@intentius/chant 0.124.46 → 0.124.48

package/dist/__golden__/wave-loop/op-overridden.json

@@ -340,6 +340,22 @@
     "wave 1 (net) applies vpc under their overrides, which are now spent"
   ],
   "files": {
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "dns": {
+          "status": "applied"
+        },
+        "nat": {
+          "status": "applied"
+        },
+        "vpc": {
+          "status": "applied"
+        }
+      }
+    },
     ".chant/op-waves/tf-apply/wave-1/dns.plan.json": {
       "planDigest": "sha256:2222222222222222222222222222222222222222222222222222222222222222"
     },

package/dist/__golden__/wave-loop/op-per-run.json

@@ -418,6 +418,26 @@
     "Nothing in wave 2 or after it ran. Read the plans, then approve: chant approve migrations migrations-wave-2 --plan jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d (with --resume, the approval also starts this job again)"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "dev": {
+          "status": "applied"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "staging": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-1/dev.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/dist/__golden__/wave-loop/op-point.json

@@ -402,6 +402,19 @@
     "wave 1 (prod): the decision point at base cannot be asked (waves.json at bbbbbbbbbbbb: `point.name` is a decision point's name: lower case letters, digits and hyphens, starting with a letter), so nothing in it was planned or applied"
   ],
   "files": {
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "db": {
+          "status": "failed"
+        },
+        "net": {
+          "status": "failed"
+        }
+      }
+    },
     ".chant/op-waves/tf-apply/wave-1/db.hooks.json": {
       "version": 1,
       "opWaves": "tf-apply",

package/dist/__golden__/wave-loop/op-pr-review.json

@@ -330,6 +330,16 @@
     "Nothing in wave 2 or after it ran. Read the plans, then approve: chant approve migrations migrations-wave-2 --plan jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d (with --resume, the approval also starts this job again)"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "staging": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-2/staging.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/dist/__golden__/wave-loop/op-sealed.json

@@ -85,6 +85,16 @@
     "Nothing in wave 2 or after it ran. Read the plans, then approve: chant approve migrations migrations-wave-2 --plan jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d --sign (with --resume, the approval also starts this job again)"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "staging": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-2/staging.plan.json": {
       "planDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
       "destructive": true

package/dist/__golden__/wave-loop/op-spend-change-only.json

@@ -114,6 +114,16 @@
     "wave 2 (staging) applies under the approval by alice at 2026-10-10T00:00:00Z, which is now spent"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "staging": {
+          "status": "applied"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-2/staging.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/dist/__golden__/wave-loop/op-spend.json

@@ -278,6 +278,16 @@
     "wave 2 (staging) could not record that it applies under the approval by alice, so nothing applied: this gate ledger cannot record an applied approval"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "staging": {
+          "status": "failed"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-2/staging.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/dist/__golden__/wave-loop/op-wave-commands.json

@@ -1503,6 +1503,22 @@
     "wave 2 (apps): gate never (read at bbbbbbbbbbbb), digest jcs1-sha256:528ae61c94cd24622aade0c3b2acbebe58dfa1789f13f71de15b9d5d7519f0d3: not-required"
   ],
   "files": {
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "dns": {
+          "status": "waiting"
+        },
+        "nat": {
+          "status": "waiting"
+        },
+        "vpc": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/tf-apply/wave-1/dns.plan.json": {
       "planDigest": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
       "empty": true
@@ -1810,6 +1826,45 @@
           "outcome": "passed"
         }
       ]
+    },
+    "wide-outcomes/outcome-wave-2-share-1.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "a1": {
+          "status": "applied"
+        },
+        "a2": {
+          "status": "applied"
+        }
+      }
+    },
+    "wide-outcomes/outcome-wave-2-share-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "a3": {
+          "status": "applied"
+        }
+      }
+    },
+    "wide-outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "a1": {
+          "status": "decided"
+        },
+        "a2": {
+          "status": "decided"
+        },
+        "a3": {
+          "status": "decided"
+        }
+      }
     }
   }
 }

package/dist/__golden__/wave-loop/op-wide-refused.json

@@ -190,6 +190,32 @@
     "wave 1 (apps) is refused by its policy; nothing applied."
   ],
   "files": {
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1-share-2.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t3": {
+          "status": "refused"
+        }
+      }
+    },
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "refused"
+        },
+        "t2": {
+          "status": "refused"
+        },
+        "t3": {
+          "status": "refused"
+        }
+      }
+    },
     ".chant/op-waves/tf-apply/wave-1/plans.json": {
       "runs": [
         {

