@intentius/chant 0.124.13 → 0.124.15

package/dist/cdk/tier-map.js

@@ -0,0 +1,64 @@
+/**
+ * CloudFormation-type → native-spec tier for the CDK carve advisor (#1056).
+ *
+ * The Terraform path's hardest layer — translating `aws_s3_bucket` into
+ * `AWS::S3::Bucket` and a tier — does not exist here: a synthesized template is
+ * already in CloudFormation type space, which is the space
+ * `AWS_CARVE_TYPES.nativeType` is written in. So this is the same table read
+ * from the other end, not a second table to keep in step. Adding an AWS type to
+ * the carve-out table lights it up for both advisors at once.
+ *
+ * `mapsTo` is the CloudFormation type itself, because that identity is the
+ * point: chant's AWS lexicon constructors take CloudFormation PascalCase props,
+ * so a CDK resource needs no translation to become one.
+ */
+import { AWS_CARVE_TYPES } from "../terraform/aws-resources.js";
+/**
+ * CloudFormation type → tier. Two Terraform types can name one CloudFormation
+ * type (`aws_lb` and `aws_alb` are the same load balancer); the first entry
+ * wins, and since aliases share a tier by construction there is nothing to
+ * reconcile.
+ */
+export const CFN_TIER_MAP = (() => {
+    const map = {};
+    for (const entry of AWS_CARVE_TYPES) {
+        if (map[entry.nativeType])
+            continue;
+        map[entry.nativeType] = { tier: entry.tier, mapsTo: entry.nativeType };
+    }
+    return map;
+})();
+/** The chant AWS lexicon constructor a CloudFormation type would carve into. */
+export const CFN_CTOR = (() => {
+    var _a;
+    const map = {};
+    for (const entry of AWS_CARVE_TYPES)
+        map[_a = entry.nativeType] ?? (map[_a] = entry.ctor);
+    return map;
+})();
+export function resolveCfnTier(cfnType) {
+    return CFN_TIER_MAP[cfnType] ?? null;
+}
+/**
+ * A nested stack is an assembly of its own: its resources live in a separate
+ * template that this advisor does not descend into, so carving the
+ * `AWS::CloudFormation::Stack` resource means carving everything under it.
+ */
+export const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
+/**
+ * CloudFormation resources CDK synthesizes for its own bookkeeping. They
+ * describe the synthesis, not the infrastructure, so they never appear in the
+ * ranking.
+ */
+export const SCAFFOLDING_TYPES = new Set(["AWS::CDK::Metadata"]);
+/**
+ * Template parameters CDK adds for bootstrap and asset plumbing. A reference to
+ * one is not a sign the resource is parameterized by its author — it is the
+ * synthesizer talking to itself — so these do not mark a construct dynamic.
+ */
+export function isScaffoldingParameter(name) {
+    return (name === "BootstrapVersion" ||
+        name === "CdkBootstrapVersion" ||
+        name.startsWith("AssetParameters") ||
+        name.startsWith("BootstrapVersion"));
+}

package/dist/cdk/types.js

@@ -0,0 +1,24 @@
+/**
+ * The parts of a CDK cloud assembly the carve advisor reads (#1056).
+ *
+ * A cloud assembly is already JSON, so there is no parser to install and no
+ * expression AST to resolve — the Terraform path's two hardest layers do not
+ * exist here. Three files carry everything the advisor needs:
+ *
+ *  - `manifest.json` — which artifacts are stacks, which template file each
+ *    one synthesized to, and (crucially) whether any context lookup went
+ *    unresolved.
+ *  - `tree.json` — the construct tree, so CloudFormation resources can be
+ *    grouped back under the construct that emitted them. Optional: CDK can be
+ *    told not to write it, and the advisor degrades to a coarser grouping.
+ *  - `*.template.json` — the CloudFormation templates themselves, already in
+ *    `AWS::*` type space, which is exactly what the AWS tier map keys on.
