@intentius/chant 0.101.0 → 0.102.0

package/src/lifecycle/work-lease.ts

@@ -100,6 +100,93 @@ export interface WorkLeaseState extends WorkLease {
   ref: string;
 }
 
+/**
+ * How a work lease can end (#3147): the closed list of outcomes a release
+ * records. A new outcome is a contract change. Readers of an older history
+ * may still find free text from before the list was closed, which counts as
+ * an attempt (see {@link outcomeCountsAsAttempt}).
+ */
+export const WORK_LEASE_OUTCOMES = [
+  /** The work was finished: built, checked and recorded. */
+  "done",
+  /** A build ran and did not finish, or the run failed. Counts as an attempt. */
+  "not_done",
+  /** An expired lease closed out by someone other than its holder: the worker went away. Counts as an attempt. */
+  "abandoned",
+  /** The run stopped at a gate, waiting for an approval. */
+  "gated",
+  /** The run stopped on a decision point's open question, waiting for a person. */
+  "waiting",
+  /** The item was dropped, such as by a refuse at the understand point. Nothing was built. */
+  "dropped",
+  /** The understand point answered redraft: the item goes back to its author. Nothing was built. */
+  "redraft",
+  /** The understand point answered ask: the item waits on a question to its author. Nothing was built. */
+  "ask",
+] as const;
+export type WorkLeaseOutcome = (typeof WORK_LEASE_OUTCOMES)[number];
+
+/** The outcomes that count toward an item's attempt limit. */
+export const ATTEMPT_OUTCOMES: readonly WorkLeaseOutcome[] = ["not_done", "abandoned"];
+
+/** Whether `value` is one of {@link WORK_LEASE_OUTCOMES}. */
+export function isWorkLeaseOutcome(value: unknown): value is WorkLeaseOutcome {
+  return typeof value === "string" && (WORK_LEASE_OUTCOMES as readonly string[]).includes(value);
+}
+
+/**
+ * Whether a release with `outcome` counts toward the item's attempt limit:
+ * `not_done` and `abandoned` do, and so does a release that gave no outcome
+ * or one outside the closed list (free text written before #3147), since
+ * nothing says the work got anywhere.
+ */
+export function outcomeCountsAsAttempt(outcome: string | null | undefined): boolean {
+  if (!isWorkLeaseOutcome(outcome)) return true;
+  return ATTEMPT_OUTCOMES.includes(outcome);
+}
+
+/** The ref prefix that keeps an unfinished attempt's work (#3147). */
+export const KEPT_REF_PREFIX = "refs/chant/kept/";
+
+/**
+ * Where the work of an attempt that ended `not_done` is kept: one ref per
+ * lease token, `refs/chant/kept/[<member>/...]<item>/<token>`, scoped by the
+ * members the way the work branch `chant/work/[<member>/]<item>` is.
+ */
+export function keptAttemptRef(id: string, token: string, members: readonly string[] = []): string {
+  return `${keptAttemptPrefix(id, members)}${token}`;
+}
+
+/** The prefix under which every kept attempt of item `id` sits. */
+export function keptAttemptPrefix(id: string, members: readonly string[] = []): string {
+  return `${KEPT_REF_PREFIX}${members.length ? `${members.join("/")}/` : ""}${id}/`;
+}
+
+/** One kept attempt, as `work history` lists it. */
+export interface KeptAttempt {
+  /** The lease token the attempt ran under. */
+  token: string;
+  ref: string;
+  /** The commit the ref points at. */
+  commit: string;
+}
+
+/** Every kept attempt of item `id`, from the local refs, sorted by ref. Empty outside git. */
+export async function listKeptAttempts(id: string, opts: { cwd: string; members?: readonly string[] }): Promise<KeptAttempt[]> {
+  const prefix = keptAttemptPrefix(id, opts.members ?? []);
+  const out = await getRuntime().spawn(["git", "for-each-ref", "--format=%(refname) %(objectname)", prefix], { cwd: opts.cwd });
+  if (out.exitCode !== 0) return [];
+  return out.stdout
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => {
+      const [ref, commit] = line.split(" ");
+      return { token: ref.slice(prefix.length), ref, commit };
+    })
+    .filter((k) => k.token !== "" && !k.token.includes("/"))
+    .sort((a, b) => (a.ref < b.ref ? -1 : a.ref > b.ref ? 1 : 0));
+}
+
 /** One line of `_leases/<id>.jsonl`. */
 export interface LeaseHistoryRecord {
   version: 1;
@@ -115,7 +202,7 @@ export interface LeaseHistoryRecord {
   expiresAt: string;
   /** When the event happened. */
   timestamp: string;
-  /** How the work ended, on a release. Free text such as done, not_done or skipped. */
+  /** How the work ended, on a release: one of {@link WORK_LEASE_OUTCOMES}, or free text in a line written before #3147. */
   outcome?: string;
   note?: string;
 }
@@ -257,7 +344,8 @@ async function finish(
 /**
  * Give the lease on `id` back. The holder releases a live lease (with
  * `token`, only that one); anyone may release an expired one, which is how an
- * abandoned claim is closed out. `outcome` says how the work ended. Refused
+ * abandoned claim is closed out. `outcome` says how the work ended, from the
+ * closed list {@link WORK_LEASE_OUTCOMES}; any other value throws. Refused
  * with `lease-not-held` when there is no lease, and `lease-held` when someone
  * else holds it live.
  */
@@ -267,6 +355,9 @@ export async function releaseWorkLease(
   opts: WorkLeaseOptions & { token?: string; outcome?: string; note?: string },
 ): Promise<WorkLeaseResult> {
   checkId(id);
+  if (opts.outcome !== undefined && !isWorkLeaseOutcome(opts.outcome)) {
+    throw new Error(`${JSON.stringify(opts.outcome)} is not a work lease outcome: use one of ${WORK_LEASE_OUTCOMES.join(", ")}`);
+  }
   const key = workLeaseKey(id);
   const now = opts.now?.() ?? new Date();
   const { record } = await readLease(key, { cwd: opts.cwd });

