@intentius/chant 0.124.45 → 0.124.48

package/src/__golden__/wave-loop/op-wide-refused.json

@@ -190,6 +190,32 @@
     "wave 1 (apps) is refused by its policy; nothing applied."
   ],
   "files": {
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1-share-2.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t3": {
+          "status": "refused"
+        }
+      }
+    },
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "refused"
+        },
+        "t2": {
+          "status": "refused"
+        },
+        "t3": {
+          "status": "refused"
+        }
+      }
+    },
     ".chant/op-waves/tf-apply/wave-1/plans.json": {
       "runs": [
         {

package/src/__golden__/wave-loop/op-wide-waiting.json

@@ -178,6 +178,35 @@
     "wave 3 (prod) is waiting on migrations-wave-3; nothing applied. chant approve migrations migrations-wave-3 --plan jcs1-sha256:106d25f35ee6bc02e9aa253d0b2633a764396833c82e0c5ec5a4ad83a2a85b4e"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-1.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "waiting"
+        },
+        "t2": {
+          "status": "waiting"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "waiting"
+        },
+        "t2": {
+          "status": "waiting"
+        },
+        "t3": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-3/t1.plan.json": {
       "planDigest": "sha256:1111111111111111111111111111111111111111111111111111111111111111"
     },

package/src/__golden__/wave-loop/op-wide.json

@@ -351,6 +351,45 @@
     "t2: its plan moved since wave 3 was decided, so it was not applied. decided: sha256:2222222222222222222222222222222222222222222222222222222222222222; planned now: sha256:9999999999999999999999999999999999999999999999999999999999999999"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-1.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "applied"
+        },
+        "t2": {
+          "status": "not-applied"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-2.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t3": {
+          "status": "applied"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "decided"
+        },
+        "t2": {
+          "status": "decided"
+        },
+        "t3": {
+          "status": "decided"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-3/t1.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/src/__snapshots__/okf.test.ts.snap

@@ -16,6 +16,10 @@ composite_instance: app
 ---
 Declared in \`main.ts\`.
 
+## Depends on
+
+- [environment](/aws/environment.md)
+
 ## Referenced by
 
 - [appBucketPolicy](/aws/appBucketPolicy.md)
@@ -60,6 +64,7 @@ Declared in \`main.ts\`.
 
 - [appBucket](/aws/appBucket.md)
 - [appRole](/aws/appRole.md)
+- [environment](/aws/environment.md)
 ",
     "path": "aws/appFunc.md",
   },
@@ -112,6 +117,11 @@ kind: resource
 source: params.ts
 ---
 Declared in \`params.ts\`.
+
+## Referenced by
+
+- [appBucket](/aws/appBucket.md)
+- [appFunc](/aws/appFunc.md)
 ",
     "path": "aws/environment.md",
   },

