@intentius/chant 0.124.45 → 0.124.48

package/src/cli/commands/carve-score-once.test.ts

@@ -0,0 +1,99 @@
+import { describe, test, expect } from "vitest";
+import { carveJson } from "./carve";
+import { boundaryIndex, boundaryReport } from "../../terraform/carve";
+import { scoreEstate } from "../../terraform/score";
+import type { TfEdge, TfGraph, TfNode } from "../../terraform/types";
+
+const node = (type: string, name: string): TfNode => ({
+  address: `${type}.${name}`,
+  kind: "resource",
+  type,
+  name,
+  instances: 1,
+  hasDynamic: false,
+});
+
+const edge = (from: string, to: string, extra: Partial<TfEdge> = {}): TfEdge => ({
+  from,
+  to,
+  attrs: ["id"],
+  via: ["bucket"],
+  ...extra,
+});
+
+/** A fixture with a fold, an output edge, a module, an unmapped type and a duplicate edge. */
+function fixture(): TfGraph {
+  return {
+    nodes: [
+      node("aws_s3_bucket", "assets"),
+      node("aws_s3_bucket_versioning", "assets"),
+      node("aws_lambda_function", "api"),
+      node("aws_sqs_queue", "q"),
+      node("random_pet", "name"),
+      { address: "module.cdn", kind: "module", name: "cdn", instances: 1, hasDynamic: false },
+    ],
+    edges: [
+      edge("aws_s3_bucket_versioning.assets", "aws_s3_bucket.assets"),
+      edge("aws_lambda_function.api", "aws_s3_bucket.assets", { attrs: ["bucket"] }),
+      edge("aws_lambda_function.api", "aws_s3_bucket.assets", { attrs: ["arn"], via: ["env"] }),
+      edge("output.bucket", "aws_s3_bucket.assets", { fromKind: "output", via: ["value"] }),
+      edge("aws_lambda_function.api", "aws_sqs_queue.q"),
+      edge("module.cdn", "aws_lambda_function.api"),
+    ],
+  };
+}
+
+/** The old path: every resource's boundary rescored the whole estate. */
+function legacyJson(graph: TfGraph) {
+  const results = scoreEstate(graph);
+  return results.map((r) => {
+    const report = boundaryReport(graph, r.address, { dialect: "terraform" });
+    return report ? { ...r, boundary: { inbound: report.inbound, outbound: report.outbound } } : r;
+  });
+}
+
+function chain(n: number): TfGraph {
+  const nodes: TfNode[] = [];
+  const edges: TfEdge[] = [];
+  for (let i = 0; i < n; i++) {
+    nodes.push(node("aws_sqs_queue", `q${i}`));
+    if (i > 0) edges.push(edge(`aws_sqs_queue.q${i}`, `aws_sqs_queue.q${i - 1}`));
+    if (i > 1) edges.push(edge(`aws_sqs_queue.q${i}`, `aws_sqs_queue.q${i - 2}`));
+  }
+  return { nodes, edges };
+}
+
+describe("carve advise scores the estate once (#4391)", () => {
+  test("output is byte-identical to the per-resource rescoring path", () => {
+    const graph = fixture();
+    const payload = carveJson({ ok: true, from: "x", source: "terraform", results: scoreEstate(graph), graph });
+    expect(JSON.stringify(payload.resources)).toBe(JSON.stringify(legacyJson(graph)));
+    expect(payload.resources.some((r) => r.boundary?.inbound.length)).toBe(true);
+  });
+
+  test("a supplied peelability and edge index give the same report", () => {
+    const graph = fixture();
+    for (const r of scoreEstate(graph)) {
+      expect(JSON.stringify(boundaryReport(graph, r.address, { peelability: r, index: boundaryIndex(graph) }))).toBe(
+        JSON.stringify(boundaryReport(graph, r.address)),
+      );
+    }
+  });
+
+  test("on a few thousand nodes the old path costs more per resource than the whole new pass", () => {
+    const graph = chain(3000);
+    // Radius is its own walk per node (#2326), not what this test is about.
+    const t0 = performance.now();
+    const results = scoreEstate(graph, { radius: false });
+    const payload = carveJson({ ok: true, from: "x", source: "terraform", results, graph });
+    const fresh = performance.now() - t0;
+    expect(payload.resources).toHaveLength(3000);
+
+    // Rescoring is O(V) per resource, so 50 of them already outweigh the one pass over all 3000.
+    const sample = results.slice(0, 50);
+    const t1 = performance.now();
+    for (const r of sample) boundaryReport(graph, r.address);
+    const legacy = performance.now() - t1;
+    expect(legacy).toBeGreaterThan(fresh);
+  });
+});