package/src/lint/engine.test.ts

@@ -6,6 +6,61 @@ import { writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
 describe("runLint", () => {
+  // #2511
+  test("a rule that throws is an error for that file, and the other rules still run", async () => {
+    await withTestDir(async (testDir) => {
+      const testFile = join(testDir, "test.ts");
+      await writeFile(testFile, "const x = 1;");
+
+      const throwing: LintRule = {
+        id: "throws",
+        severity: "warning",
+        category: "correctness",
+        check: () => {
+          throw new Error("bad input");
+        },
+      };
+      const after: LintRule = {
+        id: "after",
+        severity: "warning",
+        category: "correctness",
+        check: (context: LintContext): LintDiagnostic[] => [
+          { file: context.filePath, line: 1, column: 1, ruleId: "after", severity: "warning", message: "ran" },
+        ],
+      };
+
+      const { diagnostics } = await runLint([testFile], [throwing, after]);
+
+      expect(diagnostics.map((d) => d.ruleId).sort()).toEqual(["after", "throws"]);
+      const threw = diagnostics.find((d) => d.ruleId === "throws")!;
+      expect(threw.severity).toBe("error");
+      expect(threw.file).toBe(testFile);
+      expect(threw.message).toBe(`Rule throws threw while checking ${testFile}: bad input`);
+    });
+  });
+
+  test("a disable comment does not suppress a rule's failure", async () => {
+    await withTestDir(async (testDir) => {
+      const testFile = join(testDir, "test.ts");
+      await writeFile(testFile, "// chant-disable\nconst x = 1;");
+
+      const throwing: LintRule = {
+        id: "throws",
+        severity: "warning",
+        category: "correctness",
+        check: () => {
+          throw "not an Error";
+        },
+      };
+
+      const { diagnostics, suppressed } = await runLint([testFile], [throwing]);
+
+      expect(suppressed).toHaveLength(0);
+      expect(diagnostics).toHaveLength(1);
+      expect(diagnostics[0].message).toContain("not an Error");
+    });
+  });
+
   test("executes rules and returns diagnostics", async () => {
     await withTestDir(async (testDir) => {
       const testFile = join(testDir, "test.ts");

package/src/lint/engine.ts

@@ -189,6 +189,23 @@ function isDiagnosticDisabled(
   return { suppressed: false };
 }
 
