@intentius/chant 0.124.45 → 0.124.48

package/dist/cli/commands/import-report.js

@@ -0,0 +1,65 @@
+/**
+ * The review report of `chant import` (#4398): the parser's diagnostics as
+ * SARIF (`--report <path>`), a summary on stderr, and the exit code under
+ * `--strict`. The shape follows `chant migrate`: a needs-review diagnostic is
+ * a `warning`, and `--strict` makes any open `warning` or `error` fail the
+ * run. An `info` diagnostic names something not carried that needs no
+ * decision, and never fails a run.
+ */
+import { writeFileSync } from "fs";
+import { formatSarif } from "../reporters/stylish.js";
+/** Import diagnostics as lint diagnostics against `file`, the template that was imported. */
+export function importDiagnosticsToLint(file, diagnostics) {
+    return diagnostics.map((d) => ({
+        file,
+        line: d.line ?? 1,
+        column: d.column ?? 1,
+        ruleId: d.ruleId,
+        severity: d.severity,
+        message: d.message,
+        ...(d.entity ? { entity: d.entity } : {}),
+    }));
+}
+/** The SARIF document for a run. */
+export function importSarif(file, diagnostics, version) {
+    return formatSarif(importDiagnosticsToLint(file, diagnostics), undefined, undefined, version);
+}
+/** Write the SARIF report; an unwritable path is returned as a message, not thrown. */
+export function writeImportReport(path, file, diagnostics, version) {
+    try {
+        writeFileSync(path, importSarif(file, diagnostics, version));
+        return undefined;
+    }
+    catch (err) {
+        return `could not write SARIF report to ${path}: ${err instanceof Error ? err.message : String(err)}`;
+    }
+}
+/** Diagnostics that are open: everything but `info`. */
+export function openDiagnostics(diagnostics) {
+    return diagnostics.filter((d) => d.severity !== "info");
+}
+/**
+ * The exit code for a finished import. An `error` always fails (a failed
+ * `--validate`); a `warning` fails under `--strict`.
+ */
+export function importExitCode(diagnostics, strict) {
+    if (!diagnostics)
+        return 0;
+    if (diagnostics.some((d) => d.severity === "error"))
+        return 1;
+    return strict && diagnostics.some((d) => d.severity === "warning") ? 1 : 0;
+}
+/** Counts by severity and rule, as the lines printed after an import. */
+export function summarizeImportDiagnostics(diagnostics) {
+    const bySeverity = { error: 0, warning: 0, info: 0 };
+    const byRule = new Map();
+    for (const d of diagnostics) {
+        bySeverity[d.severity]++;
+        byRule.set(d.ruleId, (byRule.get(d.ruleId) ?? 0) + 1);
+    }
+    const rules = [...byRule].sort(([a], [b]) => a.localeCompare(b)).map(([id, n]) => `${id} x${String(n)}`);
+    return [
+        `Review: ${String(bySeverity.warning)} to review, ${String(bySeverity.error)} errors, ${String(bySeverity.info)} notes (${rules.join(", ")}).`,
+        "Write them with --report <path> as SARIF; --strict fails while any to review or error is open.",
+    ].join("\n");
+}

package/dist/cli/commands/import.d.ts

@@ -1,4 +1,4 @@
-import type { TemplateIR } from "../../import/parser.js";
+import type { TemplateIR, ImportDiagnostic } from "../../import/parser.js";
 import type { GeneratedFile, TypeScriptGenerator } from "../../import/generator.js";
 import type { LexiconPlugin, ResourceSelector } from "../../lexicon.js";
 /**
@@ -22,6 +22,8 @@ export interface ImportOptions {
      * fails the import before anything is parsed.
      */
     parserOptions?: string[];
+    /** `--validate` (#4398): check the parsed template on the lexicon's emulator before writing. */
+    validate?: boolean;
 }
 /**
  * Import command result
@@ -42,6 +44,12 @@ export interface ImportResult {
      * it was named (`--lexicon`, `--kustomize`) (#2965).
      */
     detected?: boolean;
+    /**
+     * What the parser flagged for review (#4398), then what `--validate`
+     * rejected. `--report` writes them as SARIF and `--strict` fails while a
+     * `warning` or `error` is open; see `./import-report.ts`.
+     */
+    diagnostics?: ImportDiagnostic[];
 }
 /**
  * Parse template content for detection (#2935): JSON first, then YAML. A YAML
@@ -114,6 +122,8 @@ export interface ContentImportOptions {
     force?: boolean;
     /** `--parser-option` entries for the lexicon's parser (#2994); see {@link ImportOptions.parserOptions}. */
     parserOptions?: string[];
+    /** `--validate`; see {@link ImportOptions.validate}. */
+    validate?: boolean;
 }
 export declare function importFromContent(options: ContentImportOptions): Promise<ImportResult>;
 /**

