@intentius/chant 0.105.1 → 0.106.1

package/src/__fixtures__/change-set/warden.plan.json

@@ -1,44 +1,51 @@
-{
-  "org": "acme",
-  "entries": [
-    {
-      "kind": "update",
-      "resourceType": "team",
-      "key": "platform",
-      "before": {
-        "privacy": "secret",
-        "description": "Platform team"
+[
+  {
+    "org": "acme",
+    "entries": [
+      {
+        "kind": "delete",
+        "resourceType": "team",
+        "key": "contractors",
+        "before": {
+          "privacy": "closed",
+          "description": "Old contractors"
+        },
+        "verb": "membership"
       },
-      "after": {
-        "privacy": "closed",
-        "description": "Platform team"
+      {
+        "kind": "update",
+        "resourceType": "team",
+        "key": "platform",
+        "before": {
+          "privacy": "secret",
+          "description": "Platform team"
+        },
+        "after": {
+          "privacy": "closed",
+          "description": "Platform team"
+        },
+        "fields": [
+          {
+            "field": "privacy",
+            "before": "secret",
+            "after": "closed"
+          }
+        ],
+        "verb": "membership"
       },
-      "fields": [
-        {
-          "field": "privacy",
-          "before": "secret",
-          "after": "closed"
-        }
-      ]
-    },
-    {
-      "kind": "create",
-      "resourceType": "team",
-      "key": "release",
-      "after": {
-        "privacy": "secret",
-        "description": "Release managers"
-      }
-    },
-    {
-      "kind": "delete",
-      "resourceType": "team",
-      "key": "contractors",
-      "before": {
-        "privacy": "closed",
-        "description": "Old contractors"
+      {
+        "kind": "create",
+        "resourceType": "team",
+        "key": "release",
+        "after": {
+          "privacy": "secret",
+          "description": "Release managers"
+        },
+        "verb": "membership"
       }
+    ],
+    "managedCounts": {
+      "team": 2
     }
-  ],
-  "managedCount": 2
-}
+  }
+]

