@intentius/chant 0.124.45 → 0.124.46

package/dist/capabilities/view.js

@@ -0,0 +1,484 @@
+import { terraformType } from "../graph-effective.js";
+/**
+ * Merge mappings for the same lexicon: objects merge key by key at every
+ * depth, lists concatenate, and anything else in a later mapping wins.
+ */
+export function mergeMappings(...ms) {
+    const merge = (a, b) => {
+        if (b === undefined)
+            return a;
+        if (Array.isArray(a) && Array.isArray(b))
+            return [...a, ...b.filter((x) => typeof x === "object" || !a.includes(x))];
+        const isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+        if (isObj(a) && isObj(b)) {
+            const out = { ...a };
+            for (const [k, v] of Object.entries(b))
+                out[k] = merge(a[k], v);
+            return out;
+        }
+        return b;
+    };
+    return ms.reduce((acc, m) => merge(acc, m), { lexicon: ms[0]?.lexicon ?? "" });
+}
+const arr = (v) => (v == null ? [] : Array.isArray(v) ? v : [v]);
+/** Every value at `path` (`A.B`, `A[].B`), flattened. */
+function readPath(obj, path) {
+    let cur = [obj];
+    for (const seg of path.split(".")) {
+        const spread = seg.endsWith("[]");
+        const key = spread ? seg.slice(0, -2) : seg;
+        const next = [];
+        for (const c of cur) {
+            if (!c || typeof c !== "object")
+                continue;
+            const v = c[key];
+            if (v === undefined)
+                continue;
+            if (spread)
+                next.push(...arr(v));
+            else
+                next.push(v);
+        }
+        cur = next;
+    }
+    return cur;
+}
+function readSource(obj, src) {
+    if (typeof src === "string")
+        return readPath(obj, src)[0];
+    if (Array.isArray(src)) {
+        for (const p of src) {
+            const v = readPath(obj, p)[0];
+            if (v !== undefined && v !== null)
+                return v;
+        }
+        return undefined;
+    }
+    if ("const" in src)
+        return src.const;
+    return src.all.flatMap((p) => readPath(obj, p).flatMap(arr));
+}
+function matchesWhen(obj, when) {
+    if (!when)
+        return true;
+    return Object.entries(when).every(([k, v]) => readPath(obj, k)[0] === v);
+}
+/** The bare name a row prints: no stack qualification, no root directory. */
+export function displayName(id) {
+    const s = id.includes("::") ? id.slice(id.lastIndexOf("::") + 2) : id;
+    return s.slice(s.lastIndexOf("/") + 1);
+}
+const ARN_NAMES = [
+    { label: "Role", re: /^arn:aws[\w-]*:iam::[^:]*:role\/(?:[^*]*\/)?([^/*]+)$/ },
+    { label: "Bucket", re: /^arn:aws[\w-]*:s3:::([^/*]+)(?:\/.*)?$/ },
+    { label: "Table", re: /^arn:aws[\w-]*:dynamodb:[^:]*:[^:]*:table\/([^/*]+)$/ },
+];
+/**
+ * Normalize what each lexicon spells its own way, for labels whose meaning is
+ * core vocabulary: an ingress rule's protocol and port range.
+ */
+function normalize(label, attrs) {
+    if (label === "IngressRule") {
+        const raw = attrs.proto == null ? "-1" : String(attrs.proto).toLowerCase();
+        const proto = raw === "all" || raw === "-1" ? "-1" : raw;
+        attrs.proto = proto;
+        if (proto === "-1" || attrs.from == null) {
+            attrs.from = 0;
+            attrs.to = 65535;
+        }
+        else {
+            attrs.from = Number(attrs.from);
+            attrs.to = attrs.to == null ? attrs.from : Number(attrs.to);
+        }
+        attrs.cidrs = arr(attrs.cidrs).map(String);
+    }
+}
+/**
+ * Build the view of an IR through the packs given. Nodes of a kind no
+ * mapping labels are left out, as are edges no mapping names.