package/src/action-pins.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, it } from "vitest";
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { ACTION_PINS, pinAtMajor, pinMajor, tagComments, unpinnedActions, usesRef } from "./action-pins";
+
+describe("the action pin table", () => {
+  it("holds a full commit SHA and a release of the row's major for every action", () => {
+    for (const [key, p] of Object.entries(ACTION_PINS)) {
+      expect({ key, sha: /^[0-9a-f]{40}$/.test(p.sha) }).toEqual({ key, sha: true });
+      expect({ key, tag: p.tag.startsWith(`${p.major}.`) }).toEqual({ key, tag: true });
+    }
+  });
+
+  it("finds a tag, a branch or a short SHA, and passes a full SHA, a local action and a docker image", () => {
+    const yaml = [
+      "      - uses: actions/checkout@v4",
+      "        uses: https://code.forgejo.org/actions/cache@main",
+      "      - uses: 'actions/setup-node@8207627'",
+      `      - uses: actions/checkout@${"a".repeat(40)} # v4.4.0`,
+      "      - uses: ./.github/actions/local",
+      "      - uses: docker://alpine:3.20",
+    ].join("\n");
+    expect(unpinnedActions(yaml)).toEqual(["actions/checkout@v4", "https://code.forgejo.org/actions/cache@main", "actions/setup-node@8207627"]);
+  });
+
+  it("writes the release beside a pinned line once, and leaves an unknown SHA alone", () => {
+    const line = `      - uses: ${usesRef(ACTION_PINS.checkout6)}`;
+    const once = tagComments(line);
+    expect(once).toBe(`${line} # ${ACTION_PINS.checkout6.tag}`);
+    expect(tagComments(once)).toBe(once);
+    expect(tagComments(`  uses: actions/checkout@${"f".repeat(40)}`)).toBe(`  uses: actions/checkout@${"f".repeat(40)}`);
+  });
+
+  it("moves a pinned upload-artifact to another major of the same action", () => {
+    expect(pinAtMajor(ACTION_PINS.uploadArtifact4.sha, "v3")).toBe(ACTION_PINS.uploadArtifact3);
+    expect(pinAtMajor(ACTION_PINS.uploadArtifact4.sha, "v9")).toBeUndefined();
+    expect(pinAtMajor("0".repeat(40), "v3")).toBeUndefined();
+    expect(pinMajor(ACTION_PINS.downloadArtifact4.sha)).toBe(4);
+  });
+});
+
+// #4410: the places that are not generators pin too.
+const repoRoot = join(__dirname, "../../..");
+
+describe("hand-written actions are pinned (#4410)", () => {
+  it("chant's own workflows name every action by a full commit SHA", () => {
+    const dir = join(repoRoot, ".github/workflows");
+    const unpinned: Record<string, string[]> = {};
+    for (const f of readdirSync(dir).filter((n) => n.endsWith(".yml"))) {
+      const found = unpinnedActions(readFileSync(join(dir, f), "utf8"));
+      if (found.length) unpinned[f] = found;
+    }
+    expect(unpinned).toEqual({});
+  });
+
+  it("every pinned line in chant's own workflows carries a release comment", () => {
+    const dir = join(repoRoot, ".github/workflows");
+    const bare: string[] = [];
+    for (const f of readdirSync(dir).filter((n) => n.endsWith(".yml"))) {
+      for (const line of readFileSync(join(dir, f), "utf8").split("\n")) {
+        if (/uses: *[^\s#]+@[0-9a-f]{40}\s*$/.test(line)) bare.push(`${f}: ${line.trim()}`);
+      }
+    }
+    expect(bare).toEqual([]);
+  });
+
+  it("no github composite writes a `uses:` tag literal; each takes its ref from the pin table", () => {
+    const dir = join(repoRoot, "lexicons/github/src/composites");
+    const literal: Record<string, string[]> = {};
+    for (const f of readdirSync(dir).filter((n) => n.endsWith(".ts") && !n.endsWith(".test.ts"))) {
+      const found = [...readFileSync(join(dir, f), "utf8").matchAll(/(?:uses|setupAction):\s*["'`]([^"'`]+)["'`]/g)]
+        .map((m) => m[1])
+        .filter((r) => unpinnedActions(`uses: ${r}`).length > 0);
+      if (found.length) literal[f] = found;
+    }
+    expect(literal).toEqual({});
+  });
+});

