@intentius/chant 0.124.45 → 0.124.48

package/src/workspace/graph.schema.json

@@ -67,6 +67,13 @@
               "type": "string",
               "description": "The declared name. With `at`, it identifies the workspace."
             },
+            "repo": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Added in contract 1 by #3168. The repository the document came from: the URL of the remote origin of the git repository that holds the workspace, with any user name or password removed, or null when there is no origin or the workspace is outside git. With name, root and the revision, it says which repository's workspace a document describes, so a reader that gathers several repositories' documents, such as an org workspace's repo members, tells them apart."
+            },
             "root": {
               "type": "string",
               "description": "The workspace root relative to the git root, with / separators, \".\" for the git root itself. An absolute path outside a git repository."
@@ -287,6 +294,33 @@
           "type": "string",
           "description": "Relative to the workspace root, with / separators; \".\" is the root member."
         },
+        "repo": {
+          "type": "object",
+          "description": "Added in contract 1 by #3168. For a member of kind repo, the other repository's workspace it names: url, the pinned rev and the workspace root inside that repository. Absent for every other kind. A repo member's dir is @repo/<name>, a marker that names no directory of this repository.",
+          "required": [
+            "url",
+            "rev",
+            "workspace"
+          ],
+          "properties": {
+            "url": {
+              "type": "string"
+            },
+            "rev": {
+              "type": "string"
+            },
+            "workspace": {
+              "type": "string"
+            },
+            "read": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "The repo identity the other repository's own graph document gave (its workspace.repo), or null when it gave none or the read failed."
+            }
+          }
+        },
         "kind": {
           "type": "string"
         },
@@ -437,6 +471,17 @@
               }
             }
           ]
+        },
+        "capabilityView": {
+          "description": "Added in contract 1 by #4378. Only with `--capability-view`, which `chant workspace search` asks for when a query has a capability term. The lexicon-neutral view capability rules read, built by the member's own chant through the mappings and adapters of the lexicons the member loads (its `chant graph --format ir --capability-view`), with `<member>/<id>` ids. null on a composed member whose chant printed no view (one from before #4378); a capability search reports that member as `member-chant-too-old`. Absent without the flag, and on a member that was not composed.",
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/capabilityView"
+            }
+          ]
         }
       },
       "if": {
@@ -1438,6 +1483,143 @@
           ]
         }
       }
+    },
+    "capabilityView": {
+      "type": "object",
+      "description": "One member's capability view (#4378), as `capabilities/view.ts` serializes it. Rules read labels, attributes and edges; a node's attributes are the neutral ones its lexicon's mapping names.",
+      "required": [
+        "version",
+        "lexicons",
+        "nodes",
+        "edges",
+        "unresolved"
+      ],
+      "properties": {
+        "version": {
+          "const": 1,
+          "description": "The view's own format version. A reader treats a view of a version it doesn't know as no view."
+        },
+        "lexicons": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The lexicons whose nodes a mapping labelled."
+        },
+        "nodes": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": [
+              "id",
+              "label",
+              "irId",
+              "lexicon",
+              "attrs"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "description": "A node id of the composed graph, or, for a policy statement or an inline block, that id with `#<attribute path>`."
+              },
+              "label": {
+                "type": "string",
+                "description": "The neutral label (`Role`, `Bucket`, `Statement`, `IngressRule`)."
+              },
+              "irId": {
+                "type": "string",
+                "description": "The composed graph node this view node is, or sits inside."
+              },
+              "lexicon": {
+                "type": "string"
+              },
+              "attrs": {
+                "type": "object"
+              }
+            }
+          }
+        },
+        "edges": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": [
+              "from",
+              "to",
+              "name",
+              "hops"
+            ],
+            "properties": {
+              "from": {
+                "type": "string"
+              },
+              "to": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string",
+                "description": "The view edge's name (`subnet`, `statement`, `resource`, `attachedTo`)."
+              },
+              "hops": {
+                "type": "array",
+                "description": "The graph references the edge stands for, in walk order from `from`, each in the reference's own direction.",
+                "items": {
+                  "type": "object",
+                  "required": [
+                    "from",
+                    "to",
+                    "edge"
+                  ],
+                  "properties": {
+                    "from": {
+                      "type": "string"
+                    },
+                    "fromAttr": {
+                      "type": "string"
+                    },
+                    "to": {
+                      "type": "string"
+                    },
+                    "toAttr": {
+                      "type": "string"
+                    },
+                    "edge": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "unresolved": {
+          "type": "array",
+          "description": "ARN strings naming a role, bucket or table that the member declares nothing of. `chant workspace search` resolves them by name over every member's view, so a policy in one member reaches a bucket in another.",
+          "items": {
+            "type": "object",
+            "required": [
+              "from",
+              "fromAttr",
+              "edge",
+              "value"
+            ],
+            "properties": {
+              "from": {
+                "type": "string"
+              },
+              "fromAttr": {
+                "type": "string"
+              },
+              "edge": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      }
     }
   }
 }