package/dist/__golden__/wave-loop/op-wide-waiting.json

@@ -178,6 +178,35 @@
     "wave 3 (prod) is waiting on migrations-wave-3; nothing applied. chant approve migrations migrations-wave-3 --plan jcs1-sha256:106d25f35ee6bc02e9aa253d0b2633a764396833c82e0c5ec5a4ad83a2a85b4e"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-1.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "waiting"
+        },
+        "t2": {
+          "status": "waiting"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "waiting"
+        },
+        "t2": {
+          "status": "waiting"
+        },
+        "t3": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-3/t1.plan.json": {
       "planDigest": "sha256:1111111111111111111111111111111111111111111111111111111111111111"
     },

package/dist/__golden__/wave-loop/op-wide.json

@@ -351,6 +351,45 @@
     "t2: its plan moved since wave 3 was decided, so it was not applied. decided: sha256:2222222222222222222222222222222222222222222222222222222222222222; planned now: sha256:9999999999999999999999999999999999999999999999999999999999999999"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-1.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "applied"
+        },
+        "t2": {
+          "status": "not-applied"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-2.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t3": {
+          "status": "applied"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "decided"
+        },
+        "t2": {
+          "status": "decided"
+        },
+        "t3": {
+          "status": "decided"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-3/t1.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/dist/action-pins.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The GitHub Actions the workflows chant generates use, each pinned by commit
+ * SHA (#4403). A tag can move; a SHA cannot. Every generator takes its `uses:`
+ * from here, so an update is one change to this table. Each row is the commit
+ * the named major tag pointed at, with the release that commit carries;
+ * `tagComments` writes that release beside each `uses:` line.
+ *
+ * Forgejo's actions mirror (code.forgejo.org) carries the same commits. The
+ * forgejo lexicon moves `upload-artifact` and `download-artifact` to v3, whose
+ * rows are here too: v4 and later refuse to run on a Forgejo runner (#4008).
+ *
+ * Refresh a row by resolving the major tag to its commit:
+ *
+ *   gh api repos/actions/checkout/commits/v6 --jq .sha
+ */
+export interface ActionPin {
+    /** The action, with its subpath: `actions/cache/restore`. */
+    readonly slug: string;
+    /** The major tag the row follows, such as `v4`. */
+    readonly major: string;
+    readonly sha: string;
+    /** The release at that commit, written beside the `uses:` line. */
+    readonly tag: string;
+}
+export declare const ACTION_PINS: {
+    readonly checkout7: ActionPin;
+    readonly checkout6: ActionPin;
+    readonly checkout4: ActionPin;
+    readonly setupNode6: ActionPin;
+    readonly setupNode4: ActionPin;
+    readonly setupNode7: ActionPin;
+    readonly cache6: ActionPin;
+    readonly uploadArtifact7: ActionPin;
+    readonly downloadArtifact8: ActionPin;
+    readonly setupGo7: ActionPin;
+    readonly setupPython7: ActionPin;
+    readonly setupBun2: ActionPin;
+    readonly golangciLint9: ActionPin;
+    readonly dockerLogin4: ActionPin;
+    readonly dockerSetupBuildx4: ActionPin;
+    readonly dockerMetadata6: ActionPin;
+    readonly dockerBuildPush7: ActionPin;
+    readonly createGithubAppToken2: ActionPin;
+    readonly cacheRestore4: ActionPin;
+    readonly cacheSave4: ActionPin;
+    readonly uploadArtifact4: ActionPin;
+    readonly uploadArtifact3: ActionPin;
+    readonly downloadArtifact4: ActionPin;
+    readonly downloadArtifact3: ActionPin;
+};
+/** The `uses:` value for a pin: `actions/checkout@<sha>`. */
+export declare const usesRef: (p: ActionPin) => string;
+/** Write each pinned `uses:` line's release beside it, as `# v4.4.0`. A line that has a comment, or a SHA not in the table, is left alone. */
+export declare function tagComments(yaml: string): string;
+/** Every `uses:` in a workflow that names an action by a tag or branch, not a 40-character commit SHA. Local actions and docker images are not actions on a forge. */
+export declare function unpinnedActions(yaml: string): string[];
+/** The row for the same action as the one `sha` pins, at `major`. The forgejo lexicon uses it to move a pinned `upload-artifact` v4 to v3. */
+export declare function pinAtMajor(sha: string, major: string): ActionPin | undefined;
+/** The major of the row `sha` belongs to, as a number, when it is in the table. */
+export declare function pinMajor(sha: string): number | undefined;
+//# sourceMappingURL=action-pins.d.ts.map