package/src/action-pins.ts

@@ -0,0 +1,92 @@
+/**
+ * The GitHub Actions the workflows chant generates use, each pinned by commit
+ * SHA (#4403). A tag can move; a SHA cannot. Every generator takes its `uses:`
+ * from here, so an update is one change to this table. Each row is the commit
+ * the named major tag pointed at, with the release that commit carries;
+ * `tagComments` writes that release beside each `uses:` line.
+ *
+ * Forgejo's actions mirror (code.forgejo.org) carries the same commits. The
+ * forgejo lexicon moves `upload-artifact` and `download-artifact` to v3, whose
+ * rows are here too: v4 and later refuse to run on a Forgejo runner (#4008).
+ *
+ * Refresh a row by resolving the major tag to its commit:
+ *
+ *   gh api repos/actions/checkout/commits/v6 --jq .sha
+ */
+
+export interface ActionPin {
+  /** The action, with its subpath: `actions/cache/restore`. */
+  readonly slug: string;
+  /** The major tag the row follows, such as `v4`. */
+  readonly major: string;
+  readonly sha: string;
+  /** The release at that commit, written beside the `uses:` line. */
+  readonly tag: string;
+}
+
+const pin = (slug: string, major: string, sha: string, tag: string): ActionPin => ({ slug, major, sha, tag });
+
+export const ACTION_PINS = {
+  checkout7: pin("actions/checkout", "v7", "3d3c42e5aac5ba805825da76410c181273ba90b1", "v7.0.1"),
+  checkout6: pin("actions/checkout", "v6", "d23441a48e516b6c34aea4fa41551a30e30af803", "v6.1.0"),
+  checkout4: pin("actions/checkout", "v4", "11d5960a326750d5838078e36cf38b85af677262", "v4.4.0"),
+  setupNode6: pin("actions/setup-node", "v6", "249970729cb0ef3589644e2896645e5dc5ba9c38", "v6.5.0"),
+  setupNode4: pin("actions/setup-node", "v4", "49933ea5288caeca8642d1e84afbd3f7d6820020", "v4.4.0"),
+  setupNode7: pin("actions/setup-node", "v7", "949feb2413d6458794dcd2491c4babbbce0c15c1", "v7.1.0"),
+  cache6: pin("actions/cache", "v6", "55cc8345863c7cc4c66a329aec7e433d2d1c52a9", "v6.1.0"),
+  uploadArtifact7: pin("actions/upload-artifact", "v7", "cf430e030ddbb5b0abf93d22962f4752f3646cd9", "v7.0.2"),
+  downloadArtifact8: pin("actions/download-artifact", "v8", "9000827ccba6bdab643e8b6fd33ac0654aef8333", "v8.0.2"),
+  setupGo7: pin("actions/setup-go", "v7", "b7ad1dad31e06c5925ef5d2fc7ad053ef454303e", "v7.0.0"),
+  setupPython7: pin("actions/setup-python", "v7", "6d4fd22b20465ccc0f7354476588e8df7c9ca0e0", "v7.1.0"),
+  setupBun2: pin("oven-sh/setup-bun", "v2", "0c5077e51419868618aeaa5fe8019c62421857d6", "v2.2.0"),
+  golangciLint9: pin("golangci/golangci-lint-action", "v9", "ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a", "v9.3.0"),
+  dockerLogin4: pin("docker/login-action", "v4", "81c6f93d4bc991e510b342a00b419b3bb4efc5c6", "v4.7.0"),
+  dockerSetupBuildx4: pin("docker/setup-buildx-action", "v4", "f87e5991a6d7451dcb8d9637bfbc97413f497069", "v4.4.1"),
+  dockerMetadata6: pin("docker/metadata-action", "v6", "dc802804100637a589fabce1cb79ff13a1411302", "v6.2.0"),