+ *
+ * Everything here is post-jsii, so a Python or Java CDK app reads through the
+ * same code path as a TypeScript one. Nothing in this module reads CDK source.
+ *
+ * The declarations are deliberately loose — every field optional, unknown keys
+ * tolerated — because the assembly schema is not chant's to own and gains
+ * fields between CDK releases.
+ */
+export {};

package/dist/change-set.d.ts

@@ -11,7 +11,9 @@
  * Each planner reaches it through an adapter that returns a
  * {@link ChangeSetPart}: one member and its entries. The lifecycle and
  * reconcile adapters are here; the terraform-family ones live in the
- * terraform lexicon's `change-set` subpath. {@link composeChangeSet} joins
+ * terraform lexicon's `change-set` subpath and the SQL ones in the sql
+ * lexicon's. A part another process wrote to a file reads back through
+ * {@link readChangeSetPartFile}. {@link composeChangeSet} joins
  * the parts.
  *
  * ## The digest
@@ -52,7 +54,14 @@ export declare const CHANGE_SET_ACTIONS: readonly ChangeSetAction[];
 /** How much applying one change hurts, in the vocabulary of `./lifecycle/disruption.ts`. */
 export type ChangeSetDisruption = "in-place" | "rolling" | "replace" | "destroy" | "unknown";
 /** Which tool produced a member's plan. */
-export type ChangeSetPlanner = "terraform" | "tofu" | "choudoufu" | "chant" | "warden";
+/**
+ * Which tool produced a member's plan. `sql` is a SQL schema change: a
+ * versioned plan (a product's migrations) or one of the sql lexicon's
+ * migration Ops' plans, through `@intentius/chant-lexicon-sql/change-set`.
+ */
+export type ChangeSetPlanner = "terraform" | "tofu" | "choudoufu" | "chant" | "warden" | "sql";
+/** Every planner, in the order the schema lists them. */
+export declare const CHANGE_SET_PLANNERS: readonly ChangeSetPlanner[];
 /** One attribute a change writes, at top-level granularity. */
 export interface ChangeSetAttribute {
     path: string;
@@ -251,4 +260,17 @@ export interface ReconcilePlanPartInput {
  * the managed counts, which are guardrail denominators rather than changes.
  */
 export declare function reconcilePlanPart(input: ReconcilePlanPartInput): ChangeSetPart;
+/**
+ * A part an adapter in another process wrote as JSON, read back as `member`'s
+ * part. The `sql` planner's plans arrive this way: the sql lexicon's
+ * `change-set` adapters, or a product that fills them, write the part, and
+ * `readChangeSetPart` with `planner: "sql"` reads it.
+ *
+ * The part must name `planner` on its member and on every entry, and say
+ * `status`, `planDigest` and `holes`. Its member and entries are renamed to
+ * `member`, so the file need not know the name the run gives it; a `lexicon`
+ * given here replaces the part's. Nothing is recomputed: the plan digest is
+ * the one the writer took, over a plan this process never sees.