+ */
+export function buildView(ir, packs) {
+    const byLexicon = new Map();
+    for (const p of packs) {
+        const prev = byLexicon.get(p.mapping.lexicon);
+        byLexicon.set(p.mapping.lexicon, prev ? { mapping: mergeMappings(prev.mapping, p.mapping), adapter: { ...prev.adapter, ...p.adapter } } : p);
+    }
+    const terraformPack = [...byLexicon.values()].find((p) => p.mapping.types === "terraform");
+    const kindPacks = [...byLexicon.values()].filter((p) => p.mapping.types !== "terraform");
+    const nodes = new Map();
+    const edges = [];
+    const lexicons = new Set();
+    const irById = new Map(ir.nodes.map((n) => [n.id, n]));
+    const packOf = new Map();
+    const typeAndPack = (n) => {
+        const tf = terraformType(n);
+        if (tf !== undefined)
+            return terraformPack ? { type: tf, pack: terraformPack } : undefined;
+        const kind = n.kind ?? "";
+        const pack = kindPacks.find((p) => p.mapping.labels?.[kind] !== undefined);
+        return pack ? { type: kind, pack } : undefined;
+    };
+    const bodyOf = (n, pack) => {
+        const attrs = (n.attrs ?? {});
+        if (!pack.mapping.body)
+            return attrs;
+        const b = attrs[pack.mapping.body];
+        return b && typeof b === "object" && !Array.isArray(b) ? b : {};
+    };
+    // Terraform locals, per scope, so `tags = local.restricted` reads as a map.
+    const locals = new Map();
+    const scopeOf = (id) => id.slice(0, id.lastIndexOf("/") + 1);
+    for (const n of ir.nodes) {
+        if (n.kind !== "Terraform::Locals")
+            continue;
+        const body = (n.attrs?.body ?? {});
+        locals.set(scopeOf(n.id), { ...locals.get(scopeOf(n.id)), ...body });
+    }
+    const resolveLocal = (from, v) => {
+        const m = typeof v === "string" ? /^\$\{local\.([\w-]+)\}$/.exec(v) : null;
+        return m ? locals.get(scopeOf(from))?.[m[1]] : v;
+    };
+    // ---- nodes
+    for (const n of ir.nodes) {
+        const tp = typeAndPack(n);
+        if (!tp)
+            continue;
+        const { type, pack } = tp;
+        const m = pack.mapping;
+        const spec = m.labels?.[type];
+        if (spec === undefined)
+            continue;
+        const label = typeof spec === "string" ? spec : spec.label;
+        const body = bodyOf(n, pack);
+        if (typeof spec !== "string" && !matchesWhen(body, spec.when))
+            continue;
+        const attrs = { type };
+        if (typeof spec !== "string" && spec.style)
+            attrs.style = spec.style;
+        if (typeof spec !== "string" && spec.set)
+            Object.assign(attrs, spec.set);
+        for (const [neutral, src] of Object.entries(m.attrs?.[label] ?? {})) {
+            const v = readSource(body, src);
+            if (v !== undefined)
+                attrs[neutral] = resolveLocal(n.id, v);
+        }
+        // Carry the IR's own derived attributes (a live read's `internetFacing`).