+  dockerBuildPush7: pin("docker/build-push-action", "v7", "c3c9e263c25d99ce0380d002d59b67737d91b0dc", "v7.4.0"),
+  createGithubAppToken2: pin("actions/create-github-app-token", "v2", "fee1f7d63c2ff003460e3d139729b119787bc349", "v2.2.2"),
+  cacheRestore4: pin("actions/cache/restore", "v4", "0057852bfaa89a56745cba8c7296529d2fc39830", "v4.3.0"),
+  cacheSave4: pin("actions/cache/save", "v4", "0057852bfaa89a56745cba8c7296529d2fc39830", "v4.3.0"),
+  uploadArtifact4: pin("actions/upload-artifact", "v4", "ea165f8d65b6e75b540449e92b4886f43607fa02", "v4.6.2"),
+  uploadArtifact3: pin("actions/upload-artifact", "v3", "ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5", "v3.2.1"),
+  downloadArtifact4: pin("actions/download-artifact", "v4", "d3f86a106a0bac45b974a628896c90dbdf5c8093", "v4.3.0"),
+  downloadArtifact3: pin("actions/download-artifact", "v3", "9bc31d5ccc31df68ecc42ccf4149144866c47d8a", "v3.0.2"),
+} as const satisfies Record<string, ActionPin>;
+
+/** The `uses:` value for a pin: `actions/checkout@<sha>`. */
+export const usesRef = (p: ActionPin): string => `${p.slug}@${p.sha}`;
+
+const TAG_BY_SHA = new Map<string, string>();
+for (const p of Object.values(ACTION_PINS) as ActionPin[]) TAG_BY_SHA.set(p.sha, p.tag);
+
+/** Write each pinned `uses:` line's release beside it, as `# v4.4.0`. A line that has a comment, or a SHA not in the table, is left alone. */
+export function tagComments(yaml: string): string {
+  return yaml.replace(/^(\s*(?:- )?uses: *["']?[^\s"'#]+@([0-9a-f]{40})["']?)[ \t]*$/gm, (line, head: string, sha: string) => {
+    const tag = TAG_BY_SHA.get(sha);
+    return tag ? `${head} # ${tag}` : line;
+  });
+}
+
+/** Every `uses:` in a workflow that names an action by a tag or branch, not a 40-character commit SHA. Local actions and docker images are not actions on a forge. */
+export function unpinnedActions(yaml: string): string[] {
+  const out: string[] = [];
+  for (const m of yaml.matchAll(/^\s*(?:- )?uses: *["']?([^\s"'#]+)["']?/gm)) {
+    const ref = m[1];
+    if (ref.startsWith("./") || ref.startsWith("../") || ref.startsWith("docker://")) continue;
+    if (!/@[0-9a-f]{40}$/.test(ref)) out.push(ref);
+  }
+  return out;
+}
+
+/** The row for the same action as the one `sha` pins, at `major`. The forgejo lexicon uses it to move a pinned `upload-artifact` v4 to v3. */
+export function pinAtMajor(sha: string, major: string): ActionPin | undefined {
+  const rows = Object.values(ACTION_PINS) as ActionPin[];
+  const from = rows.find((p) => p.sha === sha);
+  return from ? rows.find((p) => p.slug === from.slug && p.major === major) : undefined;
+}
+
+/** The major of the row `sha` belongs to, as a number, when it is in the table. */
+export function pinMajor(sha: string): number | undefined {
+  const row = (Object.values(ACTION_PINS) as ActionPin[]).find((p) => p.sha === sha);
+  return row ? Number(row.major.slice(1)) : undefined;
+}