+ */
+export declare function readChangeSetPartFile(part: unknown, planner: ChangeSetPlanner, member: string, lexicon?: string): ChangeSetPart;
 //# sourceMappingURL=change-set.d.ts.map

package/dist/change-set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-set.d.ts","sourceRoot":"","sources":["../src/change-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,KAAK,EAAE,SAAS,IAAI,kBAAkB,EAAoC,MAAM,wBAAwB,CAAC;AAChH,OAAO,KAAK,EAAE,SAAS,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEnE,2DAA2D;AAC3D,eAAO,MAAM,oBAAoB,sFAAsF,CAAC;AAExH,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wHAAwH;AACxH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvG,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAAyE,CAAC;AAEnI,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7F,2CAA2C;AAC3C,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvF,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,0EAA0E;IAC1E,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,2FAA2F;IAC3F,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,2IAA2I;IAC3I,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC;CAC1D;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACzC,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvC,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,mCAAmC;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,oBAAoB,CAAC;IACrC,QAAQ,EAAE,OAAO,mBAAmB,CAAC;IACrC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,uFAAuF;IACvF,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAWD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC,CAAC,GAAG,MAAM,CAS9H;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,GAAG,MAAM,CASnH;AAED,mDAAmD;AACnD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAiC1G;AAMD,MAAM,WAAW,uBAAuB;IACtC,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,EAAE,OAAO,GAAE,uBAA4B,GAAG,iBAAiB,CAwB9H;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,GAAG,OAAO,CAM7H;AAID,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,IAAI,EAAE,kBAAkB,CAAC;IACzB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAkD9E;AAID,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,IAAI,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAC;IAChD,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAyC9E"}
+{"version":3,"file":"change-set.d.ts","sourceRoot":"","sources":["../src/change-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAGH,OAAO,KAAK,EAAE,SAAS,IAAI,kBAAkB,EAAoC,MAAM,wBAAwB,CAAC;AAChH,OAAO,KAAK,EAAE,SAAS,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEnE,2DAA2D;AAC3D,eAAO,MAAM,oBAAoB,sFAAsF,CAAC;AAExH,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wHAAwH;AACxH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvG,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAAyE,CAAC;AAEnI,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7F,2CAA2C;AAC3C;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE/F,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAAiE,CAAC;AAE7H,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,0EAA0E;IAC1E,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,2FAA2F;IAC3F,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,2IAA2I;IAC3I,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC;CAC1D;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACzC,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvC,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,mCAAmC;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,oBAAoB,CAAC;IACrC,QAAQ,EAAE,OAAO,mBAAmB,CAAC;IACrC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,uFAAuF;IACvF,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAWD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC,CAAC,GAAG,MAAM,CAS9H;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,GAAG,MAAM,CASnH;AAED,mDAAmD;AACnD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAiC1G;AAMD,MAAM,WAAW,uBAAuB;IACtC,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,EAAE,OAAO,GAAE,uBAA4B,GAAG,iBAAiB,CAwB9H;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,GAAG,OAAO,CAM7H;AAID,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,IAAI,EAAE,kBAAkB,CAAC;IACzB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAkD9E;AAID,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,IAAI,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAC;IAChD,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAyC9E;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa,CAsB/H"}

package/dist/change-set.js

@@ -0,0 +1,361 @@
+/**
+ * One change-set document across planners (#3181).
+ *
+ * Several things plan changes, each with its own output: `chant lifecycle
+ * plan` for the cloud lexicons, terraform, tofu and choudoufu plans, and a
+ * warden's reconcile plan. This module is the one typed document they all
+ * become, so a reader can ask one question of every plan in a run: what will
+ * change, where, and how risky it is. Its schema is
+ * `./workspace/change-set.schema.json`, part of the workspace read contract.
+ *
+ * Each planner reaches it through an adapter that returns a
+ * {@link ChangeSetPart}: one member and its entries. The lifecycle and
+ * reconcile adapters are here; the terraform-family ones live in the
+ * terraform lexicon's `change-set` subpath and the SQL ones in the sql
+ * lexicon's. A part another process wrote to a file reads back through
+ * {@link readChangeSetPartFile}. {@link composeChangeSet} joins
+ * the parts.
+ *
+ * ## The digest
+ *
+ * Every member carries the plan digest a gate on that member alone binds
+ * (#2300): `terraformPlanDigest` for a terraform-family root, and here
+ * `computePlanDigest("lifecycle-plan", …)` and `computePlanDigest(
+ * "reconcile-plan", …)`. {@link changeSetDigest} over the sorted `{ member,
+ * planDigest }` pairs is the set digest #3049 describes, and a wave's digest
+ * is that function over the wave's members.
