@intentius/chant 0.124.45 → 0.124.48

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAkB,KAAK,UAAU,EAAmB,MAAM,YAAY,CAAC;AAa9E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAgB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AA23CzC;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBzE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,UAAU,EAwNvC,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAkB,KAAK,UAAU,EAAmB,MAAM,YAAY,CAAC;AAa9E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAgB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AA27CzC;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBzE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,UAAU,EA+NvC,CAAC"}

package/dist/cli/main.js

@@ -157,14 +157,27 @@ Commands:
                         bundle tree, otherwise JSON path→content on stdout)
   search "<query>"      Answer an estate question with a few matching rows
                         instead of a graph dump (kind:, tag:, attr:, ->/<- edge
-                        terms; --live or --at <ref> with --env <name> reads the
-                        estate or a recorded snapshot; --show <attr>,
-                        --check-live, --check-snapshot, --fail-on-drift)
+                        terms, ->* / ->{1,3} for depth, ->[via=attr] / [to=attr]
+                        by attribute; --live or --snapshot <ref> (also --at
+                        <ref>) with --env <name> reads the estate or a
+                        recorded snapshot; --show <attr>,
+                        --count-by kind|module|attr:<name>, --explain prints
+                        paths, --json, --check-live,
+                        --check-snapshot, --fail-on-drift; cap:<name> and
+                        ->[cap=<name>] ask with a capability, and
+                        --capabilities prints the catalog)
   query "<sql>" [dir]   Run one read-only SQL statement over chant/lifecycle:
                         the resources and snapshots each lexicon observed, Op
                         runs, gates, deploys, releases and cuts, loaded into
                         node:sqlite (schema v1, listed in chant_schema).
-                        --member <name> keeps members; --json prints rows
+                        --member <name> keeps members; --json prints rows.
+                        For a read contract, use chant ledger
+  ledger <table> [dir]  One ledger's rows from chant/lifecycle as a read
+                        contract (resources, snapshots, runs, gates, deploys,
+                        releases, cuts; the columns chant query loads).
+                        --where <field><op><value> (= != < <= > >= ~,
+                        repeatable), --since <time|7d>, --at <rev> of
+                        chant/lifecycle, --member <name>, --json
   generate             Generate typed code from sources chant.config declares
                         (k8s.crds, helm.charts) into src/generated/<lexicon>/
                         (codegen.outDir); --check exits 1 when the committed
@@ -567,6 +580,9 @@ Ops:
                         --layout-engine graphviz to use dot instead;
                         --detail 0..3: stacks|composites|declarables|attributes;
                         --lens lexicon:<n>|stack:<n>|blast:<node> (--up/--down))
+                        --format ir --capability-view: add the lexicon-neutral
+                        view capability rules read, as this project's lexicons
+                        map it, to the IR as capabilityView (#4378)
                         --components --format ir --projection gitlab|github|forgejo:
                         add the CI/pipeline projection (stages/jobs/needs) to
                         the component-graph IR, from the same generator
@@ -604,7 +620,7 @@ Workspace (level 1, #2524):
                         restore, from the deploy records, releases and ci
                         revoked tags. Eight weeks back by default. Read only;
                         never fetches. --json prints the read-contract document
-  workspace records [--kind <kind file>] [--current] [--uncommitted | --at <rev>] [--base <rev>] [--require attested] [--json]
+  workspace records [--kind <kind file>] [--current] [--uncommitted | --at <rev>] [--base <rev>] [--require attested] [--where <field><op><value>]... [--json]
                         Without --kind, every record kind the declaration
                         names. Read the records a record kind locates, validated
                         against its schema, with reason codes for invalid
@@ -617,7 +633,9 @@ Workspace (level 1, #2524):
                         asset-drift or asset-missing. In the working tree,
                         each record says whether it is committed, modified
                         or new against HEAD, with the branch and base;
-                        --uncommitted lists only the modified and new ones
+                        --uncommitted lists only the modified and new ones;
+                        --where keeps the records a typed filter matches
+                        (id, path, state, valid, data.<key>, ...)
   workspace records [--kind <kind file>] --since <rev|session id> [--at <rev>] [--json]
                         What changed in the records between <rev> and --at
                         (default: the working tree): new and removed records,
@@ -687,14 +705,16 @@ Workspace (level 1, #2524):
                         a url or a path pinned by hash) is appended to the
                         item's pins through records amend. Prints the
                         work-evidence document and never commits
-  workspace runs [--unit <id>] [--decision <id>] [--by <principal>] [--since <rev>] [--follow-squash] [--json]
+  workspace runs [--unit <id>] [--decision <id>] [--by <principal>] [--since <rev>] [--where <field><op><value>]... [--follow-squash] [--json]
                         The agent runs in the run ledger on chant/lifecycle, each
                         with its model, tokens, cost and the commits it made,
                         and totals per work item, decision and principal; a run
                         that reports no cost is listed as unpriced, never zero.
                         Read-only, never fetches; --follow-squash joins each
                         squash merge to its pull request's runs, fetching a