package/dist/cli/commands/import.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/import.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAyC,MAAM,qBAAqB,CAAC;AAC7F,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEjF,OAAO,KAAK,EAAoB,aAAa,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMvF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,sBAAsB;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,SAAS,CAmB7E;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,MAAM,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,2EAA2E;IAC3E,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAsBD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,OAAO,EAAE,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAiCxC;AA0CD,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwBD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,mBAAmB,GAC7B,cAAc,CA0DhB;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA8EjF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2GAA2G;IAC3G,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmB5F;AAuFD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA0BpG;AA4GD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;uBAEmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+GAA+G;IAC/G,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAkBD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAatF;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,QAAQ,CAAC,EACpD,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,OAAO,CAAC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC,CAezD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EAAE,EACxB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,YAAY,CAAC,CAgHvB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAsB5D"}
+{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/import.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAyC,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEjF,OAAO,KAAK,EAAoB,aAAa,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAOvF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,sBAAsB;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAClC;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,SAAS,CAmB7E;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,MAAM,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,2EAA2E;IAC3E,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAsBD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,OAAO,EAAE,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAiCxC;AA0CD,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwBD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,mBAAmB,GAC7B,cAAc,CA0DhB;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA+EjF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2GAA2G;IAC3G,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmB5F;AAuFD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA0BpG;AA0HD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;uBAEmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+GAA+G;IAC/G,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAkBD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAatF;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,QAAQ,CAAC,EACpD,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,OAAO,CAAC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC,CAezD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EAAE,EACxB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,YAAY,CAAC,CAgHvB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CA0B5D"}