+/**
+ * The error reported when a rule throws while checking a file (#2511). It
+ * names the rule, the file and the thrown message, at error severity so
+ * `chant lint` exits non-zero.
+ */
+export function ruleThrewDiagnostic(ruleId: string, filePath: string, error: unknown): LintDiagnostic {
+  const message = error instanceof Error ? error.message : String(error);
+  return {
+    file: filePath,
+    line: 1,
+    column: 1,
+    ruleId,
+    severity: "error",
+    message: `Rule ${ruleId} threw while checking ${filePath}: ${message}`,
+  };
+}
+
 /**
  * Execute lint rules on a set of files
  * @param files - Array of file paths to lint
@@ -246,11 +263,17 @@ export async function runLint(
         propertyClasses,
       };
 
-      // Execute each rule
+      // Execute each rule. A rule that throws is reported as an error for
+      // this file (#2511) and the remaining rules still run.
+      const ruleErrors: LintDiagnostic[] = [];
       for (const rule of rules) {
         const options = ruleOptions?.get(rule.id);
-        const diagnostics = rule.check(context, options);
-        allDiagnostics.push(...diagnostics);
+        try {
+          const diagnostics = rule.check(context, options);
+          allDiagnostics.push(...diagnostics);
+        } catch (error) {
+          ruleErrors.push(ruleThrewDiagnostic(rule.id, filePath, error));
+        }
       }
 
       // Partition file diagnostics into active and suppressed
@@ -269,7 +292,10 @@ export async function runLint(
 
       // Replace file diagnostics with filtered ones
       allDiagnostics.length = 0;
-      allDiagnostics.push(...otherFileDiags, ...keptDiags);
+      // A rule's own failure is never suppressed by a disable comment: the
+      // comment is aimed at the rule's findings, and hiding the failure would
+      // make a rule that did not run look like a clean lint.
+      allDiagnostics.push(...otherFileDiags, ...keptDiags, ...ruleErrors);
     } catch (error) {
       // If parsing fails, skip this file and continue with others
       continue;

package/src/lint/output-docs.test.ts

@@ -1,6 +1,7 @@
 import { describe, test, expect } from "vitest";
 import { parseOutputDocs, pick, get } from "./output-docs";
 import type { SerializerResult } from "../serializer";
+import { load as jsYamlLoad } from "js-yaml";
 
 describe("parseOutputDocs", () => {
   test("parses a single JSON output as one document", () => {
@@ -156,65 +157,67 @@ describe("parseOutputDocs", () => {
       expect(bad.value).toBeUndefined();
     });
   });
-});
-
-describe("pick", () => {
-  interface Widget {
-    kind: string;
-    name: string;
-    extra: unknown;
-  }
-
-  test("returns only the named keys that are present", () => {
-    const value = { kind: "Deployment", name: "web", other: "ignored" };
-    expect(pick<Widget>(value, ["kind", "name"])).toEqual({ kind: "Deployment", name: "web" });
-  });
-
-  test("omits a named key that is absent — no invented default", () => {
-    const value = { kind: "Deployment" };
-    expect(pick<Widget>(value, ["kind", "name"])).toEqual({ kind: "Deployment" });
-  });
-
-  test("returns an empty object for a non-object value", () => {
-    expect(pick<Widget>(null, ["kind"])).toEqual({});
-    expect(pick<Widget>("a string", ["kind"])).toEqual({});
-    expect(pick<Widget>(undefined, ["kind"])).toEqual({});
-  });
-
-  test("copies values through unvalidated, whatever their actual shape", () => {
-    const value = { kind: 42 }; // wrong runtime type for `kind: string`
-    expect(pick<Widget>(value, ["kind"])).toEqual({ kind: 42 });
-  });
-});
-
-describe("get", () => {
-  test("walks a dotted path through nested objects", () => {
-    const value = { spec: { template: { spec: { containers: [] } } } };
-    expect(get(value, "spec.template.spec")).toEqual({ containers: [] });
-  });
-
-  test("returns undefined as soon as a segment is missing", () => {
-    const value = { spec: {} };
-    expect(get(value, "spec.template.spec")).toBeUndefined();
-  });
 