-                        missing refs/pull/<n>/head from origin
+                        missing refs/pull/<n>/head from origin; --where keeps
+                        the runs a typed filter matches (state, model,
+                        startedAt, cost.amount, ...) before the totals
   workspace runs start --from <file|->
                         Record that an agent run started: who it worked for,
                         its harness, model, work item and lease. Prints the run
@@ -866,7 +886,7 @@ Workspace (level 1, #2524):
   workspace admit <return id> [--note <text>] [--dry-run] [--json]
                         Admit the signers of a return in .chant/trust.json, so
                         its signed work reads as attested once merged
-  workspace check [--at <rev>] [--json] [--format stylish|json|sarif] [--generated] [--kind <kind file>] [--live --env <env>]
+  workspace check [--at <rev>] [--json] [--format stylish|json|sarif] [--generated] [--kind <kind file>] [--live --env <env>] [--forge-repos <file>]
                         Fail on an unreadable lineage lock or an open manual
                         step, and, in a declared workspace, on a WSP check of
                         the declaration, member ledgers, pipelines or
@@ -878,7 +898,10 @@ Workspace (level 1, #2524):
                         resolves each declared member link against the live
                         graph of <env> (each chant member runs chant graph
                         --live, which reaches the account) and reports
-                        WSP141 and WSP142
+                        WSP141 and WSP142. --forge-repos reads a forge's
+                        repository list from a file and reports repos an
+                        org workspace lacks (WSP014) or names that the
+                        forge no longer has (WSP015)
   workspace check --changes <base>..<head> [--work <id>] [--severity off|warn|fail] [--kind <kind file>...] [--json]
                         Map each path the diff changes to the current records
                         whose constrains cover it: change-uncovered when none
@@ -906,9 +929,12 @@ Workspace (level 1, #2524):
                         its own chant, one process per toolchain. -o <dir>
                         writes <dir>/<member>.json; --member narrows the run;
                         --dry-run prints which chant runs which project
-  workspace lint [dir] [--format stylish|json|sarif] [--member <name>]
+  workspace lint [dir] [--format stylish|json|sarif] [--member <name>] [--cross-root]
                         Lint every chant member and example project with its
-                        own chant; sarif writes one run per member
+                        own chant; sarif writes one run per member.
+                        --cross-root adds the disagreement lint (LNK001 and
+                        the lexicons' cross-root checks) over every member's
+                        graph, where declared links and the graphs disagree
   workspace audit [dir] [--json] [--member <name>]
                         Audit each chant member with its own .chant-audit.json;
                         every finding carries a member field
@@ -921,6 +947,15 @@ Workspace (level 1, #2524):
                         source and toolchain are unchanged is served from
                         the cache in $CHANT_CACHE_DIR or ~/.cache/chant;
                         --no-cache reads every member
+                        --capability-view: each member's chant adds its
+                        capability view, mapped by its own lexicons
+  workspace search "<query>" [--member <name>] [--env <name>] [--snapshot <ref> | --live] [--at <rev>] [--explain] [--count-by ...] [--json]
+                        chant search in every chant member, each under its own
+                        chant, as one read-contract document: ids are
+                        <member>/<id> as workspace graph prints them, each
+                        member is searched alone, and a member that can't be
+                        searched has a reason code. --at <rev> is the git
+                        revision; --snapshot <ref> replays a recorded snapshot
   workspace graph --composites [--at <rev>] [--member <name>] [-o <file>]
                         Each composite instance the members declare, with the
                         components whose contract can deploy it; an instance
@@ -936,6 +971,29 @@ Workspace (level 1, #2524):
                         One decision's intent walk over every path: and member:
                         entry it constrains: the commits in its window, each
                         own, worked, within-other or unexplained, with counts
+  workspace run <member>/<op>... [--env <env>] [--gate <name>] [--on <lexicon>] [--dry-run] [--json]
+                        Run Ops that span members (#2554): each target's chant
+                        run <op> in the member's directory, under its own
+                        chant, producers before the members that link to them.
+                        OPS019 checks every target against the composed graph
+                        first. Member run records cite the workspace run,
+                        whose record goes under _members/_workspace/<env>/.
+                        Exits 3 when a step stops at a gate
+  workspace run --dependents-of <member> --op <op> [--env <env>] [--gate <name>] [--dry-run] [--json]
+                        Run <op> in every member that links to <member>,
+                        directly or not, nearest first; members without the
+                        Op are listed as skipped
+  workspace run approve <gate> [--plan <digest>] [--approver <principal>]
+                        Approve a workspace gate's pending fact. It stands in
+                        for a member gate only when it covers that member's
+                        plan and the member sets acceptWorkspaceGates at base
+  workspace train <env> [--pin <member>=<label|digest>]... [--dry-run] [--json]
+                        Record a release train: one cut release of every
+                        chant member (the newest, unless --pin picks one),
+                        under _members/_workspace/<env>/trains.jsonl. Refuses
+                        when a member has no release
+  workspace train list <env> [--json]
+                        The release trains recorded for <env>, oldest first
 