+        for (const [k, v] of Object.entries((n.attrs ?? {}))) {
+            if (k === "internetFacing" && attrs[k] === undefined)
+                attrs[k] = v;
+        }
+        if (m.classificationTags?.length) {
+            for (const path of m.tags ?? []) {
+                const tags = resolveLocal(n.id, readPath(body, path)[0]);
+                const map = Array.isArray(tags)
+                    ? Object.fromEntries(tags.map((t) => [t.Key, t.Value]))
+                    : tags && typeof tags === "object"
+                        ? tags
+                        : {};
+                for (const key of m.classificationTags) {
+                    if (map[key] !== undefined && attrs.classification === undefined)
+                        attrs.classification = map[key];
+                }
+            }
+        }
+        normalize(label, attrs);
+        nodes.set(n.id, { id: n.id, label, irId: n.id, lexicon: m.lexicon, attrs, body });
+        packOf.set(n.id, pack);
+        lexicons.add(m.lexicon);
+    }
+    // ---- references inside attribute values
+    const byName = new Map();
+    for (const v of nodes.values()) {
+        const name = v.attrs.name;
+        if (typeof name !== "string" || !name)
+            continue;
+        if (!byName.has(v.label))
+            byName.set(v.label, new Map());
+        byName.get(v.label).set(name, v.id);
+    }
+    const refTarget = (from, value) => {
+        const pack = packOf.get(from);
+        if (value && typeof value === "object") {
+            const ref = value.$ref;
+            if (typeof ref === "string") {
+                if (nodes.has(ref))
+                    return { id: ref };
+                const dot = ref.lastIndexOf(".");
+                if (dot > 0 && nodes.has(ref.slice(0, dot)))
+                    return { id: ref.slice(0, dot), attr: ref.slice(dot + 1) };
+                return undefined;
+            }
+            const sub = value.$sub;
+            if (typeof sub === "string") {
+                const m = /\$\{([^.}]+)(?:\.([^}]+))?\}/.exec(sub);
+                if (m && nodes.has(m[1]))
+                    return { id: m[1], attr: m[2] };
+            }
+            return undefined;
+        }
+        if (typeof value !== "string")
+            return undefined;
+        if (pack?.mapping.refs === "terraform") {
+            const m = /(?:^|[^\w.])((?:data\.)?[a-z][a-z0-9]*_[a-z0-9_]+\.[A-Za-z0-9_-]+)(?:\[[^\]]*\])?\.([A-Za-z_]+)/.exec(value);
+            if (m) {
+                const id = scopeOf(from) + m[1];
+                if (nodes.has(id))
+                    return { id, attr: m[2] };
+            }
+        }
+        for (const { label, re } of ARN_NAMES) {
+            const m = re.exec(value);
+            const id = m ? byName.get(label)?.get(m[1]) : undefined;
+            if (id)
+                return { id };
+        }
+        return undefined;
+    };
+    const unresolved = [];
+    // An ARN that names nothing declared here is kept for a workspace's composer (#4378).
+    const keepArn = (from, fromAttr, edge, value) => {
+        if (typeof value === "string" && ARN_NAMES.some(({ re }) => re.test(value)))
+            unresolved.push({ from, fromAttr, edge, value });
+    };
+    const blockEdges = [];
+    // ---- inline blocks: ingress rules, inline routes
+    for (const v of [...nodes.values()]) {
+        const pack = packOf.get(v.id);
+        const specs = pack.mapping.blocks?.[v.label];
+        if (!specs)
+            continue;
+        const body = bodyOf(irById.get(v.id), pack);
+        for (const spec of specs) {
+            readPath(body, spec.attr)
+                .flatMap(arr)
+                .forEach((raw, i) => {
+                if (!raw || typeof raw !== "object" || !matchesWhen(raw, spec.when))
+                    return;
+                const id = `${v.id}#${spec.attr.replace(/\[\]/g, "")}[${i}]`;
+                const attrs = { block: true };
+                if (spec.style)
+                    attrs.style = spec.style;
+                for (const [neutral, src] of Object.entries(spec.attrs ?? {})) {
+                    const val = readSource(raw, src);
+                    if (val !== undefined)
+                        attrs[neutral] = val;
+                }
+                normalize(spec.label, attrs);
+                nodes.set(id, { id, label: spec.label, irId: v.id, lexicon: v.lexicon, attrs, body: raw });
+                packOf.set(id, pack);
+                const back = spec.edge.startsWith("-");
+                const name = back ? spec.edge.slice(1) : spec.edge;
+                const hop = { from: v.id, fromAttr: spec.attr.replace(/\[\]/g, ""), to: id, edge: name };
+                blockEdges.push(back ? { from: id, to: v.id, name, hops: [hop] } : { from: v.id, to: id, name, hops: [hop] });
+                for (const [attr, edge] of Object.entries(spec.refs ?? {})) {
+                    for (const val of arr(raw[attr])) {
+                        const t = refTarget(v.id, val);
+                        if (!t)
+                            keepArn(id, attr, edge, val);
+                        if (t)
+                            blockEdges.push({ from: id, to: t.id, name: edge, hops: [{ from: id, fromAttr: attr, to: t.id, ...(t.attr ? { toAttr: t.attr } : {}), edge }] });
+                    }
+                }
+            });
+        }
+    }
+    // Blocks first: an inline route is read before a separate route resource,
+    // the order the folds always used.
