@intentius/chant 0.80.0 → 0.81.0

package/src/config-static.ts

@@ -0,0 +1,232 @@
+/**
+ * chant#2591, chant#2589 — read the `lexicons` a project's config declares
+ * without running the config.
+ *
+ * `chant.config.ts` is project code. Most commands evaluate it (see
+ * `./config-sandbox.ts`), but a few only need to know which lexicons it
+ * declares by path (#2520) so their messages can name the path instead of a
+ * package: `init --force`, `dev onboard`, `import --agents` and `audit`.
+ * Those read the config here, statically, and never evaluate it.
+ *
+ * The reader parses the file and reduces the `lexicons` value with the fold
+ * machinery (`./fold/fold.ts`'s {@link fold}), given the file's own top-level
+ * `const`s and nothing else. It never imports anything, so an imported
+ * binding, a function call or `process.env` is not readable. When the value
+ * cannot be read, the result says why and callers treat path lexicons as
+ * unknown. They never fall back to evaluating the config.
+ *
+ * What the config's export looks like follows `selectConfigExport` in
+ * `./config-sandbox.ts`: `export default`, else `export const config`, else
+ * the module's named exports (`export const lexicons`).
+ *
+ * `chant.config.json` is data and is simply parsed.
+ *
+ * {@link readConfigFieldsStatically} reads other top-level fields the same
+ * way. `chant workspace check` reads a member's `ownership` and
+ * `environments` with it for the ledger checks (#2641).
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import * as ts from "typescript";
+import { ChantConfigSchema, findProjectConfigPastFragments } from "./config";
+import { collectConsts, fold, propName, FoldError } from "./fold/fold";
+import type { LexiconDeclaration } from "./lexicon-module";
+
+/** What {@link readLexiconDeclarationsStatically} found. */
+export type StaticLexiconRead =
+  /** No `chant.config.ts` or `chant.config.json` for the directory. */
+  | { status: "no-config" }
+  /** The declarations, in order. Empty when the config declares no `lexicons`. */
+  | { status: "read"; configPath: string; entries: LexiconDeclaration[] }
+  /** The config exists, but its `lexicons` could not be read without running it. */
+  | { status: "unknown"; configPath: string; reason: string };
+
+/** Signals a config shape the reader does not follow. The message is the reason reported. */
+class Unreadable extends Error {}
+
+/**
+ * Find the project config for `startDir` (the walk `loadChantConfigUpward`
+ * makes) and read its `lexicons` without evaluating it.
+ */
+export function readLexiconDeclarationsStatically(startDir: string): StaticLexiconRead {
+  const { configPath } = findProjectConfigPastFragments(startDir);
+  if (configPath === undefined) return { status: "no-config" };
+  try {
+    const value = readFields(configPath, ["lexicons"]).lexicons;
+    if (value === undefined) return { status: "read", configPath, entries: [] };
+    const parsed = ChantConfigSchema.shape.lexicons.safeParse(value);
+    if (!parsed.success) {
+      return { status: "unknown", configPath, reason: "`lexicons` is not a list of lexicon entries" };
+    }
+    return { status: "read", configPath, entries: (parsed.data ?? []) as LexiconDeclaration[] };
+  } catch (err) {
+    return { status: "unknown", configPath, reason: unreadableReason(err) };
+  }
+}
+
+function unreadableReason(err: unknown): string {
+  return err instanceof FoldError
+    ? `line ${err.line}: ${err.message}`
+    : err instanceof Unreadable
+      ? err.message
+      : `the file could not be read (${err instanceof Error ? err.message : String(err)})`;
+}
+
+/** What {@link readConfigFieldsStatically} found. */
+export type StaticFieldsRead =
+  /** No `chant.config.ts` or `chant.config.json` in the directory. */
+  | { status: "no-config" }
+  /** Each asked-for field the config sets, folded to a value. A field it doesn't set is absent. */
+  | { status: "read"; configPath: string; fields: Record<string, unknown> }
+  /** The config exists, but a field could not be read without running it. */
+  | { status: "unknown"; configPath: string; reason: string };
+
+/**
+ * Read top-level `fields` of the config in `dir` itself, as
+ * `loadChantConfig(dir)` finds it (`chant.config.ts`, else
+ * `chant.config.json`), without evaluating it. The values are not checked
+ * against the config schema; the caller does that for the fields it reads.
+ */
+export function readConfigFieldsStatically(dir: string, fields: readonly string[]): StaticFieldsRead {
+  const configPath = ["chant.config.ts", "chant.config.json"].map((f) => join(dir, f)).find((f) => existsSync(f));
+  if (configPath === undefined) return { status: "no-config" };
+  try {
+    return { status: "read", configPath, fields: readFields(configPath, fields) };
+  } catch (err) {
+    return { status: "unknown", configPath, reason: unreadableReason(err) };
+  }
+}
+
+function readFields(configPath: string, fields: readonly string[]): Record<string, unknown> {
+  const values = configPath.endsWith(".json") ? readJsonFields(configPath, fields) : readTsFields(configPath, fields);
+  // Absent fields are left out rather than set to undefined.
+  return Object.fromEntries(Object.entries(values).filter(([, v]) => v !== undefined));
+}
+
+/** The directory a read config's relative module paths resolve against. */