 Lifecycle (alias: lc):
   lifecycle snapshot <env>  Query API, save metadata to orphan branch
@@ -1009,7 +1067,9 @@ Component release ledger + status:
                             from the report pr-plan --no-status wrote
                             (--pr <n> --head <sha> --env <env> --forge
                             <kind>), in a job that runs none of the
-                            change's code (#4295)
+                            change's code (#4295); --open posts every
+                            open merge request's from a GitLab pipeline
+                            of the target branch (#4328)
   components pr-record     On merge (#4168): plan the same members again,
                             store the change set and write the merge record
                             _merges/<commit>.json; applies and refuses
@@ -1167,12 +1227,16 @@ Options:
                         JSON (lifecycle plan)
                         OR '--report markdown': emit a reviewer-facing markdown
                         render, holes and disruption included (lifecycle plan)
-  --from <name>         Source lexicon for migrate (default: github)
-  --to <name>           Target lexicon for migrate (default: gitlab)
-  --emit <fmt>          Migration output format: yaml (default) or ts
+  --from <name>         Source for migrate: a lexicon, or lexicon/dialect such
+                        as sql/postgres (default: github)
+  --to <name>           Target for migrate, same form, such as sql/clickhouse
+                        (default: gitlab)
+  --emit <fmt>          Migration output format: yaml (default), ts, or sql;
+                        sql/clickhouse defaults to ts
   --strict              Escalate needs-review/validation to errors (migrate);
                         exit nonzero on an unresolved identity (lifecycle whoami)
-  --validate            Run external validator (glci/glab) after migrate
+  --validate            Run external validator after migrate: glci/glab, or the
+                        ClickHouse emulator for sql/clickhouse
   --use-composites      Rewrite to composite calls when patterns match (migrate)
   --components          Target discovered Component declarations instead of
                         lexicon resources (list, describe, graph, build, run)
@@ -1463,6 +1527,7 @@ export const commandRegistry = [
     { name: "search", handler: runSearch },
     // #4297 — SQL over the snapshots, runs, gates, deploys and releases on chant/lifecycle. Imported on first use.
     { name: "query", runsNoConfig: true, handler: async (ctx) => (await import("./handlers/query.js")).runQueryCommand(ctx) },
+    { name: "ledger", runsNoConfig: true, handler: async (ctx) => (await import("./handlers/ledger.js")).runLedgerCommand(ctx) },
     // chant#2591 — `import --agents` and `audit` read chant.config statically
     // and never evaluate it (chant#2589 for audit, which audits code it must not run).
     { name: "import", handler: runImport, runsNoConfig: (args) => args.agents === true },
@@ -1588,6 +1653,12 @@ export const commandRegistry = [
     // chant#2618 — audit runs no project code, at the workspace level too.
     { name: "workspace audit", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/member-commands.js")).runWorkspaceMembers(ctx, "audit") },
     { name: "workspace graph", handler: async (ctx) => (await import("../workspace/member-commands.js")).runWorkspaceMembers(ctx, "graph") },
+    // #4374 — chant search in every member, under its own chant, composed with workspace graph's ids: the search document.
+    // #2554 — Ops that span members, as <member>/<op> targets, each run under its member's own chant.
+    { name: "workspace run", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/workspace-run.js")).runWorkspaceRun(ctx) },
+    // #2554 — a release train: one release of every chant member, pinned in the workspace ledger.
+    { name: "workspace train", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/release-train.js")).runWorkspaceTrain(ctx) },
+    { name: "workspace search", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/search-cli.js")).runWorkspaceSearch(ctx) },
     // Each unit decides for itself whether its config is loaded (runCommandInProcess).
     { name: "workspace member-run", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/member-run.js")).runWorkspaceMemberRun(ctx, runCommandInProcess) },
     // #3308 — a box's listing, written through chant so a tool never edits the declaration itself (ws-074).