package/dist/cli/commands/import.js

@@ -5,6 +5,7 @@ import { listInstalledLexicons, loadPlugin, loadPlugins, resolveProjectLexicons
 import { parseYAMLDocument, splitYAMLDocuments } from "../../yaml.js";
 import { importLexiconPackage } from "../../lexicon-module.js";
 import { resolveParserOptions } from "../../import/parser-options.js";
+import { summarizeImportDiagnostics } from "./import-report.js";
 import { EmbeddedImports } from "../../import/embedded.js";
 /**
  * Parse template content for detection (#2935): JSON first, then YAML. A YAML
@@ -257,6 +258,7 @@ export async function importCommand(options) {
             output: options.output,
             force: options.force,
             parserOptions: options.parserOptions,
+            validate: options.validate,
         });
     }
     // Parse for detection: JSON, falling back to YAML.
@@ -288,7 +290,7 @@ export async function importCommand(options) {
         warnings.push(`The template is also recognized by ${detection.alsoMatched.join(", ")}. ` +
             `Importing with ${plugin.name}; pass --lexicon <name> to choose another.`);
     }
-    const result = await parseAndWrite(plugin, content, outputDir, options.force, warnings, generatedFiles, plugin.name, projectDir, options.parserOptions);
+    const result = await parseAndWrite(plugin, content, outputDir, options.force, warnings, generatedFiles, plugin.name, projectDir, options.parserOptions, options.validate);
     return { ...result, detected: true };
 }
 export async function importFromContent(options) {
@@ -310,7 +312,7 @@ export async function importFromContent(options) {
         return { success: false, generatedFiles: [], warnings: [], error: `Lexicon "${options.lexicon}" not available.` };
     }
     const projectDir = resolve(options.output ? dirname(options.output) : ".");
-    return parseAndWrite(plugin, options.content, outputDir, options.force, [], [], plugin.name, projectDir, options.parserOptions);
+    return parseAndWrite(plugin, options.content, outputDir, options.force, [], [], plugin.name, projectDir, options.parserOptions, options.validate);
 }
 /**
  * The importers for the content a host's parser offered (#2962): those of the
@@ -431,7 +433,7 @@ export async function buildErrorWarnings(plugin, outputDir) {
     }
 }
 /** The shared tail of every template import: parse → generate → write. */
-async function parseAndWrite(plugin, content, outputDir, force, warnings, generatedFiles, lexicon, projectDir, parserOptionEntries) {
+async function parseAndWrite(plugin, content, outputDir, force, warnings, generatedFiles, lexicon, projectDir, parserOptionEntries, validate) {
     // A lexicon can recognize a template (detectTemplate) without being able to
     // import it (grafana had no parser until #2945). Every path funnels through here, so
     // this one check covers detection, --lexicon and content import (#2940).
@@ -470,6 +472,19 @@ async function parseAndWrite(plugin, content, outputDir, force, warnings, genera
     if (ir.warnings) {
         warnings.push(...ir.warnings);
     }
+    // Findings for review (#4398), and what the lexicon's emulator rejects.
+    const diagnostics = [...(ir.diagnostics ?? [])];
+    if (validate) {
+        if (!plugin.validateImport) {
+            return { success: false, generatedFiles: [], warnings: [], error: `lexicon "${plugin.name}" has no emulator to validate an import against`, lexicon: plugin.name };
+        }
+        try {
+            diagnostics.push(...(await plugin.validateImport(ir, resolved.options)));
+        }
+        catch (err) {
+            return { success: false, generatedFiles: [], warnings: [], error: `--validate failed to run: ${err instanceof Error ? err.message : String(err)}`, lexicon: plugin.name };
+        }
+    }
     // Embedded content the owner could not carry, or that no installed lexicon imports.
     if (embedded)
         warnings.push(...embedded.warnings);
@@ -512,6 +527,7 @@ async function parseAndWrite(plugin, content, outputDir, force, warnings, genera
         generatedFiles,
         warnings,
         lexicon,
+        ...(diagnostics.length > 0 ? { diagnostics } : {}),
     };
 }
 /**
@@ -699,6 +715,9 @@ export function printImportResult(result) {
     if (result.lexicon) {
         console.log(`${result.detected ? "Detected lexicon" : "Lexicon"}: ${result.lexicon}`);
     }
+    if (result.diagnostics && result.diagnostics.length > 0) {
+        console.error(summarizeImportDiagnostics(result.diagnostics));
+    }
     if (result.generatedFiles.length > 0) {
         console.log(formatSuccess("Generated files:"));
         for (const file of result.generatedFiles) {

package/dist/cli/commands/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAyCzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAoBhC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,WAAW,CAAC;AAsBnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AA2I9C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AA+eD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA+N3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAyCzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAoBhC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,WAAW,CAAC;AAsBnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AA2I9C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAgfD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA+N3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}

package/dist/cli/commands/lint.js

@@ -653,6 +653,7 @@ async function runLexiconPostSynthDiagnostics(infraPath, plugins, buildParams, s
         ruleId: d.checkId,
         severity: d.severity,
         message: `${d.entity ? `[${d.entity}] ` : ""}${d.message}`,
+        ...(d.entity ? { entity: d.entity } : {}),
     });
     for (const { plugin, diagnostics: raw } of runLexiconPostSynthChecks(withChecks, result, env, { activityContracts, telemetry, projectDir: configDir, ...(loadedConfig ? { projectConfig: loadedConfig } : {}) })) {
         const presetIds = resolvePresetIds(plugin.lintPresets?.(), lintConfig.presets?.[plugin.name] ?? "recommended");

