@intentius/chant 0.12.1 → 0.13.1

package/dist/audit/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/audit/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AASD,KAAK,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhD,UAAU,UAAU;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;CACvB;AAQD,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAExC,UAAU,UAAU;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAqBpD;AAuKD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA6B5H;AAID;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAsB7B;AAeD,UAAU,QAAQ;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAsB/D;AAkBD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1D,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA+B7B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwB7B"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/audit/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AASD,KAAK,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhD,UAAU,UAAU;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;CACvB;AAQD,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAExC,UAAU,UAAU;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAqBpD;AAoND;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA6B5H;AAID;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAsB7B;AAeD,UAAU,QAAQ;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAsB/D;AAkBD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1D,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA+B7B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwB7B"}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAe9E;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAiJpD"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAgB9E;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAiJpD"}

package/dist/cli/registry.d.ts

@@ -52,7 +52,8 @@ export interface ParsedArgs {
     verbatim?: boolean;
     /** `chant lifecycle … --src <dir>` — build root override for lifecycle commands */
     src?: string;
-    /** `chant build --env <name>` — environment for organizational policy evaluation */
+    /** `--env <name>` — active environment: sets CHANT_ENV so env-aware source
+     * re-evaluates for that environment (`build` + `graph`), and drives policy. */
     env?: string;
     /** `chant graph --stacks` — render the cross-stack apply-ordering graph */
     stacks?: boolean;

package/dist/cli/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/cli/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;uFACmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,UAAU,CAAC;IAChB,4FAA4F;IAC5F,QAAQ,EAAE,OAAO,CAAC;CACnB;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,eAAe,GAAG,IAAI,CAiB/F"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/cli/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;mFAC+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;uFACmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,UAAU,CAAC;IAChB,4FAA4F;IAC5F,QAAQ,EAAE,OAAO,CAAC;CACnB;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,eAAe,GAAG,IAAI,CAiB/F"}

package/dist/env.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Active environment for a chant run (#505).
+ *
+ * `chant graph --env prod` / `chant build --env prod` set {@link ENV_VAR} before
+ * the project is discovered, so env-aware source can branch on it — producing an
+ * environment-specific graph (or build). Environments in chant are **build-context
+ * switches**, not a resource filter: there is no per-node env membership, so an
+ * "env view" comes from *re-evaluating* the project under the environment, exactly
+ * as a deploy of that environment would. Author env-aware source by branching on
+ * {@link env}:
+ *
+ * ```ts
+ * import { env } from "@intentius/chant";
+ * const replicas = env() === "prod" ? 5 : 1;
+ * ```
+ *
+ * Run `chant graph --env prod` and `chant graph --env dev` to get the two graphs;
+ * pinhole renders/diffs them to show environment drift (INTENTIUS/pinhole#3).
+ */
+/** The environment variable the CLI sets from `--env`. */
+export declare const ENV_VAR = "CHANT_ENV";
+/** The active environment for this run (from `--env`), or `fallback` if none. */
+export declare function env(fallback?: string): string | undefined;
+/**
+ * Validate a requested environment against the project's declared `environments`
+ * (`chant.config`). Returns an error message for an unknown env, or `undefined`
+ * when it's valid (or when the project declares no environments, in which case
+ * any name is accepted).
+ */
+export declare function unknownEnvError(requested: string | undefined, declared: string[] | undefined): string | undefined;
+//# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,0DAA0D;AAC1D,eAAO,MAAM,OAAO,cAAc,CAAC;AAEnC,iFAAiF;AACjF,wBAAgB,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIjH"}

