@intentius/chant 0.124.51 → 0.124.54

package/dist/cli/commands/import-index.js

@@ -0,0 +1,226 @@
+/**
+ * `chant import --index <ref>` (#4524): typed source for indexed resources.
+ *
+ * Reads one index version (a file, or a version in the project's index
+ * store), selects nodes, and writes source through each lexicon's own
+ * template generator. Nothing is applied and nothing is written to the
+ * cloud. The pure part is ../../lifecycle/index-import.ts; this module reads
+ * the index, builds the project for the declared check, and writes files.
+ *
+ * The report (`chant-index-import.json` in the output directory, or
+ * `--report <path>`) names every selected resource's identity and cloud ids,
+ * what was imported, declared or unsupported, each reference and each
+ * parameter. The adoption step (INTENTIUS/choudoufu#2284) reads it.
+ * `--adopt-out <file>` also writes the adoption file (`adopt: v1`, #4536)
+ * that adopts every imported resource as its logical id.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, join, relative, resolve } from "path";
+import { adoptionFileFromImportReport, adoptionFileJson } from "../../lifecycle/adoption-file.js";
+import { declaredNodes, indexImportHeader, planIndexImport, selectionIsEmpty, } from "../../lifecycle/index-import.js";
+import { generateOrganizedFiles } from "./import.js";
+export const INDEX_IMPORT_REPORT_FILE = "chant-index-import.json";
+function asDocuments(parsed, from) {
+    const list = Array.isArray(parsed)
+        ? parsed
+        : parsed && typeof parsed === "object" && Array.isArray(parsed.documents)
+            ? parsed.documents
+            : [parsed];
+    for (const d of list) {
+        if (!d || typeof d !== "object" || d.index !== "v1") {
+            throw new Error(`${from} does not hold index documents (index: "v1")`);
+        }
+    }
+    return list;
+}
+/**
+ * The documents an index ref names: a file path, or a store ref in the
+ * grammar `chant search --index` reads (`<scopeKey>[@latest|@<version>]`,
+ * ../../lifecycle/index-join.ts), from the store chant.config's `snapshots`
+ * picks (#4519).
+ */
+export async function loadIndexDocuments(ref, cwd) {
+    const asFile = resolve(cwd, ref);
+    if (existsSync(asFile))
+        return asDocuments(JSON.parse(readFileSync(asFile, "utf-8")), ref);
+    const { parseIndexRef, readIndexRef } = await import("../../lifecycle/index-join.js");
+    const parsed = parseIndexRef(ref);
+    if ("error" in parsed)
+        throw new Error(`no file of that name, and ${parsed.error}; ${parsed.hint}`);
+    const { resolveSnapshotStore } = await import("../../lifecycle/snapshot-store.js");
+    const store = await resolveSnapshotStore({ cwd });
+    await store.fetch();
+    const read = await readIndexRef(store, parsed);
+    if ("error" in read)
+        throw new Error(read.hint ? `${read.error}; ${read.hint}` : read.error);
+    return [read.doc];
+}
+/**
+ * The files an import plan writes, through each lexicon's template
+ * generator, with the plan's header on each group's first file. Pure apart
+ * from the generators, so the same plan gives byte-identical files.
+ */
+export function renderIndexImport(plan, plugins) {
+    const files = [];
+    const warnings = [];
+    for (const group of plan.groups) {
+        const plugin = plugins.find((p) => p.name === group.lexicon);
+        if (!plugin?.templateGenerator) {
+            warnings.push(`the ${group.lexicon} lexicon has no template generator; ${group.ir.resources.length} resource(s) in ${group.dir || "."} were not written`);
+            continue;
+        }
+        const organized = generateOrganizedFiles(group.ir, plugin.templateGenerator());
+        warnings.push(...organized.warnings);
+        organized.files.forEach((f, i) => {
+            const path = group.dir ? `${group.dir}/${f.path}` : f.path;
+            files.push({ path, content: i === 0 ? indexImportHeader(plan, group) + f.content : f.content });
+        });
+    }
+    return { files, warnings };
+}
+/** The report as written: two-space JSON and a final newline. */
+export function indexImportReportJson(report) {
+    return JSON.stringify(report, null, 2) + "\n";
+}
+/** The project's declared entities by lexicon, or why there are none to check. */
+async function projectEntities(projectDir, src, plugins) {
+    const entities = new Map();
+    try {
+        const { loadChantConfigUpward } = await import("../../config.js");
+        const { config, configPath } = await loadChantConfigUpward(projectDir);
+        if (!configPath)
+            return { entities };
+        const projectPlugins = plugins.filter((p) => p.serializer);
+        if (projectPlugins.length === 0)
+            return { entities };
+        const { build } = await import("../../build.js");
+        const { isObservableDeclarable } = await import("../../declarable.js");
+        const root = src ? resolve(src) : resolve(dirname(configPath), config.sourceDir ?? ".");
+        const result = await build(root, projectPlugins.map((p) => p.serializer), undefined, { config: config });
+        if (result.errors.length > 0) {
+            return { entities, warning: `the project at ${root} does not build, so no indexed resource was checked against its declarations` };
+        }
+        for (const [name, entity] of result.entities) {
+            if (!isObservableDeclarable(entity))
+                continue;
+            const list = entities.get(entity.lexicon) ?? entities.set(entity.lexicon, []).get(entity.lexicon);