package/dist/cli/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/cli/mcp/server.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAmE,MAAM,SAAS,CAAC;AAEvI,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAOrF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,YAAI,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AAG3H;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAK9E;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,aAAa,CAAA;CAAE,CASnH;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAO1E;AAED;;GAEG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAA0C;IACvD,OAAO,CAAC,YAAY,CAAuC;IAC3D,OAAO,CAAC,eAAe,CAA8F;IACrH,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,YAAY,CAAqB;IACzC,4GAA4G;IAC5G,OAAO,CAAC,UAAU,CAA4B;IAE9C;;;;;;;;;OASG;IACH,YAAY,OAAO,CAAC,EAAE,aAAa,EAAE,EAAE,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;KAAO,EAqChH;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAgB/B;;OAEG;IACH,OAAO,CAAC,YAAY;IAQpB;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG;QAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACnF,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAwBtE;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAW7B;;OAEG;YACW,QAAQ;IAmCtB;;OAEG;YACW,eAAe;IA2C7B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAqC3B;CACF;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAYpD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/cli/mcp/server.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAmE,MAAM,SAAS,CAAC;AAEvI,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAOrF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,YAAI,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AAG3H;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAK9E;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,aAAa,CAAA;CAAE,CASnH;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAO1E;AAED;;GAEG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAA0C;IACvD,OAAO,CAAC,YAAY,CAAuC;IAC3D,OAAO,CAAC,eAAe,CAA8F;IACrH,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,YAAY,CAAqB;IACzC,4GAA4G;IAC5G,OAAO,CAAC,UAAU,CAA4B;IAE9C;;;;;;;;;OASG;IACH,YAAY,OAAO,CAAC,EAAE,aAAa,EAAE,EAAE,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;KAAO,EAuChH;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAgB/B;;OAEG;IACH,OAAO,CAAC,YAAY;IAQpB;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG;QAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACnF,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAwBtE;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAW7B;;OAEG;YACW,QAAQ;IAmCtB;;OAEG;YACW,eAAe;IA2C7B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAqC3B;CACF;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAYpD"}

package/dist/cli/mcp/server.js

@@ -7,6 +7,7 @@ import { explainTool, handleExplain } from "./tools/explain.js";
 import { scaffoldTool, createScaffoldHandler } from "./tools/scaffold.js";
 import { searchTool, createSearchHandler } from "./tools/search.js";
 import { compositesTool, createCompositesHandler } from "./tools/composites.js";
+import { capabilitiesTool, createCapabilitiesHandler } from "./tools/capabilities.js";
 import { findWorkspaceRoot } from "../../project-root.js";
 import { createWorkspaceTools } from "./workspace-tools.js";
 import { createSnapshotTool, createDiffTool } from "./lifecycle-tools.js";
@@ -113,6 +114,8 @@ export class McpServer {
         this.registerTool(scaffoldTool, createScaffoldHandler(plugins ?? []));
         this.registerTool(searchTool, createSearchHandler(plugins ?? []));
         this.registerTool(compositesTool, createCompositesHandler(plugins ?? []));
+        // The capability catalog (#4375), the read contract's capabilities document.
+        this.registerTool(capabilitiesTool, createCapabilitiesHandler(options.workspace?.cwd ?? process.cwd(), options.workspace?.chantCommand));
         // Register state tools
         const snapshot = createSnapshotTool(plugins ?? []);
         this.registerTool(snapshot.definition, snapshot.handler);

package/dist/cli/mcp/tools/capabilities.d.ts

@@ -0,0 +1,7 @@
+import type { ToolDefinition, ToolHandler } from "../types.js";
+import { type ChantCommand } from "../workspace-tools.js";
+export declare const capabilitiesTool: ToolDefinition;
+/** The argv the tool runs in `cwd`: the workspace form inside a declared workspace. */
+export declare function capabilitiesArgv(cwd: string): string[];
+export declare function createCapabilitiesHandler(cwd: string, command?: ChantCommand): ToolHandler;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/cli/mcp/tools/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../../src/cli/mcp/tools/capabilities.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAA4B,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEjF,eAAO,MAAM,gBAAgB,EAAE,cAO9B,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEtD;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,YAAgC,GAAG,WAAW,CAE7G"}