+export function staticConfigBaseDir(read: { configPath: string }): string {
+  return dirname(read.configPath);
+}
+
+/**
+ * The line a command prints when {@link readLexiconDeclarationsStatically}
+ * could not read the config, or `undefined` when it could.
+ */
+export function unknownPathLexiconsNotice(read: StaticLexiconRead): string | undefined {
+  if (read.status !== "unknown") return undefined;
+  return (
+    `note: could not read the lexicons in ${read.configPath} without running it (${read.reason}). ` +
+    "chant does not run it for this command, so any lexicon it declares by path is unknown here and is treated as a package."
+  );
+}
+
+function readJsonFields(configPath: string, fields: readonly string[]): Record<string, unknown> {
+  const parsed = JSON.parse(readFileSync(configPath, "utf-8")) as unknown;
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Unreadable("the config is not a JSON object");
+  }
+  return Object.fromEntries(fields.map((f) => [f, (parsed as Record<string, unknown>)[f]]));
+}
+
+function readTsFields(configPath: string, fields: readonly string[]): Record<string, unknown> {
+  const source = ts.createSourceFile(configPath, readFileSync(configPath, "utf-8"), ts.ScriptTarget.Latest, true);
+  const consts = collectConsts(source);
+
+  let defaultExport: ts.Expression | undefined;
+  const named = new Map<string, ts.Expression>();
+  for (const statement of source.statements) {
+    if (ts.isExportAssignment(statement)) {
+      if (statement.isExportEquals) throw new Unreadable("`export =` is not read");
+      defaultExport = statement.expression;
+    } else if (ts.isExportDeclaration(statement)) {
+      // `export { x as default }`, `export * from "./other"`: the export's
+      // value lives elsewhere, possibly in another module.
+      throw new Unreadable("an `export { … }` or `export … from` declaration is not read");
+    } else if (ts.isVariableStatement(statement) && hasExportModifier(statement)) {
+      if ((statement.declarationList.flags & ts.NodeFlags.Const) === 0) {
+        throw new Unreadable("an exported `let` or `var` is not read");
+      }
+      for (const decl of statement.declarationList.declarations) {
+        if (ts.isIdentifier(decl.name) && decl.initializer) named.set(decl.name.text, decl.initializer);
+        else throw new Unreadable("a destructured export is not read");
+      }
+    } else if (hasExportModifier(statement) && hasDefaultModifier(statement)) {
+      throw new Unreadable("the default export is not an object");
+    }
+  }
+
+  const configExpr = defaultExport ?? named.get("config");
+  if (configExpr === undefined) {
+    // The module's named exports are the config.
+    return Object.fromEntries(
+      fields.map((f) => {
+        const expr = named.get(f);
+        return [f, expr === undefined ? undefined : fold(expr, consts)];
+      }),
+    );
+  }
+  const obj = configObject(configExpr, consts, new Set());
+  return Object.fromEntries(fields.map((f) => [f, fieldOfObject(obj, f, consts)]));
+}
+
+/** The object literal a config export reduces to, following `const` aliases. */
+function configObject(
+  node: ts.Expression,
+  consts: Map<string, ts.Expression>,
+  seen: Set<string>,
+): ts.ObjectLiteralExpression {
+  const inner = unwrap(node);
+  if (ts.isObjectLiteralExpression(inner)) return inner;
+  if (ts.isIdentifier(inner)) {
+    const init = consts.get(inner.text);
+    if (init === undefined || seen.has(inner.text)) {
+      throw new Unreadable(`the exported config \`${inner.text}\` is not a top-level const of this file`);
+    }
+    seen.add(inner.text);
+    return configObject(init, consts, seen);
+  }
+  throw new Unreadable("the exported config is not an object literal");
+}
+
+/** The value `field` takes in a config object literal, or `undefined` when it sets none. */
+function fieldOfObject(obj: ts.ObjectLiteralExpression, field: string, consts: Map<string, ts.Expression>): unknown {
+  let value: unknown = undefined;
+  for (const prop of obj.properties) {
+    if (ts.isSpreadAssignment(prop)) {
+      const spread = fold(prop.expression, consts);
+      if (spread !== null && typeof spread === "object" && Object.prototype.hasOwnProperty.call(spread, field)) {
+        value = (spread as Record<string, unknown>)[field];
+      }
+      continue;
+    }
+    if (prop.name === undefined) continue;
+    const name = propName(prop.name);
+    if (name !== field) continue;
+    if (ts.isPropertyAssignment(prop)) value = fold(prop.initializer, consts);
+    else if (ts.isShorthandPropertyAssignment(prop)) value = fold(prop.name, consts);
+    else throw new Unreadable(`\`${field}\` is a method or accessor`);
+  }
+  return value;
+}
+
+function unwrap(node: ts.Expression): ts.Expression {
+  let current = node;
+  while (
+    ts.isParenthesizedExpression(current) ||
+    ts.isAsExpression(current) ||
+    ts.isSatisfiesExpression(current) ||
+    ts.isNonNullExpression(current) ||
+    ts.isTypeAssertionExpression(current)
+  ) {
+    current = current.expression;
+  }
+  return current;
+}
+
+function hasExportModifier(node: ts.Node): boolean {
+  return (ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword)) ?? false;
+}
+
+function hasDefaultModifier(node: ts.Node): boolean {
+  return (ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword)) ?? false;
+}