+ *
+ * The document's digest is {@link changeSetDocumentDigest}: the set digest,
+ * each member's status and holes, the entries and the side effects. An
+ * approval of the document binds what it says as well as the plans it came
+ * from, so a pull request's apply that resumes from a record (#3464) can
+ * check a re-planned member against the record's entries without trusting
+ * whoever wrote the record. The summary is computed from the entries and is
+ * not hashed. A change to how chant projects a plan into entries moves the
+ * document's digest, so an approval given under one chant does not carry to
+ * an apply under a chant that projects the same plan differently.
+ *
+ * ## The import graph
+ *
+ * terragucci runs this in customer CI as one bundled file with no TypeScript
+ * toolchain (#3421). Everything here imports `./lifecycle/plan-digest` and
+ * types only, and `change-set-bundle.test.ts` holds that.
+ */
+import { computePlanDigest } from "./lifecycle/plan-digest.js";
+/** The schema a change-set document names in `$schema`. */
+export const CHANGE_SET_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/change-set/v1/change-set.schema.json";
+/** The read-contract version the document follows. */
+export const CHANGE_SET_CONTRACT = 1;
+/** Every action, in the order the summary lists them. */
+export const CHANGE_SET_ACTIONS = ["create", "update", "replace", "delete", "read", "no-op", "forget"];
+/** Every planner, in the order the schema lists them. */
+export const CHANGE_SET_PLANNERS = ["terraform", "tofu", "choudoufu", "chant", "warden", "sql"];
+const byString = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+function entryKey(e) {
+    return `${e.member}\u0000${e.address}\u0000${e.deposed ?? ""}\u0000${e.action}`;
+}
+const bySideEffect = (a, b) => byString(a.member, b.member) || byString(a.address, b.address) || byString(a.trigger ?? "", b.trigger ?? "");
+/**
+ * The set digest over members' plan digests: `computePlanDigest("change-set",
+ * …)` over `{ member, planDigest }` sorted by member. Order-independent,
+ * and different whenever one member's plan digest is. Refuses a set that
+ * names a member twice, which has no single plan for that member.
+ *
+ * Provisional members are left out: their plans may stand on values that do
+ * not exist yet, so an approval of this digest never covers them.
+ */
+export function changeSetDigest(members) {
+    const pairs = members
+        .filter((m) => m.provisional !== true)
+        .map((m) => ({ member: m.member, planDigest: m.planDigest }))
+        .sort((a, b) => byString(a.member, b.member));
+    for (let i = 1; i < pairs.length; i++) {
+        if (pairs[i - 1].member === pairs[i].member)
+            throw new Error(`the change set names member ${pairs[i].member} twice`);
+    }
+    return computePlanDigest("change-set", pairs);
+}
+/**
+ * The document's digest: `computePlanDigest("change-set-document", …)` over
+ * the set digest ({@link changeSetDigest}), each member's name, status and
+ * holes, the entries and the side effects. Members are sorted by name and
+ * entries and side effects by the keys {@link composeChangeSet} sorts them by,
+ * so order makes no difference.
+ *
+ * A provisional member is left out, with its entries and side effects, as
+ * the set digest leaves it out: no approval of the document covers it.