package/src/workspace/identity.test.ts

@@ -71,14 +71,26 @@ describe("identity.attribution", () => {
     expect(decl({ attribution: "identified", gates: { ship: { class: "operator" }, rollback: {} } }).identity).toEqual({
       attribution: "identified",
       gates: {
-        ship: { gate: "ship", class: "operator", pointer: "/identity/gates/ship" },
-        rollback: { gate: "rollback", class: null, pointer: "/identity/gates/rollback" },
+        ship: { gate: "ship", class: "operator", quorum: null, pointer: "/identity/gates/ship" },
+        rollback: { gate: "rollback", class: null, quorum: null, pointer: "/identity/gates/rollback" },
       },
     });
     expect(() => decl({ attribution: "verified" })).toThrow();
     expect(() => decl({ gates: { ship: { by: "x" } } })).toThrow();
   });
 
+  test("a gate entry takes a quorum beside its class (#4324)", () => {
+    const rules = [{ targets: ["prod-*"], count: 2, roles: ["platform"] }, { count: 1 }];
+    const gates = decl({ gates: { ship: { class: "operator", quorum: { count: 2 } }, deploy: { quorum: rules } } }).identity!.gates;
+    expect(gates.ship).toEqual({ gate: "ship", class: "operator", quorum: { count: 2 }, pointer: "/identity/gates/ship" });
+    expect(gates.deploy!.quorum).toEqual(rules);
+    // The schema refuses a malformed rule, and the reader refuses notAuthor, which an Op gate can't judge.
+    expect(() => decl({ gates: { ship: { quorum: { count: 0 } } } })).toThrow();
+    expect(() => decl({ gates: { ship: { quorum: [] } } })).toThrow();
+    expect(() => decl({ gates: { ship: { quorum: { count: 1, by: "x" } } } })).toThrow();
+    expect(() => decl({ gates: { ship: { quorum: { count: 1, notAuthor: true } } } })).toThrow(/identity\.gates\.ship\.quorum\.notAuthor is not read here/);
+  });
+
   test("identified refuses a bare name and takes a forge identity or a signer", () => {
     const source = { declaration: decl({ attribution: "identified" }), policy: policyWith([{ principal: "dana@example.test", key: "ssh-ed25519 AAAA" }]) };
     expect(() => refuseUnidentified(source, ["github:alice", "dana@example.test"], "--by")).not.toThrow();

package/src/workspace/intent.ts

@@ -66,6 +66,7 @@ import { isGeneratedPath } from "./generated-files";
 import { entityDecisions, hasTrailer, readCommitJoins, runCommitJoins, type CommitJoins, type IntentCommit, type JoinedEntity, type PluginFinding } from "./intent-joins";
 import { loadKindRegistry } from "./kinds";
 import { resolveLinks, type LinkTableRow } from "./links";
+import { readKindLinks } from "./kind-link-readers";
 import { sourceMemberHandles } from "./member-handles";
 import { constraintCovers, isWorkspacePath, memberHolding } from "./record-assets";
 import type { DecidedIn } from "./record-decided";
@@ -78,6 +79,7 @@ import { memberDirOnDisk, memberSymbolResolvers, type SymbolPluginLoader } from
 import { resolveSymbol, symbolResolverFor, type SymbolResolver } from "./symbols";
 import { readTrailerJoins, type CommitTrailerJoins } from "./trailer-joins";
 import { buildTrace, type IntentTrace } from "./intent-trace";
+import { compareDecisionRank, type WhyRelevance } from "./decision-rank";
 import { joinPath, skippedDir, workingTree, type WorkspaceTree } from "./tree";
 import { activeAttestors, type ProvenanceLevel } from "./trust/attestor";
 import { commitProvenance, policyAtBase, resolveBase } from "./trust/provenance";
@@ -524,8 +526,7 @@ export interface WhySpan {
   via?: string[];
 }
 
