@intentius/chant 0.1.22 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.1.22",
+  "version": "0.2.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/migrate.ts

@@ -96,6 +96,9 @@ export async function migrateCommand(opts: MigrateCliOpts): Promise<MigrateCliRe
       useComposites: opts.useComposites,
       sourceFile: opts.sourceFile,
       strict: opts.strict,
+      // --validate also runs the target lexicon's security checks against the
+      // migrated output and classifies security-property fates (#306).
+      security: opts.validate,
     });
   } catch (err) {
     return {
@@ -168,7 +171,11 @@ export async function migrateCommand(opts: MigrateCliOpts): Promise<MigrateCliRe
   }
 
   // Markdown summary (always to stderr — leaves stdout clean for piping)
-  const markdownSummary = formatMarkdownSummary(result.provenance, result.diagnostics, content);
+  let markdownSummary = formatMarkdownSummary(result.provenance, result.diagnostics, content);
+  // Append the security posture section when security analysis ran (#306).
+  if (result.securityPosture) {
+    markdownSummary += `\n\n${result.securityPosture}`;
+  }
 
   // Determine exit code: any error-severity diagnostic fails when --strict.
   // The transformer already escalates needs-review → error when opts.strict

package/src/lexicon.ts

@@ -109,6 +109,9 @@ export interface MigrateOptions {
   sourceFile?: string;
   /** Escalate needs-review diagnostics to errors. */
   strict?: boolean;
+  /** Run security-aware migration analysis (classify property fates + run
+   * target security checks). Enabled by `chant migrate --validate`. */
+  security?: boolean;
 }
 
 /**
@@ -125,6 +128,8 @@ export interface MigrationResult {
   provenance: Array<Record<string, unknown>>;
   /** SARIF-shaped diagnostics. */
   diagnostics: Array<Record<string, unknown>>;
+  /** Markdown "Security posture" section, when security analysis ran (#306). */
+  securityPosture?: string;
 }
 
 /**