package/src/cli/commands/carve.ts

@@ -19,7 +19,7 @@ import { adviseCloudAssembly, CDK_DIALECT } from "../../cdk/advise";
 import { isCloudAssembly } from "../../cdk/assembly";
 import { parseTerraformDir, Hcl2JsonNotInstalled } from "../../terraform/parse";
 import { scoreEstate, type Peelability, type PeelabilityBand, type ScoreOptions } from "../../terraform/score";
-import { boundaryReport, type BoundaryEdge, type CarveDialect } from "../../terraform/carve";
+import { boundaryIndex, boundaryReport, type BoundaryIndex, type BoundaryEdge, type CarveDialect } from "../../terraform/carve";
 import type { TfGraph } from "../../terraform/types";
 
 export interface CarveAdviseOptions {
@@ -141,6 +141,9 @@ async function adviseTerraform(opts: CarveAdviseOptions): Promise<CarveAdviseRes
  * additive and ignorable: the top-level `source` discriminator, per-resource
  * `notes` and `members`, and two more `bridge` values in a list that was
  * already declared open-ended.
+ *
+ * Per-resource `radius` (#2326) is additive the same way: a new field beside
+ * `score`, not a term inside it, so the score and its penalties are unchanged.
  */
 export const CARVE_REPORT_VERSION = 1;
 
@@ -201,6 +204,7 @@ export function carveJson(result: CarveAdviseResult): CarveJsonReport {
   );
   const source = result.source ?? "terraform";
   const dialect: CarveDialect = source === "cdk" ? CDK_DIALECT : "terraform";
+  const index = result.graph ? boundaryIndex(result.graph) : undefined;
   return {
     version: CARVE_REPORT_VERSION,
     from: result.from,
@@ -209,7 +213,7 @@ export function carveJson(result: CarveAdviseResult): CarveJsonReport {
     count: results.length,
     bands: counts,
     ...(result.diagnostics?.length ? { diagnostics: result.diagnostics } : {}),
-    resources: results.map((r) => withBoundary(r, result.graph, dialect, result.scoreOptions)),
+    resources: results.map((r) => withBoundary(r, result.graph, dialect, result.scoreOptions, index)),
   };
 }
 
@@ -219,9 +223,11 @@ function withBoundary(
   graph: TfGraph | undefined,
   dialect: CarveDialect,
   score: ScoreOptions | undefined,
+  index: BoundaryIndex | undefined,
 ): CarveJsonResource {
   if (!graph) return r;
-  const report = boundaryReport(graph, r.address, { dialect, score });
+  // The ranking already scored this resource; the report reads it back rather than rescoring the estate (#4391).
+  const report = boundaryReport(graph, r.address, { dialect, score, peelability: r, index });
   if (!report) return r;
   return { ...r, boundary: { inbound: report.inbound, outbound: report.outbound } };
 }
@@ -246,6 +252,8 @@ export function formatCarveReport(result: CarveAdviseResult): string {
   );
   for (const note of result.diagnostics ?? []) lines.push(`  ! ${note}`);
   lines.push("");
+  const cells = new Map(results.map((r) => [r.address, radiusCell(r)]));
+  const cellWidth = Math.max(...[...cells.values()].map((c) => c.length));
 