package/src/config.test.ts

@@ -468,10 +468,10 @@ describe("exclude / include discovery globs (#2519)", () => {
     await expect(resolveDiscoveryGlobs(TEST_DIR)).rejects.toThrow(message);
   });
 
-  test("resolveDiscoveryGlobs is undefined without exclude, so include alone changes nothing", async () => {
+  test("resolveDiscoveryGlobs returns include alone, since it re-admits the walk's default skips (#2527)", async () => {
     expect(await resolveDiscoveryGlobs(TEST_DIR)).toBeUndefined();
     writeFileSync(join(TEST_DIR, "chant.config.json"), JSON.stringify({ include: ["ops/**"] }));
-    expect(await resolveDiscoveryGlobs(TEST_DIR)).toBeUndefined();
+    expect(await resolveDiscoveryGlobs(TEST_DIR)).toEqual({ root: TEST_DIR, exclude: [], include: ["ops/**"] });
   });
 
   test("resolveDiscoveryGlobs anchors the globs at the project config's directory, past a lint fragment", async () => {

package/src/config.ts

@@ -10,7 +10,7 @@ import type { BuildParamsConfig } from "./build-params";
 import type { BuildParamProvenance } from "./provenance";
 import { findProjectConfig } from "./project-root";
 import { evaluateProjectConfig } from "./config-sandbox";
-import { lexiconNames, registerLexiconDeclarations, type LexiconDeclaration } from "./lexicon-module";
+import { lexiconNames, pathLexiconRoot, registerLexiconDeclarations, type LexiconDeclaration } from "./lexicon-module";
 
 /**
  * One project-declared environment (chant #1166). Historically always a bare
@@ -131,6 +131,7 @@ const LexiconEntrySchema = z.union([
   z.object({
     name: z.string().min(1),
     module: z.string().min(1),
+    root: z.string().min(1).optional(),
   }).strict(),
 ]);
 