package/src/capabilities/aws.paths

@@ -0,0 +1,148 @@
+# Capabilities over AWS resources (#4375, ruled on #4361).
+#
+# Rules read the lexicon-neutral view, not the IR. Labels (Instance, Role,
+# SecurityGroup) and edge names (subnet, sg, statement) come from each
+# lexicon's mapping, so this one file serves CloudFormation (the aws lexicon)
+# and Terraform's AWS provider (the terraform lexicon) alike.
+#
+# name(x) is a node set, tested with [@name]. name(a, b) is an edge, followed
+# with ->name. Parameters follow `;`. The language is in language.ts.
+#
+# `## key: value` lines describe the capability that follows them, for the
+# `capabilities` document: meaning, answers (one per line), depth, search,
+# not-evaluated, and a line per parameter (param-<name>). A rule with no
+# `## meaning` is a helper: other rules use it, the catalog doesn't list it.
+
+# ------------------------------------------------------------------ helpers
+
+in-sg(x, g)          := x ->{0,1}template ->sg g:SecurityGroup
+ingress-of(x, r)     := x ->in-sg ->ingress r:IngressRule
+world-open(r)        := r:IngressRule[cidrs in ("0.0.0.0/0", "::/0")]
+allows(r, x; action?) := r:Role <-{0,1}attachedTo ->statement :Statement[doc = "permission", effect = "Allow", actions ~ $action] ->resource x
+                      | r:Role <-principal :Statement[doc = "resource", effect = "Allow", actions ~ $action] ->resource x
+denies(r, x; action?) := r:Role <-{0,1}attachedTo ->statement :Statement[doc = "permission", effect = "Deny", actions ~ $action] ->resource x
+                      | r:Role <-principal :Statement[doc = "resource", effect = "Deny", actions ~ $action] ->resource x
+pivot(a, b)          := a ->(runs-as|can-assume|network) b
+
+# ------------------------------------------------------------------ network
+
+## meaning: its subnet routes 0.0.0.0/0 to an internet gateway
+## answers: which instances are in a public subnet
+## answers: what sits in a subnet that routes to the internet
+## depth: either
+## not-evaluated: a subnet on its VPC's main route table (no explicit association) is not followed
+internet-facing(c)   := c:Instance ->subnet :Subnet <-subnet :RouteTableAssociation ->table :RouteTable <-table :Route[dest in ("0.0.0.0/0", "::/0", null)] ->gateway :InternetGateway
+                      | c:Instance[internetFacing = true]
+
+## meaning: a security group reaching it, directly or through a launch template, admits 0.0.0.0/0 or ::/0
+## param-port: a port the open rule must cover, such as 22
+## param-proto: a protocol the open rule must allow, such as tcp; a rule for every protocol (-1) always does
+## answers: what admits SSH from anywhere
+## answers: which instances have a security group open to the world
+## depth: declared
+## not-evaluated: network ACLs; prefix lists
+open-ingress(c; port?, proto?) := c:Instance|Database|Function|Service ->ingress-of r:IngressRule[@world-open, from <= $port, to >= $port, proto in ($proto, "-1")]
+
+## meaning: internet-facing and open-ingress, or a Lambda function URL with no auth. Load balancers and API gateways come later
+## param-port: a port the open rule must cover, such as 22
+## answers: what in prod can be reached on SSH from the internet
+## answers: which instances are SSH-reachable from the internet
+## depth: either
+## not-evaluated: load balancers; API gateways; network ACLs
+internet-reachable(c; port?) := c[@internet-facing, @open-ingress($port)]
+                      | c:Function <-function :FunctionUrl[authType = "NONE"]
+
+## meaning: no member, attachment or route references it
+## answers: which security groups are unused
+## answers: which subnets have no instances or network interfaces
+## answers: which policies are attached to nothing
+## depth: either
+attached-to-nothing(x) := x:SecurityGroup !<-sg
+                      | x:Subnet !<-subnet
+                      | x:Policy !->attachedTo
+                      | x:InternetGateway !<-gateway
+
+## meaning: in the account's default VPC
+## answers: which instances run in the default VPC
+## answers: which instances are not in the default VPC (negate it: !cap:in-default-vpc)
+## depth: either
+in-default-vpc(x)    := x ->{1,2}(subnet|vpc) :Vpc[isDefault = true]
+
+## meaning: host to host through security-group-to-group ingress
+## answers: what can this instance reach on the network
+## depth: declared
+## not-evaluated: CIDR-to-CIDR reachability inside the VPC; network ACLs
+network(a, y)        := a:Instance|Database|Function|Service ->in-sg <-source :IngressRule <-ingress :SecurityGroup <-in-sg y:Instance|Database|Function|Service
+
+# ------------------------------------------------------------------ data
+
+## meaning: a bucket, table, database, queue, file system or secret
+## answers: where is our data
+## depth: declared