   for (const band of BAND_ORDER) {
     const inBand = results.filter((r) => r.band === band);
@@ -253,9 +261,11 @@ export function formatCarveReport(result: CarveAdviseResult): string {
     lines.push(`${bandLabel(band, cdk)}  (${inBand.length})`);
     for (const r of inBand) {
       const target = r.mapsTo ? ` -> ${r.mapsTo}` : "";
-      lines.push(`  ${String(r.score).padStart(3)}  ${r.address}${target}`);
-      lines.push(`       ${reasons(r, cdk)}`);
-      for (const note of r.notes ?? []) lines.push(`       ${note}`);
+      const cell = cellWidth > 0 ? `${cells.get(r.address)!.padEnd(cellWidth)}  ` : "";
+      const indent = " ".repeat(7 + (cellWidth > 0 ? cellWidth + 2 : 0));
+      lines.push(`  ${String(r.score).padStart(3)}  ${cell}${r.address}${target}`);
+      lines.push(`${indent}${reasons(r, cdk)}`);
+      for (const note of r.notes ?? []) lines.push(`${indent}${note}`);
     }
     lines.push("");
   }
@@ -263,9 +273,30 @@ export function formatCarveReport(result: CarveAdviseResult): string {
   lines.push(
     `Bands: 80-100 carve now | 50-79 carve with boundary edits | 0-49 leave in ${cdk ? "CDK" : "Terraform"}`,
   );
+  if (cellWidth > 0) {
+    lines.push(
+      "Radius: resources+outputs that depend on it at any depth, dN the farthest hop; - none; " +
+        (cdk ? "xN across a stack boundary." : "? a module or unresolved count/for_each hides how many."),
+    );
+  }
   return lines.join("\n").trimEnd();
 }
 
+/**
+ * The radius column (#2326): `3+1 d2` is three resources and one output that
+ * depend on the node, the farthest two hops away; `-` is nothing; `?` stands in
+ * for a count a module or unresolved `count` hides; ` x2` is how many sit
+ * across a stack boundary. Empty when the result carries no radius.
+ */
+function radiusCell(r: Peelability): string {
+  const radius = r.radius;
+  if (!radius) return "";
+  if (radius.depth === 0) return "-";
+  const n = (v: number | "unknown"): string => (v === "unknown" ? "?" : String(v));
+  const cross = radius.crossStack !== undefined && radius.crossStack !== 0 ? ` x${n(radius.crossStack)}` : "";
+  return `${n(radius.resources)}+${radius.outputs} d${radius.depth}${cross}`;
+}
+
 function bandLabel(band: PeelabilityBand, cdk: boolean): string {
   switch (band) {
     case "clean leaf":

package/src/cli/commands/check-lexicon.test.ts

@@ -85,8 +85,8 @@ describe("coverageReportCheck", () => {
 describe("countRequiredNames (#3377)", () => {
   const read = (lex: string) => readFileSync(join(repoRoot, "lexicons", lex, "src/validate.ts"), "utf8");
 
-  test("counts names with digits: otel reports 37", () => {
-    expect(countRequiredNames(read("otel"))).toBe(37);
+  test("counts names with digits: otel reports 38", () => {
+    expect(countRequiredNames(read("otel"))).toBe(38);
   });
 
   test("counts only the REQUIRED_NAMES entries: prometheus reports the array length", () => {