-/** Why a decision is in `why`, most relevant first (#3034). */
-export type WhyRelevance = "carried" | "path" | "contract" | "issue" | "member" | "related";
+export type { WhyRelevance };
 
 export interface WhyDecision {
   decision: string;
@@ -1854,7 +1855,7 @@ async function walk(query: IntentQuery, head: Head): Promise<IntentResult> {
         atRevision: located.at !== null,
         ...(query.loadLexicon ? { load: query.loadLexicon as unknown as import("./lexicon-outputs").OutputsPluginLoader } : {}),
       });
-      rows = resolveLinks(declaration, sourceMemberHandles(declaration, located.tree, groups, kindsRegistry, lexiconOutputs)).filter((r) => r.origin === "declared");
+      rows = resolveLinks(declaration, sourceMemberHandles(declaration, located.tree, groups, kindsRegistry, lexiconOutputs), undefined, readKindLinks(declaration, located.tree, kindsRegistry)).filter((r) => r.origin === "declared");
     } catch (err) {
       if (!(err instanceof WorkspaceReadError)) throw err;
     }
@@ -2080,7 +2081,6 @@ async function walk(query: IntentQuery, head: Head): Promise<IntentResult> {
     // The decisions, most relevant first.
     const decisionNodes = [...nodes.values()].filter((n): n is DecisionNode => n.kind === "decision");
     const ownLines = (d: DecisionNode) => who.filter((w) => w.sha !== null && ownWork(joined.get(w.sha) ?? { contracts: [], authorship: [], decisions: [], carries: [] }, d)).length;
-    const ORDER: WhyRelevance[] = ["carried", "path", "contract", "issue", "member", "related"];
     const ranked = decisionNodes.map((d) => {
       const lines = ownLines(d);
       const carried = lines > 0 || (fileLines === null && touched.some((t) => ownWork(joined.get(t.sha) ?? { contracts: [], authorship: [], decisions: [], carries: [] }, d)));
@@ -2090,16 +2090,8 @@ async function walk(query: IntentQuery, head: Head): Promise<IntentResult> {
       const specificity = Math.max(0, ...d.constrains.filter((c) => c.granularity === "path").map((c) => c.entry.length));
       return { d, entry: { decision: d.id, relevance, current: d.supersededBy === null, closed: d.closed, lines } satisfies WhyDecision, specificity };
     });
-    ranked.sort(
-      (a, b) =>
-        Number(b.entry.current) - Number(a.entry.current) ||
-        ORDER.indexOf(a.entry.relevance) - ORDER.indexOf(b.entry.relevance) ||
-        b.entry.lines - a.entry.lines ||
-        Number(b.entry.closed) - Number(a.entry.closed) ||
-        b.specificity - a.specificity ||
-        (b.d.decidedIn?.date ?? "").localeCompare(a.d.decidedIn?.date ?? "") ||
-        a.d.id.localeCompare(b.d.id),
-    );
+    const key = (r: (typeof ranked)[number]) => ({ ...r.entry, id: r.d.id, specificity: r.specificity, decidedOn: r.d.decidedIn?.date ?? null });
+    ranked.sort((a, b) => compareDecisionRank(key(a), key(b)));
     const decisions = ranked.map((r) => r.entry);
 
     // The runs that wrote the current lines, most lines first; for a directory, every run in the walk.

package/src/workspace/kind-link-readers.ts

@@ -19,12 +19,24 @@
  * `resolveLinks` (`./links.ts`) resolves the links beside the declared ones,
  * with origin `kind-reader`; WSP093 and WSP094 name the reader's file and line,
  * and WSP099 reports the gaps.
+ *
+ * A migration directory's reader (#4400) lists its migrations in order, in
+ * {@link KindLinkRead.migrations}, and returns no links: what the migrations
+ * produce comes from a replay.
+ *
+ * A reader may also return outputs (#3935): names the member's files state,
+ * which other members link to. A dbt project's models are outputs, read the
+ * same way as its sources. `resolveLinks` adds them to the member's handles
+ * (`withReaderOutputs`), so a link to one resolves, and goes missing when the
+ * file that states it is gone.
  */
 
 import type { Declaration, Member } from "./declaration";
 import { resolveMemberFields, type FieldValue, type KindLinkReaderName, type KindRegistry } from "./kinds";
 import type { WorkspaceTree } from "./tree";
 import { readDbtProject } from "./dbt-project-reader";
+import { readClickHouseMigrationsDir, readGolangMigrateDir, readGooseDir } from "./migration-dirs";
+import { readFlywayDir } from "./flyway-dir";
 