-  test("returns undefined when an intermediate value is not indexable", () => {
-    const value = { spec: "not-an-object" };
-    expect(get(value, "spec.template")).toBeUndefined();
-  });
+  // #2925: hand-written and third-party YAML (`chant audit`, test fixtures)
+  // uses flow collections and folded scalars. Each case is checked against
+  // js-yaml, so the expected value is what a full parser reads.
+  describe("YAML a hand-written manifest uses (#2925)", () => {
+    const docOf = (yaml: string): unknown => {
+      const docs = parseOutputDocs(new Map<string, string | SerializerResult>([["k8s", yaml]]));
+      expect(docs).toHaveLength(1);
+      expect(docs[0].error).toBeUndefined();
+      return docs[0].value;
+    };
 
-  test("indexes into arrays with a numeric path segment", () => {
-    const value = { items: [{ name: "first" }, { name: "second" }] };
-    expect(get(value, "items.1.name")).toBe("second");
-  });
+    test("flow mappings read as mappings, not strings", () => {
+      const yaml = [
+        "apiVersion: apps/v1",
+        "kind: Deployment",
+        "metadata: { name: gw, namespace: obs }",
+        "spec:",
+        "  template:",
+        "    spec:",
+        "      volumes:",
+        "        - name: conf",
+        "          configMap: { name: gw-config }",
+      ].join("\n");
+      const value = docOf(yaml);
+      expect(value).toEqual(jsYamlLoad(yaml));
+      expect(get(value, "metadata.namespace")).toBe("obs");
+      expect(get(value, "spec.template.spec.volumes.0.configMap.name")).toBe("gw-config");
+    });
 
-  test("returns the value itself for an empty path", () => {
-    const value = { a: 1 };
-    expect(get(value, "")).toBe(value);
-  });
+    test("a flow sequence of flow mappings reads as a list of mappings", () => {
+      const yaml = [
+        "kind: Pod",
+        "spec:",
+        "  containers:",
+        "    - name: gw",
+        "      volumeMounts: [{ name: conf, mountPath: /conf }, { name: data, mountPath: /data, readOnly: true }]",
+        "      args: [--config, /conf/config.yaml]",
+      ].join("\n");
+      const value = docOf(yaml);
+      expect(value).toEqual(jsYamlLoad(yaml));
+      expect(get(value, "spec.containers.0.volumeMounts.1.readOnly")).toBe(true);
+      expect(get(value, "spec.containers.0.args")).toEqual(["--config", "/conf/config.yaml"]);
+    });
 
-  test("does not throw on null/undefined input", () => {
-    expect(get(null, "a.b")).toBeUndefined();
-    expect(get(undefined, "a.b")).toBeUndefined();
+    test("a folded scalar keeps the line breaks of its more-indented lines", () => {
+      // js-yaml dumps a long ConfigMap value this way.
+      const yaml = [
+        "kind: ConfigMap",
+        "data:",
+        "  config.yaml: >",
+        "    receivers:",
+        "      k8s_cluster:",
+        "        auth_type: serviceAccount",
+        "    exporters: {}",
+      ].join("\n");
+      const value = docOf(yaml);
+      expect(value).toEqual(jsYamlLoad(yaml));
+      expect((value as { data: Record<string, string> }).data["config.yaml"]).toBe(
+        "receivers:\n  k8s_cluster:\n    auth_type: serviceAccount\nexporters: {}\n",
+      );
+    });
   });
 });

package/src/op/activities/apply.test.ts

@@ -1,7 +1,7 @@
 import { describe, test, expect } from "vitest";
 import { applyResult } from "../../apply";
 import { defaultOutput, nativeApply, compensateApply, hasNativeRollback } from "./apply";
-import type { K8sApplier, AzureApplier, GcpApplier, FlyApplier, AwsApplier, AwsRollback } from "./apply";
+import type { K8sApplier, AzureApplier, GcpApplier, FlyApplier, GrafanaApplier, ClickHouseApplier, PostgresApplier, AwsApplier, AwsRollback } from "./apply";
 
