@intentius/chant 0.124.45 → 0.124.48

package/dist/capabilities/view.js

@@ -0,0 +1,484 @@
+import { terraformType } from "../graph-effective.js";
+/**
+ * Merge mappings for the same lexicon: objects merge key by key at every
+ * depth, lists concatenate, and anything else in a later mapping wins.
+ */
+export function mergeMappings(...ms) {
+    const merge = (a, b) => {
+        if (b === undefined)
+            return a;
+        if (Array.isArray(a) && Array.isArray(b))
+            return [...a, ...b.filter((x) => typeof x === "object" || !a.includes(x))];
+        const isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+        if (isObj(a) && isObj(b)) {
+            const out = { ...a };
+            for (const [k, v] of Object.entries(b))
+                out[k] = merge(a[k], v);
+            return out;
+        }
+        return b;
+    };
+    return ms.reduce((acc, m) => merge(acc, m), { lexicon: ms[0]?.lexicon ?? "" });
+}
+const arr = (v) => (v == null ? [] : Array.isArray(v) ? v : [v]);
+/** Every value at `path` (`A.B`, `A[].B`), flattened. */
+function readPath(obj, path) {
+    let cur = [obj];
+    for (const seg of path.split(".")) {
+        const spread = seg.endsWith("[]");
+        const key = spread ? seg.slice(0, -2) : seg;
+        const next = [];
+        for (const c of cur) {
+            if (!c || typeof c !== "object")
+                continue;
+            const v = c[key];
+            if (v === undefined)
+                continue;
+            if (spread)
+                next.push(...arr(v));
+            else
+                next.push(v);
+        }
+        cur = next;
+    }
+    return cur;
+}
+function readSource(obj, src) {
+    if (typeof src === "string")
+        return readPath(obj, src)[0];
+    if (Array.isArray(src)) {
+        for (const p of src) {
+            const v = readPath(obj, p)[0];
+            if (v !== undefined && v !== null)
+                return v;
+        }
+        return undefined;
+    }
+    if ("const" in src)
+        return src.const;
+    return src.all.flatMap((p) => readPath(obj, p).flatMap(arr));
+}
+function matchesWhen(obj, when) {
+    if (!when)
+        return true;
+    return Object.entries(when).every(([k, v]) => readPath(obj, k)[0] === v);
+}
+/** The bare name a row prints: no stack qualification, no root directory. */
+export function displayName(id) {
+    const s = id.includes("::") ? id.slice(id.lastIndexOf("::") + 2) : id;
+    return s.slice(s.lastIndexOf("/") + 1);
+}
+const ARN_NAMES = [
+    { label: "Role", re: /^arn:aws[\w-]*:iam::[^:]*:role\/(?:[^*]*\/)?([^/*]+)$/ },
+    { label: "Bucket", re: /^arn:aws[\w-]*:s3:::([^/*]+)(?:\/.*)?$/ },
+    { label: "Table", re: /^arn:aws[\w-]*:dynamodb:[^:]*:[^:]*:table\/([^/*]+)$/ },
+];
+/**
+ * Normalize what each lexicon spells its own way, for labels whose meaning is
+ * core vocabulary: an ingress rule's protocol and port range.
+ */
+function normalize(label, attrs) {
+    if (label === "IngressRule") {
+        const raw = attrs.proto == null ? "-1" : String(attrs.proto).toLowerCase();
+        const proto = raw === "all" || raw === "-1" ? "-1" : raw;
+        attrs.proto = proto;
+        if (proto === "-1" || attrs.from == null) {
+            attrs.from = 0;
+            attrs.to = 65535;
+        }
+        else {
+            attrs.from = Number(attrs.from);
+            attrs.to = attrs.to == null ? attrs.from : Number(attrs.to);
+        }
+        attrs.cidrs = arr(attrs.cidrs).map(String);
+    }
+}
+/**
+ * Build the view of an IR through the packs given. Nodes of a kind no
+ * mapping labels are left out, as are edges no mapping names.