+    edges.push(...blockEdges);
+    // ---- IR edges, named per label
+    for (const e of ir.edges ?? []) {
+        const from = nodes.get(e.from);
+        const to = nodes.get(e.to);
+        if (!from || !to)
+            continue;
+        const pack = packOf.get(e.from);
+        const via = e.viaAttr ?? e.kind ?? "";
+        const spec = pack.mapping.edges?.[from.label]?.[via];
+        const name = typeof spec === "string" ? spec : spec?.[to.label];
+        if (!name)
+            continue;
+        const back = name.startsWith("-");
+        const n = back ? name.slice(1) : name;
+        const hop = irHop(e, n);
+        edges.push(back ? { from: e.to, to: e.from, name: n, hops: [hop] } : { from: e.from, to: e.to, name: n, hops: [hop] });
+    }
+    // ---- link resources -> one edge
+    for (const v of [...nodes.values()]) {
+        const link = packOf.get(v.id)?.mapping.links?.[v.label];
+        if (!link)
+            continue;
+        const a = edges.find((e) => e.from === v.id && e.name === link.from);
+        const b = edges.find((e) => e.from === v.id && e.name === link.to);
+        if (a && b)
+            edges.push({ from: a.to, to: b.to, name: link.edge, hops: [...a.hops, ...b.hops] });
+    }
+    // ---- policy documents -> statements
+    for (const holder of [...nodes.values()]) {
+        if (holder.attrs.block)
+            continue;
+        const pack = packOf.get(holder.id);
+        const docs = pack.mapping.documents?.[holder.label];
+        if (!docs)
+            continue;
+        const body = bodyOf(irById.get(holder.id), pack);
+        for (const [path, docKind] of Object.entries(docs)) {
+            readPath(body, path).forEach((raw, di) => {
+                const doc = readDocument(raw, pack);
+                if (!doc)
+                    return;
+                const base = path.replace(/\[\]/g, "");
+                arr(doc.Statement).forEach((s0, si) => {
+                    if (!s0 || typeof s0 !== "object")
+                        return;
+                    const s = s0;
+                    const id = `${holder.id}#${base}[${di}].Statement[${si}]`;
+                    const principal = s.Principal;
+                    const principals = principal === "*"
+                        ? ["*"]
+                        : principal && typeof principal === "object"
+                            ? Object.values(principal).flatMap(arr).map((p) => (typeof p === "string" ? p : "ref"))
+                            : [];
+                    const resources = arr(s.Resource);
+                    const attrs = {
+                        doc: docKind,
+                        effect: s.Effect,
+                        actions: arr(s.Action).map(String),
+                        ...(s.NotAction !== undefined ? { notActions: arr(s.NotAction).map(String) } : {}),
+                        ...(s.NotResource !== undefined ? { notResource: true } : {}),
+                        ...(s.Condition !== undefined ? { condition: true } : {}),
+                        ...(resources.some((r) => r === "*") ? { anyResource: true } : {}),
+                        principals,
+                    };
+                    nodes.set(id, { id, label: "Statement", irId: holder.id, lexicon: holder.lexicon, attrs });
+                    packOf.set(id, pack);
+                    edges.push({ from: holder.id, to: id, name: "statement", hops: [{ from: holder.id, fromAttr: base, to: id, edge: "statement" }] });
+                    let unresolved = 0;
+                    resources.forEach((r, ri) => {
+                        const t = refTarget(holder.id, r);
+                        // A reference the graph holds but can't name (an intrinsic with
+                        // no target, a Terraform expression to an undeclared resource) is
+                        // counted, so an answer can say what it skipped. A `Sub` is read
+                        // through its `$sub` template (chant#4373).