+ */
+export function changeSetDocumentDigest(doc) {
+    const provisional = new Set(doc.members.filter((m) => m.provisional === true).map((m) => m.member));
+    const members = doc.members
+        .filter((m) => !provisional.has(m.member))
+        .map((m) => ({ member: m.member, status: m.status, holes: m.holes }))
+        .sort((a, b) => byString(a.member, b.member));
+    const entries = doc.entries.filter((e) => !provisional.has(e.member)).sort((a, b) => byString(entryKey(a), entryKey(b)));
+    const sideEffects = (doc.sideEffects ?? []).filter((s) => !provisional.has(s.member)).sort(bySideEffect);
+    return computePlanDigest("change-set-document", { set: changeSetDigest(doc.members), members, entries, sideEffects });
+}
+/** The summary of a set of members and entries. */
+export function summarizeChangeSet(members, entries) {
+    const actions = Object.fromEntries(CHANGE_SET_ACTIONS.map((a) => [a, 0]));
+    const types = {};
+    const byMember = {};
+    const deletes = [];
+    const replacements = [];
+    const bump = (into, key, action) => {
+        const counts = (into[key] ?? (into[key] = {}));
+        counts[action] = (counts[action] ?? 0) + 1;
+    };
+    for (const e of entries) {
+        actions[e.action]++;
+        bump(types, e.type, e.action);
+        bump(byMember, e.member, e.action);
+        const named = {
+            member: e.member, address: e.address, type: e.type,
+            ...(e.deposed !== undefined ? { deposed: e.deposed } : {}),
+            ...(e.disruption !== undefined ? { disruption: e.disruption } : {}),
+        };
+        if (e.action === "delete")
+            deletes.push(named);
+        if (e.action === "replace")
+            replacements.push(named);
+    }
+    return {
+        members: members.length,
+        entries: entries.length,
+        actions,
+        types: sortKeys(types),
+        byMember: sortKeys(byMember),
+        deletes,
+        replacements,
+        failed: members.filter((m) => m.status === "failed").map((m) => m.member),
+        holes: members.reduce((n, m) => n + m.holes.length, 0),
+    };
+}
+function sortKeys(o) {
+    return Object.fromEntries(Object.entries(o).sort(([a], [b]) => byString(a, b)));
+}
+/**
+ * Join adapters' parts into one document: members sorted by name, entries
+ * by member, address, deposed key and action, the summary, and the digest.
+ * Throws when two parts name the same member, or an entry names a member
+ * other than its part's.
+ */
+export function composeChangeSet(parts, options = {}) {
+    const members = parts.map((p) => p.member).sort((a, b) => byString(a.member, b.member));
+    const entries = [];
+    for (const part of parts) {
+        for (const e of part.entries) {
+            if (e.member !== part.member.member)
+                throw new Error(`an entry at ${e.address} names member ${e.member}, inside member ${part.member.member}`);
+            entries.push(e);
+        }
+    }
+    entries.sort((a, b) => byString(entryKey(a), entryKey(b)));
+    const sideEffects = parts
+        .flatMap((p) => (p.sideEffects ?? []).map((s) => ({ member: p.member.member, ...s })))
+        .sort(bySideEffect);
+    const digest = changeSetDocumentDigest({ members, entries, sideEffects });
+    return {
+        $schema: CHANGE_SET_SCHEMA_ID,
+        contract: CHANGE_SET_CONTRACT,
+        ...(options.chant !== undefined ? { chant: options.chant } : {}),
+        digest,
+        members,
+        entries,
+        ...(sideEffects.length > 0 ? { sideEffects } : {}),
+        summary: summarizeChangeSet(members, entries),
+    };
+}
+/**
+ * Whether a document's digest is the one its members, entries and side
+ * effects give ({@link changeSetDocumentDigest}). A document that names a
+ * member twice has no digest and is not verified.
+ */
+export function verifyChangeSetDigest(doc) {
+    try {
+        return changeSetDocumentDigest(doc) === doc.digest;
+    }
+    catch {
+        return false;
+    }
+}
+function lifecycleAttributes(entry) {
+    const because = new Set(entry.disruptionBecause ?? []);
+    return (entry.deltas ?? []).map((d) => ({
+        path: d.path,
+        ...(d.oldValue !== undefined ? { before: d.oldValue } : {}),
+        ...(d.newValue !== undefined ? { after: d.newValue } : {}),
+        ...(because.has(d.path) ? { forcesReplacement: true } : {}),
+    }));
+}
+/**
+ * A chant member's part, from `chant lifecycle plan <env> --json`.