+ */
+export function buildView(ir, packs) {
+    const byLexicon = new Map();
+    for (const p of packs) {
+        const prev = byLexicon.get(p.mapping.lexicon);
+        byLexicon.set(p.mapping.lexicon, prev ? { mapping: mergeMappings(prev.mapping, p.mapping), adapter: { ...prev.adapter, ...p.adapter } } : p);
+    }
+    const terraformPack = [...byLexicon.values()].find((p) => p.mapping.types === "terraform");
+    const kindPacks = [...byLexicon.values()].filter((p) => p.mapping.types !== "terraform");
+    const nodes = new Map();
+    const edges = [];
+    const lexicons = new Set();
+    const irById = new Map(ir.nodes.map((n) => [n.id, n]));
+    const packOf = new Map();
+    const typeAndPack = (n) => {
+        const tf = terraformType(n);
+        if (tf !== undefined)
+            return terraformPack ? { type: tf, pack: terraformPack } : undefined;
+        const kind = n.kind ?? "";
+        const pack = kindPacks.find((p) => p.mapping.labels?.[kind] !== undefined);
+        return pack ? { type: kind, pack } : undefined;
+    };
+    const bodyOf = (n, pack) => {
+        const attrs = (n.attrs ?? {});
+        if (!pack.mapping.body)
+            return attrs;
+        const b = attrs[pack.mapping.body];
+        return b && typeof b === "object" && !Array.isArray(b) ? b : {};
+    };
+    // Terraform locals, per scope, so `tags = local.restricted` reads as a map.
+    const locals = new Map();
+    const scopeOf = (id) => id.slice(0, id.lastIndexOf("/") + 1);
+    for (const n of ir.nodes) {
+        if (n.kind !== "Terraform::Locals")
+            continue;
+        const body = (n.attrs?.body ?? {});
+        locals.set(scopeOf(n.id), { ...locals.get(scopeOf(n.id)), ...body });
+    }
+    const resolveLocal = (from, v) => {
+        const m = typeof v === "string" ? /^\$\{local\.([\w-]+)\}$/.exec(v) : null;
+        return m ? locals.get(scopeOf(from))?.[m[1]] : v;
+    };
+    // ---- nodes
+    for (const n of ir.nodes) {
+        const tp = typeAndPack(n);
+        if (!tp)
+            continue;
+        const { type, pack } = tp;
+        const m = pack.mapping;
+        const spec = m.labels?.[type];
+        if (spec === undefined)
+            continue;
+        const label = typeof spec === "string" ? spec : spec.label;
+        const body = bodyOf(n, pack);
+        if (typeof spec !== "string" && !matchesWhen(body, spec.when))
+            continue;
+        const attrs = { type };
+        if (typeof spec !== "string" && spec.style)
+            attrs.style = spec.style;
+        if (typeof spec !== "string" && spec.set)
+            Object.assign(attrs, spec.set);
+        for (const [neutral, src] of Object.entries(m.attrs?.[label] ?? {})) {
+            const v = readSource(body, src);
+            if (v !== undefined)
+                attrs[neutral] = resolveLocal(n.id, v);
+        }
+        // Carry the IR's own derived attributes (a live read's `internetFacing`).
+        for (const [k, v] of Object.entries((n.attrs ?? {}))) {
+            if (k === "internetFacing" && attrs[k] === undefined)
+                attrs[k] = v;
+        }
+        if (m.classificationTags?.length) {
+            for (const path of m.tags ?? []) {
+                const tags = resolveLocal(n.id, readPath(body, path)[0]);
+                const map = Array.isArray(tags)
+                    ? Object.fromEntries(tags.map((t) => [t.Key, t.Value]))
+                    : tags && typeof tags === "object"
+                        ? tags
+                        : {};
+                for (const key of m.classificationTags) {
+                    if (map[key] !== undefined && attrs.classification === undefined)
+                        attrs.classification = map[key];
+                }
+            }
+        }
+        normalize(label, attrs);
+        nodes.set(n.id, { id: n.id, label, irId: n.id, lexicon: m.lexicon, attrs, body });
+        packOf.set(n.id, pack);
+        lexicons.add(m.lexicon);
+    }
+    // ---- references inside attribute values
+    const byName = new Map();
+    for (const v of nodes.values()) {
+        const name = v.attrs.name;
+        if (typeof name !== "string" || !name)
+            continue;
+        if (!byName.has(v.label))