package/dist/graph-ir.d.ts

@@ -60,14 +60,30 @@ export interface IREdge {
 export interface IRGroups {
     byLexicon?: Record<string, string[]>;
     byComposite?: Record<string, string[]>;
-    /** Reserved for stack grouping (#494). */
+    /** Deployable-stack grouping (`stackName → nodeIds`). A stack is a lexicon
+     * partition today; #513 phase 2 regroups by nested child-project. Consumers
+     * (e.g. pinhole's boundary boxes) read this rather than inferring stacks. */
     byStack?: Record<string, string[]>;
 }
+/** A cross-stack export this stack publishes (a `stackOutput`/`output`): its
+ * name (the matching key another stack imports by) and the node that produces it. */
+export interface IRExport {
+    /** Output name — the cross-stack handle (e.g. "ClusterArn"). */
+    name: string;
+    /** Logical name of the producing node, when resolvable. */
+    node?: string;
+    /** Producer-side attribute the output reads (e.g. "Arn"). */
+    attr?: string;
+}
 /** The full graph IR for a project at the default (declarable) detail level. */
 export interface GraphIR {
     nodes: IRNode[];
     edges: IREdge[];
     groups: IRGroups;
+    /** Outputs this stack publishes for other stacks to import. Imports are already
+     * nodes (`AWS::CloudFormation::Parameter` etc.); a viewer matches an import's
+     * name to an export's name to draw the cross-stack edge to its producer (#513). */
+    exports?: IRExport[];
 }
 /**
  * Build the graph IR from resolved entities (the output of `discover`). Pure and

package/dist/graph-ir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph-ir.d.ts","sourceRoot":"","sources":["../src/graph-ir.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAK7D;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mCAAmC;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,IAAI,EAAE,KAAK,CAAC;IACZ,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACpC;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;CAClB;AA6ID;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAmDT"}
+{"version":3,"file":"graph-ir.d.ts","sourceRoot":"","sources":["../src/graph-ir.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAK7D;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mCAAmC;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,IAAI,EAAE,KAAK,CAAC;IACZ,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;iFAE6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACpC;AAED;qFACqF;AACrF,MAAM,WAAW,QAAQ;IACvB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB;;uFAEmF;IACnF,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;CACtB;AA6ID;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CA6ET"}

package/dist/index.d.ts

@@ -24,6 +24,7 @@ export * from "./discovery/graph.js";
 export * from "./discovery/index.js";
 export * from "./discovery/cache.js";
 export * from "./build.js";
+export * from "./env.js";
 export * from "./graph-ir.js";
 export * from "./graph-detail.js";
 export * from "./graph-mermaid.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,QAAQ,CAAC;AACvB,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAElC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAClE,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5F,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,QAAQ,CAAC;AACvB,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAElC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAClE,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5F,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.12.1",
+  "version": "0.13.1",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/fetch.test.ts

@@ -54,14 +54,51 @@ function gitTreeMock(files: Record<string, string>, sizes: Record<string, number
   return { impl, calls };
 }
 
-/** A GitLab-shaped mock: project default_branch, paginated repository/tree, raw files. */
-function gitlabMock(files: Record<string, string>) {
+/**
+ * GitLab mock for authenticated search-based discovery. `searchMap` maps search
+ * term → array of blob paths the search API returns. `files` maps path → content.
+ * Pass `token` to fetchRepoFiles when using this mock so the code takes the
+ * search path (unauthenticated calls fall back to BFS).
+ */
+function gitlabMock(searchMap: Record<string, string[]>, files: Record<string, string>) {
+  const impl = (async (url: string | URL | Request) => {
+    const u = String(url);
+    if (u.includes("/search")) {
+      const params = new URL(u).searchParams;
+      const term = params.get("search") ?? "";
+      const page = Number(params.get("page") ?? "1");
+      const paths = page === 1 ? (searchMap[term] ?? []) : [];
+      return new Response(JSON.stringify(paths.map((p) => ({ path: p }))), { status: 200 });
+    }
+    const rm = u.match(/\/repository\/files\/(.+?)\/raw\?/);
+    if (rm) {
+      const path = decodeURIComponent(rm[1]);
+      if (files[path] === undefined) return new Response("not found", { status: 404 });
+      return new Response(files[path], { status: 200 });
+    }
+    if (/\/projects\/[^/]+(\?|$)/.test(u)) return new Response(JSON.stringify({ default_branch: "main" }), { status: 200 });
+    return new Response("not found", { status: 404 });
+  }) as unknown as typeof fetch;
+  return { impl };
+}
+
+/**
+ * GitLab mock for the unauthenticated BFS fallback. `dirEntries` maps directory
+ * path (empty = root) to entries returned by the non-recursive tree API. `files`
+ * maps path → content for the raw endpoint.
+ */
+function gitlabBfsMock(
+  dirEntries: Record<string, Array<{ path: string; type: "blob" | "tree" }>>,
+  files: Record<string, string>,
+) {
   const impl = (async (url: string | URL | Request) => {
     const u = String(url);
     if (u.includes("/repository/tree")) {
-      const page = Number(new URL(u).searchParams.get("page") ?? "1");
-      const all = Object.keys(files).map((path) => ({ path, type: "blob" }));
-      return new Response(JSON.stringify(page === 1 ? all : []), { status: 200 });
+      const params = new URL(u).searchParams;
+      const dir = params.get("path") ?? "";
+      const page = Number(params.get("page") ?? "1");
+      const entries = dirEntries[dir] ?? [];
+      return new Response(JSON.stringify(page === 1 ? entries : []), { status: 200 });
     }
     const rm = u.match(/\/repository\/files\/(.+?)\/raw\?/);
     if (rm) {
@@ -174,13 +211,80 @@ describe("fetchRepoFiles", () => {
     await expect(fetchRepoFiles("https://evil.example.com/o/r")).rejects.toThrow(/Host not allowed/);
   });
 