+stores-data(x)       := x:Bucket|Table|Database|Queue|FileSystem|Secret|Parameter
+
+## meaning: a secret, an SSM SecureString, or a data store tagged as restricted (the tag keys are the lexicon mapping's classificationTags)
+## answers: which stores hold secrets or restricted data
+## depth: declared
+holds-secret(x)      := x:Secret
+                      | x:Parameter[paramType = "SecureString"]
+                      | x:Bucket|Table|Database|Queue|FileSystem[classification in ("restricted", "secret", "confidential")]
+
+## meaning: encrypted at rest: a database, file system or volume whose encryption attribute is set; S3 buckets, DynamoDB tables, SQS queues and secrets always are
+## answers: which data stores are not encrypted at rest (negate it: !cap:encrypted-at-rest)
+## depth: declared
+## not-evaluated: account-level EBS encryption by default; which key (AWS-owned, AWS-managed or customer-managed)
+encrypted-at-rest(x) := x:Database|FileSystem|Volume[encrypted = true]
+                      | x:Bucket|Table|Queue|Secret
+
+## meaning: a bucket whose policy allows principal * and no public-access block stops it, or a public ACL
+## answers: what is public
+## answers: which buckets can anyone read
+## depth: declared
+## not-evaluated: IAM Condition keys; account-level public-access blocks
+publicly-readable(x) := x:Bucket[!blockPublicPolicy = true] !<-blocks :PublicAccessBlock[blockPublicPolicy = true] <-policyOf :ResourcePolicy ->statement :Statement[doc = "resource", effect = "Allow", principals in ("*")]
+                      | x:Bucket[acl in ("public-read", "public-read-write")]
+
+# ------------------------------------------------------------------ identity
+
+## meaning: compute to the role it runs as (instance profile, also through a launch template; Lambda role; ECS task role)
+## answers: what identity does this instance run as
+## depth: declared
+runs-as(c, r)        := c:Instance|Function|Service|TaskDefinition ->{0,1}template ->{0,1}(profile|task) ->role r:Role
+
+## meaning: role to role, where both the caller's permission and the target's trust allow sts:AssumeRole
+## answers: which roles can this role become
+## depth: declared
+## not-evaluated: IAM Condition keys; Resource "*"; a trust policy that names the account root
+can-assume(a, b)     := a:Role <-{0,1}attachedTo ->statement :Statement[doc = "permission", effect = "Allow", actions ~ "sts:AssumeRole"] ->resource b:Role ->statement :Statement[doc = "trust", actions ~ "sts:AssumeRole"] ->principal a
+
+## meaning: role to resource, by an identity policy or a resource policy, with no explicit Deny on the same pair
+## param-action: an IAM action the grant must cover, such as dynamodb:GetItem
+## answers: what can this role touch
+## answers: what can reach the customer database (read it in reverse: <-[cap=grants])
+## depth: declared
+## not-evaluated: IAM Condition keys; Resource "*"; NotAction and NotResource; permission boundaries and SCPs; AWS-managed policies, named by ARN only; resources the graph holds but can't resolve, such as an expression naming nothing declared
+grants(r, x; action?) := r:Role ->allows($action) x !<-denies($action) r
+
+## meaning: can-assume any number of times, then grants
+## param-action: an IAM action the grant must cover, such as s3:GetObject
+## answers: if this role is compromised, what data can it reach
+## answers: what can reach the customer database (read it in reverse: <-[cap=reaches])
+## depth: declared
+## not-evaluated: IAM Condition keys; Resource "*"; NotAction and NotResource; permission boundaries and SCPs; AWS-managed policies, named by ARN only; resources the graph holds but can't resolve, such as an expression naming nothing declared
+reaches(r, x; action?) := r:Role ->{0,}can-assume ->grants($action) x
+
+# ------------------------------------------------------------------ paths
+
+## meaning: internet-reachable compute that runs as a role that reaches a store holding a secret
+## answers: is there an exfiltration path from the internet to our data
+## answers: which internet-facing hosts can read restricted data
+## depth: declared
+## not-evaluated: IAM Condition keys; Resource "*"; load balancers and API gateways; resources the graph holds but can't resolve, such as an expression naming nothing declared
+exfiltrates(c, x)    := c[@internet-reachable] ->runs-as ->reaches x[@holds-secret]
+
+## meaning: what a compromise of it reaches: runs-as, can-assume and network any number of times, then what each identity is granted
+## answers: what is the blast radius if this host is compromised
+## depth: declared
+## not-evaluated: IAM Condition keys; Resource "*"; CIDR-to-CIDR reachability; resources the graph holds but can't resolve, such as an expression naming nothing declared
+blast(s, x)          := s ->{0,}pivot ->{0,1}grants x