+            byName.set(v.label, new Map());
+        byName.get(v.label).set(name, v.id);
+    }
+    const refTarget = (from, value) => {
+        const pack = packOf.get(from);
+        if (value && typeof value === "object") {
+            const ref = value.$ref;
+            if (typeof ref === "string") {
+                if (nodes.has(ref))
+                    return { id: ref };
+                const dot = ref.lastIndexOf(".");
+                if (dot > 0 && nodes.has(ref.slice(0, dot)))
+                    return { id: ref.slice(0, dot), attr: ref.slice(dot + 1) };
+                return undefined;
+            }
+            const sub = value.$sub;
+            if (typeof sub === "string") {
+                const m = /\$\{([^.}]+)(?:\.([^}]+))?\}/.exec(sub);
+                if (m && nodes.has(m[1]))
+                    return { id: m[1], attr: m[2] };
+            }
+            return undefined;
+        }
+        if (typeof value !== "string")
+            return undefined;
+        if (pack?.mapping.refs === "terraform") {
+            const m = /(?:^|[^\w.])((?:data\.)?[a-z][a-z0-9]*_[a-z0-9_]+\.[A-Za-z0-9_-]+)(?:\[[^\]]*\])?\.([A-Za-z_]+)/.exec(value);
+            if (m) {
+                const id = scopeOf(from) + m[1];
+                if (nodes.has(id))
+                    return { id, attr: m[2] };
+            }
+        }
+        for (const { label, re } of ARN_NAMES) {
+            const m = re.exec(value);
+            const id = m ? byName.get(label)?.get(m[1]) : undefined;
+            if (id)
+                return { id };
+        }
+        return undefined;
+    };
+    const unresolved = [];
+    // An ARN that names nothing declared here is kept for a workspace's composer (#4378).
+    const keepArn = (from, fromAttr, edge, value) => {
+        if (typeof value === "string" && ARN_NAMES.some(({ re }) => re.test(value)))
+            unresolved.push({ from, fromAttr, edge, value });
+    };
+    const blockEdges = [];
+    // ---- inline blocks: ingress rules, inline routes
+    for (const v of [...nodes.values()]) {
+        const pack = packOf.get(v.id);
+        const specs = pack.mapping.blocks?.[v.label];
+        if (!specs)
+            continue;
+        const body = bodyOf(irById.get(v.id), pack);
+        for (const spec of specs) {
+            readPath(body, spec.attr)
+                .flatMap(arr)
+                .forEach((raw, i) => {
+                if (!raw || typeof raw !== "object" || !matchesWhen(raw, spec.when))
+                    return;
+                const id = `${v.id}#${spec.attr.replace(/\[\]/g, "")}[${i}]`;
+                const attrs = { block: true };
+                if (spec.style)
+                    attrs.style = spec.style;
+                for (const [neutral, src] of Object.entries(spec.attrs ?? {})) {
+                    const val = readSource(raw, src);
+                    if (val !== undefined)
+                        attrs[neutral] = val;
+                }
+                normalize(spec.label, attrs);
+                nodes.set(id, { id, label: spec.label, irId: v.id, lexicon: v.lexicon, attrs, body: raw });
+                packOf.set(id, pack);
+                const back = spec.edge.startsWith("-");
+                const name = back ? spec.edge.slice(1) : spec.edge;
+                const hop = { from: v.id, fromAttr: spec.attr.replace(/\[\]/g, ""), to: id, edge: name };
+                blockEdges.push(back ? { from: id, to: v.id, name, hops: [hop] } : { from: v.id, to: id, name, hops: [hop] });
+                for (const [attr, edge] of Object.entries(spec.refs ?? {})) {
+                    for (const val of arr(raw[attr])) {
+                        const t = refTarget(v.id, val);
+                        if (!t)
+                            keepArn(id, attr, edge, val);
+                        if (t)
+                            blockEdges.push({ from: id, to: t.id, name: edge, hops: [{ from: id, fromAttr: attr, to: t.id, ...(t.attr ? { toAttr: t.attr } : {}), edge }] });
+                    }
+                }
+            });
+        }
+    }
+    // Blocks first: an inline route is read before a separate route resource,
+    // the order the folds always used.