package/src/__fixtures__/plan-summary/normalization-vectors.json

@@ -5,7 +5,8 @@
     "Each repo keeps its own grouping code and runs every row in CI.",
     "rootPairs: a and b are two roots of a choudoufu live-plan-set -json document; summarize a set holding exactly the two, and they must land in one group iff group is true.",
     "instancePairs: a and b are two resource_changes of one terraform show -json plan; summarize that plan, and the two instances must land in one group iff group is true.",
-    "Red first: a naive grouper (equal raw resource_changes) must fail every rootPairs row with group true, and a grouper that blanks every string value in before and after must falsely group exactly the rootPairs rows named in overEagerFalselyGroups."
+    "Red first: a naive grouper (equal raw resource_changes) must fail every rootPairs row with group true, and a grouper that blanks every string value in before and after must falsely group exactly the rootPairs rows named in overEagerFalselyGroups.",
+    "sensitive attribute: chant's change-set carries no value for an attribute marked in before_sensitive or after_sensitive, so two sensitive attributes group by path alone, and a sensitive attribute never groups with an unmarked one. read entry: a data source read carries no attributes, so reads of one address group whatever they returned."
   ],
   "rootPairs": [
     {
@@ -1379,6 +1380,277 @@
           ]
         }
       }
+    },
+    {
+      "name": "sensitive attribute with different values",
+      "group": true,
+      "a": {
+        "root": "roots/acme",
+        "estate": "acme",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "aws_db_instance.main",
+              "change": {
+                "actions": [
+                  "update"
+                ],
+                "before": {
+                  "password": "old-a",
+                  "instance_class": "db.t3.small"
+                },
+                "after": {
+                  "password": "new-a",
+                  "instance_class": "db.t3.small"
+                },
+                "before_sensitive": {
+                  "password": true
+                },
+                "after_sensitive": {
+                  "password": true
+                }
+              }
+            }
+          ]
+        }
+      },
+      "b": {
+        "root": "roots/globex",
+        "estate": "globex",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "aws_db_instance.main",
+              "change": {
+                "actions": [
+                  "update"
+                ],
+                "before": {
+                  "password": "old-b",
+                  "instance_class": "db.t3.small"
+                },
+                "after": {
+                  "password": "new-b",
+                  "instance_class": "db.t3.small"
+                },
+                "before_sensitive": {
+                  "password": true
+                },
+                "after_sensitive": {
+                  "password": true
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "name": "sensitive against not sensitive on the same attribute",
+      "group": false,
+      "a": {
+        "root": "roots/acme",
+        "estate": "acme",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "aws_db_instance.main",
+              "change": {
+                "actions": [
+                  "update"
+                ],
+                "before": {
+                  "password": "same-old",
+                  "instance_class": "db.t3.small"
+                },
+                "after": {
+                  "password": "same-new",
+                  "instance_class": "db.t3.small"
+                },
+                "before_sensitive": {
+                  "password": true
+                },
+                "after_sensitive": {
+                  "password": true
+                }
+              }
+            }
+          ]
+        }
+      },
+      "b": {
+        "root": "roots/globex",
+        "estate": "globex",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "aws_db_instance.main",
+              "change": {
+                "actions": [
+                  "update"
+                ],
+                "before": {
+                  "password": "same-old",
+                  "instance_class": "db.t3.small"
+                },
+                "after": {
+                  "password": "same-new",
+                  "instance_class": "db.t3.small"
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "name": "read entries whose results differ",
+      "group": true,
+      "a": {
+        "root": "roots/acme",
+        "estate": "acme",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "data.aws_ami.base",
+              "change": {
+                "actions": [
+                  "read"
+                ],
+                "after": {
+                  "id": "ami-0aaa111",
+                  "image_id": "ami-0aaa111",
+                  "owner": "amazon"
+                },
+                "after_unknown": {}
+              }
+            }
+          ]
+        }
+      },
+      "b": {
+        "root": "roots/globex",
+        "estate": "globex",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "data.aws_ami.base",
+              "change": {
+                "actions": [
+                  "read"
+                ],
+                "after": {
+                  "id": "ami-0bbb222",
+                  "image_id": "ami-0bbb222",
+                  "owner": "amazon"
+                },
+                "after_unknown": {}
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "name": "a read of a different data source",
+      "group": false,
+      "a": {
+        "root": "roots/acme",
+        "estate": "acme",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "data.aws_ami.base",
+              "change": {
+                "actions": [
+                  "read"
+                ],
+                "after": {
+                  "id": "ami-0aaa111",
+                  "image_id": "ami-0aaa111",
+                  "owner": "amazon"
+                },
+                "after_unknown": {}
+              }
+            }
+          ]
+        }
+      },
+      "b": {
+        "root": "roots/globex",
+        "estate": "globex",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "data.aws_ami.other",
+              "change": {
+                "actions": [
+                  "read"
+                ],
+                "after": {
+                  "id": "ami-0aaa111",
+                  "image_id": "ami-0aaa111",
+                  "owner": "amazon"
+                },
+                "after_unknown": {}
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "name": "a read against a plan with no entry for it",
+      "group": false,
+      "a": {
+        "root": "roots/acme",
+        "estate": "acme",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "data.aws_ami.base",
+              "change": {
+                "actions": [
+                  "read"
+                ],
+                "after": {
+                  "id": "ami-0aaa111",
+                  "image_id": "ami-0aaa111",
+                  "owner": "amazon"
+                },
+                "after_unknown": {}
+              }
+            }
+          ]
+        }
+      },
+      "b": {
+        "root": "roots/globex",
+        "estate": "globex",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": []
+        }
+      }
     }
   ],
   "instancePairs": [
@@ -1588,6 +1860,7 @@
     "different policy document",
     "different tag value that does not carry the estate",
     "a tofu-estate marker naming some other estate",
-    "the estate name inside a longer word is not the estate"
+    "the estate name inside a longer word is not the estate",
+    "sensitive against not sensitive on the same attribute"
   ]
 }