package/dist/action-pins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-pins.d.ts","sourceRoot":"","sources":["../src/action-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,SAAS;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAID,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;CAyBsB,CAAC;AAE/C,6DAA6D;AAC7D,eAAO,MAAM,OAAO,MAAO,SAAS,KAAG,MAA8B,CAAC;AAKtE,8IAA8I;AAC9I,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,sKAAsK;AACtK,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQtD;AAED,8IAA8I;AAC9I,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAI5E;AAED,mFAAmF;AACnF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxD"}

package/dist/action-pins.js

@@ -0,0 +1,77 @@
+/**
+ * The GitHub Actions the workflows chant generates use, each pinned by commit
+ * SHA (#4403). A tag can move; a SHA cannot. Every generator takes its `uses:`
+ * from here, so an update is one change to this table. Each row is the commit
+ * the named major tag pointed at, with the release that commit carries;
+ * `tagComments` writes that release beside each `uses:` line.
+ *
+ * Forgejo's actions mirror (code.forgejo.org) carries the same commits. The
+ * forgejo lexicon moves `upload-artifact` and `download-artifact` to v3, whose
+ * rows are here too: v4 and later refuse to run on a Forgejo runner (#4008).
+ *
+ * Refresh a row by resolving the major tag to its commit:
+ *
+ *   gh api repos/actions/checkout/commits/v6 --jq .sha
+ */
+const pin = (slug, major, sha, tag) => ({ slug, major, sha, tag });
+export const ACTION_PINS = {
+    checkout7: pin("actions/checkout", "v7", "3d3c42e5aac5ba805825da76410c181273ba90b1", "v7.0.1"),
+    checkout6: pin("actions/checkout", "v6", "d23441a48e516b6c34aea4fa41551a30e30af803", "v6.1.0"),
+    checkout4: pin("actions/checkout", "v4", "11d5960a326750d5838078e36cf38b85af677262", "v4.4.0"),
+    setupNode6: pin("actions/setup-node", "v6", "249970729cb0ef3589644e2896645e5dc5ba9c38", "v6.5.0"),
+    setupNode4: pin("actions/setup-node", "v4", "49933ea5288caeca8642d1e84afbd3f7d6820020", "v4.4.0"),
+    setupNode7: pin("actions/setup-node", "v7", "949feb2413d6458794dcd2491c4babbbce0c15c1", "v7.1.0"),
+    cache6: pin("actions/cache", "v6", "55cc8345863c7cc4c66a329aec7e433d2d1c52a9", "v6.1.0"),
+    uploadArtifact7: pin("actions/upload-artifact", "v7", "cf430e030ddbb5b0abf93d22962f4752f3646cd9", "v7.0.2"),
+    downloadArtifact8: pin("actions/download-artifact", "v8", "9000827ccba6bdab643e8b6fd33ac0654aef8333", "v8.0.2"),
+    setupGo7: pin("actions/setup-go", "v7", "b7ad1dad31e06c5925ef5d2fc7ad053ef454303e", "v7.0.0"),
+    setupPython7: pin("actions/setup-python", "v7", "6d4fd22b20465ccc0f7354476588e8df7c9ca0e0", "v7.1.0"),
+    setupBun2: pin("oven-sh/setup-bun", "v2", "0c5077e51419868618aeaa5fe8019c62421857d6", "v2.2.0"),
+    golangciLint9: pin("golangci/golangci-lint-action", "v9", "ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a", "v9.3.0"),
+    dockerLogin4: pin("docker/login-action", "v4", "81c6f93d4bc991e510b342a00b419b3bb4efc5c6", "v4.7.0"),
+    dockerSetupBuildx4: pin("docker/setup-buildx-action", "v4", "f87e5991a6d7451dcb8d9637bfbc97413f497069", "v4.4.1"),
+    dockerMetadata6: pin("docker/metadata-action", "v6", "dc802804100637a589fabce1cb79ff13a1411302", "v6.2.0"),