package/dist/cli/commands/migrate.d.ts

@@ -6,11 +6,16 @@
  * stdout/stderr surfaces, and exit codes.
  */
 import type { LexiconPlugin } from "../../lexicon.js";
+/**
+ * A side of `--from` or `--to`: a lexicon, or a lexicon and one of its
+ * dialects, `sql/clickhouse` (#4399). The plugin is the part before the slash.
+ */
+export declare function lexiconOfSide(side: string): string;
 export interface MigrateCliOpts {
     sourceFile: string;
     from: string;
     to: string;
-    emit: "yaml" | "ts";
+    emit: "yaml" | "ts" | "sql";
     strict: boolean;
     validate: boolean;
     useComposites: boolean;
@@ -30,6 +35,8 @@ export interface MigrateCliResult {
     error?: string;
     /** Markdown summary lines printed to stderr */
     markdownSummary?: string;
+    /** What was done about workspace links, or why nothing was (#4399) */
+    linkNote?: string;
 }
 export declare function migrateCommand(opts: MigrateCliOpts): Promise<MigrateCliResult>;
 interface ValidatorResult {
@@ -46,6 +53,11 @@ interface ValidatorResult {
  * Exported for testability.
  */
 export declare function tryValidateExternal(yamlText: string): ValidatorResult;
+/**
+ * The report for a pair that is not GitHub to GitLab: the counts and the
+ * diagnostics, with none of that pair's workflow advice (#4399).
+ */
+export declare function formatDiagnosticSummary(provenance: Array<Record<string, unknown>>, diagnostics: Array<Record<string, unknown>>): string;
 /**
  * Format the migration report as Markdown, mirroring the output format
  * prescribed by the upstream gitlab-org/ci-cd/github-actions-to-gitlab-ci

package/dist/cli/commands/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAInD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsJpF;AAED,UAAU,eAAe;IACvB,GAAG,EAAE,OAAO,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AASD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAUrE;AAsBD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC3C,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAkER;AAyID,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAajE"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAKnD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0NpF;AAED,UAAU,eAAe;IACvB,GAAG,EAAE,OAAO,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AASD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAUrE;AAwCD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAavI;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC3C,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAkER;AAyID,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAgBjE"}