package/src/cli/commands/import-report.ts

@@ -0,0 +1,71 @@
+/**
+ * The review report of `chant import` (#4398): the parser's diagnostics as
+ * SARIF (`--report <path>`), a summary on stderr, and the exit code under
+ * `--strict`. The shape follows `chant migrate`: a needs-review diagnostic is
+ * a `warning`, and `--strict` makes any open `warning` or `error` fail the
+ * run. An `info` diagnostic names something not carried that needs no
+ * decision, and never fails a run.
+ */
+
+import { writeFileSync } from "fs";
+import type { ImportDiagnostic } from "../../import/parser";
+import type { LintDiagnostic } from "../../lint/rule";
+import { formatSarif } from "../reporters/stylish";
+
+/** Import diagnostics as lint diagnostics against `file`, the template that was imported. */
+export function importDiagnosticsToLint(file: string, diagnostics: readonly ImportDiagnostic[]): LintDiagnostic[] {
+  return diagnostics.map((d) => ({
+    file,
+    line: d.line ?? 1,
+    column: d.column ?? 1,
+    ruleId: d.ruleId,
+    severity: d.severity,
+    message: d.message,
+    ...(d.entity ? { entity: d.entity } : {}),
+  }));
+}
+
+/** The SARIF document for a run. */
+export function importSarif(file: string, diagnostics: readonly ImportDiagnostic[], version?: string): string {
+  return formatSarif(importDiagnosticsToLint(file, diagnostics), undefined, undefined, version);
+}
+
+/** Write the SARIF report; an unwritable path is returned as a message, not thrown. */
+export function writeImportReport(path: string, file: string, diagnostics: readonly ImportDiagnostic[], version?: string): string | undefined {
+  try {
+    writeFileSync(path, importSarif(file, diagnostics, version));
+    return undefined;
+  } catch (err) {
+    return `could not write SARIF report to ${path}: ${err instanceof Error ? err.message : String(err)}`;
+  }
+}
+
+/** Diagnostics that are open: everything but `info`. */
+export function openDiagnostics(diagnostics: readonly ImportDiagnostic[]): ImportDiagnostic[] {
+  return diagnostics.filter((d) => d.severity !== "info");
+}
+
+/**
+ * The exit code for a finished import. An `error` always fails (a failed
+ * `--validate`); a `warning` fails under `--strict`.
+ */
+export function importExitCode(diagnostics: readonly ImportDiagnostic[] | undefined, strict: boolean): number {
+  if (!diagnostics) return 0;
+  if (diagnostics.some((d) => d.severity === "error")) return 1;
+  return strict && diagnostics.some((d) => d.severity === "warning") ? 1 : 0;
+}
+
+/** Counts by severity and rule, as the lines printed after an import. */
+export function summarizeImportDiagnostics(diagnostics: readonly ImportDiagnostic[]): string {
+  const bySeverity = { error: 0, warning: 0, info: 0 };
+  const byRule = new Map<string, number>();
+  for (const d of diagnostics) {
+    bySeverity[d.severity]++;
+    byRule.set(d.ruleId, (byRule.get(d.ruleId) ?? 0) + 1);
+  }
+  const rules = [...byRule].sort(([a], [b]) => a.localeCompare(b)).map(([id, n]) => `${id} x${String(n)}`);
+  return [
+    `Review: ${String(bySeverity.warning)} to review, ${String(bySeverity.error)} errors, ${String(bySeverity.info)} notes (${rules.join(", ")}).`,
+    "Write them with --report <path> as SARIF; --strict fails while any to review or error is open.",
+  ].join("\n");
+}

package/src/cli/commands/import.ts

@@ -1,13 +1,14 @@
 import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync } from "fs";
 import { join, resolve, basename, dirname } from "path";
 import { formatSuccess, formatWarning, formatError } from "../format";
-import type { TemplateIR, ResourceIR, ParameterIR, ParseContext } from "../../import/parser";
+import type { TemplateIR, ResourceIR, ParameterIR, ParseContext, ImportDiagnostic } from "../../import/parser";
 import type { GeneratedFile, TypeScriptGenerator } from "../../import/generator";
 import { listInstalledLexicons, loadPlugin, loadPlugins, resolveProjectLexicons } from "../plugins";
 import type { ExportedTemplate, LexiconPlugin, ResourceSelector } from "../../lexicon";
 import { parseYAMLDocument, splitYAMLDocuments } from "../../yaml";
 import { importLexiconPackage } from "../../lexicon-module";
 import { resolveParserOptions } from "../../import/parser-options";
+import { summarizeImportDiagnostics } from "./import-report";
 import { EmbeddedImports, type EmbeddedContent, type RegisteredEmbeddedImporter } from "../../import/embedded";
 