+    edges.push(...blockEdges);
+    // ---- IR edges, named per label
+    for (const e of ir.edges ?? []) {
+        const from = nodes.get(e.from);
+        const to = nodes.get(e.to);
+        if (!from || !to)
+            continue;
+        const pack = packOf.get(e.from);
+        const via = e.viaAttr ?? e.kind ?? "";
+        const spec = pack.mapping.edges?.[from.label]?.[via];
+        const name = typeof spec === "string" ? spec : spec?.[to.label];
+        if (!name)
+            continue;
+        const back = name.startsWith("-");
+        const n = back ? name.slice(1) : name;
+        const hop = irHop(e, n);
+        edges.push(back ? { from: e.to, to: e.from, name: n, hops: [hop] } : { from: e.from, to: e.to, name: n, hops: [hop] });
+    }
+    // ---- link resources -> one edge
+    for (const v of [...nodes.values()]) {
+        const link = packOf.get(v.id)?.mapping.links?.[v.label];
+        if (!link)
+            continue;
+        const a = edges.find((e) => e.from === v.id && e.name === link.from);
+        const b = edges.find((e) => e.from === v.id && e.name === link.to);
+        if (a && b)
+            edges.push({ from: a.to, to: b.to, name: link.edge, hops: [...a.hops, ...b.hops] });
+    }
+    // ---- policy documents -> statements
+    for (const holder of [...nodes.values()]) {
+        if (holder.attrs.block)
+            continue;
+        const pack = packOf.get(holder.id);
+        const docs = pack.mapping.documents?.[holder.label];
+        if (!docs)
+            continue;
+        const body = bodyOf(irById.get(holder.id), pack);
+        for (const [path, docKind] of Object.entries(docs)) {
+            readPath(body, path).forEach((raw, di) => {
+                const doc = readDocument(raw, pack);
+                if (!doc)
+                    return;
+                const base = path.replace(/\[\]/g, "");
+                arr(doc.Statement).forEach((s0, si) => {
+                    if (!s0 || typeof s0 !== "object")
+                        return;
+                    const s = s0;
+                    const id = `${holder.id}#${base}[${di}].Statement[${si}]`;
+                    const principal = s.Principal;
+                    const principals = principal === "*"
+                        ? ["*"]
+                        : principal && typeof principal === "object"
+                            ? Object.values(principal).flatMap(arr).map((p) => (typeof p === "string" ? p : "ref"))
+                            : [];
+                    const resources = arr(s.Resource);
+                    const attrs = {
+                        doc: docKind,
+                        effect: s.Effect,
+                        actions: arr(s.Action).map(String),
+                        ...(s.NotAction !== undefined ? { notActions: arr(s.NotAction).map(String) } : {}),
+                        ...(s.NotResource !== undefined ? { notResource: true } : {}),
+                        ...(s.Condition !== undefined ? { condition: true } : {}),
+                        ...(resources.some((r) => r === "*") ? { anyResource: true } : {}),
+                        principals,
+                    };
+                    nodes.set(id, { id, label: "Statement", irId: holder.id, lexicon: holder.lexicon, attrs });
+                    packOf.set(id, pack);
+                    edges.push({ from: holder.id, to: id, name: "statement", hops: [{ from: holder.id, fromAttr: base, to: id, edge: "statement" }] });
+                    let unresolved = 0;
+                    resources.forEach((r, ri) => {
+                        const t = refTarget(holder.id, r);
+                        // A reference the graph holds but can't name (an intrinsic with
+                        // no target, a Terraform expression to an undeclared resource) is
+                        // counted, so an answer can say what it skipped. A `Sub` is read
+                        // through its `$sub` template (chant#4373).