package/dist/cli/commands/migrate.js

@@ -5,13 +5,24 @@
  * The lexicon owns the actual translation logic; core orchestrates I/O,
  * stdout/stderr surfaces, and exit codes.
  */
-import { readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
 import { spawnSync } from "node:child_process";
 import { formatError, formatInfo } from "../format.js";
 import { formatSarif } from "../reporters/stylish.js";
 import { ensureTypeScriptLoader } from "../../ts-loader.js";
+import { planMigrateLinks } from "../../workspace/migrate-links.js";
+/**
+ * A side of `--from` or `--to`: a lexicon, or a lexicon and one of its
+ * dialects, `sql/clickhouse` (#4399). The plugin is the part before the slash.
+ */
+export function lexiconOfSide(side) {
+    const slash = side.indexOf("/");
+    return slash === -1 ? side : side.slice(0, slash);
+}
 export async function migrateCommand(opts) {
-    const targetPlugin = opts.plugins.find((p) => p.name === opts.to);
+    const targetLexicon = lexiconOfSide(opts.to);
+    const targetPlugin = opts.plugins.find((p) => p.name === targetLexicon);
     if (!targetPlugin) {
         return {
             exitCode: 1,
@@ -28,7 +39,7 @@ export async function migrateCommand(opts) {
             error: `Lexicon "${opts.to}" does not support migration`,
         };
     }
-    const source = targetPlugin.migrationSource(opts.from);
+    const source = targetPlugin.migrationSource(opts.from, opts.to);
     if (!source) {
         return {
             exitCode: 1,
@@ -38,8 +49,24 @@ export async function migrateCommand(opts) {
         };
     }
     let content;
+    // A directory is a workspace member: the source reads it itself (#4399).
+    let isDirectory = false;
+    try {
+        isDirectory = statSync(opts.sourceFile).isDirectory();
+    }
+    catch {
+        // The read below names the problem.
+    }
+    if (isDirectory && !source.directory) {
+        return {
+            exitCode: 1,
+            diagnostics: [],
+            provenance: [],
+            error: `${opts.sourceFile} is a directory, and migrating from "${opts.from}" reads a file`,
+        };
+    }
     try {
-        content = readFileSync(opts.sourceFile, "utf-8");
+        content = isDirectory ? "" : readFileSync(opts.sourceFile, "utf-8");
     }
     catch (err) {
         return {
@@ -49,7 +76,7 @@ export async function migrateCommand(opts) {
             error: `Cannot read ${opts.sourceFile}: ${err instanceof Error ? err.message : String(err)}`,
         };
     }
-    if (!source.detect(content)) {
+    if (!isDirectory && !source.detect(content)) {
         return {
             exitCode: 1,
             diagnostics: [],
@@ -80,6 +107,7 @@ export async function migrateCommand(opts) {
     // Write output (--output file or stdout)
     if (opts.output && opts.output !== "-") {
         try {
+            mkdirSync(dirname(opts.output), { recursive: true });
             writeFileSync(opts.output, result.output);
         }
         catch (err) {
@@ -94,9 +122,35 @@ export async function migrateCommand(opts) {
     else {
         process.stdout.write(result.output);
     }
+    // The target's own server (--validate), when the source has one (#4399).
+    // A refusal always fails the run; so does a server that could not start,
+    // since a validation that did not run is not a pass.
+    let validationFailed = false;
+    if (opts.validate && result.validate) {
+        try {
+            const found = await result.validate();
+            result.diagnostics.push(...found);
+            if (found.some((d) => d.severity === "error")) {
+                validationFailed = true;
+                console.error(`Validator found ${found.filter((d) => d.severity === "error").length} refused statement(s):\n${found.map((d) => `  ${String(d.message)}`).join("\n")}`);
+            }
+            else {
+                console.error("Validator (target server) OK");
+            }
+        }
+        catch (err) {
+            return {
+                exitCode: 1,
+                output: result.output,
+                diagnostics: result.diagnostics,
+                provenance: result.provenance,
+                error: `--validate did not run: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+    }
     // External validator (--validate) — glci preferred, glab fallback.
     let validatorWarning;
-    if (opts.validate && opts.emit === "yaml") {
+    if (opts.validate && !result.validate && opts.emit === "yaml") {
         const v = tryValidateExternal(result.output);
         if (!v.ran) {
             validatorWarning = "neither glci nor glab is on PATH; skipping --validate";
@@ -126,11 +180,37 @@ export async function migrateCommand(opts) {
             console.error(`Validator (${v.backend}) OK`);
         }
     }
+    // Links from the output's workspace member to the outputs it reads (#4399).
+    let linkNote;
+    if (result.links && result.links.length > 0) {
+        const outcome = planMigrateLinks({
+            sourcePath: opts.sourceFile,
+            outputPath: opts.output && opts.output !== "-" ? opts.output : undefined,
+            outputs: result.links,
+        });
+        if (outcome && "skipped" in outcome)
+            linkNote = outcome.skipped;
+        else if (outcome) {
+            const { plan } = outcome;
+            if (plan.added.length === 0) {