-  test("gitlab: paginated tree + raw file content", async () => {
-    const { impl } = gitlabMock({ ".gitlab-ci.yml": "stages:\n  - build\n" });
-    const files = await fetchRepoFiles("https://gitlab.com/acme/widgets", { fetchImpl: impl });
+  test("gitlab: authenticated search finds .gitlab-ci.yml via stages: term", async () => {
+    const { impl } = gitlabMock(
+      { "stages:": [".gitlab-ci.yml"] },
+      { ".gitlab-ci.yml": "stages:\n  - build\n" },
+    );
+    const files = await fetchRepoFiles("https://gitlab.com/acme/widgets", { fetchImpl: impl, token: "tok" });
     expect(files.map((f) => f.path)).toEqual([".gitlab-ci.yml"]);
     expect(files[0].content).toContain("stages:");
   });
 
+  test("gitlab: search finds CI at non-canonical paths (include targets) (#520)", async () => {
+    // A .gitlab-ci.yml with `include:` referencing other CI files — the included
+    // file also has `stages:` so the search finds it without knowing the path.
+    const { impl } = gitlabMock(
+      { "stages:": [".gitlab-ci.yml", ".gitlab/ci/build.gitlab-ci.yml"] },
+      {
+        ".gitlab-ci.yml": "stages:\n  - build\ninclude:\n  - .gitlab/ci/build.gitlab-ci.yml\n",
+        ".gitlab/ci/build.gitlab-ci.yml": "stages:\n  - build\nscript:\n  - make\n",
+      },
+    );
+    const files = await fetchRepoFiles("https://gitlab.com/acme/widgets", { fetchImpl: impl, token: "tok" });
+    expect(files.map((f) => f.path)).toContain(".gitlab/ci/build.gitlab-ci.yml");
+  });
+
+  test("gitlab: search finds IaC files by content, unaffected by repo size (#518)", async () => {
+    // Previously, gitlab-org/gitlab returned 0 files because the recursive tree
+    // API listed thousands of directories before any blobs. Search-based discovery
+    // is independent of directory count — it goes directly to content.
+    const { impl } = gitlabMock(
+      {
+        "AWSTemplateFormatVersion": ["infra/stack.json"],
+        "stages:": [".gitlab-ci.yml"],
+      },
+      {
+        "infra/stack.json": '{"AWSTemplateFormatVersion":"2010-09-09","Resources":{}}',
+        ".gitlab-ci.yml": "stages:\n  - deploy\n",
+      },
+    );
+    const files = await fetchRepoFiles("https://gitlab.com/acme/monorepo", { fetchImpl: impl, token: "tok" });
+    const paths = files.map((f) => f.path);
+    expect(paths).toContain(".gitlab-ci.yml");
+    expect(paths).toContain("infra/stack.json");
+  });
+
+  test("gitlab: search deduplicates paths found by multiple terms", async () => {
+    // A Helm Chart.yaml matches both "apiVersion: v2" and the broader "apiVersion".
+    const { impl } = gitlabMock(
+      {
+        "apiVersion: v2": ["helm/Chart.yaml"],
+        "apiVersion": ["helm/Chart.yaml", "k8s/deploy.yaml"],
+      },
+      {
+        "helm/Chart.yaml": "apiVersion: v2\nname: myapp\nversion: 1.0.0\n",
+        "k8s/deploy.yaml": "apiVersion: apps/v1\nkind: Deployment\n",
+      },
+    );
+    const files = await fetchRepoFiles("https://gitlab.com/acme/widgets", { fetchImpl: impl, token: "tok" });
+    const paths = files.map((f) => f.path);
+    expect(paths.filter((p) => p === "helm/Chart.yaml")).toHaveLength(1);
+    expect(paths).toContain("k8s/deploy.yaml");
+  });
+
+  test("gitlab: unauthenticated falls back to BFS tree walk", async () => {
+    // Without a token, GitLab search returns 401. The BFS fallback walks
+    // directories non-recursively so root blobs appear on the first request.
+    const { impl } = gitlabBfsMock(
+      { "": [{ path: ".gitlab-ci.yml", type: "blob" }] },
+      { ".gitlab-ci.yml": "stages:\n  - build\n" },
+    );
+    // No token → BFS path
+    const files = await fetchRepoFiles("https://gitlab.com/acme/widgets", { fetchImpl: impl });
+    expect(files.map((f) => f.path)).toContain(".gitlab-ci.yml");
+  });
+
   test("forgejo (codeberg): gitea tree + contents", async () => {
     const { impl } = gitTreeMock({ ".forgejo/workflows/ci.yml": CI_YAML });
     const files = await fetchRepoFiles("https://codeberg.org/acme/widgets", { fetchImpl: impl });