package/dist/cli/mcp/tools/capabilities.js

@@ -0,0 +1,27 @@
+/**
+ * The `capabilities` tool of `chant serve mcp` (#4375): the capability
+ * catalog `chant search` answers `cap:` terms with, as the read contract's
+ * `capabilities` document (capabilities.schema.json).
+ *
+ * Like the workspace reads, it runs the command and returns the document it
+ * printed, unchanged: `chant workspace search --capabilities --json` inside a
+ * declared workspace, where the workspace's chant runs the rules, and `chant
+ * search --capabilities --json` anywhere else. It is served everywhere, since
+ * a plain project's agent asks the same questions.
+ */
+import { findWorkspaceRoot } from "../../../project-root.js";
+import { ownChantCommand, runRead } from "../workspace-tools.js";
+export const capabilitiesTool = {
+    name: "capabilities",
+    description: "The capability catalog for chant search (capabilities.schema.json, #4375): each capability's name, meaning, parameters, the search term that asks for it (cap:<name> for a set, ->[cap=<name>] for an edge), the questions it answers, whether each lexicon can supply it, what it does not evaluate, and its rule. " +
+        "Read it once per session, then ask estate questions with those terms, such as cap:internet-reachable(22) or cap:stores-data <-[cap=reaches]<role>. Not the resource-type catalog: that is the search tool. " +
+        "Returns the document chant search --capabilities --json prints (chant workspace search --capabilities --json inside a declared workspace), unchanged.",
+    inputSchema: { type: "object", properties: {} },
+};
+/** The argv the tool runs in `cwd`: the workspace form inside a declared workspace. */
+export function capabilitiesArgv(cwd) {
+    return findWorkspaceRoot(cwd) ? ["workspace", "search", "--capabilities", "--json"] : ["search", "--capabilities", "--json"];
+}
+export function createCapabilitiesHandler(cwd, command = ownChantCommand()) {
+    return async () => runRead(command, capabilitiesArgv(cwd), cwd);
+}

package/dist/cli/mcp/workspace-tools.d.ts

@@ -5,7 +5,7 @@
  * Served when the server starts at or inside a declared workspace. Each tool
  * is a thin call into the code the CLI runs:
  *
- * - The reads (`workspace-ls`, `workspace-status`, `workspace-graph`,
+ * - The reads (`workspace-ls`, `workspace-status`, `workspace-graph`, `workspace-search`,
  *   `workspace-changes`, `workspace-records`, `workspace-points`,
  *   `workspace-work-history`, `workspace-runs`) run `chant workspace <command>
  *   ... --json` with the chant this server runs as, in the server's
@@ -60,6 +60,8 @@ export declare const workspaceReadTools: ToolDefinition[];
 export declare const workspaceWriteTools: ToolDefinition[];
 /** The `chant` arguments each read tool runs, from its input. Exported for the conformance suite's MCP transport. */
 export declare function readArgv(tool: string, params: Record<string, unknown>): string[];
+/** Run chant and parse the one JSON document it printed. The exit code does not matter: an error document is a document. */
+export declare function runRead(command: ChantCommand, argv: string[], cwd: string): Promise<unknown>;
 export interface WorkspaceTool {
     definition: ToolDefinition;
     handler: ToolHandler;

package/dist/cli/mcp/workspace-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-tools.d.ts","sourceRoot":"","sources":["../../../src/cli/mcp/workspace-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,KAAK,EAAe,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAKxE,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;AAEpC;;;GAGG;AACH,wBAAgB,eAAe,IAAI,YAAY,CAE9C;AAED,MAAM,WAAW,qBAAqB;IACpC,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAmBD,eAAO,MAAM,kBAAkB,EAAE,cAAc,EAkI9C,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,cAAc,EA+H/C,CAAC;AAsCF,qHAAqH;AACrH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAyEhF;AA6CD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,aAAa,EAAE,CA+GpF"}
+{"version":3,"file":"workspace-tools.d.ts","sourceRoot":"","sources":["../../../src/cli/mcp/workspace-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,KAAK,EAAe,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAKxE,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;AAEpC;;;GAGG;AACH,wBAAgB,eAAe,IAAI,YAAY,CAE9C;AAED,MAAM,WAAW,qBAAqB;IACpC,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAmBD,eAAO,MAAM,kBAAkB,EAAE,cAAc,EAuJ9C,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,cAAc,EA+H/C,CAAC;AAsCF,qHAAqH;AACrH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAiGhF;AAED,4HAA4H;AAC5H,wBAAgB,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB5F;AAyBD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,aAAa,EAAE,CA+GpF"}