+                linkNote = `member ${plan.consumer} already links every output it reads from ${plan.producer}`;
+            }
+            else {
+                try {
+                    writeFileSync(plan.file, plan.text);
+                    linkNote = `added ${plan.added.length} link${plan.added.length === 1 ? "" : "s"} from member ${plan.consumer} to ${plan.producer} in ${plan.file}`;
+                }
+                catch (err) {
+                    linkNote = `could not write the links to ${plan.file}: ${err instanceof Error ? err.message : String(err)}`;
+                }
+            }
+        }
+    }
     // SARIF report (--report <path>) — reuse the lint-side formatSarif so any
     // CI SARIF ingest path treats migration findings uniformly.
     if (opts.reportFile) {
         try {
-            const rules = await loadMigrationRules(opts.to);
+            const rules = await loadMigrationRules(targetLexicon);
             const lintShape = result.diagnostics;
             const sarif = formatSarif(lintShape, rules);
             writeFileSync(opts.reportFile, sarif);
@@ -141,7 +221,7 @@ export async function migrateCommand(opts) {
         }
     }
     // Markdown summary (always to stderr — leaves stdout clean for piping)
-    let markdownSummary = formatMarkdownSummary(result.provenance, result.diagnostics, content);
+    let markdownSummary = targetLexicon === "gitlab" ? formatMarkdownSummary(result.provenance, result.diagnostics, content) : formatDiagnosticSummary(result.provenance, result.diagnostics);
     // Append the security posture section when security analysis ran (#306).
     if (result.securityPosture) {
         markdownSummary += `\n\n${result.securityPosture}`;
@@ -150,13 +230,14 @@ export async function migrateCommand(opts) {
     // The transformer already escalates needs-review → error when opts.strict
     // is passed via MigrationSource.transform(); we double-check here.
     const errorDiagnostics = result.diagnostics.filter((d) => d.severity === "error");
-    const exitCode = opts.strict && errorDiagnostics.length > 0 ? 1 : 0;
+    const exitCode = validationFailed || (opts.strict && errorDiagnostics.length > 0) ? 1 : 0;
     return {
         exitCode,
         output: result.output,
         diagnostics: result.diagnostics,
         provenance: result.provenance,
         markdownSummary,
+        ...(linkNote ? { linkNote } : {}),
     };
 }
 function isOnPath(cmd) {
@@ -188,7 +269,7 @@ export function tryValidateExternal(yamlText) {
  * Returns an empty array if the lexicon doesn't expose them.
  */
 async function loadMigrationRules(targetLexicon) {
-    // For now only gitlab exposes migration rules. Hard-coded import keeps
+    // gitlab and sql expose migration rules. Hard-coded imports keep
     // the dependency direction explicit; widen the switch when more
     // lexicons ship their own migrate paths.
     if (targetLexicon === "gitlab") {
@@ -201,8 +282,48 @@ async function loadMigrationRules(targetLexicon) {
             return [];
         }
     }
+    // The sql lexicon's needs-review catalog (#4399), one rule per finding id.
+    if (targetLexicon === "sql") {
+        try {
+            ensureTypeScriptLoader();
+            const mod = await import("@intentius/chant-lexicon-sql/clickhouse/review-catalog");
+            const rules = mod.REVIEW_RULES;
+            return Object.values(rules).map((r) => ({
+                id: r.id,
+                severity: "warning",
+                category: "correctness",
+                description: `${r.name}: ${r.summary}`,
+                helpUri: r.docs[0] ?? "https://intentius.io/chant/lexicons/sql/migrate-postgres-to-clickhouse/",
+                check: () => [],
+            }));
+        }
+        catch {
+            return [];
+        }
+    }
     return [];
 }
+/**
+ * The report for a pair that is not GitHub to GitLab: the counts and the
+ * diagnostics, with none of that pair's workflow advice (#4399).
+ */
+export function formatDiagnosticSummary(provenance, diagnostics) {
+    const totals = { error: 0, warning: 0, info: 0 };
+    for (const d of diagnostics) {
+        const sev = d.severity;
+        if (sev === "error" || sev === "warning" || sev === "info")
+            totals[sev]++;
+    }
+    const lines = ["", "## Migration report", "", `- Translated: ${provenance.length}`, `- Diagnostics: ${totals.error} error, ${totals.warning} warning, ${totals.info} info`];
+    if (diagnostics.length > 0) {
+        lines.push("", "### Diagnostics", "", "| Severity | Rule | Message |", "|---|---|---|");
+        for (const d of diagnostics.slice(0, 50))
+            lines.push(`| ${String(d.severity)} | ${String(d.ruleId)} | ${String(d.message).replace(/\|/g, "\\|").slice(0, 160)} |`);
+        if (diagnostics.length > 50)
+            lines.push(`| ... | ... | ${diagnostics.length - 50} more diagnostics omitted |`);
+    }
+    return lines.join("\n");
+}
 /**
  * Format the migration report as Markdown, mirroring the output format
  * prescribed by the upstream gitlab-org/ci-cd/github-actions-to-gitlab-ci
@@ -414,6 +535,9 @@ export function printMigrateResult(result) {
     if (result.markdownSummary) {
         console.error(result.markdownSummary);
     }
+    if (result.linkNote) {
+        console.error(`\nWorkspace links: ${result.linkNote}`);
+    }
     if (result.exitCode === 0) {
         console.error(formatInfo("\nMigration complete."));
     }