+                        if (!t && ((r && typeof r === "object") || (typeof r === "string" && r.includes("${"))))
+                            unresolved++;
+                        if (!t)
+                            keepArn(id, `Resource[${ri}]`, "resource", r);
+                        if (t)
+                            edges.push({ from: id, to: t.id, name: "resource", hops: [{ from: id, fromAttr: `Resource[${ri}]`, to: t.id, ...(t.attr ? { toAttr: t.attr } : {}), edge: "resource" }] });
+                    });
+                    if (unresolved > 0)
+                        attrs.unresolved = unresolved;
+                    if (principal && typeof principal === "object") {
+                        for (const p of arr(principal.AWS)) {
+                            const t = refTarget(holder.id, p);
+                            if (!t)
+                                keepArn(id, "Principal.AWS", "principal", p);
+                            if (t)
+                                edges.push({ from: id, to: t.id, name: "principal", hops: [{ from: id, fromAttr: "Principal.AWS", to: t.id, ...(t.attr ? { toAttr: t.attr } : {}), edge: "principal" }] });
+                        }
+                    }
+                });
+            });
+        }
+    }
+    return { nodes, edges, lexicons, unresolved };
+}
+/** The version of the serialized view a member's `chant graph --capability-view` prints (#4378). */
+export const VIEW_DOCUMENT_VERSION = 1;
+export function serializeView(view) {
+    return {
+        version: VIEW_DOCUMENT_VERSION,
+        lexicons: [...view.lexicons].sort(),
+        nodes: [...view.nodes.values()].map((n) => ({ id: n.id, label: n.label, irId: n.irId, lexicon: n.lexicon, attrs: n.attrs })),
+        edges: view.edges,
+        unresolved: view.unresolved ?? [],
+    };
+}
+/** Whether a member printed a view this chant reads; anything else is treated as no view. */
+export function isViewDocument(v) {
+    if (!v || typeof v !== "object")
+        return false;
+    const d = v;
+    return d.version === VIEW_DOCUMENT_VERSION && Array.isArray(d.nodes) && Array.isArray(d.edges) && Array.isArray(d.lexicons);
+}
+/** A view document with every id it holds given `prefix` (`<member>/`), as `workspace graph` composes ids. */
+export function prefixView(doc, prefix) {
+    const p = (id) => `${prefix}${id}`;
+    const hop = (h) => ({ ...h, from: p(h.from), to: p(h.to) });
+    return {
+        version: doc.version,
+        lexicons: doc.lexicons,
+        nodes: doc.nodes.map((n) => ({ ...n, id: p(n.id), irId: p(n.irId) })),
+        edges: doc.edges.map((e) => ({ ...e, from: p(e.from), to: p(e.to), hops: e.hops.map(hop) })),
+        unresolved: (doc.unresolved ?? []).map((u) => ({ ...u, from: p(u.from) })),
+    };
+}
+/**
+ * Compose member views into one (#4378), the matcher's input over a
+ * workspace. Each member's view was mapped by its own chant; the one thing
+ * left to do here is resolve the ARNs a member couldn't, by name over every
+ * member's nodes. Where several members declare the name, the last one in
+ * member order wins, as within one view.
+ */
+export function composeViews(docs) {
+    const nodes = new Map();
+    const edges = [];
+    const lexicons = new Set();
+    for (const d of docs) {
+        for (const n of d.nodes)
+            nodes.set(n.id, { ...n });
+        edges.push(...d.edges);
+        for (const l of d.lexicons)
+            lexicons.add(l);
+    }
+    const byName = new Map();
+    for (const v of nodes.values()) {
+        const name = v.attrs.name;
+        if (typeof name !== "string" || !name)
+            continue;
+        if (!byName.has(v.label))
+            byName.set(v.label, new Map());
+        byName.get(v.label).set(name, v.id);
+    }
+    const unresolved = [];
+    for (const u of docs.flatMap((d) => d.unresolved ?? [])) {
+        let to;
+        for (const { label, re } of ARN_NAMES) {
+            const m = re.exec(u.value);
+            to = m ? byName.get(label)?.get(m[1]) : undefined;
+            if (to)
+                break;
+        }
+        if (to)
+            edges.push({ from: u.from, to, name: u.edge, hops: [{ from: u.from, fromAttr: u.fromAttr, to, edge: u.edge }] });
+        else
+            unresolved.push(u);
+    }
+    return { nodes, edges, lexicons, unresolved };
+}
+function irHop(e, name) {
+    return {
+        from: e.from,
+        ...(e.viaAttr ? { fromAttr: e.viaAttr } : {}),
+        to: e.to,
+        ...(e.toAttr ? { toAttr: e.toAttr } : {}),
+        edge: name,
+    };
+}
+function readDocument(raw, pack) {
+    if (pack.adapter?.readDocument)
+        return pack.adapter.readDocument(raw);
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+        const inner = raw.PolicyDocument;
+        return inner && typeof inner === "object" ? inner : raw;
+    }
+    if (typeof raw === "string") {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}

package/dist/cli/commands/carve.d.ts

@@ -74,6 +74,9 @@ export declare function carveAdvise(opts: CarveAdviseOptions): Promise<CarveAdvi
  * additive and ignorable: the top-level `source` discriminator, per-resource
  * `notes` and `members`, and two more `bridge` values in a list that was
  * already declared open-ended.
+ *
+ * Per-resource `radius` (#2326) is additive the same way: a new field beside
+ * `score`, not a term inside it, so the score and its penalties are unchanged.