 /**
@@ -31,6 +32,8 @@ export interface ImportOptions {
    * fails the import before anything is parsed.
    */
   parserOptions?: string[];
+  /** `--validate` (#4398): check the parsed template on the lexicon's emulator before writing. */
+  validate?: boolean;
 }
 
 /**
@@ -52,6 +55,12 @@ export interface ImportResult {
    * it was named (`--lexicon`, `--kustomize`) (#2965).
    */
   detected?: boolean;
+  /**
+   * What the parser flagged for review (#4398), then what `--validate`
+   * rejected. `--report` writes them as SARIF and `--strict` fails while a
+   * `warning` or `error` is open; see `./import-report.ts`.
+   */
+  diagnostics?: ImportDiagnostic[];
 }
 
 /**
@@ -353,6 +362,7 @@ export async function importCommand(options: ImportOptions): Promise<ImportResul
       output: options.output,
       force: options.force,
       parserOptions: options.parserOptions,
+      validate: options.validate,
     });
   }
 
@@ -391,7 +401,7 @@ export async function importCommand(options: ImportOptions): Promise<ImportResul
     );
   }
 
-  const result = await parseAndWrite(plugin, content, outputDir, options.force, warnings, generatedFiles, plugin.name, projectDir, options.parserOptions);
+  const result = await parseAndWrite(plugin, content, outputDir, options.force, warnings, generatedFiles, plugin.name, projectDir, options.parserOptions, options.validate);
   return { ...result, detected: true };
 }
 
@@ -412,6 +422,8 @@ export interface ContentImportOptions {
   force?: boolean;
   /** `--parser-option` entries for the lexicon's parser (#2994); see {@link ImportOptions.parserOptions}. */
   parserOptions?: string[];
+  /** `--validate`; see {@link ImportOptions.validate}. */
+  validate?: boolean;
 }
 
 export async function importFromContent(options: ContentImportOptions): Promise<ImportResult> {
@@ -432,7 +444,7 @@ export async function importFromContent(options: ContentImportOptions): Promise<
     return { success: false, generatedFiles: [], warnings: [], error: `Lexicon "${options.lexicon}" not available.` };
   }
   const projectDir = resolve(options.output ? dirname(options.output) : ".");
-  return parseAndWrite(plugin, options.content, outputDir, options.force, [], [], plugin.name, projectDir, options.parserOptions);
+  return parseAndWrite(plugin, options.content, outputDir, options.force, [], [], plugin.name, projectDir, options.parserOptions, options.validate);
 }
 
 /**
@@ -568,6 +580,7 @@ async function parseAndWrite(
   lexicon: string,
   projectDir: string,
   parserOptionEntries?: readonly string[],
+  validate?: boolean,
 ): Promise<ImportResult> {
   // A lexicon can recognize a template (detectTemplate) without being able to
   // import it (grafana had no parser until #2945). Every path funnels through here, so
@@ -609,6 +622,18 @@ async function parseAndWrite(
   if (ir.warnings) {
     warnings.push(...ir.warnings);
   }
+  // Findings for review (#4398), and what the lexicon's emulator rejects.
+  const diagnostics: ImportDiagnostic[] = [...(ir.diagnostics ?? [])];
+  if (validate) {
+    if (!plugin.validateImport) {
+      return { success: false, generatedFiles: [], warnings: [], error: `lexicon "${plugin.name}" has no emulator to validate an import against`, lexicon: plugin.name };
+    }
+    try {
+      diagnostics.push(...(await plugin.validateImport(ir, resolved.options)));
+    } catch (err) {
+      return { success: false, generatedFiles: [], warnings: [], error: `--validate failed to run: ${err instanceof Error ? err.message : String(err)}`, lexicon: plugin.name };
+    }
+  }
   // Embedded content the owner could not carry, or that no installed lexicon imports.
   if (embedded) warnings.push(...embedded.warnings);
 