 /** One link a reader found in the member's files. */
 export interface KindReadLink {
@@ -54,18 +66,67 @@ export interface KindReadGap {
   file: string;
   line: number;
   message: string;
+  /**
+   * True when the gap leaves an output out of {@link KindLinkRead.outputs}
+   * (#3935): a link to a name the member does not list is then unresolved,
+   * not missing.
+   */
+  outputs?: boolean;
+}
+
+/** One output a reader found in the member's files: a name other members may link to. */
+export interface KindReadOutput {
+  name: string;
+  /** The file that states it, relative to the workspace root. */
+  file: string;
+  /** Its line, from 1. */
+  line: number;
+}
+
+/**
+ * One migration a migration-directory reader found (#4400), in the order the
+ * tool applies it. The reader lists files and never runs the tool, so the
+ * schema the migrations produce comes from a replay, not from here.
+ */
+export interface KindReadMigration {
+  /** 1-based position in the order the tool applies the migrations. */
+  position: number;
+  /** The version as the file name writes it, such as `00002`, `20240101120000` or `1.2`. */
+  version: string;
+  name: string;
+  /** `versioned` runs once; `repeatable` runs again when its checksum changes (Flyway); `baseline` and `undo` are Flyway's B and U files. */
+  type: "versioned" | "repeatable" | "baseline" | "undo";
+  /** The file with the up statements, relative to the workspace root. */
+  file: string;
+  /** The line the up statements start on, from 1. */
+  line: number;
+  /** The file that undoes it, or true when the same file does (goose), or false when none does. */
+  down: string | boolean;
+  /** The SQL dialect the migration is written in: the member's `dialect` field, or what the directory's own configuration names. */
+  dialect: string;
+  /** False when the file asks to run outside a transaction (`-- +goose NO TRANSACTION`). */
+  transaction?: boolean;
 }
 
 export interface KindLinkRead {
-  /** The reader that ran. */
-  reader: KindLinkReaderName;
+  /** The reader that ran: a kind's reader, or `lexicon <name>` for links a member's lexicon read from its declarations (#4397). */
+  reader: KindLinkReaderName | `lexicon${string}`;
   links: KindReadLink[];
   gaps: KindReadGap[];
+  /**
+   * The outputs the member exposes that its files state (#3935), beside the
+   * ones its kind lists. `resolveLinks` adds them to the member's handles, so
+   * another member can link to them. A gap flagged `outputs` makes the list
+   * incomplete.
+   */
+  outputs?: KindReadOutput[];
   /**
    * The member field that names the producer, for messages that ask the
    * author to set it when the files don't say (`sqlMember` for dbt).
    */
   producerField?: string;
+  /** The migrations of a migration directory (#4400), in the order they apply; unset for other readers. */
+  migrations?: KindReadMigration[];
 }
 
 /** What a reader gets: the member, its directory and resolved fields, and the tree read. */
@@ -83,6 +144,10 @@ export type KindLinkReader = (input: KindReaderInput) => KindLinkRead;
 /** Every reader chant ships, by the name a kinds file uses. */
 export const LINK_READERS: Record<KindLinkReaderName, KindLinkReader> = {
   "dbt-project": readDbtProject,
+  "goose-dir": readGooseDir,
+  "golang-migrate-dir": readGolangMigrateDir,
+  "clickhouse-migrations-dir": readClickHouseMigrationsDir,
+  "flyway-dir": readFlywayDir,
 };
 