package/dist/cli/handlers/approve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approve.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/approve.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EACuE,KAAK,UAAU,EAC5F,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EAEuC,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EAChG,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAiE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAO3H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAkDlD,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6GrE;AAED,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oGAAoG;IACpG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AA0ClB;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CAqX9B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,oBAAoB,EAAE,EAC7B,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,OAAO,GAAE,SAAS,iBAAiB,EAA+B,EAClE,KAAK,GAAE,eAAgC,GACtC,MAAM,EAAE,CAuCV"}
+{"version":3,"file":"approve.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/approve.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EACuE,KAAK,UAAU,EAC5F,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EAEuC,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EAChG,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAiE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAO3H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAkDlD,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6GrE;AAED,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oGAAoG;IACpG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AA0ClB;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CA0Y9B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,oBAAoB,EAAE,EAC7B,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,OAAO,GAAE,SAAS,iBAAiB,EAA+B,EAClE,KAAK,GAAE,eAAgC,GACtC,MAAM,EAAE,CAuCV"}

package/dist/cli/handlers/approve.js

@@ -488,6 +488,21 @@ export async function recordGateApproval(opName, gate, opts) {
     // decision is written next to the approval, so a pass can be traced to the
     // rule that allowed it.
     const approval = standingForOrigin?.approval;
+    // #4290, #4324: roles come from .chant/trust.json at base, for an approver
+    // a seal proves. The quorum and the policy both read these, never --role.
+    const judge = trustQuorumJudge({ signers: scope.policy, roles: scope.policy.roles });
+    const trusted = judge({
+        version: 1,
+        op: opName,
+        gate,
+        ...(environment !== undefined ? { environment } : {}),
+        ...(planDigest !== undefined ? { planDigest } : {}),
+        resolvedBy,
+        ...(relayedBy ? { relayedBy } : {}),
+        timestamp,
+        ...(checkpointDigest !== undefined ? { checkpointDigest } : {}),
+        ...(seal ? { seal } : {}),
+    }).roles;
     let policyDecision;
     if (approval?.policy) {
         try {
@@ -497,6 +512,7 @@ export async function recordGateApproval(opName, gate, opts) {
                 gate,
                 resolvedBy,
                 approver,
+                roles: trusted,
                 ...(planDigest !== undefined ? { planDigest } : {}),
                 ...(approval.context ? { context: approval.context } : {}),
             }));
@@ -557,9 +573,12 @@ export async function recordGateApproval(opName, gate, opts) {
         console.error(formatInfo(`The next run resumes at this gate from run ${standing?.runId ?? "(unknown)"}'s checkpoint ${record.checkpointDigest}, ` +
             "after it plans again. A moved plan or another commit starts it at the first phase."));
     }
+    const untrusted = (approver.roles ?? []).filter((r) => !trusted.includes(r));
+    if (untrusted.length > 0) {
+        console.error(formatInfo(`--role ${untrusted.join(", ")} is recorded on the approval and trusted by nothing: a gate's quorum and policy read ` +
+            `${record.resolvedBy}'s roles from .chant/trust.json at base, and only for an approval sealed by a signer listed at base (chant approve --sign).`));
+    }
     if (approval) {
-        // #4290: the rules count roles from .chant/trust.json at base, for a proven approver.
-        const judge = trustQuorumJudge({ signers: scope.policy, roles: scope.policy.roles });
         for (const line of describeApprovalProgress(approval, record, ledger.resolutions, standingForOrigin, ledger.pending, judge)) {
             console.error(formatInfo(line));
         }

package/dist/cli/handlers/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/build.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAqPlD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsJnE"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/build.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA2PlD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsJnE"}