 /**
  * The kubectl branch moved to the k8s lexicon in chant #1075, the arm branch to
@@ -415,6 +415,189 @@ describe("nativeApply: fly dispatches to the fly lexicon (chant #1449)", () => {
   });
 });
 
+describe("nativeApply: grafana dispatches to the grafana lexicon (chant #3011)", () => {
+  /** Records what the applier was handed, and reports an empty envelope. */
+  const spy = (): { calls: Array<Parameters<GrafanaApplier>[0]>; applier: GrafanaApplier } => {
+    const calls: Array<Parameters<GrafanaApplier>[0]> = [];
+    const applier: GrafanaApplier = async (args) => {
+      calls.push(args);
+      return applyResult([]);
+    };
+    return { calls, applier };
+  };
+  /** nativeApply with only the grafana applier injected. */
+  const applyGrafana = (args: Parameters<typeof nativeApply>[0], applier: GrafanaApplier) =>
+    nativeApply(args, undefined, undefined, undefined, undefined, undefined, undefined, undefined, applier);
+
+  test("output maps to the index path and env to the environment, and nothing else is passed", async () => {
+    const { calls, applier } = spy();
+    await applyGrafana({ target: "grafana", env: "prod", output: "dist/grafana.json" }, applier);
+    // env selects grafana.profiles.<env>; the ownership marker is read from
+    // chant.config.ts inside grafanaApply, so neither stack nor
+    // ownershipEnv crosses this seam.
+    expect(calls).toEqual([{ indexPath: "dist/grafana.json", environment: "prod", prune: false }]);
+  });
+
+  test("owned-only and gated ask the grafana applier to prune", async () => {
+    for (const deleteMode of ["owned-only", "gated"] as const) {
+      const { calls, applier } = spy();
+      await applyGrafana({ target: "grafana", env: "prod", deleteMode }, applier);
+      expect(calls[0].prune).toBe(true);
+    }
+  });
+
+  test("never (and the default) do not prune", async () => {
+    const explicit = spy();
+    await applyGrafana({ target: "grafana", env: "prod", deleteMode: "never" }, explicit.applier);
+    expect(explicit.calls[0].prune).toBe(false);
+
+    const defaulted = spy();
+    await applyGrafana({ target: "grafana", env: "prod" }, defaulted.applier);
+    expect(defaulted.calls[0].prune).toBe(false);
+  });
+
+  test("defaults the index path to dist/grafana.json", async () => {
+    const { calls, applier } = spy();
+    await applyGrafana({ target: "grafana", env: "prod" }, applier);
+    expect(calls[0].indexPath).toBe("dist/grafana.json");
+    expect(defaultOutput("grafana")).toBe("dist/grafana.json");
+  });
+
+  test("counts are preserved from the applier's envelope, not-prunable kinds included", async () => {
+    const applier: GrafanaApplier = async () =>
+      applyResult(
+        [
+          { kind: "Folder", name: "team-a", action: "created" },
+          { kind: "Dashboard", name: "api", action: "updated" },
+          { kind: "Dashboard", name: "db", action: "unchanged" },
+        ],
+        [{ kind: "Dashboard", name: "old", deleted: true }],
+        [{ kind: "LibraryPanel", name: "*", reason: "not-prunable", detail: "library panels carry no labels" }],
+      );
+    const result = await applyGrafana({ target: "grafana", env: "prod" }, applier);
+    expect(result).toEqual({ applied: 3, pruned: 1, notAttempted: 1 });
+  });
+
+  test("with nothing injected it resolves the real grafana lexicon's grafanaApply", async () => {
+    // An index path that does not exist fails inside grafanaApply's own read,
+    // reachable only if the dynamic import found the lexicon, and before any
+    // binding or HTTP call.
+    const err = await nativeApply({
+      target: "grafana",
+      env: "prod",
+      output: "/nonexistent/chant-3011-grafana.json",
+    }).catch((e: unknown) => e);
+    expect(String(err)).toMatch(/ENOENT|no such file/);
+    expect(String(err)).not.toMatch(/could not be loaded/);
+  });
+});
+
+describe("nativeApply: clickhouse dispatches to the sql lexicon (chant #3208)", () => {
+  const spy = (): { calls: Array<Parameters<ClickHouseApplier>[0]>; applier: ClickHouseApplier } => {
+    const calls: Array<Parameters<ClickHouseApplier>[0]> = [];
+    const applier: ClickHouseApplier = async (args) => {
+      calls.push(args);
+      return applyResult([]);
+    };
+    return { calls, applier };
+  };
+  const applyClickHouse = (args: Parameters<typeof nativeApply>[0], applier: ClickHouseApplier) =>
+    nativeApply(args, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, applier);
+
+  test("output maps to the build path and env to the environment, and nothing else is passed", async () => {
+    const { calls, applier } = spy();
+    await applyClickHouse({ target: "clickhouse", env: "prod", output: "dist/schema.json" }, applier);
+    expect(calls).toEqual([{ buildPath: "dist/schema.json", environment: "prod", prune: false }]);
+  });
+
+  test("owned-only and gated prune; never and the default do not", async () => {
