice(readTs(`export default { lexicons: ["aws"] };`))).toBeUndefined();
+  });
+});
+
+describe("readConfigFieldsStatically (#2641)", () => {
+  test("reads the asked-for fields of a default export, a named config or named exports, and leaves unset ones out", () => {
+    writeFileSync(join(dir, "chant.config.ts"), `const env = "prod";\nexport default { environments: [env, { name: "staging" }], ownership: { stack: "shop", env }, lexicons: ["aws"] };`);
+    expect(readConfigFieldsStatically(dir, ["ownership", "environments", "sourceDir"])).toEqual({
+      status: "read",
+      configPath: join(dir, "chant.config.ts"),
+      fields: { ownership: { stack: "shop", env: "prod" }, environments: ["prod", { name: "staging" }] },
+    });
+    writeFileSync(join(dir, "chant.config.ts"), `export const ownership = { stack: "named" };`);
+    expect(readConfigFieldsStatically(dir, ["ownership"])).toMatchObject({ status: "read", fields: { ownership: { stack: "named" } } });
+  });
+
+  test("a value it can't fold is unknown, with the reason, and the config is not run", () => {
+    const marker = join(dir, "ran");
+    writeFileSync(
+      join(dir, "chant.config.ts"),
+      `import { writeFileSync } from "node:fs";\nwriteFileSync(${JSON.stringify(marker)}, "x");\nexport default { ownership: { stack: process.env.STACK } };`,
+    );
+    const read = readConfigFieldsStatically(dir, ["ownership"]);
+    expect(read.status).toBe("unknown");
+    expect(existsSync(marker)).toBe(false);
+  });
+
+  test("reads chant.config.json, and only in the directory itself", () => {
+    writeFileSync(join(dir, "chant.config.json"), JSON.stringify({ environments: ["prod"] }));
+    expect(readConfigFieldsStatically(dir, ["environments"])).toMatchObject({ status: "read", fields: { environments: ["prod"] } });
+    mkdirSync(join(dir, "sub"));
+    expect(readConfigFieldsStatically(join(dir, "sub"), ["environments"])).toEqual({ status: "no-config" });
+  });
+});