package/src/audit/fetch.ts

@@ -157,16 +157,61 @@ interface TreeEntry {
 /** List every blob path in the repo (recursive), with size where the host reports it. */
 async function listTree(host: HostConfig, owner: string, repo: string, ref: string, doFetch: typeof fetch, headers: Record<string, string>, ms: number): Promise<TreeEntry[]> {
   if (host.kind === "gitlab") {
+    // GitLab search API requires authentication even for public projects. When a
+    // token is present, use content search — one query per lexicon finds only
+    // relevant files regardless of repo size, and catches non-canonical CI paths
+    // that path-based detection misses (#518, #520). Without a token, fall back
+    // to the non-recursive BFS which works for public repos.
+    if ("PRIVATE-TOKEN" in headers) {
+      const out: TreeEntry[] = [];
+      const seen = new Set<string>();
+      const addPath = (p: string) => { if (typeof p === "string" && !seen.has(p)) { seen.add(p); out.push({ path: p, type: "blob" }); } };
+      // Ordered most → least selective so the seen-set dedup reduces noise from
+      // broader terms (e.g. `apiVersion` won't re-add files already found by
+      // the more specific `apiVersion: v2`).
+      const SEARCH_TERMS = [
+        "AWSTemplateFormatVersion", // CloudFormation
+        "deploymentTemplate",        // Azure ARM ($schema substring)
+        "cnrm.cloud.google.com",     // GCP Config Connector
+        "apiVersion: v2",            // Helm Chart.yaml
+        "stages:",                   // GitLab CI — root file + non-canonical includes (#520)
+        "FROM ",                     // Dockerfiles (content-based; space avoids false matches)
+        "services:",                 // Docker Compose
+        "apiVersion",                // k8s manifests (broad; runs last)
+      ];
+      for (const term of SEARCH_TERMS) {
+        for (let page = 1; page <= 3; page++) {
+          const url = `${host.api}/projects/${projectId(owner, repo)}/search?scope=blobs&search=${encodeURIComponent(term)}&per_page=100&page=${page}&ref=${encodeURIComponent(ref)}`;
+          const { body } = await getJsonAt(url, headers, doFetch, ms);
+          if (!Array.isArray(body) || body.length === 0) break;
+          for (const e of body as Array<{ path: string }>) addPath(e.path);
+          if (body.length < 100) break;
+        }
+      }
+      return out;
+    }
+    // Unauthenticated fallback: non-recursive BFS. GitLab's recursive tree API
+    // lists ALL directories before any blobs for large repos (#518), so we walk
+    // directories breadth-first to ensure root blobs appear on the first request.
     const out: TreeEntry[] = [];
-    const MAX_PAGES = 20; // 20 * 100 = 2000 entries — bounded; candidate filter + caps trim further
-    for (let page = 1; page <= MAX_PAGES; page++) {
-      const url = `${host.api}/projects/${projectId(owner, repo)}/repository/tree?recursive=true&per_page=100&page=${page}&ref=${encodeURIComponent(ref)}`;
-      const { body } = await getJsonAt(url, headers, doFetch, ms);
-      if (!Array.isArray(body) || body.length === 0) break;
-      for (const e of body as Array<{ path: string; type: string }>) {
-        if (e.type === "blob") out.push({ path: e.path, type: "blob" });
+    const queue: string[] = [""]; // "" = repo root
+    const MAX_DIRS = 30;
+    const MAX_BLOBS = 200;
+    let dirs = 0;
+    while (queue.length > 0 && dirs < MAX_DIRS && out.length < MAX_BLOBS) {
+      const dir = queue.shift()!;
+      dirs++;
+      const pathParam = dir ? `&path=${encodeURIComponent(dir)}` : "";
+      for (let page = 1; page <= 5; page++) {
+        const url = `${host.api}/projects/${projectId(owner, repo)}/repository/tree?per_page=100&page=${page}&ref=${encodeURIComponent(ref)}${pathParam}`;
+        const { body } = await getJsonAt(url, headers, doFetch, ms);
+        if (!Array.isArray(body) || body.length === 0) break;
+        for (const e of body as Array<{ path: string; type: string }>) {
+          if (e.type === "blob") out.push({ path: e.path, type: "blob" });
+          else if (e.type === "tree") queue.push(e.path);
+        }
+        if (body.length < 100) break;
       }
-      if (body.length < 100) break;
     }
     return out;
   }