  */
 export declare const CARVE_REPORT_VERSION = 1;
 /** One ranked resource in the JSON report: its score, plus the boundary its carve would cut. */

package/dist/cli/commands/carve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"carve.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/carve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,EAAe,KAAK,WAAW,EAAwB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAAkB,KAAK,YAAY,EAAqB,MAAM,uBAAuB,CAAC;AAC7F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,KAAK,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAID,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAatF;AA4CD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,gGAAgG;AAChG,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;CAClE;AAED,yGAAyG;AACzG,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC;AAED,+CAA+C;AAC/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,iBAAiB,GAAG,eAAe,CAiBpE;AAeD,6CAA6C;AAC7C,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAqCnE"}
+{"version":3,"file":"carve.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/carve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,EAAe,KAAK,WAAW,EAAwB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAAqD,KAAK,YAAY,EAAqB,MAAM,uBAAuB,CAAC;AAChI,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,KAAK,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAID,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAatF;AA4CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,gGAAgG;AAChG,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;CAClE;AAED,yGAAyG;AACzG,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC;AAED,+CAA+C;AAC/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,iBAAiB,GAAG,eAAe,CAkBpE;AAiBD,6CAA6C;AAC7C,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CA+CnE"}

package/dist/cli/commands/carve.js

@@ -18,7 +18,7 @@ import { adviseCloudAssembly, CDK_DIALECT } from "../../cdk/advise.js";
 import { isCloudAssembly } from "../../cdk/assembly.js";
 import { parseTerraformDir, Hcl2JsonNotInstalled } from "../../terraform/parse.js";
 import { scoreEstate } from "../../terraform/score.js";
-import { boundaryReport } from "../../terraform/carve.js";
+import { boundaryIndex, boundaryReport } from "../../terraform/carve.js";
 const BAND_ORDER = ["clean leaf", "carvable w/ edits", "leave in Terraform"];
 export async function carveAdvise(opts) {
     if (!opts.from) {
@@ -100,6 +100,9 @@ async function adviseTerraform(opts) {
  * additive and ignorable: the top-level `source` discriminator, per-resource
  * `notes` and `members`, and two more `bridge` values in a list that was
  * already declared open-ended.
+ *
+ * Per-resource `radius` (#2326) is additive the same way: a new field beside
+ * `score`, not a term inside it, so the score and its penalties are unchanged.
  */
 export const CARVE_REPORT_VERSION = 1;
 /** Build the `--json` / `--report` payload. */
@@ -108,6 +111,7 @@ export function carveJson(result) {
     const counts = Object.fromEntries(BAND_ORDER.map((b) => [b, results.filter((r) => r.band === b).length]));
     const source = result.source ?? "terraform";
     const dialect = source === "cdk" ? CDK_DIALECT : "terraform";
+    const index = result.graph ? boundaryIndex(result.graph) : undefined;
     return {
         version: CARVE_REPORT_VERSION,
         from: result.from,
@@ -116,14 +120,15 @@ export function carveJson(result) {
         count: results.length,
         bands: counts,
         ...(result.diagnostics?.length ? { diagnostics: result.diagnostics } : {}),
-        resources: results.map((r) => withBoundary(r, result.graph, dialect, result.scoreOptions)),
+        resources: results.map((r) => withBoundary(r, result.graph, dialect, result.scoreOptions, index)),
     };
 }
 /** A scored resource plus its carve boundary, when the graph is at hand (#1636). */
-function withBoundary(r, graph, dialect, score) {
+function withBoundary(r, graph, dialect, score, index) {
     if (!graph)
         return r;
-    const report = boundaryReport(graph, r.address, { dialect, score });
+    // The ranking already scored this resource; the report reads it back rather than rescoring the estate (#4391).