@@ -660,6 +685,7 @@ async function parseAndWrite(
     generatedFiles,
     warnings,
     lexicon,
+    ...(diagnostics.length > 0 ? { diagnostics } : {}),
   };
 }
 
@@ -894,6 +920,10 @@ export function printImportResult(result: ImportResult): void {
     console.log(`${result.detected ? "Detected lexicon" : "Lexicon"}: ${result.lexicon}`);
   }
 
+  if (result.diagnostics && result.diagnostics.length > 0) {
+    console.error(summarizeImportDiagnostics(result.diagnostics));
+  }
+
   if (result.generatedFiles.length > 0) {
     console.log(formatSuccess("Generated files:"));
     for (const file of result.generatedFiles) {

package/src/cli/commands/lint.ts

@@ -785,6 +785,7 @@ async function runLexiconPostSynthDiagnostics(
     ruleId: d.checkId,
     severity: d.severity,
     message: `${d.entity ? `[${d.entity}] ` : ""}${d.message}`,
+    ...(d.entity ? { entity: d.entity } : {}),
   });
 
   for (const { plugin, diagnostics: raw } of runLexiconPostSynthChecks(withChecks, result, env, { activityContracts, telemetry, projectDir: configDir, ...(loadedConfig ? { projectConfig: loadedConfig } : {}) })) {