+                        if (!t && ((r && typeof r === "object") || (typeof r === "string" && r.includes("${"))))
+                            unresolved++;
+                        if (!t)
+                            keepArn(id, `Resource[${ri}]`, "resource", r);
+                        if (t)
+                            edges.push({ from: id, to: t.id, name: "resource", hops: [{ from: id, fromAttr: `Resource[${ri}]`, to: t.id, ...(t.attr ? { toAttr: t.attr } : {}), edge: "resource" }] });
+                    });
+                    if (unresolved > 0)
+                        attrs.unresolved = unresolved;
+                    if (principal && typeof principal === "object") {
+                        for (const p of arr(principal.AWS)) {
+                            const t = refTarget(holder.id, p);
+                            if (!t)
+                                keepArn(id, "Principal.AWS", "principal", p);
+                            if (t)
+                                edges.push({ from: id, to: t.id, name: "principal", hops: [{ from: id, fromAttr: "Principal.AWS", to: t.id, ...(t.attr ? { toAttr: t.attr } : {}), edge: "principal" }] });
+                        }
+                    }
+                });
+            });
+        }
+    }
+    return { nodes, edges, lexicons, unresolved };
+}
+/** The version of the serialized view a member's `chant graph --capability-view` prints (#4378). */
+export const VIEW_DOCUMENT_VERSION = 1;
+export function serializeView(view) {
+    return {
+        version: VIEW_DOCUMENT_VERSION,
+        lexicons: [...view.lexicons].sort(),
+        nodes: [...view.nodes.values()].map((n) => ({ id: n.id, label: n.label, irId: n.irId, lexicon: n.lexicon, attrs: n.attrs })),
+        edges: view.edges,
+        unresolved: view.unresolved ?? [],
+    };
+}
+/** Whether a member printed a view this chant reads; anything else is treated as no view. */
+export function isViewDocument(v) {
+    if (!v || typeof v !== "object")
+        return false;
+    const d = v;
+    return d.version === VIEW_DOCUMENT_VERSION && Array.isArray(d.nodes) && Array.isArray(d.edges) && Array.isArray(d.lexicons);
+}
+/** A view document with every id it holds given `prefix` (`<member>/`), as `workspace graph` composes ids. */
+export function prefixView(doc, prefix) {
+    const p = (id) => `${prefix}${id}`;
+    const hop = (h) => ({ ...h, from: p(h.from), to: p(h.to) });
+    return {
+        version: doc.version,
+        lexicons: doc.lexicons,
+        nodes: doc.nodes.map((n) => ({ ...n, id: p(n.id), irId: p(n.irId) })),
+        edges: doc.edges.map((e) => ({ ...e, from: p(e.from), to: p(e.to), hops: e.hops.map(hop) })),
+        unresolved: (doc.unresolved ?? []).map((u) => ({ ...u, from: p(u.from) })),
+    };
+}
+/**
+ * Compose member views into one (#4378), the matcher's input over a
+ * workspace. Each member's view was mapped by its own chant; the one thing
+ * left to do here is resolve the ARNs a member couldn't, by name over every
+ * member's nodes. Where several members declare the name, the last one in
+ * member order wins, as within one view.