package/src/cli/main.ts

@@ -5,6 +5,7 @@ import { formatSuccess, formatError } from "./format";
 import { loadPlugins, resolveProjectLexicons } from "./plugins";
 import { resolveCommand, type CommandDef, type ParsedArgs } from "./registry";
 import { loadChantConfig } from "../config";
+import { ENV_VAR, unknownEnvError } from "../env";
 import { initRuntime } from "../runtime-adapter";
 import { runBuild } from "./handlers/build";
 import { runLint } from "./handlers/lint";
@@ -242,7 +243,10 @@ Options:
                         - list: text (default) or json
                         - lint: stylish (default), json, or sarif
   -d, --lexicon <name>  Build only the specified lexicon (e.g. aws, gitlab)
-      --env <name>      Environment for organizational policy evaluation (build)
+      --env <name>      Active environment: sets CHANT_ENV so env-aware source
+                        re-evaluates for that environment (build + graph), and
+                        drives organizational policy. Must be in chant.config
+                        \`environments\` when declared.
   -t, --template <name> Init template (e.g. node-pipeline, docker-build)
   --skill <name>        Init: install only this skill from the lexicon
   --fix                 Auto-fix fixable issues (lint command)
@@ -369,16 +373,30 @@ async function main(): Promise<void> {
     process.exit(args.help ? 0 : 1);
   }
 
+  // `--env <name>` is a build-context switch for the whole invocation: set it
+  // *before* anything imports the project so env-aware source (and thus the graph
+  // / build) reflects that environment. Set early, before config import, since
+  // chant.config itself may branch on the env. (#505)
+  if (args.env) process.env[ENV_VAR] = args.env;
+
   // Initialize runtime adapter early — before plugins or commands run
   const projectPath0 = resolve(args.path === "." ? "." : args.path);
+  let loadedConfig;
   try {
-    await loadChantConfig(projectPath0);
+    loadedConfig = await loadChantConfig(projectPath0);
     initRuntime();
   } catch {
     // Config may not exist yet (e.g. `chant init`)
     initRuntime();
   }
 
+  // Reject an --env that isn't among the project's declared `environments`.
+  const envErr = unknownEnvError(args.env, loadedConfig?.config.environments);
+  if (envErr) {
+    console.error(formatError({ message: envErr, hint: 'Declare it in chant.config `environments`, or omit --env.' }));
+    process.exit(1);
+  }
+
   const match = resolveCommand(args, registry);
   if (!match) {
     console.error(formatError({

package/src/cli/registry.ts

@@ -53,7 +53,8 @@ export interface ParsedArgs {
   verbatim?: boolean;
   /** `chant lifecycle … --src <dir>` — build root override for lifecycle commands */
   src?: string;
-  /** `chant build --env <name>` — environment for organizational policy evaluation */
+  /** `--env <name>` — active environment: sets CHANT_ENV so env-aware source
+   * re-evaluates for that environment (`build` + `graph`), and drives policy. */
   env?: string;
   /** `chant graph --stacks` — render the cross-stack apply-ordering graph */
   stacks?: boolean;