package/dist/cli/handlers/build.js

@@ -168,6 +168,11 @@ async function runGenerateComponents(ctx) {
             return 1;
         }
     }
+    // #4327: ci.locks: plan adds the lock and unlock jobs. Read from the declaration, as the security groups are; GitLab keeps its own jobs.
+    let locks;
+    if (found && args.prLoop && lexicon !== "gitlab") {
+        locks = (await import("../../workspace/ci-locks.js")).ciLocksAt(resolve(args.path)) === "plan" ? "plan" : undefined;
+    }
     // Which lexicons support generate mode is a property of the loaded lexicon
     // plugins (those implementing `generateComponentPipeline`, #688), not a
     // hard-coded core list — `generateComponentsPipeline` returns a descriptive
@@ -186,7 +191,7 @@ async function runGenerateComponents(ctx) {
             : {}),
         // #3183: a plan job per pull request and an apply job per merge.
         // #4292: on the branch ci.branches routes the member to, when it routes it.
-        ...(args.prLoop ? { prLoop: { ...prLoopOption(args, reportUrl, reviewRules, isolatedRunners), ...(plan?.branch ? { branch: plan.branch } : {}), ...(identity ? { identity } : {}), ...(prEnvIdentity ? { prEnvIdentity } : {}) } } : {}),
+        ...(args.prLoop ? { prLoop: { ...prLoopOption(args, reportUrl, reviewRules, isolatedRunners), ...(plan?.branch ? { branch: plan.branch } : {}), ...(identity ? { identity } : {}), ...(prEnvIdentity ? { prEnvIdentity } : {}), ...(locks ? { locks } : {}) } } : {}),
         // #4002: the job image and the lines that install what it lacks, chant itself included.
         ...(args.image ? { image: args.image } : {}),
         ...(args.beforeScript?.length ? { beforeScript: args.beforeScript } : {}),

package/dist/cli/handlers/declared-graph.d.ts

@@ -0,0 +1,44 @@
+import type { Declarable } from "../../declarable.js";
+import { type GraphIR } from "../../graph-ir.js";
+import type { BuildRootContributor, LexiconPlugin } from "../../lexicon.js";
+import type { CommandContext } from "../registry.js";
+/**
+ * The pieces of the declared graph that `chant graph` and `chant search` both
+ * read (#1626, #4365, #4368). They live here, once, so the two commands answer
+ * over the same entity set and the same edges: search drifted from graph once
+ * already, answering `(no matches)` over a `terraform.roots` project graph drew
+ * in full, because it never ran the build-root contributors.
+ */
+/**
+ * The build-root contributors this invocation's project configures (#1626):
+ * a `terraform.roots` root's blocks, a `k8s.kustomize.roots` root's rendered
+ * objects. The same closures `chant build` and the lifecycle handlers hand to
+ * `BuildOptions.buildRoots`, bound here for the discover-based paths, which
+ * never run `build()` and so never ran the hook.
+ *
+ * Neither command is `requiresPlugins` (Op/source-graph modes must work
+ * without a lexicon), so plugins are loaded here when `ctx.plugins` is empty.
+ * Rooted at the config's own directory, like `cli/commands/build.ts`: a
+ * relative root resolves against where it was declared, not against a
+ * sourceDir-scoped path. A project that fails to load plugins degrades to no
+ * contributors with a warning rather than failing modes that never needed
+ * plugins at all.
+ */
+export declare function declaredBuildRootContributors(ctx: CommandContext, projectPath: string): Promise<BuildRootContributor[]>;
+/**
+ * Merge build-root contributions into a discovered entity set: the exact
+ * merge `build()` performs (one implementation: `mergeBuildRootEntities`,
+ * ../../build.ts), with its warnings and errors printed. Returns false when a
+ * contributor failed or a name collided; the caller stops, because a graph
+ * missing the entities the build would refuse over must not be answered from
+ * as if complete.
+ */
+export declare function mergeDeclaredBuildRoots(entities: Map<string, Declarable>, contributors: BuildRootContributor[]): Promise<boolean>;
+/**
+ * Add the edges the lexicons' `graphEdges` hooks resolve (#3910): CI
+ * dependencies written as strings (`needs`, `uses:`, `trigger:`, `include:`,
+ * `extends`), which the AttrRef walk in `buildGraphIr` cannot see. A hook that
+ * throws costs its own edges and a warning, not the graph.
+ */
+export declare function withLexiconEdges(ir: GraphIR, plugins: readonly LexiconPlugin[], entities: Map<string, Declarable>): GraphIR;
+//# sourceMappingURL=declared-graph.d.ts.map

package/dist/cli/handlers/declared-graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-graph.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/declared-graph.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAA0B,KAAK,OAAO,EAA0B,MAAM,gBAAgB,CAAC;AAC9F,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;GAMG;AAEH;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAoBjC;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,oBAAoB,EAAE,GACnC,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,aAAa,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,OAAO,CAY3H"}