+    const report = boundaryReport(graph, r.address, { dialect, score, peelability: r, index });
     if (!report)
         return r;
     return { ...r, boundary: { inbound: report.inbound, outbound: report.outbound } };
@@ -145,6 +150,8 @@ export function formatCarveReport(result) {
     for (const note of result.diagnostics ?? [])
         lines.push(`  ! ${note}`);
     lines.push("");
+    const cells = new Map(results.map((r) => [r.address, radiusCell(r)]));
+    const cellWidth = Math.max(...[...cells.values()].map((c) => c.length));
     for (const band of BAND_ORDER) {
         const inBand = results.filter((r) => r.band === band);
         if (inBand.length === 0)
@@ -152,16 +159,38 @@ export function formatCarveReport(result) {
         lines.push(`${bandLabel(band, cdk)}  (${inBand.length})`);
         for (const r of inBand) {
             const target = r.mapsTo ? ` -> ${r.mapsTo}` : "";
-            lines.push(`  ${String(r.score).padStart(3)}  ${r.address}${target}`);
-            lines.push(`       ${reasons(r, cdk)}`);
+            const cell = cellWidth > 0 ? `${cells.get(r.address).padEnd(cellWidth)}  ` : "";
+            const indent = " ".repeat(7 + (cellWidth > 0 ? cellWidth + 2 : 0));
+            lines.push(`  ${String(r.score).padStart(3)}  ${cell}${r.address}${target}`);
+            lines.push(`${indent}${reasons(r, cdk)}`);
             for (const note of r.notes ?? [])
-                lines.push(`       ${note}`);
+                lines.push(`${indent}${note}`);
         }
         lines.push("");
     }
     lines.push(`Bands: 80-100 carve now | 50-79 carve with boundary edits | 0-49 leave in ${cdk ? "CDK" : "Terraform"}`);
+    if (cellWidth > 0) {
+        lines.push("Radius: resources+outputs that depend on it at any depth, dN the farthest hop; - none; " +
+            (cdk ? "xN across a stack boundary." : "? a module or unresolved count/for_each hides how many."));
+    }
     return lines.join("\n").trimEnd();
 }
+/**
+ * The radius column (#2326): `3+1 d2` is three resources and one output that
+ * depend on the node, the farthest two hops away; `-` is nothing; `?` stands in
+ * for a count a module or unresolved `count` hides; ` x2` is how many sit
+ * across a stack boundary. Empty when the result carries no radius.
+ */
+function radiusCell(r) {
+    const radius = r.radius;
+    if (!radius)
+        return "";
+    if (radius.depth === 0)
+        return "-";
+    const n = (v) => (v === "unknown" ? "?" : String(v));
+    const cross = radius.crossStack !== undefined && radius.crossStack !== 0 ? ` x${n(radius.crossStack)}` : "";
+    return `${n(radius.resources)}+${radius.outputs} d${radius.depth}${cross}`;
+}
 function bandLabel(band, cdk) {
     switch (band) {
         case "clean leaf":

package/dist/cli/commands/import-report.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The review report of `chant import` (#4398): the parser's diagnostics as
+ * SARIF (`--report <path>`), a summary on stderr, and the exit code under
+ * `--strict`. The shape follows `chant migrate`: a needs-review diagnostic is
+ * a `warning`, and `--strict` makes any open `warning` or `error` fail the
+ * run. An `info` diagnostic names something not carried that needs no
+ * decision, and never fails a run.
+ */
+import type { ImportDiagnostic } from "../../import/parser.js";
+import type { LintDiagnostic } from "../../lint/rule.js";
+/** Import diagnostics as lint diagnostics against `file`, the template that was imported. */
+export declare function importDiagnosticsToLint(file: string, diagnostics: readonly ImportDiagnostic[]): LintDiagnostic[];
+/** The SARIF document for a run. */
+export declare function importSarif(file: string, diagnostics: readonly ImportDiagnostic[], version?: string): string;
+/** Write the SARIF report; an unwritable path is returned as a message, not thrown. */
+export declare function writeImportReport(path: string, file: string, diagnostics: readonly ImportDiagnostic[], version?: string): string | undefined;
+/** Diagnostics that are open: everything but `info`. */
+export declare function openDiagnostics(diagnostics: readonly ImportDiagnostic[]): ImportDiagnostic[];
+/**
+ * The exit code for a finished import. An `error` always fails (a failed
+ * `--validate`); a `warning` fails under `--strict`.
+ */
+export declare function importExitCode(diagnostics: readonly ImportDiagnostic[] | undefined, strict: boolean): number;
+/** Counts by severity and rule, as the lines printed after an import. */
+export declare function summarizeImportDiagnostics(diagnostics: readonly ImportDiagnostic[]): string;
+//# sourceMappingURL=import-report.d.ts.map

package/dist/cli/commands/import-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-report.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/import-report.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD,6FAA6F;AAC7F,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,gBAAgB,EAAE,GAAG,cAAc,EAAE,CAUhH;AAED,oCAAoC;AACpC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,gBAAgB,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5G;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,gBAAgB,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO5I;AAED,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,GAAG,gBAAgB,EAAE,CAE5F;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAI5G;AAED,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAY3F"}