+    for (const [deleteMode, prune] of [["owned-only", true], ["gated", true], ["never", false], [undefined, false]] as const) {
+      const { calls, applier } = spy();
+      await applyClickHouse({ target: "clickhouse", env: "prod", ...(deleteMode ? { deleteMode } : {}) }, applier);
+      expect(calls[0].prune).toBe(prune);
+    }
+  });
+
+  test("defaults the build path to dist/schema.json", async () => {
+    const { calls, applier } = spy();
+    await applyClickHouse({ target: "clickhouse", env: "prod" }, applier);
+    expect(calls[0].buildPath).toBe("dist/schema.json");
+    expect(defaultOutput("clickhouse")).toBe("dist/schema.json");
+  });
+
+  test("counts come from the envelope, a refused rebuild among the not-attempted", async () => {
+    const applier: ClickHouseApplier = async () =>
+      applyResult(
+        [
+          { kind: "ClickHouse::Database", name: "shop", action: "unchanged" },
+          { kind: "ClickHouse::Table", name: "shop.users", action: "updated" },
+        ],
+        [{ kind: "ClickHouse::Table", name: "shop.old", deleted: true }],
+        [{ kind: "ClickHouse::Table", name: "shop.events", reason: "unsupported-kind", detail: "needs a rebuild" }],
+      );
+    expect(await applyClickHouse({ target: "clickhouse", env: "prod" }, applier)).toEqual({ applied: 2, pruned: 1, notAttempted: 1 });
+  });
+
+  test("with nothing injected it resolves the real sql lexicon's clickhouseApply", async () => {
+    const err = await nativeApply({ target: "clickhouse", env: "prod", output: "/nonexistent/chant-3208-schema.json" }).catch((e: unknown) => e);
+    expect(String(err)).toMatch(/ENOENT|no such file/);
+    expect(String(err)).not.toMatch(/could not be loaded/);
+  });
+});
+
+describe("nativeApply: postgres dispatches to the sql lexicon (chant #3280)", () => {
+  const spy = (): { calls: Array<Parameters<PostgresApplier>[0]>; applier: PostgresApplier } => {
+    const calls: Array<Parameters<PostgresApplier>[0]> = [];
+    const applier: PostgresApplier = async (args) => {
+      calls.push(args);
+      return applyResult([]);
+    };
+    return { calls, applier };
+  };
+  const applyPostgres = (args: Parameters<typeof nativeApply>[0], applier: PostgresApplier) =>
+    nativeApply(args, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, applier);
+
+  test("output maps to the build path and env to the environment, and nothing else is passed", async () => {
+    const { calls, applier } = spy();
+    await applyPostgres({ target: "postgres", env: "prod", output: "dist/schema.json" }, applier);
+    expect(calls).toEqual([{ buildPath: "dist/schema.json", environment: "prod", prune: false }]);
+  });
+
+  test("owned-only and gated prune; never and the default do not", async () => {
+    for (const [deleteMode, prune] of [["owned-only", true], ["gated", true], ["never", false], [undefined, false]] as const) {
+      const { calls, applier } = spy();
+      await applyPostgres({ target: "postgres", env: "prod", ...(deleteMode ? { deleteMode } : {}) }, applier);
+      expect(calls[0].prune).toBe(prune);
+    }
+  });
+
+  test("defaults the build path to dist/schema.json", async () => {
+    const { calls, applier } = spy();
+    await applyPostgres({ target: "postgres", env: "prod" }, applier);
+    expect(calls[0].buildPath).toBe("dist/schema.json");
+    expect(defaultOutput("postgres")).toBe("dist/schema.json");
+  });
+
+  test("counts come from the envelope, a refused expand-and-contract change among the not-attempted", async () => {
+    const applier: PostgresApplier = async () =>
+      applyResult(
+        [
+          { kind: "Postgres::Schema", name: "app", action: "unchanged" },
+          { kind: "Postgres::Table", name: "app.users", action: "updated" },
+        ],
+        [{ kind: "Postgres::Table", name: "app.old", deleted: true }],
+        [{ kind: "Postgres::Table", name: "app.orders", reason: "unsupported-kind", detail: "SQLPG205 Rename a column" }],
+      );
+    expect(await applyPostgres({ target: "postgres", env: "prod" }, applier)).toEqual({ applied: 2, pruned: 1, notAttempted: 1 });
+  });
+
+  test("with nothing injected it resolves the real sql lexicon's postgresApply", async () => {
+    const err = await nativeApply({ target: "postgres", env: "prod", output: "/nonexistent/chant-3280-schema.json" }).catch((e: unknown) => e);
+    expect(String(err)).toMatch(/ENOENT|no such file/);
+    expect(String(err)).not.toMatch(/could not be loaded/);
+  });
+});
+
 describe("nativeApply: cloudformation dispatches to the aws lexicon (chant #1449)", () => {
   /** Records what the applier was handed, and reports a settled create. */
   const spy = (): { calls: Array<Parameters<AwsApplier>[0]>; applier: AwsApplier } => {
@@ -515,11 +698,11 @@ describe("compensateApply: cloudformation rolls back through the aws lexicon (ch
     expect(result).toEqual({ command: "echo custom-rollback" });
   });
 