package/dist/cli/mcp/workspace-tools.js

@@ -5,7 +5,7 @@
  * Served when the server starts at or inside a declared workspace. Each tool
  * is a thin call into the code the CLI runs:
  *
- * - The reads (`workspace-ls`, `workspace-status`, `workspace-graph`,
+ * - The reads (`workspace-ls`, `workspace-status`, `workspace-graph`, `workspace-search`,
  *   `workspace-changes`, `workspace-records`, `workspace-points`,
  *   `workspace-work-history`, `workspace-runs`) run `chant workspace <command>
  *   ... --json` with the chant this server runs as, in the server's
@@ -98,6 +98,26 @@ export const workspaceReadTools = [
             },
         },
     },
+    {
+        name: "workspace-search",
+        description: "Answer an estate question over every chant member of the workspace with a few rows instead of the whole graph: chant workspace search <query> --json (search.schema.json, #4374). Returns that document unchanged. Each member is searched under its own chant and alone, ids are <member>/<id> as workspace-graph names the same nodes, and a member that can't be searched is listed with a reason code, never as zero matches. " +
+            "The query is space-separated terms that must all match: a bare word (substring of id, kind or attributes), kind:<substr> (a Terraform resource matches its type, kind:aws_instance), attr:<name>=<value>, tag:<key>=<value>, and edge terms ->X (this node references a node matching X) and <-X (referenced by one); ->*X is any depth, ->{2}X or ->{1,3}X a number of hops, ->[via=attr]X and ->[to=attr]X pick the edge by attribute, and !term negates. " +
+            "at is the git revision of the source; snapshot (with env) answers from a recorded lifecycle snapshot such as latest. They are two different times, and at refuses a snapshot ref.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                query: { type: "string", description: "The search terms. May start with -> or <-." },
+                member: { type: "array", items: { type: "string" }, description: "Only these members (--member)." },
+                env: { type: "string", description: "The environment a snapshot was recorded for (--env)." },
+                snapshot: { type: "string", description: "Answer from this recorded lifecycle snapshot, such as latest (--snapshot). Needs env." },
+                countBy: { type: "string", description: "Group the matches: kind, module or attr:<name> (--count-by). The query may then be empty." },
+                show: { type: "string", description: "Comma-separated attributes to carry on each row (--show)." },
+                explain: { type: "boolean", description: "Add each member's universe and near misses (--explain)." },
+                at: atProp,
+            },
+            required: ["query"],
+        },
+    },
     {
         name: "workspace-changes",
         description: "The forward coverage check over a diff: chant workspace check --changes <range> --json (changes.schema.json, #2773). Each changed path with the current records whose constrains cover it, and a change-uncovered or change-out-of-scope finding for each gap, at the severity the declaration's changes block sets. links says whether each trunk commit of the range names its work item, with commit-unlinked and commit-wrongly-linked findings at the same severity. Returns the document unchanged.",
@@ -384,6 +404,31 @@ export function readArgv(tool, params) {
                 "--json",
             ];
         }
+        case "workspace-search": {
+            // The query is one argument after `--`, so one that opens with -> stays a query.
+            const query = params.query;
+            if (typeof query !== "string")
+                throw new ToolInputError("query must be a string");
+            const members = params.member === undefined || params.member === null ? [] : Array.isArray(params.member) ? params.member : [params.member];
+            const memberArgs = members.flatMap((m, i) => ["--member", str({ [`member[${i}]`]: m }, `member[${i}]`, true)]);
+            const flags = ["env", "snapshot", "show"].flatMap((f) => {
+                const v = str(params, f);
+                return v !== undefined ? [`--${f}`, v] : [];
+            });
+            const countBy = str(params, "countBy");
+            return [
+                "workspace",
+                "search",
+                ...memberArgs,
+                ...flags,
+                ...(countBy !== undefined ? ["--count-by", countBy] : []),
+                ...(bool(params, "explain") ? ["--explain"] : []),
+                ...atArgs,
+                "--json",
+                "--",
+                query,
+            ];
+        }
         case "workspace-agent": {
             const name = str(params, "name", true);
             return ["workspace", "agent", name, "--json"];
@@ -425,7 +470,7 @@ export function readArgv(tool, params) {
     }
 }
 /** Run chant and parse the one JSON document it printed. The exit code does not matter: an error document is a document. */
-function runRead(command, argv, cwd) {
+export function runRead(command, argv, cwd) {
     return new Promise((settle, fail) => {
         const child = spawn(command[0], [...command.slice(1), ...argv], { cwd, env: { ...process.env, NO_COLOR: "1" }, stdio: ["ignore", "pipe", "pipe"] });
         let stdout = "";