package/src/env.test.ts

@@ -0,0 +1,77 @@
+import { describe, test, expect } from "vitest";
+import { mkdir, writeFile, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { env, unknownEnvError, ENV_VAR } from "./env";
+import { discover } from "./discovery/index";
+
+const withEnv = async (value: string | undefined, fn: () => void | Promise<void>): Promise<void> => {
+  const prev = process.env[ENV_VAR];
+  try {
+    if (value === undefined) delete process.env[ENV_VAR];
+    else process.env[ENV_VAR] = value;
+    await fn();
+  } finally {
+    if (prev === undefined) delete process.env[ENV_VAR];
+    else process.env[ENV_VAR] = prev;
+  }
+};
+
+describe("env()", () => {
+  test("reads CHANT_ENV, with a fallback", async () => {
+    await withEnv(undefined, () => {
+      expect(env()).toBeUndefined();
+      expect(env("dev")).toBe("dev");
+    });
+    await withEnv("prod", () => {
+      expect(env()).toBe("prod");
+      expect(env("dev")).toBe("prod");
+    });
+  });
+});
+
+describe("unknownEnvError", () => {
+  test("accepts a declared env, and any env when none are declared", () => {
+    expect(unknownEnvError("prod", ["dev", "prod"])).toBeUndefined();
+    expect(unknownEnvError("prod", undefined)).toBeUndefined();
+    expect(unknownEnvError("prod", [])).toBeUndefined();
+    expect(unknownEnvError(undefined, ["dev"])).toBeUndefined();
+  });
+  test("rejects an undeclared env with a clear message", () => {
+    expect(unknownEnvError("stage", ["dev", "prod"])).toMatch(/Unknown environment "stage".*dev, prod/);
+  });
+});
+
+describe("env-aware discovery (#505)", () => {
+  // Env is a build-context switch: the same source, discovered under a different
+  // CHANT_ENV, yields a different entity set (here a prod-only resource).
+  const src = `
+    export const base = { entityType: "Base", [Symbol.for("chant.declarable")]: true };
+    export const prodOnly = process.env.CHANT_ENV === "prod"
+      ? { entityType: "ProdOnly", [Symbol.for("chant.declarable")]: true }
+      : undefined;
+  `;
+
+  test("re-evaluates the project under the active environment", async () => {
+    // Distinct dirs → distinct module URLs → fresh import per env (import() caches by path).
+    const prodDir = join(tmpdir(), `chant-env-prod-${Date.now()}-${Math.random()}`);
+    const devDir = join(tmpdir(), `chant-env-dev-${Date.now()}-${Math.random()}`);
+    await mkdir(prodDir, { recursive: true });
+    await mkdir(devDir, { recursive: true });
+    await writeFile(join(prodDir, "app.ts"), src);
+    await writeFile(join(devDir, "app.ts"), src);
+    try {
+      let prod!: Awaited<ReturnType<typeof discover>>;
+      let dev!: Awaited<ReturnType<typeof discover>>;
+      await withEnv("prod", async () => { prod = await discover(prodDir); });
+      await withEnv("dev", async () => { dev = await discover(devDir); });
+      expect(prod.entities.has("base")).toBe(true);
+      expect(dev.entities.has("base")).toBe(true);
+      expect(prod.entities.has("prodOnly")).toBe(true); // present under prod
+      expect(dev.entities.has("prodOnly")).toBe(false); // absent under dev
+    } finally {
+      await rm(prodDir, { recursive: true, force: true });
+      await rm(devDir, { recursive: true, force: true });
+    }
+  });
+});