+ *
+ * `create`, `update`, `delete` and `noop` map across. An `update` whose
+ * lexicon says it replaces or destroys becomes a `replace`. An `effect`
+ * entry is the receipt its effect step writes: a `create` when the receipt
+ * is absent, else an `update`. `unobserved` entries are holes. `adopt` and
+ * `runtime` propose nothing and are left out.
+ *
+ * The member's plan digest is `computePlanDigest("lifecycle-plan", plan)`
+ * over the whole document, which carries no timestamp or run id.
+ */
+export function lifecyclePlanPart(input) {
+    const { plan } = input;
+    const fallback = input.lexicon ?? "chant";
+    const entries = [];
+    const holes = [];
+    for (const e of plan.entries ?? []) {
+        const lexicon = e.lexicon ?? fallback;
+        if (e.action === "unobserved") {
+            holes.push({ address: e.name, ...(e.type ? { type: e.type } : {}), reason: e.unobservedReason ?? "unobserved" });
+            continue;
+        }
+        let action;
+        let disruption;
+        switch (e.action) {
+            case "create":
+                action = "create";
+                break;
+            case "noop":
+                action = "no-op";
+                break;
+            case "delete":
+                action = "delete";
+                disruption = "destroy";
+                break;
+            case "effect":
+                action = e.effectReason === "receipt-absent" ? "create" : "update";
+                break;
+            case "update":
+                disruption = e.disruption ?? "unknown";
+                action = disruption === "replace" || disruption === "destroy" ? "replace" : "update";
+                break;
+            default: continue; // adopt, runtime: not a proposal
+        }
+        entries.push({
+            member: input.member,
+            lexicon,
+            planner: "chant",
+            address: e.name,
+            type: e.type ?? "unknown",
+            ...(e.physicalId ? { id: e.physicalId } : {}),
+            action,
+            ...(disruption ? { disruption } : {}),
+            scope: plan.env,
+            attributes: lifecycleAttributes(e),
+        });
+    }
+    const lexicons = [...new Set(entries.map((e) => e.lexicon))].sort();
+    return {
+        member: {
+            member: input.member,
+            lexicon: lexicons.length === 1 ? lexicons[0] : fallback,
+            planner: "chant",
+            scope: plan.env,
+            status: "planned",
+            planDigest: computePlanDigest("lifecycle-plan", plan),
+            holes,
+        },
+        entries,
+    };
+}
+function topLevelKeys(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value).sort() : [];
+}
+/**
+ * A warden member's part, from the reconcile `ChangeSet`s it planned
+ * (`./reconcile.ts`). The address is `<resourceType>.<key>`, unique within
+ * one org, and the scope is the org. An update's disruption is `unknown`:
+ * the reconcile model says nothing about it.
+ *
+ * The plan digest covers each change set's org and entries, and leaves out
+ * the managed counts, which are guardrail denominators rather than changes.
+ */
+export function reconcilePlanPart(input) {
+    const sets = (Array.isArray(input.plan) ? input.plan : [input.plan])
+        .map((cs) => ({ org: cs.org, entries: [...cs.entries].sort((a, b) => byString(`${a.resourceType}\u0000${a.key}`, `${b.resourceType}\u0000${b.key}`)) }))
+        .sort((a, b) => byString(a.org, b.org));
+    const lexicon = input.lexicon ?? "github";
+    const entries = [];
+    for (const cs of sets) {
+        for (const e of cs.entries) {
+            const attributes = e.kind === "update"
+                ? (e.fields ?? []).map((f) => ({ path: f.field, ...(f.before !== undefined ? { before: f.before } : {}), ...(f.after !== undefined ? { after: f.after } : {}) }))
+                : e.kind === "create"
+                    ? topLevelKeys(e.after).map((k) => ({ path: k, after: e.after[k] }))
+                    : [];
+            entries.push({
+                member: input.member,
+                lexicon,
+                planner: "warden",
+                address: `${e.resourceType}.${e.key}`,
+                type: e.resourceType,
+                name: e.key,
+                action: e.kind,
+                ...(e.kind === "delete" ? { disruption: "destroy" } : e.kind === "update" ? { disruption: "unknown" } : {}),
+                scope: cs.org,
+                attributes,
+            });
+        }
+    }
+    const orgs = [...new Set(sets.map((s) => s.org))];
+    return {
+        member: {
+            member: input.member,
+            lexicon,
+            planner: "warden",
+            ...(orgs.length === 1 ? { scope: orgs[0] } : {}),
+            status: "planned",
+            planDigest: computePlanDigest("reconcile-plan", sets),
+            holes: [],
+        },
+        entries,
+    };
+}
+// ── a part written to a file ───────────────────────────────────────────────────
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/**
+ * A part an adapter in another process wrote as JSON, read back as `member`'s
+ * part. The `sql` planner's plans arrive this way: the sql lexicon's
+ * `change-set` adapters, or a product that fills them, write the part, and
+ * `readChangeSetPart` with `planner: "sql"` reads it.