@@ -195,6 +196,7 @@ export const ChantConfigSchema = z.object({
   }).optional(),
   exclude: z.array(z.string().min(1)).optional(),
   include: z.array(z.string().min(1)).optional(),
+  rootOnly: z.boolean().optional(),
 }).passthrough();
 
 /**
@@ -207,7 +209,8 @@ export interface ChantConfig {
    * Lexicons to load. A bare name (`"aws"`) loads the package
    * `@intentius/chant-lexicon-aws`. `{ name, module }` (#2520) loads a
    * project-local lexicon from a module path, resolved against the directory
-   * holding this config; see `./lexicon-module.ts`.
+   * holding this config; see `./lexicon-module.ts`. An optional `root`
+   * (chant#2590) names the directory holding the lexicon's other files.
    *
    * Once loaded, this holds names only: the loader replaces each
    * `{ name, module }` entry with its name and records the path in
@@ -453,19 +456,33 @@ export interface ChantConfig {
    * import or lint a matching file. A pattern matches a file when it matches
    * the file's path or the path of any directory above it, so `"ops"` and
    * `"ops/**"` both skip everything under `ops/`. Matched with picomatch,
-   * dot files included. See `./discovery/files.ts`'s `compileDiscoveryFilter`.
+   * dot files included. Op discovery and component discovery honour it too
+   * (#2527). See `./discovery/walk.ts`.
    */
   exclude?: string[];
 
   /**
-   * Globs that re-admit files {@link exclude} would skip. `include` always
-   * wins over `exclude`, and it never narrows discovery on its own: a file
-   * no `exclude` pattern matches is discovered whether or not it matches an
-   * `include`. It does not re-admit what discovery skips unconditionally
-   * (`node_modules`, test files, child projects, the generated and skip
-   * markers).
+   * Globs that re-admit files {@link exclude} would skip, and, since #2527,
+   * files the discovery walk skips by default: dot-directories, `dist`,
+   * git-ignored paths and child projects. `include` always wins over
+   * `exclude`, and it never narrows discovery on its own: a file nothing
+   * skips is discovered whether or not it matches an `include`. It never
+   * re-admits `node_modules`, `.git`, test files, workspace members, or
+   * files carrying the generated or skip marker.
    */
   include?: string[];
+
+  /**
+   * Lets `chant build` and `chant lint` run on this project when it is the
+   * root of a declared workspace (#2537, #2524 D0). Without it, or the
+   * `--root-only` flag, both commands refuse there with `WSP000` and point to
+   * `chant workspace build` and `lint`. With it they act on the root project
+   * alone. Member directories and example-group matches are left out of
+   * discovery either way, as they are for every walk under a declaration
+   * (#2527, `workspaceMemberDirs` in `./discovery/walk.ts`). It means nothing
+   * in a project with no `chant.workspace.json`.
+   */
+  rootOnly?: boolean;
 }
 
 /**
@@ -561,7 +578,7 @@ export async function loadChantConfigUpward(startDir: string): Promise<ResolvedC
 }
 
 /** The walk {@link loadChantConfigUpward} makes, lint-only fragments skipped, without its warning. */
-function findProjectConfigPastFragments(startDir: string): { dir: string; configPath?: string } {
+export function findProjectConfigPastFragments(startDir: string): { dir: string; configPath?: string } {
   let { dir, configPath } = findProjectConfig(startDir);
   while (configPath && isLintOnlyFragment(configPath)) {
     const parent = dirname(dir);
@@ -582,8 +599,9 @@ export interface DiscoveryGlobs {
 /**
  * The `exclude`/`include` globs of the project `startDir` belongs to, found by
  * the same upward walk as {@link loadChantConfigUpward}. `undefined` when the
- * project declares no `exclude`, which leaves discovery exactly as it was
- * before the keys existed: `include` only ever re-admits what `exclude` skips.
+ * project declares neither. `include` re-admits what `exclude` skips, and
+ * also what the discovery walk skips by default (#2527), so it means
+ * something on its own.
  *
  * A config that fails to load is left to the command's own config load to
  * report, so discovery keeps working where it did before, unless the failure
@@ -600,8 +618,10 @@ export async function resolveDiscoveryGlobs(startDir: string): Promise<Discovery
     if (err instanceof InvalidChantConfigError && (err.key === "exclude" || err.key === "include")) throw err;
     return undefined;
   }
-  if (!config.exclude || config.exclude.length === 0) return undefined;
-  return { root: dir, exclude: config.exclude, include: config.include ?? [] };
+  const exclude = config.exclude ?? [];
+  const include = config.include ?? [];
+  if (exclude.length === 0 && include.length === 0) return undefined;
+  return { root: dir, exclude, include };
 }
 