+    dockerBuildPush7: pin("docker/build-push-action", "v7", "c3c9e263c25d99ce0380d002d59b67737d91b0dc", "v7.4.0"),
+    createGithubAppToken2: pin("actions/create-github-app-token", "v2", "fee1f7d63c2ff003460e3d139729b119787bc349", "v2.2.2"),
+    cacheRestore4: pin("actions/cache/restore", "v4", "0057852bfaa89a56745cba8c7296529d2fc39830", "v4.3.0"),
+    cacheSave4: pin("actions/cache/save", "v4", "0057852bfaa89a56745cba8c7296529d2fc39830", "v4.3.0"),
+    uploadArtifact4: pin("actions/upload-artifact", "v4", "ea165f8d65b6e75b540449e92b4886f43607fa02", "v4.6.2"),
+    uploadArtifact3: pin("actions/upload-artifact", "v3", "ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5", "v3.2.1"),
+    downloadArtifact4: pin("actions/download-artifact", "v4", "d3f86a106a0bac45b974a628896c90dbdf5c8093", "v4.3.0"),
+    downloadArtifact3: pin("actions/download-artifact", "v3", "9bc31d5ccc31df68ecc42ccf4149144866c47d8a", "v3.0.2"),
+};
+/** The `uses:` value for a pin: `actions/checkout@<sha>`. */
+export const usesRef = (p) => `${p.slug}@${p.sha}`;
+const TAG_BY_SHA = new Map();
+for (const p of Object.values(ACTION_PINS))
+    TAG_BY_SHA.set(p.sha, p.tag);
+/** Write each pinned `uses:` line's release beside it, as `# v4.4.0`. A line that has a comment, or a SHA not in the table, is left alone. */
+export function tagComments(yaml) {
+    return yaml.replace(/^(\s*(?:- )?uses: *["']?[^\s"'#]+@([0-9a-f]{40})["']?)[ \t]*$/gm, (line, head, sha) => {
+        const tag = TAG_BY_SHA.get(sha);
+        return tag ? `${head} # ${tag}` : line;
+    });
+}
+/** Every `uses:` in a workflow that names an action by a tag or branch, not a 40-character commit SHA. Local actions and docker images are not actions on a forge. */
+export function unpinnedActions(yaml) {
+    const out = [];
+    for (const m of yaml.matchAll(/^\s*(?:- )?uses: *["']?([^\s"'#]+)["']?/gm)) {
+        const ref = m[1];
+        if (ref.startsWith("./") || ref.startsWith("../") || ref.startsWith("docker://"))
+            continue;
+        if (!/@[0-9a-f]{40}$/.test(ref))
+            out.push(ref);
+    }
+    return out;
+}
+/** The row for the same action as the one `sha` pins, at `major`. The forgejo lexicon uses it to move a pinned `upload-artifact` v4 to v3. */
+export function pinAtMajor(sha, major) {
+    const rows = Object.values(ACTION_PINS);
+    const from = rows.find((p) => p.sha === sha);
+    return from ? rows.find((p) => p.slug === from.slug && p.major === major) : undefined;
+}
+/** The major of the row `sha` belongs to, as a number, when it is in the table. */
+export function pinMajor(sha) {
+    const row = Object.values(ACTION_PINS).find((p) => p.sha === sha);
+    return row ? Number(row.major.slice(1)) : undefined;
+}

package/dist/cli/commands/carve.d.ts

@@ -74,6 +74,9 @@ export declare function carveAdvise(opts: CarveAdviseOptions): Promise<CarveAdvi
  * additive and ignorable: the top-level `source` discriminator, per-resource
  * `notes` and `members`, and two more `bridge` values in a list that was
  * already declared open-ended.
+ *
+ * Per-resource `radius` (#2326) is additive the same way: a new field beside
+ * `score`, not a term inside it, so the score and its penalties are unchanged.
  */
 export declare const CARVE_REPORT_VERSION = 1;
 /** One ranked resource in the JSON report: its score, plus the boundary its carve would cut. */