package/src/env.ts

@@ -0,0 +1,39 @@
+/**
+ * Active environment for a chant run (#505).
+ *
+ * `chant graph --env prod` / `chant build --env prod` set {@link ENV_VAR} before
+ * the project is discovered, so env-aware source can branch on it — producing an
+ * environment-specific graph (or build). Environments in chant are **build-context
+ * switches**, not a resource filter: there is no per-node env membership, so an
+ * "env view" comes from *re-evaluating* the project under the environment, exactly
+ * as a deploy of that environment would. Author env-aware source by branching on
+ * {@link env}:
+ *
+ * ```ts
+ * import { env } from "@intentius/chant";
+ * const replicas = env() === "prod" ? 5 : 1;
+ * ```
+ *
+ * Run `chant graph --env prod` and `chant graph --env dev` to get the two graphs;
+ * pinhole renders/diffs them to show environment drift (INTENTIUS/pinhole#3).
+ */
+
+/** The environment variable the CLI sets from `--env`. */
+export const ENV_VAR = "CHANT_ENV";
+
+/** The active environment for this run (from `--env`), or `fallback` if none. */
+export function env(fallback?: string): string | undefined {
+  return process.env[ENV_VAR] ?? fallback;
+}
+
+/**
+ * Validate a requested environment against the project's declared `environments`
+ * (`chant.config`). Returns an error message for an unknown env, or `undefined`
+ * when it's valid (or when the project declares no environments, in which case
+ * any name is accepted).
+ */
+export function unknownEnvError(requested: string | undefined, declared: string[] | undefined): string | undefined {
+  if (!requested || !declared || declared.length === 0) return undefined;
+  if (declared.includes(requested)) return undefined;
+  return `Unknown environment "${requested}". Declared environments: ${declared.join(", ")}.`;
+}

package/src/graph-ir.test.ts

@@ -2,6 +2,7 @@ import { describe, test, expect } from "vitest";
 import { buildGraphIr } from "./graph-ir";
 import { DECLARABLE_MARKER, type Declarable } from "./declarable";
 import { AttrRef } from "./attrref";
+import { LexiconOutput } from "./lexicon-output";
 import { resolveAttrRefs } from "./discovery/resolve";
 import { setProvenance } from "./provenance";
 
@@ -66,6 +67,20 @@ describe("buildGraphIr", () => {
     expect(ir.nodes.find((n) => n.id === "sg")!.attrs).toEqual({ VpcId: { $ref: "vpc.VpcId" } });
   });
 
+  test("surfaces cross-stack exports with the producing node, not as nodes (#513)", () => {
+    const cluster = decl({ lexicon: "aws", entityType: "AWS::ECS::Cluster" });
+    const out = new LexiconOutput(new AttrRef(cluster, "Arn"), "ClusterArn");
+    const entities = new Map<string, Declarable>([
+      ["cluster", cluster],
+      ["clusterArn", out as unknown as Declarable],
+    ]);
+    resolveAttrRefs(entities);
+
+    const ir = buildGraphIr(entities);
+    expect(ir.nodes.map((n) => n.id)).toEqual(["cluster"]); // the output itself is not a node
+    expect(ir.exports).toEqual([{ name: "ClusterArn", node: "cluster", attr: "Arn" }]);
+  });
+
   test("excludes property-kind declarables and keeps resources", () => {
     const resource = decl({ lexicon: "k8s", entityType: "Deployment" });
     const prop = decl({ lexicon: "k8s", entityType: "Probe", kind: "property" as const });
@@ -133,6 +148,9 @@ describe("buildGraphIr", () => {
     const ir = buildGraphIr(entities);
     expect(ir.nodes.map((n) => n.id)).toEqual(["alpha", "mid", "zeta"]); // sorted
     expect(ir.groups.byLexicon).toEqual({ gcp: ["alpha", "zeta"], k8s: ["mid"] });
+    // byStack mirrors the lexicon partition today (each lexicon → one deployable
+    // stack); emitted as its own axis so consumers read stacks, not lexicons (#513).
+    expect(ir.groups.byStack).toEqual({ gcp: ["alpha", "zeta"], k8s: ["mid"] });
 
     // Same input (different insertion order) yields identical IR.
     const reordered = new Map<string, Declarable>([

package/src/graph-ir.ts

@@ -2,7 +2,7 @@ import { relative, isAbsolute } from "node:path";
 import { AttrRef } from "./attrref";
 import { isAttrRefLike } from "./utils";
 import { type Declarable, isDeclarable } from "./declarable";
-import { isLexiconOutput } from "./lexicon-output";
+import { isLexiconOutput, type LexiconOutput } from "./lexicon-output";
 import { getProvenance } from "./provenance";
 import { INTRINSIC_MARKER } from "./intrinsic";
 
@@ -72,15 +72,32 @@ export interface IREdge {
 export interface IRGroups {
   byLexicon?: Record<string, string[]>;
   byComposite?: Record<string, string[]>;
-  /** Reserved for stack grouping (#494). */
+  /** Deployable-stack grouping (`stackName → nodeIds`). A stack is a lexicon
+   * partition today; #513 phase 2 regroups by nested child-project. Consumers
+   * (e.g. pinhole's boundary boxes) read this rather than inferring stacks. */
   byStack?: Record<string, string[]>;
 }
 