package/src/change-set.test.ts

@@ -10,10 +10,11 @@
  * update. The update, delete, effect and hole mappings are pinned on typed
  * entries below.
  *
- * `warden.plan.json` is the reconcile change set chant's own
- * `diffCollection` produces for a warden's teams cycle: one create, one
- * update and one owned delete. github-warden prints its plan as text today,
- * so this is the shape it would write.
+ * `warden.plan.json` is what github-warden's `reconcile --plan-json` wrote
+ * (github-warden#66) for a teams cycle in an org that declares `owned: true`:
+ * one create, one update and one owned delete, as a JSON array of reconcile
+ * change sets. It was produced by warden's own `runReconcile` and
+ * `teamsCycle` against a stubbed live state, not built here.
  *
  * Goldens regenerate with `UPDATE_GOLDEN=1`.
  */
@@ -140,10 +141,8 @@ describe("lifecyclePlanPart", () => {
 });
 
 describe("reconcilePlanPart", () => {
-  test("a warden's teams cycle, as chant's reconcile primitives plan it", () => {
-    const plan = wardenPlan();
-    golden("warden.plan.json", plan);
-    const part = reconcilePlanPart({ member: "warden", plan: read(DIR, "warden.plan.json") as ReconcileChangeSet });
+  test("a warden's teams cycle, as `reconcile --plan-json` wrote it", () => {
+    const part = reconcilePlanPart({ member: "warden", plan: read(DIR, "warden.plan.json") as ReconcileChangeSet[] });
     expect(part.entries.map((e) => [e.address, e.action, e.disruption ?? null])).toEqual([
       ["team.contractors", "delete", "destroy"],
       ["team.platform", "update", "unknown"],

package/src/cli/commands/lint.ts

@@ -4,7 +4,8 @@ import { readFileSync, writeFileSync, readdirSync } from "fs";
 import { runLint, parseDisableComments } from "../../lint/engine";
 import type { LintRule, LintDiagnostic, LintFix } from "../../lint/rule";
 import type { IntrinsicDef, LexiconPlugin } from "../../lexicon";
-import { loadPlugins, resolveProjectLexicons } from "../plugins";
+import { loadPlugin, loadPlugins, resolveProjectLexicons } from "../plugins";
+import { findInfraFiles, detectLexicons } from "../../index";
 import { formatStylish, formatJson, formatSarif } from "../reporters/stylish";
 import { loadLocalRules } from "../../lint/rule-loader";
 import { loadCoreRules } from "../../lint/rules/index";
@@ -129,6 +130,29 @@ function lexiconResolutionDiagnostic(projectRoot: string, error: Error): LintDia
   };
 }
 
+/**
+ * The plugins of lexicons that the project's source imports from and that are not in `configured`, for their
+ * property-kind class names (#3184). A package that is not installed, or that fails to load, is skipped.
+ */
+async function loadImportedPropertyPlugins(projectPath: string, configured: readonly string[]): Promise<LexiconPlugin[]> {
+  let imported: string[];
+  try {
+    imported = await detectLexicons(await findInfraFiles(projectPath));
+  } catch {
+    return [];
+  }
+  const plugins: LexiconPlugin[] = [];
+  for (const name of imported) {
+    if (configured.includes(name)) continue;
+    try {
+      plugins.push(await loadPlugin(name));
+    } catch {
+      // Not installed here; the import is the build's problem to report, not lint's.
+    }
+  }
+  return plugins;
+}
+
 /**
  * Load all lint rules: core COR/EVL rules, then lexicon plugin rules.
  *
@@ -210,6 +234,15 @@ async function loadAllPluginRules(
   // them as resources.
   const propertyClasses = new Set(plugins.flatMap((plugin) => plugin.propertyClassNames?.() ?? []));
 
+  // chant #3184: a lexicon the source imports from but the config does not list (grafana in a k8s project that
+  // holds a dashboard ConfigMap, after `chant import`) still declares which of its classes are property-kind. Only
+  // those names are taken from it; its rules and intrinsics stay out, since the project did not ask for them.
+  if (!lexiconError) {
+    for (const plugin of await loadImportedPropertyPlugins(projectPath, lexiconNames)) {
+      for (const name of plugin.propertyClassNames?.() ?? []) propertyClasses.add(name);
+    }
+  }
+
   for (const plugin of plugins) {
     if (plugin.lintRules) {
       for (const r of plugin.lintRules()) {