package/dist/cli/parse-args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-args.d.ts","sourceRoot":"","sources":["../../src/cli/parse-args.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA4F7C;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAu4BpD"}
+{"version":3,"file":"parse-args.d.ts","sourceRoot":"","sources":["../../src/cli/parse-args.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA6F7C;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAs8BpD"}

package/dist/cli/parse-args.js

@@ -45,6 +45,7 @@ const BOOLEAN_FLAGS = new Set([
     "--up",
     "--down",
     "--include-dependents",
+    "--cross-root",
     "--local",
     "--json",
     "--progress-json",
@@ -148,11 +149,39 @@ export function parseArgs(args) {
     // whose own value legitimately contains `=` (`--param=tier=production`
     // splits to flag `--param`, value `tier=production`, not further split on
     // the second `=`).
-    args = splitJoinedFlags(args, BOOLEAN_FLAGS);
+    //
+    // Tokens after a bare `--` are positionals (#4369), so they are not split.
+    const end = args.indexOf("--");
+    args = end < 0 ? splitJoinedFlags(args, BOOLEAN_FLAGS) : [...splitJoinedFlags(args.slice(0, end), BOOLEAN_FLAGS), ...args.slice(end)];
+    // chant #4369 — every token after a bare `--` is a positional, whatever it
+    // starts with: `chant search -- "-kind:X"` is the spelling that always works.
+    let onlyPositionals = false;
+    const positional = (arg) => {
+        if (result.command)
+            (result.positionals ?? (result.positionals = [])).push(arg);
+        if (!result.command) {
+            result.command = arg;
+        }
+        else if (result.path === ".") {
+            result.path = arg;
+        }
+        else if (!result.extraPositional) {
+            result.extraPositional = arg;
+        }
+        else {
+            result.extraPositional2 = arg;
+        }
+    };
     let i = 0;
     while (i < args.length) {
         const arg = args[i];
-        if (arg === "--help" || arg === "-h") {
+        if (onlyPositionals) {
+            positional(arg);
+        }
+        else if (arg === "--") {
+            onlyPositionals = true;
+        }
+        else if (arg === "--help" || arg === "-h") {
             result.help = true;
         }
         else if (arg === "--version" || arg === "-V") {
@@ -414,6 +443,12 @@ export function parseArgs(args) {
         else if (arg === "--show") {
             result.show = args[++i];
         }
+        else if (arg === "--count-by") {
+            // `chant search --count-by kind|module|attr:<name>` (#4360)
+            result.countBy = args[++i];
+            if (!result.countBy || result.countBy.startsWith("-"))
+                throw new Error("--count-by needs a grouping: --count-by kind, --count-by module or --count-by attr:<name>");
+        }
         else if (arg === "--up") {
             result.up = true;
         }
@@ -435,6 +470,24 @@ export function parseArgs(args) {
         else if (arg === "--include-dependents") {
             result.includeDependents = true;
         }
+        else if (arg === "--cross-root") {
+            // `chant workspace lint --cross-root` (#2549): the disagreement lint over every member's graph.
+            result.crossRoot = true;
+        }
+        else if (arg === "--dependents-of") {
+            // `chant workspace run --dependents-of <member> --op <op>` (#2554).
+            const value = args[++i];
+            if (!value || value.startsWith("-"))
+                throw new Error("--dependents-of needs a member name: --dependents-of <member>");
+            result.dependentsOf = value;
+        }
+        else if (arg === "--pin") {
+            // `chant workspace train <env> --pin <member>=<label|digest>` (#2554), repeatable.
+            const value = args[++i];
+            if (!value || value.startsWith("-") || !value.includes("="))
+                throw new Error("--pin needs a member and a release: --pin <member>=<label|digest>");
+            (result.pins ?? (result.pins = [])).push(value);
+        }
         else if (arg === "--from-affected") {
             result.fromAffected = args[++i];
         }
@@ -655,6 +708,20 @@ export function parseArgs(args) {
         else if (arg === "--at") {
             result.at = args[++i];
         }
+        else if (arg === "--capability-view") {
+            // `chant graph --format ir --capability-view` and `chant workspace graph --capability-view` (#4378)
+            result.capabilityView = true;
+        }