package/dist/cli/commands/carve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"carve.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/carve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,EAAe,KAAK,WAAW,EAAwB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAAkB,KAAK,YAAY,EAAqB,MAAM,uBAAuB,CAAC;AAC7F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,KAAK,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAID,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAatF;AA4CD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,gGAAgG;AAChG,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;CAClE;AAED,yGAAyG;AACzG,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC;AAED,+CAA+C;AAC/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,iBAAiB,GAAG,eAAe,CAiBpE;AAeD,6CAA6C;AAC7C,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAqCnE"}
+{"version":3,"file":"carve.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/carve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,EAAe,KAAK,WAAW,EAAwB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAAqD,KAAK,YAAY,EAAqB,MAAM,uBAAuB,CAAC;AAChI,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,KAAK,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAID,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAatF;AA4CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,gGAAgG;AAChG,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;CAClE;AAED,yGAAyG;AACzG,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC;AAED,+CAA+C;AAC/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,iBAAiB,GAAG,eAAe,CAkBpE;AAiBD,6CAA6C;AAC7C,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CA+CnE"}

package/dist/cli/commands/carve.js

@@ -18,7 +18,7 @@ import { adviseCloudAssembly, CDK_DIALECT } from "../../cdk/advise.js";
 import { isCloudAssembly } from "../../cdk/assembly.js";
 import { parseTerraformDir, Hcl2JsonNotInstalled } from "../../terraform/parse.js";
 import { scoreEstate } from "../../terraform/score.js";
-import { boundaryReport } from "../../terraform/carve.js";
+import { boundaryIndex, boundaryReport } from "../../terraform/carve.js";
 const BAND_ORDER = ["clean leaf", "carvable w/ edits", "leave in Terraform"];
 export async function carveAdvise(opts) {
     if (!opts.from) {
@@ -100,6 +100,9 @@ async function adviseTerraform(opts) {
  * additive and ignorable: the top-level `source` discriminator, per-resource
  * `notes` and `members`, and two more `bridge` values in a list that was
  * already declared open-ended.
+ *
+ * Per-resource `radius` (#2326) is additive the same way: a new field beside
+ * `score`, not a term inside it, so the score and its penalties are unchanged.
  */
 export const CARVE_REPORT_VERSION = 1;
 /** Build the `--json` / `--report` payload. */
@@ -108,6 +111,7 @@ export function carveJson(result) {
     const counts = Object.fromEntries(BAND_ORDER.map((b) => [b, results.filter((r) => r.band === b).length]));
     const source = result.source ?? "terraform";
     const dialect = source === "cdk" ? CDK_DIALECT : "terraform";
+    const index = result.graph ? boundaryIndex(result.graph) : undefined;
     return {
         version: CARVE_REPORT_VERSION,
         from: result.from,
@@ -116,14 +120,15 @@ export function carveJson(result) {
         count: results.length,
         bands: counts,
         ...(result.diagnostics?.length ? { diagnostics: result.diagnostics } : {}),
-        resources: results.map((r) => withBoundary(r, result.graph, dialect, result.scoreOptions)),
+        resources: results.map((r) => withBoundary(r, result.graph, dialect, result.scoreOptions, index)),
     };
 }
 /** A scored resource plus its carve boundary, when the graph is at hand (#1636). */
-function withBoundary(r, graph, dialect, score) {
+function withBoundary(r, graph, dialect, score, index) {
     if (!graph)
         return r;
-    const report = boundaryReport(graph, r.address, { dialect, score });
+    // The ranking already scored this resource; the report reads it back rather than rescoring the estate (#4391).
+    const report = boundaryReport(graph, r.address, { dialect, score, peelability: r, index });
     if (!report)
         return r;
     return { ...r, boundary: { inbound: report.inbound, outbound: report.outbound } };
@@ -145,6 +150,8 @@ export function formatCarveReport(result) {
     for (const note of result.diagnostics ?? [])
         lines.push(`  ! ${note}`);
     lines.push("");
+    const cells = new Map(results.map((r) => [r.address, radiusCell(r)]));
+    const cellWidth = Math.max(...[...cells.values()].map((c) => c.length));
     for (const band of BAND_ORDER) {
         const inBand = results.filter((r) => r.band === band);
         if (inBand.length === 0)
@@ -152,16 +159,38 @@ export function formatCarveReport(result) {
         lines.push(`${bandLabel(band, cdk)}  (${inBand.length})`);
         for (const r of inBand) {
             const target = r.mapsTo ? ` -> ${r.mapsTo}` : "";
-            lines.push(`  ${String(r.score).padStart(3)}  ${r.address}${target}`);
-            lines.push(`       ${reasons(r, cdk)}`);
+            const cell = cellWidth > 0 ? `${cells.get(r.address).padEnd(cellWidth)}  ` : "";
+            const indent = " ".repeat(7 + (cellWidth > 0 ? cellWidth + 2 : 0));
+            lines.push(`  ${String(r.score).padStart(3)}  ${cell}${r.address}${target}`);
+            lines.push(`${indent}${reasons(r, cdk)}`);
             for (const note of r.notes ?? [])
-                lines.push(`       ${note}`);
+                lines.push(`${indent}${note}`);
         }
         lines.push("");
     }
     lines.push(`Bands: 80-100 carve now | 50-79 carve with boundary edits | 0-49 leave in ${cdk ? "CDK" : "Terraform"}`);
+    if (cellWidth > 0) {
+        lines.push("Radius: resources+outputs that depend on it at any depth, dN the farthest hop; - none; " +
+            (cdk ? "xN across a stack boundary." : "? a module or unresolved count/for_each hides how many."));
+    }
     return lines.join("\n").trimEnd();
 }
+/**
+ * The radius column (#2326): `3+1 d2` is three resources and one output that
+ * depend on the node, the farthest two hops away; `-` is nothing; `?` stands in
+ * for a count a module or unresolved `count` hides; ` x2` is how many sit
+ * across a stack boundary. Empty when the result carries no radius.
+ */
+function radiusCell(r) {
+    const radius = r.radius;
+    if (!radius)
+        return "";
+    if (radius.depth === 0)
+        return "-";
+    const n = (v) => (v === "unknown" ? "?" : String(v));
+    const cross = radius.crossStack !== undefined && radius.crossStack !== 0 ? ` x${n(radius.crossStack)}` : "";
+    return `${n(radius.resources)}+${radius.outputs} d${radius.depth}${cross}`;
+}
 function bandLabel(band, cdk) {
     switch (band) {
         case "clean leaf":