package/src/cli/handlers/build-lexicon-output.test.ts

@@ -0,0 +1,94 @@
+/**
+ * `chant build --lexicon-output <lexicon>=<path>`: each named lexicon is built
+ * into its own file, so one project can declare otel and prometheus. The build
+ * itself is mocked; this checks how the handler splits the serializers and
+ * the output paths.
+ */
+import { describe, test, expect, vi, beforeEach } from "vitest";
+import type { ParsedArgs, CommandContext } from "../registry";
+import type { Serializer } from "../../serializer";
+
+const buildCommandMock = vi.fn();
+
+vi.mock("../commands/build", async () => {
+  const actual = await vi.importActual<typeof import("../commands/build")>("../commands/build");
+  return { ...actual, buildCommand: (...args: unknown[]) => buildCommandMock(...args) };
+});
+
+const { runBuild } = await import("./build");
+
+const ser = (name: string) => ({ name }) as unknown as Serializer;
+
+function ctx(overrides: Partial<ParsedArgs>, names = ["otel", "prometheus", "grafana"]): CommandContext {
+  const args = {
+    command: "build",
+    path: ".",
+    format: "",
+    fix: false,
+    watch: false,
+    verbose: false,
+    help: false,
+    live: false,
+    ...overrides,
+  } as ParsedArgs;
+  return { args, plugins: [], serializers: names.map(ser) } as unknown as CommandContext;
+}
+
+describe("runBuild --lexicon-output", () => {
+  beforeEach(() => {
+    buildCommandMock.mockReset().mockResolvedValue({ success: true, errors: [], warnings: [], resourceCount: 1, fileCount: 1 });
+    vi.spyOn(console, "error").mockImplementation(() => {});
+  });
+
+  test("builds each named lexicon into its own file", async () => {
+    const code = await runBuild(ctx({ lexiconOutput: ["otel=out/collector.yml", "prometheus=out/prometheus.yml"] }));
+    expect(code).toBe(0);
+    expect(buildCommandMock).toHaveBeenCalledTimes(2);
+    const calls = buildCommandMock.mock.calls.map(([o]) => [o.serializers.map((s: Serializer) => s.name), o.output, o.format]);
+    expect(calls).toEqual([
+      [["otel"], "out/collector.yml", "yaml"],
+      [["prometheus"], "out/prometheus.yml", "yaml"],
+    ]);
+  });
+
+  test("lexicons not named go to --output when given, and are skipped otherwise", async () => {
+    await runBuild(ctx({ lexiconOutput: ["otel=a.yml"], output: "rest.json" }));
+    expect(buildCommandMock.mock.calls.map(([o]) => [o.serializers.map((s: Serializer) => s.name), o.output])).toEqual([
+      [["otel"], "a.yml"],
+      [["prometheus", "grafana"], "rest.json"],
+    ]);
+    buildCommandMock.mockClear();
+    await runBuild(ctx({ lexiconOutput: ["otel=a.yml"] }));
+    expect(buildCommandMock).toHaveBeenCalledTimes(1);
+  });
+
+  test("drops the 'No serializer found' warning for lexicons another file carries, and repeats nothing", async () => {
+    const warn = "No serializer found for lexicon \"grafana\"";
+    buildCommandMock.mockResolvedValue({ success: true, errors: [], warnings: [warn, "something else"], resourceCount: 1, fileCount: 1 });
+    const err = vi.spyOn(console, "error").mockImplementation(() => {});
+    await runBuild(ctx({ lexiconOutput: ["otel=a.yml", "prometheus=b.yml"] }));
+    const printed = err.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(printed).not.toContain("No serializer found");
+    expect(printed.match(/something else/g)).toHaveLength(1);
+  });
+
+  test("a failed build fails the command, and the other files are still written", async () => {
+    buildCommandMock.mockResolvedValueOnce({ success: false, errors: ["boom"], warnings: [], resourceCount: 0, fileCount: 0 });
+    const code = await runBuild(ctx({ lexiconOutput: ["otel=a.yml", "prometheus=b.yml"] }));
+    expect(code).toBe(1);
+    expect(buildCommandMock).toHaveBeenCalledTimes(2);
+  });
+
+  test("refuses a malformed spec, an unknown lexicon, a repeat, and --lexicon", async () => {
+    for (const a of [
+      { lexiconOutput: ["otel"] },
+      { lexiconOutput: ["otel="] },
+      { lexiconOutput: ["nope=a.yml"] },
+      { lexiconOutput: ["otel=a.yml", "otel=b.yml"] },
+      { lexiconOutput: ["otel=a.yml"], lexicon: "otel" },
+    ]) {
+      expect(await runBuild(ctx(a))).toBe(1);
+    }
+    expect(buildCommandMock).not.toHaveBeenCalled();
+  });
+});