+ *
+ * The part must name `planner` on its member and on every entry, and say
+ * `status`, `planDigest` and `holes`. Its member and entries are renamed to
+ * `member`, so the file need not know the name the run gives it; a `lexicon`
+ * given here replaces the part's. Nothing is recomputed: the plan digest is
+ * the one the writer took, over a plan this process never sees.
+ */
+export function readChangeSetPartFile(part, planner, member, lexicon) {
+    const where = `the ${planner} part for ${member}`;
+    if (!isRecord(part) || !isRecord(part.member) || !Array.isArray(part.entries))
+        throw new Error(`${where} is not a change-set part: it needs member and entries`);
+    const m = part.member;
+    if (m.planner !== planner)
+        throw new Error(`${where} names planner ${String(m.planner)}, not ${planner}`);
+    if (m.status !== "planned" && m.status !== "failed")
+        throw new Error(`${where} has no status`);
+    if (m.planDigest !== null && typeof m.planDigest !== "string")
+        throw new Error(`${where} has no planDigest`);
+    if (m.status === "planned" && m.planDigest === null)
+        throw new Error(`${where} planned but has no planDigest`);
+    if (!Array.isArray(m.holes))
+        throw new Error(`${where} has no holes array`);
+    const entries = part.entries.map((e, i) => {
+        if (!isRecord(e) || typeof e.address !== "string" || typeof e.type !== "string" || typeof e.action !== "string" || !Array.isArray(e.attributes)) {
+            throw new Error(`${where}: entries[${i}] needs address, type, action and attributes`);
+        }
+        if (!CHANGE_SET_ACTIONS.includes(e.action))
+            throw new Error(`${where}: entries[${i}] has action ${e.action}`);
+        if (e.planner !== planner)
+            throw new Error(`${where}: entries[${i}] names planner ${String(e.planner)}, not ${planner}`);
+        return { ...e, member, ...(lexicon !== undefined ? { lexicon } : {}) };
+    });
+    return {
+        member: { ...m, member, ...(lexicon !== undefined ? { lexicon } : {}) },
+        entries,
+        ...(Array.isArray(part.sideEffects) ? { sideEffects: part.sideEffects } : {}),
+    };
+}

package/dist/child-project.js

@@ -0,0 +1,21 @@
+/**
+ * Child Project — represents a nested project directory that gets built
+ * independently and referenced from a parent as a single deployment unit.
+ *
+ * Lexicons create ChildProjectInstance via their own factory (e.g. `nestedStack()`).
+ * The core build pipeline detects these and recursively builds children.
+ */
+import { DECLARABLE_MARKER } from "./declarable.js";
+/**
+ * Marker symbol for child project identification.
+ */
+export const CHILD_PROJECT_MARKER = Symbol.for("chant.childProject");
+/**
+ * Type guard for ChildProjectInstance.
+ */
+export function isChildProject(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        CHILD_PROJECT_MARKER in value &&
+        value[CHILD_PROJECT_MARKER] === true);
+}