 /**
@@ -941,7 +961,20 @@ function normalizeConfig(raw: Record<string, unknown>, source?: string): LoadedC
   // the loaders and the entry becomes its name, so every reader of `lexicons`
   // keeps seeing names. A config of plain names is returned untouched.
   const lexicons = (raw as ChantConfig).lexicons;
-  const recorded = registerLexiconDeclarations(lexicons, source !== undefined ? dirname(source) : process.cwd());
+  const baseDir = source !== undefined ? dirname(source) : process.cwd();
+  const sourceDir = (raw as ChantConfig).sourceDir;
+  // chant#2590 — a declared `root` must stay inside the project and must not
+  // contain its source directory. Refused here rather than narrowed, since
+  // the project asked for it by name.
+  for (const [i, entry] of (lexicons ?? []).entries()) {
+    if (typeof entry === "string" || entry.root === undefined) continue;
+    const { problem } = pathLexiconRoot(entry, baseDir, sourceDir);
+    if (problem !== undefined) {
+      const loc = source ? ` in ${source}` : "";
+      throw new InvalidChantConfigError(`Invalid chant config${loc}: lexicons.${i}.root: ${problem}`, "lexicons");
+    }
+  }
+  const recorded = registerLexiconDeclarations(lexicons, baseDir, sourceDir);
   if (Object.keys(recorded).length > 0) {
     return { ...(raw as ChantConfig), lexicons: lexiconNames(lexicons), lexiconModules: recorded };
   }