 /**
@@ -102,7 +167,7 @@ export function readKindLinks(declaration: Declaration, tree: WorkspaceTree, kin
     try {
       out.set(m.name, LINK_READERS[kind.reader]({ member: m, dir, fields, tree }));
     } catch (err) {
-      out.set(m.name, { reader: kind.reader, links: [], gaps: [{ file: dir || ".", line: 1, message: `the ${kind.reader} reader failed: ${(err as Error).message}` }] });
+      out.set(m.name, { reader: kind.reader, links: [], gaps: [{ file: dir || ".", line: 1, message: `the ${kind.reader} reader failed: ${(err as Error).message}`, outputs: true }] });
     }
   }
   return out;

package/src/workspace/kind-readers.e2e.test.ts

@@ -65,4 +65,32 @@ describe("terraform and choudoufu members through the terraform lexicon (#2874)"
     },
     TIMEOUT,
   );
+
+  // behold#919: the reader project sets `graph.lint: "report"`, so a member
+  // whose HCL fails one of the lexicon's error rules is composed, with the
+  // finding on its meta.lint. Before, it failed with command-failed.
+  test(
+    "a member with a lint error is composed, the finding on its meta.lint",
+    async () => {
+      const root = repo({
+        "chant.workspace.json": declaration([{ name: "db", dir: "estates/db", kind: "terraform" }], { pins: [{ package: LEXICON, version: VERSION }] }),
+        "estates/db/main.tf":
+          'resource "aws_db_instance" "orders" {\n  identifier        = "orders"\n  engine            = "postgres"\n  instance_class    = "db.t3.micro"\n  allocated_storage = 20\n  storage_encrypted = false\n}\n',
+        ".gitignore": "node_modules\n",
+      });
+      symlinkSync(join(REPO, "node_modules"), join(root, "node_modules"), "dir");
+
+      const { doc, failed } = await workspaceGraph({ cwd: root });
+      const g = result(doc);
+      expectValid(g);
+      expect(g.members.map((m) => [m.name, m.status, m.reason?.code ?? null])).toEqual([["db", "composed", null]]);
+      expect(failed).toBe(false);
+      expect(g.nodes.map((n) => n.id)).toContain("db/db/aws_db_instance.orders");
+      const lint = (g.members[0] as { meta?: { lint?: { errors: number; findings: { ruleId: string; severity: string; entity?: string }[] } } }).meta?.lint;
+      expect(lint?.errors).toBeGreaterThanOrEqual(1);
+      // The finding names its entity, the id the member IR gives the node (before composition prefixes it).
+      expect(lint?.findings).toContainEqual(expect.objectContaining({ ruleId: "TF033", severity: "error", entity: "db/aws_db_instance.orders" }));
+    },
+    TIMEOUT,
+  );
 });

package/src/workspace/kind-readers.test.ts

@@ -80,7 +80,7 @@ describe("workspace graph reads a package kind with a graph block (#2874)", () =
     ]);
     expect(g.nodes.map((n) => n.id)).toEqual(["net/root/Thing"]);
     const attrs = g.nodes[0].attrs as { found: boolean; pwd: string; argv: string; config: Record<string, unknown> };
-    expect(attrs.config).toEqual({ lexicons: ["fake"], fake: { moduleRoot: root, roots: { net: { dir: `${root}/estates/net` } } } });
+    expect(attrs.config).toEqual({ lexicons: ["fake"], fake: { moduleRoot: root, roots: { net: { dir: `${root}/estates/net` } } }, graph: { lint: "report" } });
     expect(attrs.found).toBe(true);
     // A reader project declares no environments, so --env stays with the chant members.
     expect(attrs.argv).toBe("graph . --format ir");

package/src/workspace/kind-readers.ts

@@ -13,6 +13,9 @@
  *   (`substituteGraphConfig`). The terraform lexicon's config names one root
  *   after the member, at the member's directory, with `moduleRoot` at the
  *   workspace root, so a member that calls `../modules/x` keeps its modules.
+ * - It also sets `graph.lint: "report"` (behold#919), so a member whose
+ *   source fails the lexicon's lint is still composed, with the findings on
+ *   its `meta.lint`, instead of failing with `command-failed`.
  * - `node_modules` links to the `node_modules` directory holding the lexicon
  *   package, found from the workspace root as the kind's pin was. The lexicon
  *   chant loads is then the one the declaration pins.
@@ -95,7 +98,10 @@ export function prepareKindReaders(plan: MemberPlan, root: string): PreparedRead
         const project = join(scratch, unit.id);
         mkdirSync(project, { recursive: true });
         const config = substituteGraphConfig(unit.reader.config, { member: unit.member, dir: unit.abs, workspace: root });
-        writeFileSync(join(project, "chant.config.json"), `${JSON.stringify({ lexicons: [unit.reader.lexicon], [unit.reader.lexicon]: config }, null, 2)}\n`);
+        // `graph.lint: "report"` (behold#919): chant did not author a reader
+        // member's source, so a lint error there is a finding about it, carried
+        // on the member's `meta.lint`, not a reason to leave it out of the graph.
+        writeFileSync(join(project, "chant.config.json"), `${JSON.stringify({ lexicons: [unit.reader.lexicon], [unit.reader.lexicon]: config, graph: { lint: "report" } }, null, 2)}\n`);
         symlinkSync(found.modules, join(project, "node_modules"), "dir");
         unit.abs = project;
         return true;