+/** A cross-stack export this stack publishes (a `stackOutput`/`output`): its
+ * name (the matching key another stack imports by) and the node that produces it. */
+export interface IRExport {
+  /** Output name — the cross-stack handle (e.g. "ClusterArn"). */
+  name: string;
+  /** Logical name of the producing node, when resolvable. */
+  node?: string;
+  /** Producer-side attribute the output reads (e.g. "Arn"). */
+  attr?: string;
+}
+
 /** The full graph IR for a project at the default (declarable) detail level. */
 export interface GraphIR {
   nodes: IRNode[];
   edges: IREdge[];
   groups: IRGroups;
+  /** Outputs this stack publishes for other stacks to import. Imports are already
+   * nodes (`AWS::CloudFormation::Parameter` etc.); a viewer matches an import's
+   * name to an export's name to draw the cross-stack edge to its producer (#513). */
+  exports?: IRExport[];
 }
 
 /** A node is anything that serializes to a resource — not a property or output. */
@@ -243,6 +260,7 @@ export function buildGraphIr(
   const nodes: IRNode[] = [];
   const byLexicon: Record<string, string[]> = {};
   const byComposite: Record<string, string[]> = {};
+  const byStack: Record<string, string[]> = {};
 
   for (const [name, entity] of entities) {
     if (!nodeIds.has(name)) continue;
@@ -260,6 +278,12 @@ export function buildGraphIr(
     nodes.push(node);
 
     (byLexicon[entity.lexicon] ??= []).push(name);
+    // A stack is a lexicon partition (each lexicon serialises to one deployable
+    // stack — a CloudFormation template, a CI config). `byStack` mirrors that
+    // today; #513 phase 2 will regroup it by nested child-project. It's a
+    // distinct axis from `byLexicon` (which is for provenance/colouring), so it's
+    // emitted separately even where the two currently coincide.
+    (byStack[entity.lexicon] ??= []).push(name);
     if (prov?.composite) (byComposite[prov.composite] ??= []).push(name);
   }
 
@@ -275,12 +299,31 @@ export function buildGraphIr(
   const edges = [...edgeMap.values()].sort((a, b) => edgeKey(a).localeCompare(edgeKey(b)));
   for (const ids of Object.values(byLexicon)) ids.sort();
   for (const ids of Object.values(byComposite)) ids.sort();
+  for (const ids of Object.values(byStack)) ids.sort();
 
   const groups: IRGroups = {};
   if (Object.keys(byLexicon).length) groups.byLexicon = sortKeys(byLexicon);
   if (Object.keys(byComposite).length) groups.byComposite = sortKeys(byComposite);
+  if (Object.keys(byStack).length) groups.byStack = sortKeys(byStack);
+
+  // Cross-stack exports: a stack's `output(ref, name)` LexiconOutputs are dropped
+  // from the node set (they're not resources), but their name + producing node is
+  // the handle another stack imports by. Surface them so a viewer can draw the
+  // cross-stack edge (#513). Resolve the producer via the output's source entity.
+  const exports: IRExport[] = [];
+  for (const entity of entities.values()) {
+    if (!isLexiconOutput(entity)) continue;
+    const lo = entity as unknown as LexiconOutput;
+    if (!lo.outputName) continue;
+    const parent = lo._sourceParent?.deref();
+    const node = (parent ? reverse.get(parent) : undefined) ?? (lo.sourceEntity || undefined);
+    exports.push({ name: lo.outputName, ...(node ? { node } : {}), ...(lo.sourceAttribute ? { attr: lo.sourceAttribute } : {}) });
+  }
+  exports.sort((a, b) => a.name.localeCompare(b.name));
 
-  return { nodes, edges, groups };
+  const ir: GraphIR = { nodes, edges, groups };
+  if (exports.length) ir.exports = exports;
+  return ir;
 }
 
 function sortKeys(rec: Record<string, string[]>): Record<string, string[]> {

package/src/index.ts

@@ -25,6 +25,7 @@ export * from "./discovery/graph";
 export * from "./discovery/index";
 export * from "./discovery/cache";
 export * from "./build";
+export * from "./env";
 export * from "./graph-ir";
 export * from "./graph-detail";
 export * from "./graph-mermaid";