+ */
+export function composeViews(docs) {
+    const nodes = new Map();
+    const edges = [];
+    const lexicons = new Set();
+    for (const d of docs) {
+        for (const n of d.nodes)
+            nodes.set(n.id, { ...n });
+        edges.push(...d.edges);
+        for (const l of d.lexicons)
+            lexicons.add(l);
+    }
+    const byName = new Map();
+    for (const v of nodes.values()) {
+        const name = v.attrs.name;
+        if (typeof name !== "string" || !name)
+            continue;
+        if (!byName.has(v.label))
+            byName.set(v.label, new Map());
+        byName.get(v.label).set(name, v.id);
+    }
+    const unresolved = [];
+    for (const u of docs.flatMap((d) => d.unresolved ?? [])) {
+        let to;
+        for (const { label, re } of ARN_NAMES) {
+            const m = re.exec(u.value);
+            to = m ? byName.get(label)?.get(m[1]) : undefined;
+            if (to)
+                break;
+        }
+        if (to)
+            edges.push({ from: u.from, to, name: u.edge, hops: [{ from: u.from, fromAttr: u.fromAttr, to, edge: u.edge }] });
+        else
+            unresolved.push(u);
+    }
+    return { nodes, edges, lexicons, unresolved };
+}
+function irHop(e, name) {
+    return {
+        from: e.from,
+        ...(e.viaAttr ? { fromAttr: e.viaAttr } : {}),
+        to: e.to,
+        ...(e.toAttr ? { toAttr: e.toAttr } : {}),
+        edge: name,
+    };
+}
+function readDocument(raw, pack) {
+    if (pack.adapter?.readDocument)
+        return pack.adapter.readDocument(raw);
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+        const inner = raw.PolicyDocument;
+        return inner && typeof inner === "object" ? inner : raw;
+    }
+    if (typeof raw === "string") {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}

package/dist/cli/commands/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAyCzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAoBhC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,WAAW,CAAC;AAsBnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AA2I9C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AA+eD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA+N3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAyCzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAoBhC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,WAAW,CAAC;AAsBnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AA2I9C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAgfD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA+N3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}

package/dist/cli/commands/lint.js

@@ -653,6 +653,7 @@ async function runLexiconPostSynthDiagnostics(infraPath, plugins, buildParams, s
         ruleId: d.checkId,
         severity: d.severity,
         message: `${d.entity ? `[${d.entity}] ` : ""}${d.message}`,
+        ...(d.entity ? { entity: d.entity } : {}),
     });
     for (const { plugin, diagnostics: raw } of runLexiconPostSynthChecks(withChecks, result, env, { activityContracts, telemetry, projectDir: configDir, ...(loadedConfig ? { projectConfig: loadedConfig } : {}) })) {
         const presetIds = resolvePresetIds(plugin.lintPresets?.(), lintConfig.presets?.[plugin.name] ?? "recommended");

package/dist/cli/handlers/declared-graph.d.ts

@@ -0,0 +1,44 @@
+import type { Declarable } from "../../declarable.js";
+import { type GraphIR } from "../../graph-ir.js";
+import type { BuildRootContributor, LexiconPlugin } from "../../lexicon.js";
+import type { CommandContext } from "../registry.js";
+/**
+ * The pieces of the declared graph that `chant graph` and `chant search` both
+ * read (#1626, #4365, #4368). They live here, once, so the two commands answer
+ * over the same entity set and the same edges: search drifted from graph once
+ * already, answering `(no matches)` over a `terraform.roots` project graph drew
+ * in full, because it never ran the build-root contributors.
+ */
+/**
+ * The build-root contributors this invocation's project configures (#1626):
+ * a `terraform.roots` root's blocks, a `k8s.kustomize.roots` root's rendered
+ * objects. The same closures `chant build` and the lifecycle handlers hand to
+ * `BuildOptions.buildRoots`, bound here for the discover-based paths, which
+ * never run `build()` and so never ran the hook.
+ *
+ * Neither command is `requiresPlugins` (Op/source-graph modes must work
+ * without a lexicon), so plugins are loaded here when `ctx.plugins` is empty.