package/src/cli/commands/migrate-dialect.test.ts

@@ -0,0 +1,145 @@
+/**
+ * `chant migrate` naming and the target-server `--validate` (#4399): a side is
+ * `lexicon` or `lexicon/dialect`, a directory is a source only when the
+ * lexicon says so, and a result's own `validate` replaces the external linter.
+ */
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { lexiconOfSide, migrateCommand } from "./migrate";
+import type { LexiconPlugin, MigrationResult, MigrationSource } from "../../lexicon";
+
+const seen: Array<{ from: string; to: string | undefined }> = [];
+
+function sqlPlugin(over: { directory?: boolean; result?: Partial<MigrationResult>; transform?: MigrationSource["transform"] } = {}): LexiconPlugin {
+  return {
+    name: "sql",
+    serializer: { name: "sql", rulePrefix: "SQL", serialize: () => "" },
+    async generate() {},
+    async validate() {},
+    async coverage() {},
+    async package() {},
+    migrationSource(from: string, to?: string) {
+      seen.push({ from, to });
+      if (from !== "sql/postgres" || (to !== undefined && to !== "sql/clickhouse")) return undefined;
+      return {
+        detect: (content: string) => content.includes("CREATE TABLE"),
+        ...(over.directory ? { directory: true } : {}),
+        transform: over.transform ?? (async () => ({ output: "-- ddl\n", provenance: [], diagnostics: [], ...over.result })),
+      };
+    },
+  };
+}
+
+const base = { emit: "sql" as const, strict: false, validate: false, useComposites: false };
+
+describe("lexiconOfSide", () => {
+  test("is the part before the slash", () => {
+    expect(lexiconOfSide("sql/clickhouse")).toBe("sql");
+    expect(lexiconOfSide("gitlab")).toBe("gitlab");
+  });
+});
+
+describe("migrateCommand with lexicon/dialect sides", () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "chant-migrate-dialect-"));
+    seen.length = 0;
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+  const file = () => {
+    const f = join(dir, "schema.sql");
+    writeFileSync(f, "CREATE TABLE t (id int);");
+    return f;
+  };
+
+  test("finds the plugin by the lexicon part, and hands the source both sides as written", async () => {
+    const r = await migrateCommand({ ...base, sourceFile: file(), from: "sql/postgres", to: "sql/clickhouse", output: join(dir, "out.sql"), plugins: [sqlPlugin()] });
+    expect(r.exitCode).toBe(0);
+    expect(seen).toEqual([{ from: "sql/postgres", to: "sql/clickhouse" }]);
+    expect(readFileSync(join(dir, "out.sql"), "utf8")).toBe("-- ddl\n");
+  });
+
+  test("a dialect the lexicon does not know is refused by name", async () => {
+    const r = await migrateCommand({ ...base, sourceFile: file(), from: "sql/postgres", to: "sql/mysql", plugins: [sqlPlugin()] });
+    expect(r.exitCode).toBe(1);
+    expect(r.error).toContain('Lexicon "sql/mysql" does not support migration from "sql/postgres"');
+  });
+
+  test("creates the output's directory", async () => {
+    const out = join(dir, "a/b/out.sql");
+    const r = await migrateCommand({ ...base, sourceFile: file(), from: "sql/postgres", to: "sql/clickhouse", output: out, plugins: [sqlPlugin()] });
+    expect(r.exitCode).toBe(0);
+    expect(readFileSync(out, "utf8")).toBe("-- ddl\n");
+  });
+
+  test("a directory is refused unless the source reads directories; then detect is skipped and content is empty", async () => {
+    const member = join(dir, "db");
+    mkdirSync(member);
+    const refused = await migrateCommand({ ...base, sourceFile: member, from: "sql/postgres", to: "sql/clickhouse", plugins: [sqlPlugin()] });
+    expect(refused.exitCode).toBe(1);
+    expect(refused.error).toContain("is a directory");
+    let got: { content: string; sourceFile?: string } | undefined;
+    const ok = await migrateCommand({
+      ...base,
+      sourceFile: member,
+      from: "sql/postgres",
+      to: "sql/clickhouse",
+      output: join(dir, "o.sql"),
+      plugins: [sqlPlugin({ directory: true, transform: async (content, opts) => ((got = { content, sourceFile: opts.sourceFile }), { output: "x", provenance: [], diagnostics: [] }) })],
+    });
+    expect(ok.exitCode).toBe(0);
+    expect(got).toEqual({ content: "", sourceFile: member });
+  });
+});
+
+describe("--validate with a result that checks itself", () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "chant-migrate-validate-"));
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+  const run = (result: Partial<MigrationResult>, extra: { strict?: boolean } = {}) => {
+    const f = join(dir, "schema.sql");
+    writeFileSync(f, "CREATE TABLE t (id int);");
+    return migrateCommand({ ...base, ...extra, validate: true, sourceFile: f, from: "sql/postgres", to: "sql/clickhouse", output: join(dir, "o.sql"), plugins: [sqlPlugin({ result })] });
+  };
+
+  test("a clean check passes and its diagnostics join the result", async () => {
+    const r = await run({ validate: async () => [] });
+    expect(r.exitCode).toBe(0);
+  });
+
+  test("a refused statement fails the run without --strict, and is in the diagnostics", async () => {
+    const r = await run({ validate: async () => [{ ruleId: "SQLRV012", severity: "error", message: "t: the emulator rejected the statement." }] });
+    expect(r.exitCode).toBe(1);
+    expect(r.diagnostics.map((d) => d.ruleId)).toEqual(["SQLRV012"]);
+  });
+
+  test("a server that cannot start is a validation that did not run, which fails", async () => {
+    const r = await run({
+      validate: async () => {
+        throw new Error("Docker is not available, so the ClickHouse emulator cannot start");
+      },
+    });
+    expect(r.exitCode).toBe(1);
+    expect(r.error).toContain("--validate did not run: Docker is not available");
+  });
+
+  test("without --validate the check is not run", async () => {
+    let ran = false;
+    const f = join(dir, "schema.sql");
+    writeFileSync(f, "CREATE TABLE t (id int);");
+    const r = await migrateCommand({
+      ...base,
+      sourceFile: f,
+      from: "sql/postgres",
+      to: "sql/clickhouse",
+      output: join(dir, "o.sql"),
+      plugins: [sqlPlugin({ result: { validate: async () => ((ran = true), []) } })],
+    });
+    expect(r.exitCode).toBe(0);
+    expect(ran).toBe(false);
+  });
+});