package/src/capabilities/base-mappings.json

@@ -0,0 +1,122 @@
+{
+  "$comment": "The kinds core's effective-topology folds read (#1139, #4362), as data. These were constants in graph-effective.ts; they stay in core so the folds work on a graph read without its lexicon's plugin. Each lexicon's own mapping (src/capabilities/mapping.json) extends its entry here.",
+  "mappings": [
+    {
+      "lexicon": "aws",
+      "types": "kind",
+      "refs": "cloudformation",
+      "labels": {
+        "AWS::EC2::Instance": "Instance",
+        "AWS::EC2::LaunchTemplate": "LaunchTemplate",
+        "AWS::EC2::SecurityGroup": "SecurityGroup",
+        "AWS::EC2::SecurityGroupIngress": { "label": "IngressRule", "style": "cfn" },
+        "AWS::EC2::Subnet": "Subnet",
+        "AWS::EC2::SubnetRouteTableAssociation": "RouteTableAssociation",
+        "AWS::EC2::RouteTable": "RouteTable",
+        "AWS::EC2::Route": "Route",
+        "AWS::EC2::InternetGateway": "InternetGateway"
+      },
+      "edges": {
+        "Instance": {
+          "SecurityGroupIds": "sg",
+          "SecurityGroupId": "sg",
+          "LaunchTemplate": "template",
+          "LaunchTemplateId": "template",
+          "SubnetId": "subnet"
+        },
+        "LaunchTemplate": {
+          "LaunchTemplateData": { "SecurityGroup": "sg" },
+          "SecurityGroupIds": "sg",
+          "SecurityGroupId": "sg"
+        },
+        "IngressRule": { "GroupId": "-ingress", "SourceSecurityGroupId": "source" },
+        "RouteTableAssociation": { "SubnetId": "subnet", "RouteTableId": "table" },
+        "Route": { "RouteTableId": "table", "GatewayId": "gateway" }
+      },
+      "attrs": {
+        "Route": { "dest": "DestinationCidrBlock" },
+        "IngressRule": { "proto": "IpProtocol", "from": "FromPort", "to": "ToPort", "cidrs": { "all": ["CidrIp", "CidrIpv6"] } }
+      },
+      "blocks": {
+        "SecurityGroup": [
+          {
+            "attr": "SecurityGroupIngress",
+            "label": "IngressRule",
+            "edge": "ingress",
+            "style": "cfn",
+            "attrs": { "proto": "IpProtocol", "from": "FromPort", "to": "ToPort", "cidrs": { "all": ["CidrIp", "CidrIpv6"] } },
+            "refs": { "SourceSecurityGroupId": "source" }
+          }
+        ]
+      }
+    },
+    {
+      "lexicon": "terraform",
+      "types": "terraform",
+      "body": "body",
+      "refs": "terraform",
+      "labels": {
+        "aws_instance": "Instance",
+        "aws_launch_template": "LaunchTemplate",
+        "aws_security_group": "SecurityGroup",
+        "aws_security_group_rule": { "label": "IngressRule", "when": { "type": "ingress" }, "style": "tf-sg-rule" },
+        "aws_vpc_security_group_ingress_rule": { "label": "IngressRule", "style": "tf-vpc-rule" },
+        "aws_subnet": "Subnet",
+        "aws_route_table_association": "RouteTableAssociation",
+        "aws_route_table": "RouteTable",
+        "aws_route": "Route",
+        "aws_internet_gateway": "InternetGateway"
+      },
+      "edges": {
+        "Instance": {
+          "vpc_security_group_ids": "sg",
+          "security_groups": "sg",
+          "launch_template": "template",
+          "subnet_id": "subnet"
+        },
+        "LaunchTemplate": {
+          "vpc_security_group_ids": "sg",
+          "security_group_names": "sg",
+          "network_interfaces": { "SecurityGroup": "sg" }
+        },
+        "IngressRule": {
+          "security_group_id": "-ingress",
+          "source_security_group_id": "source",
+          "referenced_security_group_id": "source"
+        },
+        "RouteTableAssociation": { "subnet_id": "subnet", "route_table_id": "table" },
+        "Route": { "route_table_id": "table", "gateway_id": "gateway" }
+      },
+      "attrs": {
+        "Route": { "dest": ["destination_cidr_block", "destination_ipv6_cidr_block"] },
+        "IngressRule": {
+          "proto": ["ip_protocol", "protocol"],
+          "from": "from_port",
+          "to": "to_port",
+          "cidrs": { "all": ["cidr_blocks", "ipv6_cidr_blocks", "cidr_ipv4", "cidr_ipv6"] }
+        }
+      },
+      "blocks": {
+        "SecurityGroup": [
+          {
+            "attr": "ingress",
+            "label": "IngressRule",
+            "edge": "ingress",
+            "style": "tf-inline",
+            "attrs": { "proto": "protocol", "from": "from_port", "to": "to_port", "cidrs": { "all": ["cidr_blocks", "ipv6_cidr_blocks"] } },
+            "refs": { "security_groups": "source" }
+          }
+        ],
+        "RouteTable": [
+          {
+            "attr": "route",
+            "label": "Route",
+            "edge": "-table",
+            "attrs": { "dest": ["cidr_block", "ipv6_cidr_block"] },
+            "refs": { "gateway_id": "gateway" }
+          }
+        ]
+      }
+    }
+  ]
+}