+ * Rooted at the config's own directory, like `cli/commands/build.ts`: a
+ * relative root resolves against where it was declared, not against a
+ * sourceDir-scoped path. A project that fails to load plugins degrades to no
+ * contributors with a warning rather than failing modes that never needed
+ * plugins at all.
+ */
+export declare function declaredBuildRootContributors(ctx: CommandContext, projectPath: string): Promise<BuildRootContributor[]>;
+/**
+ * Merge build-root contributions into a discovered entity set: the exact
+ * merge `build()` performs (one implementation: `mergeBuildRootEntities`,
+ * ../../build.ts), with its warnings and errors printed. Returns false when a
+ * contributor failed or a name collided; the caller stops, because a graph
+ * missing the entities the build would refuse over must not be answered from
+ * as if complete.
+ */
+export declare function mergeDeclaredBuildRoots(entities: Map<string, Declarable>, contributors: BuildRootContributor[]): Promise<boolean>;
+/**
+ * Add the edges the lexicons' `graphEdges` hooks resolve (#3910): CI
+ * dependencies written as strings (`needs`, `uses:`, `trigger:`, `include:`,
+ * `extends`), which the AttrRef walk in `buildGraphIr` cannot see. A hook that
+ * throws costs its own edges and a warning, not the graph.
+ */
+export declare function withLexiconEdges(ir: GraphIR, plugins: readonly LexiconPlugin[], entities: Map<string, Declarable>): GraphIR;
+//# sourceMappingURL=declared-graph.d.ts.map

package/dist/cli/handlers/declared-graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-graph.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/declared-graph.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAA0B,KAAK,OAAO,EAA0B,MAAM,gBAAgB,CAAC;AAC9F,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;GAMG;AAEH;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAoBjC;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,oBAAoB,EAAE,GACnC,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,aAAa,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,OAAO,CAY3H"}

package/dist/cli/handlers/declared-graph.js

@@ -0,0 +1,87 @@
+import { dirname } from "node:path";
+import { mergeBuildRootEntities } from "../../build.js";
+import { loadChantConfigUpward } from "../../config.js";
+import { applyLexiconGraphEdges } from "../../graph-ir.js";
+import { formatError, formatWarning } from "../format.js";
+import { collectBuildRootContributors, loadPlugins, resolveProjectLexicons } from "../plugins.js";
+/**
+ * The pieces of the declared graph that `chant graph` and `chant search` both
+ * read (#1626, #4365, #4368). They live here, once, so the two commands answer
+ * over the same entity set and the same edges: search drifted from graph once
+ * already, answering `(no matches)` over a `terraform.roots` project graph drew
+ * in full, because it never ran the build-root contributors.
+ */
+/**
+ * The build-root contributors this invocation's project configures (#1626):
+ * a `terraform.roots` root's blocks, a `k8s.kustomize.roots` root's rendered
+ * objects. The same closures `chant build` and the lifecycle handlers hand to
+ * `BuildOptions.buildRoots`, bound here for the discover-based paths, which
+ * never run `build()` and so never ran the hook.
+ *
+ * Neither command is `requiresPlugins` (Op/source-graph modes must work
+ * without a lexicon), so plugins are loaded here when `ctx.plugins` is empty.
+ * Rooted at the config's own directory, like `cli/commands/build.ts`: a
+ * relative root resolves against where it was declared, not against a
+ * sourceDir-scoped path. A project that fails to load plugins degrades to no
+ * contributors with a warning rather than failing modes that never needed
+ * plugins at all.