package/src/content-digest.test.ts

@@ -0,0 +1,120 @@
+/**
+ * chant #2514 — `contentDigest` is real SHA-256 over UTF-8, and the manifest
+ * and SBOM digests built on it separate inputs one byte apart.
+ */
+import { describe, expect, test } from "vitest";
+import { createHash } from "node:crypto";
+import { contentDigest } from "./content-digest";
+import { canonicalJson } from "./effect-receipt";
+import {
+  addArchiveEntry,
+  computeManifestDigest,
+  contentDigest as archiveContentDigest,
+  createBuildArchiveManifest,
+} from "./components/verbs/build-archive";
+import { createGenerateSbomCapability } from "./components/verbs/sbom";
+import type { SbomDocument, SbomGenerator } from "./components/verbs/sbom-generator";
+import { computePlanDigest } from "./lifecycle/plan-digest";
+import { hashProps } from "./lifecycle/digest";
+import { isLegacyContentDigest } from "./lifecycle/legacy-digest";
+
+describe("contentDigest (#2514)", () => {
+  test("matches the FIPS 180-2 test vectors", () => {
+    expect(contentDigest("abc")).toBe("sha256:ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad");
+    expect(contentDigest("")).toBe("sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
+  });
+
+  test("hashes the UTF-8 bytes, not UTF-16 code units", () => {
+    const text = "héllo, 世界 🌍";
+    const expected = createHash("sha256").update(Buffer.from(text, "utf8")).digest("hex");
+    expect(contentDigest(text)).toBe(`sha256:${expected}`);
+  });
+
+  test("the build archive exports the same function", () => {
+    expect(archiveContentDigest).toBe(contentDigest);
+  });
+
+  test("its output is never mistaken for the old form", () => {
+    for (const input of ["", "x", "hello", "{}"]) {
+      expect(isLegacyContentDigest(contentDigest(input))).toBe(false);
+    }
+  });
+
+  test("inputs one byte apart get different digests", () => {
+    expect(contentDigest("template-a")).not.toBe(contentDigest("template-b"));
+    expect(contentDigest("abc")).not.toBe(contentDigest("abc "));
+  });
+});
+
+describe("manifest digest (#2514)", () => {
+  const entry = (digest: string, path = "web.json") => ({ kind: "template" as const, path, digest });
+
+  test("is contentDigest over the canonical JSON of the sorted entries", () => {
+    const a = entry(contentDigest("{}"), "b.json");
+    const b = entry(contentDigest("[]"), "a.json");
+    const expected = contentDigest(
+      canonicalJson([
+        { kind: b.kind, path: b.path, digest: b.digest },
+        { kind: a.kind, path: a.path, digest: a.digest },
+      ]),
+    );
+    expect(computeManifestDigest([a, b])).toBe(expected);
+    expect(computeManifestDigest([b, a])).toBe(expected);
+  });
+
+  test("templates one byte apart give different entry and manifest digests", () => {
+    const base = createBuildArchiveManifest("web", { now: () => new Date(0) });
+    const one = addArchiveEntry(base, entry(contentDigest('{"Resources":{"A":1}}')));
+    const two = addArchiveEntry(base, entry(contentDigest('{"Resources":{"A":2}}')));
+    expect(one.contents[0]!.digest).not.toBe(two.contents[0]!.digest);
+    expect(one.manifestDigest).not.toBe(two.manifestDigest);
+  });
+
+  test("a path cannot be read as a separator", () => {
+    // Under the old `kind:path:digest` join these two could be confused.
+    const x = computeManifestDigest([entry("sha256:1", "a:template:b")]);
+    const y = computeManifestDigest([entry("template:b:sha256:1", "a")]);
+    expect(x).not.toBe(y);
+  });
+});
+
+describe("SBOM digest (#2514)", () => {
+  function fixedGenerator(bytes: string): SbomGenerator {
+    const doc = async (): Promise<SbomDocument> => ({
+      format: "spdx",
+      mediaType: "application/spdx+json",
+      bytes,
+      generator: "test",
+    });
+    return { forImage: doc, forJar: doc, forZip: doc, forDir: doc };
+  }
+
+  test("SBOMs one byte apart get different digests, each real SHA-256", async () => {
+    const ctx = { env: "dev", component: "web" };
+    const input = { artifactType: "image" as const, path: "archive/web.tar", digest: contentDigest("image") };
+    const a = await createGenerateSbomCapability(fixedGenerator('{"packages":[1]}')).run(ctx, input);
+    const b = await createGenerateSbomCapability(fixedGenerator('{"packages":[2]}')).run(ctx, input);
+    expect(a.digest).toBe(contentDigest('{"packages":[1]}'));
+    expect(a.digest).not.toBe(b.digest);
+    expect(a.manifest.manifestDigest).not.toBe(b.manifest.manifestDigest);
+  });
+});
+
+describe("other hashes use contentDigest over canonicalJson (#2514)", () => {
+  test("a plan digest", () => {
+    const subject = { b: 1, a: [true, null] };
+    expect(computePlanDigest("lifecycle-diff", subject)).toBe(
+      contentDigest(canonicalJson({ kind: "lifecycle-diff", subject })),
+    );
+  });
+
+  test("a plan digest orders keys by code unit, not by locale", () => {
+    // localeCompare puts "a" before "B"; canonicalJson puts "B" first.
+    expect(computePlanDigest("k", { a: 1, B: 2 })).toBe(contentDigest('{"kind":"k","subject":{"B":2,"a":1}}'));
+  });
+
+  test("a props hash, which drops what JSON cannot hold instead of throwing", () => {
+    const props = { Name: "x", fn: () => 1, nested: { z: 1, a: undefined } };
+    expect(hashProps(props)).toBe(contentDigest('{"Name":"x","nested":{"z":1}}').slice("sha256:".length));
+  });
+});

package/src/content-digest.ts

@@ -0,0 +1,21 @@
+/**
+ * The one content digest chant computes itself (chant #2514).
+ *
+ * `contentDigest(x)` is `"sha256:"` followed by the lowercase hex SHA-256 of
+ * the UTF-8 bytes of `x`. Anything core hashes goes through it, and anything
+ * structured is first put in canonical form with `canonicalJson`
+ * (./effect-receipt.ts), so the same value always hashes the same way. The
+ * build archive re-exports it from ./components/verbs/build-archive.ts, where
+ * it used to live.
+ *
+ * Before #2514 this function computed a 32-bit string hash and repeated its
+ * eight hex digits eight times. Values recorded then are recognised and
+ * flagged by ./lifecycle/legacy-digest.ts.
+ */
+
+import { createHash } from "node:crypto";
+
+/** `sha256:<64 hex>` over the UTF-8 bytes of `input`. */
+export function contentDigest(input: string): string {
+  return `sha256:${createHash("sha256").update(input, "utf8").digest("hex")}`;
+}

package/src/discovery/files.test.ts

@@ -189,11 +189,11 @@ describe("findInfraFiles — project exclude/include globs (#2519)", () => {
     ".stage/copy.ts": "export const copy = {};",
   };
 