-  test("kubectl / kustomize / arm / gcp / fly without a command throw — the defensive branch (#1449)", async () => {
+  test("kubectl / kustomize / arm / gcp / fly / grafana / clickhouse / postgres without a command throw — the defensive branch (#1449)", async () => {
     // Unreachable from a built ApplyOp, which refuses this combination at
     // build time. A hand-assembled op that reaches it fails loudly rather than
     // returning a result that could read as a revert.
-    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly"] as const) {
+    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly", "grafana", "clickhouse", "postgres"] as const) {
       const err = await compensateApply({ target, env: "prod" }).catch((e: unknown) => e);
       expect(String(err)).toMatch(`no automatic rollback for target "${target}"`);
       expect(String(err)).toMatch(/NOT\s+reverted/);
@@ -529,7 +712,7 @@ describe("compensateApply: cloudformation rolls back through the aws lexicon (ch
 
   test("hasNativeRollback: cloudformation only", () => {
     expect(hasNativeRollback("cloudformation")).toBe(true);
-    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly"] as const) {
+    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly", "grafana", "clickhouse", "postgres"] as const) {
       expect(hasNativeRollback(target)).toBe(false);
     }
   });
@@ -557,11 +740,12 @@ describe("compensateApply: cloudformation rolls back through the aws lexicon (ch
 });
 
 describe('defaultOutput (target-aware apply output)', () => {
-  test('kubectl → dist (dir); cloudformation/arm → template.json (file); gcp → dist/gcp.yaml; fly → dist/fly.json', () => {
+  test('kubectl → dist (dir); cloudformation/arm → template.json (file); gcp → dist/gcp.yaml; fly → dist/fly.json; grafana → dist/grafana.json', () => {
     expect(defaultOutput('kubectl')).toBe('dist');
     expect(defaultOutput('cloudformation')).toBe('template.json');
     expect(defaultOutput('arm')).toBe('template.json');
     expect(defaultOutput('gcp')).toBe('dist/gcp.yaml');
     expect(defaultOutput('fly')).toBe('dist/fly.json');
+    expect(defaultOutput('grafana')).toBe('dist/grafana.json');
   });
 });