package/src/workspace/kinds.test.ts

@@ -61,10 +61,10 @@ function pkg(name: string, version: string, kinds: unknown[] | null, extra: Reco
 }
 
 describe("the built-in kinds (#2535)", () => {
-  test("are chant, workspace, design and other, and the group kind examples", () => {
-    expect(BUILTIN_KINDS.map((k) => `${k.name}:${k.shape}`)).toEqual(["chant:member", "workspace:member", "other:member", "design:member", "examples:group"]);
+  test("are chant, workspace, repo, design and other, and the group kind examples", () => {
+    expect(BUILTIN_KINDS.map((k) => `${k.name}:${k.shape}`)).toEqual(["chant:member", "workspace:member", "repo:member", "other:member", "design:member", "examples:group"]);
     const registry = builtinKindRegistry();
-    expect(registry.names()).toEqual(["chant", "design", "other", "workspace"]);
+    expect(registry.names()).toEqual(["chant", "design", "other", "repo", "workspace"]);
     expect(registry.get(EXAMPLES_KIND)?.shape).toBe("group");
   });
 
@@ -72,8 +72,13 @@ describe("the built-in kinds (#2535)", () => {
     const entry = declarationSchema.$defs.entry;
     expect(entry.if.properties.kind.const).toBe(EXAMPLES_KIND);
     expect(declarationSchema.$defs.group.properties.kind.const).toBe(EXAMPLES_KIND);
-    expect(declarationSchema.$defs.member.if.properties.kind.const).toBe("other");
-    expect(declarationSchema.$defs.member.then.required).toEqual(["because"]);
+    const [other, repo] = declarationSchema.$defs.member.allOf;
+    expect(other.if.properties.kind.const).toBe("other");
+    expect(other.then.required).toEqual(["because"]);
+    // A repo member (#3168) has repo and no dir; every other member has dir and no repo.
+    expect(repo.if.properties.kind.const).toBe("repo");
+    expect(repo.then.required).toEqual(["repo"]);
+    expect(repo.else?.required).toEqual(["dir"]);
   });
 
   test("a registry refuses a name twice", () => {
@@ -203,7 +208,7 @@ describe("loadKindRegistry: kinds from the pins", () => {
     const { registry, problems } = loadKindRegistry([{ package: "@acme/chant-lexicon-tf", version: "1.2.3", path: null }], root);
     expect(problems).toEqual([]);
     expect(registry.get("terraform")).toMatchObject({ source: "@acme/chant-lexicon-tf", precedence: 400 });
-    expect(registry.names()).toEqual(["chant", "design", "other", "terraform", "workspace"]);
+    expect(registry.names()).toEqual(["chant", "design", "other", "repo", "terraform", "workspace"]);
     expect(existsSync(join(root, "node_modules/@acme/chant-lexicon-tf/IMPORTED"))).toBe(false);
     expect((globalThis as { __chantKindsImported?: boolean }).__chantKindsImported).toBeUndefined();
   });
@@ -223,7 +228,7 @@ describe("loadKindRegistry: kinds from the pins", () => {
       ],
       root,
     );
-    expect(registry.names()).toEqual(["chant", "design", "other", "workspace"]);
+    expect(registry.names()).toEqual(["chant", "design", "other", "repo", "workspace"]);
     expect(problems).toEqual([
       { pin: 1, message: "pinned package absent is not installed; install it to read the kinds it supplies" },
       { pin: 2, message: "tf-kinds is pinned at 1.0.0, and 2.0.0 is installed" },