package/src/cli/handlers/build.ts

@@ -65,6 +65,8 @@ async function runGenerateComponents(ctx: CommandContext): Promise<number> {
         output: args.output,
         params: args.param,
         paramsFile: args.paramsFile,
+        ...(args.waveGate ? { waveGate: { gate: args.waveGate, ...(args.canary?.length ? { canary: args.canary } : {}), ...(args.base ? { base: args.base } : {}) } } : {}),
+        ...(args.prLoop ? { prLoop: { ...(args.gate ? { gate: args.gate } : {}), ...(args.branch ? { branch: args.branch } : {}) } } : {}),
       });
     } catch (err) {
       console.error(formatError({ message: memberPipeline.describeError(err) }));
@@ -177,6 +179,69 @@ export async function runBuild(ctx: CommandContext): Promise<number> {
   // #1064 — `--param name=value`, repeated, into a flat { name: value } record.
   const params = parseParamFlags(args.param);
 
+  // `--lexicon-output <lexicon>=<path>`: each named lexicon builds into its own
+  // file. One build per file, over the same project, so every write, check and
+  // diagnostic path is the one a single-lexicon `--lexicon` build already takes.
+  if (args.lexiconOutput?.length) {
+    if (args.watch || args.lexicon) {
+      console.error(formatError({ message: "--lexicon-output cannot be combined with --watch or --lexicon" }));
+      return 1;
+    }
+    const targets = new Map<string, string>();
+    for (const spec of args.lexiconOutput) {
+      const eq = (spec ?? "").indexOf("=");
+      if (eq <= 0 || eq === spec.length - 1) {
+        console.error(formatError({ message: `Invalid --lexicon-output "${spec}". Expected <lexicon>=<path>.` }));
+        return 1;
+      }
+      const name = spec.slice(0, eq);
+      if (targets.has(name)) {
+        console.error(formatError({ message: `--lexicon-output names lexicon "${name}" twice.` }));
+        return 1;
+      }
+      if (!serializers.some((s) => s.name === name)) {
+        console.error(formatError({ message: `No serializer found for lexicon "${name}". Available: ${serializers.map((s) => s.name).join(", ")}. List the lexicon in chant.config.ts.` }));
+        return 1;
+      }
+      targets.set(name, spec.slice(eq + 1));
+    }
+    const groups: { serializers: typeof serializers; output: string }[] = [...targets].map(([name, output]) => ({
+      serializers: serializers.filter((s) => s.name === name),
+      output,
+    }));
+    const rest = serializers.filter((s) => !targets.has(s.name));
+    if (args.output && rest.length > 0) groups.push({ serializers: rest, output: args.output });
+
+    const seenWarnings = new Set<string>();
+    let failed = false;
+    for (const group of groups) {
+      const { format, warning } = resolveBuildFormat(args.format, group.output);
+      if (warning) console.error(formatInfo(warning));
+      const result = await buildCommand({
+        path: args.path,
+        output: group.output,
+        format,
+        serializers: group.serializers,
+        plugins,
+        verbose: args.verbose,
+        env: args.env,
+        fold: args.fold,
+        sandbox: args.sandbox,
+        foldRank: args.foldRank,
+        foldRankCollapsedFile: args.foldRankCollapsedFile,
+        params: parseParamFlags(args.param),
+        paramsFile: args.paramsFile,
+      });
+      // The lexicons built by another group are not missing serializers.
+      const own = result.warnings.filter((w) => !w.includes("No serializer found for lexicon") && !seenWarnings.has(w));
+      for (const w of own) seenWarnings.add(w);
+      printWarnings(own);
+      printErrors(result.errors);
+      if (!result.success) failed = true;
+    }
+    return failed ? 1 : 0;
+  }
+
   if (args.watch) {
     const cleanup = buildCommandWatch({
       path: args.path,