+        else if (arg === "--capabilities") {
+            // `chant search --capabilities` and `chant workspace search --capabilities` (#4375)
+            result.capabilities = true;
+        }
+        else if (arg === "--snapshot") {
+            // `chant search` and `chant workspace search --snapshot <ref>` (#4374)
+            result.snapshot = args[++i];
+            if (!result.snapshot || result.snapshot.startsWith("-"))
+                throw new Error("--snapshot needs a snapshot ref: --snapshot latest");
+        }
         else if (arg === "--kind") {
             // `chant workspace records|graph|check --kind <kind file>` (#2546, #2549)
             result.kind = args[++i];
@@ -1203,8 +1270,8 @@ export function parseArgs(args) {
             result.expire = true;
         }
         else if (arg === "--role") {
-            // #2508 — a role the approver claims, which a gate's policy sees. A
-            // quorum reads roles from .chant/trust.json at base instead (#4290).
+            // #2508 — a role the approver claims, recorded on the approval. A quorum
+            // (#4290) and a gate policy (#4324) read roles from .chant/trust.json at base.
             // Repeatable, and a comma list works too.
             const value = args[++i] ?? "";
             result.roles = [...(result.roles ?? []), ...value.split(",").map((r) => r.trim()).filter(Boolean)];
@@ -1255,6 +1322,14 @@ export function parseArgs(args) {
             // run on the root project alone instead of refusing with WSP000.
             result.rootOnly = true;
         }
+        else if (arg === "--forge-repos") {
+            // #3168 — `chant workspace check --forge-repos <file>`: the forge's
+            // repository list, as a warden reads it, for an org workspace's checks.
+            const value = args[++i];
+            if (!value || value.startsWith("-"))
+                throw new Error("--forge-repos needs a file: --forge-repos <repos.json>");
+            result.forgeRepos = value;
+        }
         else if (arg === "--generated") {
             // #2641 — `chant workspace check --generated` runs each declared
             // generator and compares its output with the file in the tree.
@@ -1282,6 +1357,13 @@ export function parseArgs(args) {
         else if (arg === "--op") {
             result.op = args[++i];
         }
+        else if (arg === "--where") {
+            // #4363 — a typed filter on a contract read; repeatable, every clause has to hold.
+            const value = args[++i];
+            if (value === undefined || value.startsWith("--"))
+                throw new Error("--where needs a clause: --where <field><op><value>");
+            result.where = [...(result.where ?? []), value];
+        }
         else if (arg === "--since") {
             result.since = args[++i];
         }
@@ -1303,21 +1385,20 @@ export function parseArgs(args) {
             // flags" isn't something this loop can name in isolation.
             throw new Error(`Unknown flag: ${arg}\nRun "chant --help" to see supported flags.`);
         }
-        else if (!arg.startsWith("-")) {
-            if (result.command)
-                (result.positionals ?? (result.positionals = [])).push(arg);
-            if (!result.command) {
-                result.command = arg;
-            }
-            else if (result.path === ".") {
-                result.path = arg;
-            }
-            else if (!result.extraPositional) {
-                result.extraPositional = arg;
-            }
-            else {
-                result.extraPositional2 = arg;
-            }
+        else if (/^-[A-Za-z]/.test(arg)) {
+            // chant #4369 — an unrecognised short flag (`-x`) is refused like an
+            // unrecognised `--flag` (#1127). It used to be dropped without a word,
+            // the same silent misparse #1127 closed for long flags. A lexicon's own
+            // mounted command still gets its short flags: `main` tries the plugin
+            // commands before rethrowing a parse error.
+            throw new Error(`Unknown flag: ${arg}\nRun "chant --help" to see supported flags.`);
+        }
+        else {
+            // Anything else is a positional, including a token that starts with `-`
+            // but is not flag-shaped (#4369): `->kind:Bucket` is a search query that
+            // opens with an outgoing edge term, and dropping it made `chant search`
+            // answer for "." instead. A bare `-` is a positional too.
+            positional(arg);
         }
         i++;
     }