+ */
+export async function declaredBuildRootContributors(ctx, projectPath) {
+    const { config, configPath } = await loadChantConfigUpward(projectPath).catch(() => ({ config: {}, configPath: undefined }));
+    let plugins = ctx.plugins;
+    if (plugins.length === 0) {
+        try {
+            plugins = await loadPlugins(await resolveProjectLexicons(projectPath));
+        }
+        catch (err) {
+            console.error(formatWarning({
+                message: `could not load the project's lexicons — build-root entities (terraform and kustomize roots) will be missing from the graph (${err instanceof Error ? err.message : String(err)})`,
+            }));
+            return [];
+        }
+    }
+    return collectBuildRootContributors(plugins, config, configPath ? dirname(configPath) : projectPath);
+}
+/**
+ * Merge build-root contributions into a discovered entity set: the exact
+ * merge `build()` performs (one implementation: `mergeBuildRootEntities`,
+ * ../../build.ts), with its warnings and errors printed. Returns false when a
+ * contributor failed or a name collided; the caller stops, because a graph
+ * missing the entities the build would refuse over must not be answered from
+ * as if complete.
+ */
+export async function mergeDeclaredBuildRoots(entities, contributors) {
+    if (contributors.length === 0)
+        return true;
+    const merged = await mergeBuildRootEntities(entities, contributors);
+    for (const w of merged.warnings)
+        console.error(formatWarning({ message: w }));
+    if (merged.errors.length > 0) {
+        for (const message of merged.errors)
+            console.error(formatError({ message }));
+        return false;
+    }
+    return true;
+}
+/**
+ * Add the edges the lexicons' `graphEdges` hooks resolve (#3910): CI
+ * dependencies written as strings (`needs`, `uses:`, `trigger:`, `include:`,
+ * `extends`), which the AttrRef walk in `buildGraphIr` cannot see. A hook that
+ * throws costs its own edges and a warning, not the graph.
+ */
+export function withLexiconEdges(ir, plugins, entities) {
+    const reports = [];
+    for (const p of plugins) {
+        if (!p.graphEdges)
+            continue;
+        try {
+            const report = p.graphEdges(entities);
+            if (report)
+                reports.push(report);
+        }
+        catch (err) {
+            console.error(formatWarning({ message: `the ${p.name} lexicon's graphEdges failed (${err instanceof Error ? err.message : String(err)}); its edges are left out` }));
+        }
+    }
+    return reports.length === 0 ? ir : applyLexiconGraphEdges(ir, reports);
+}

package/dist/cli/handlers/graph.d.ts

@@ -1,3 +1,4 @@
+import { type LintResult } from "../commands/lint.js";
 import type { CommandContext } from "../registry.js";
 /**
  * `chant graph` — the Op dependency graph by default; `--stacks` renders the
@@ -16,4 +17,28 @@ import type { CommandContext } from "../registry.js";
  * is the read the other gets.
  */
 export declare function runGraph(ctx: CommandContext): Promise<number>;
+/** One lint finding as `meta.lint` carries it (INTENTIUS/behold#919). */
+export interface GraphLintFinding {
+    ruleId: string;
+    severity: string;
+    message: string;
+    /** Relative to the project when inside it, else as lint reported it. */
+    file: string;
+    line: number;
+    column: number;
+    /** The entity a post-synth check named, which is the graph node's id. Absent for a source-file rule. */
+    entity?: string;
+}
+/**
+ * What a `graph.lint: "report"` project's entity graph carries on `meta.lint`:
+ * the counts `chant lint` would print and every finding behind them, warnings
+ * included. Present on every graph such a project emits, findings or none, so
+ * a reader can tell "linted, clean" from "not looked" (no key).
+ */
+export interface GraphLintReport {
+    errors: number;
+    warnings: number;
+    findings: GraphLintFinding[];
+}
+export declare function graphLintReport(lint: LintResult, projectPath: string): GraphLintReport;
 //# sourceMappingURL=graph.d.ts.map

package/dist/cli/handlers/graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/graph.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,aAAa,CAAC;AA+H9D;;;;;;;;;GASG;AACH;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D"}
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/graph.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAYhE,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,aAAa,CAAC;AAgE9D;;;;;;;;;GASG;AACH;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;AAoaD,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAQD,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,eAAe,CAoBtF"}