package/dist/cli/commands/import-report.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The review report of `chant import` (#4398): the parser's diagnostics as
+ * SARIF (`--report <path>`), a summary on stderr, and the exit code under
+ * `--strict`. The shape follows `chant migrate`: a needs-review diagnostic is
+ * a `warning`, and `--strict` makes any open `warning` or `error` fail the
+ * run. An `info` diagnostic names something not carried that needs no
+ * decision, and never fails a run.
+ */
+import type { ImportDiagnostic } from "../../import/parser.js";
+import type { LintDiagnostic } from "../../lint/rule.js";
+/** Import diagnostics as lint diagnostics against `file`, the template that was imported. */
+export declare function importDiagnosticsToLint(file: string, diagnostics: readonly ImportDiagnostic[]): LintDiagnostic[];
+/** The SARIF document for a run. */
+export declare function importSarif(file: string, diagnostics: readonly ImportDiagnostic[], version?: string): string;
+/** Write the SARIF report; an unwritable path is returned as a message, not thrown. */
+export declare function writeImportReport(path: string, file: string, diagnostics: readonly ImportDiagnostic[], version?: string): string | undefined;
+/** Diagnostics that are open: everything but `info`. */
+export declare function openDiagnostics(diagnostics: readonly ImportDiagnostic[]): ImportDiagnostic[];
+/**
+ * The exit code for a finished import. An `error` always fails (a failed
+ * `--validate`); a `warning` fails under `--strict`.
+ */
+export declare function importExitCode(diagnostics: readonly ImportDiagnostic[] | undefined, strict: boolean): number;
+/** Counts by severity and rule, as the lines printed after an import. */
+export declare function summarizeImportDiagnostics(diagnostics: readonly ImportDiagnostic[]): string;
+//# sourceMappingURL=import-report.d.ts.map

package/dist/cli/commands/import-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-report.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/import-report.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD,6FAA6F;AAC7F,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,gBAAgB,EAAE,GAAG,cAAc,EAAE,CAUhH;AAED,oCAAoC;AACpC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,gBAAgB,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5G;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,gBAAgB,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO5I;AAED,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,GAAG,gBAAgB,EAAE,CAE5F;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAI5G;AAED,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAY3F"}