-  test("with neither key configured, discovery returns exactly what it did before", async () => {
+  test("with neither key configured, every file but the dot directory's is discovered", async () => {
     await withTestDir(async (testDir) => {
       await project(testDir, { lexicons: ["aws"] }, LAYOUT);
       expect(rel(testDir, await findInfraFiles(testDir))).toEqual([
-        ".stage/copy.ts", "ops/keep.ts", "ops/run.ts", "src/app.ts", "src/lib/util.ts",
+        "ops/keep.ts", "ops/run.ts", "src/app.ts", "src/lib/util.ts",
       ]);
     });
   });
@@ -201,14 +201,14 @@ describe("findInfraFiles — project exclude/include globs (#2519)", () => {
   test.each([["ops"], ["ops/**"], ["ops/*.ts"]])("exclude %s skips everything under ops/", async (pattern) => {
     await withTestDir(async (testDir) => {
       await project(testDir, { exclude: [pattern] }, LAYOUT);
-      expect(rel(testDir, await findInfraFiles(testDir))).toEqual([".stage/copy.ts", "src/app.ts", "src/lib/util.ts"]);
+      expect(rel(testDir, await findInfraFiles(testDir))).toEqual(["src/app.ts", "src/lib/util.ts"]);
     });
   });
 
-  test("patterns match dot directories", async () => {
+  test("include re-admits a dot directory the walk skips by default (#2527)", async () => {
     await withTestDir(async (testDir) => {
-      await project(testDir, { exclude: [".stage"] }, LAYOUT);
-      expect(rel(testDir, await findInfraFiles(testDir))).not.toContain(".stage/copy.ts");
+      await project(testDir, { include: [".stage"] }, LAYOUT);
+      expect(rel(testDir, await findInfraFiles(testDir))).toContain(".stage/copy.ts");
     });
   });
 
@@ -216,7 +216,7 @@ describe("findInfraFiles — project exclude/include globs (#2519)", () => {
     await withTestDir(async (testDir) => {
       await project(testDir, { exclude: ["ops"], include: ["ops/keep.ts"] }, LAYOUT);
       expect(rel(testDir, await findInfraFiles(testDir))).toEqual([
-        ".stage/copy.ts", "ops/keep.ts", "src/app.ts", "src/lib/util.ts",
+        "ops/keep.ts", "src/app.ts", "src/lib/util.ts",
       ]);
     });
   });
@@ -231,7 +231,7 @@ describe("findInfraFiles — project exclude/include globs (#2519)", () => {
   test("include alone changes nothing", async () => {
     await withTestDir(async (testDir) => {
       await project(testDir, { include: ["src"] }, LAYOUT);
-      expect(await findInfraFiles(testDir)).toHaveLength(5);
+      expect(await findInfraFiles(testDir)).toHaveLength(4);
     });
   });
 
@@ -252,9 +252,9 @@ describe("findInfraFiles — project exclude/include globs (#2519)", () => {
   test("explicit globs override the config; null applies none", async () => {
     await withTestDir(async (testDir) => {
       await project(testDir, { exclude: ["ops"] }, LAYOUT);
-      expect(await findInfraFiles(testDir, { globs: null })).toHaveLength(5);
+      expect(await findInfraFiles(testDir, { globs: null })).toHaveLength(4);
       const only = await findInfraFiles(testDir, { globs: { root: testDir, exclude: ["src"], include: [] } });
-      expect(rel(testDir, only)).toEqual([".stage/copy.ts", "ops/keep.ts", "ops/run.ts"]);
+      expect(rel(testDir, only)).toEqual(["ops/keep.ts", "ops/run.ts"]);
     });
   });
 });