+            list.push({ name, entityType: entity.entityType, props: (entity.props ?? {}) });
+        }
+        return { entities };
+    }
+    catch (err) {
+        return { entities, warning: `the declared check did not run: ${err instanceof Error ? err.message : String(err)}` };
+    }
+}
+/** The plugins for the index's lexicons and the project's, each loaded once; one that fails to load is left out. */
+async function pluginsFor(docs, projectDir) {
+    const { loadPlugin, resolveProjectLexicons } = await import("../plugins.js");
+    let names = [];
+    try {
+        names = await resolveProjectLexicons(projectDir);
+    }
+    catch {
+        names = [];
+    }
+    for (const d of docs)
+        for (const n of d.graph.nodes)
+            if (!n.unmappedKind)
+                names.push(n.lexicon);
+    const plugins = [];
+    for (const name of [...new Set(names)].sort()) {
+        try {
+            const plugin = await loadPlugin(name);
+            await plugin.init?.();
+            plugins.push(plugin);
+        }
+        catch {
+            // Not installed here: its nodes are reported as not loaded.
+        }
+    }
+    return plugins;
+}
+export async function importFromIndex(options) {
+    const outputDir = resolve(options.output ?? "./infra/");
+    const projectDir = resolve(options.projectDir ?? (options.output ? dirname(outputDir) : "."));
+    const warnings = [];
+    const fail = (error) => ({ success: false, generatedFiles: [], warnings, error });
+    if (selectionIsEmpty(options.selection)) {
+        return fail("name what to import: --type <type>, --name <native id>, --tag key=value, --select <file of node ids>, or --all");
+    }
+    let docs;
+    try {
+        docs = await loadIndexDocuments(options.index, process.cwd());
+    }
+    catch (err) {
+        return fail(`could not read the index ${options.index}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const plugins = options.plugins ?? (await pluginsFor(docs, projectDir));
+    let declared = new Map();
+    let entities;
+    if (options.declaredEntities) {
+        entities = options.declaredEntities;
+    }
+    else {
+        const project = await projectEntities(projectDir, options.src, plugins);
+        if (project.warning)
+            warnings.push(project.warning);
+        entities = project.entities;
+    }
+    try {
+        declared = declaredNodes(docs, entities, plugins);
+    }
+    catch (err) {
+        warnings.push(`the declared check did not run: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    let plan;
+    try {
+        plan = planIndexImport(docs, options.selection, plugins, { declared });
+    }
+    catch (err) {
+        return fail(err instanceof Error ? err.message : String(err));
+    }
+    if (plan.report.resources.length === 0)
+        return fail("the selection matches no node in the index");
+    const { files, warnings: renderWarnings } = renderIndexImport(plan, plugins);
+    warnings.push(...renderWarnings);
+    for (const r of plan.report.resources) {
+        if (r.status === "unsupported")
+            warnings.push(`${r.node}: not imported, ${r.reason}`);
+    }
+    const reportPath = resolve(options.report ?? join(outputDir, INDEX_IMPORT_REPORT_FILE));
+    const generatedFiles = [];
+    const write = (path, content, shown) => {
+        if (existsSync(path) && !options.force) {
+            warnings.push(`File ${shown} already exists, skipping`);
+            return;
+        }
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, content);
+        generatedFiles.push(shown);
+    };
+    for (const file of files)
+        write(join(outputDir, file.path), file.content, file.path);
+    write(reportPath, indexImportReportJson(plan.report), relative(outputDir, reportPath) || reportPath);
+    if (options.adoptOut) {
+        const adoptPath = resolve(options.adoptOut);
+        try {
+            write(adoptPath, adoptionFileJson(adoptionFileFromImportReport(plan.report)), relative(outputDir, adoptPath) || adoptPath);
+        }
+        catch (err) {
+            return { success: false, generatedFiles, warnings, error: `no adoption file written: ${err instanceof Error ? err.message : String(err)}`, report: plan.report };
+        }
+    }
+    const lexicons = [...new Set(plan.groups.map((g) => g.lexicon))];
+    return {
+        success: true,
+        generatedFiles,
+        warnings,
+        ...(lexicons.length === 1 ? { lexicon: lexicons[0] } : {}),
+        report: plan.report,
+    };
+}
+/** One line per status: what was imported, declared and left out. */
+export function summarizeIndexImport(report) {
+    const count = (s) => report.resources.filter((r) => r.status === s).length;
+    return `index import: ${count("imported")} imported, ${count("declared")} already declared, ${count("unsupported")} unsupported, ${report.parameters.length} parameter(s) to fill in`;
+}

package/dist/cli/commands/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAyCzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAoBhC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,WAAW,CAAC;AAsBnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AA2I9C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAgfD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA+N3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAyCzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAoBhC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,WAAW,CAAC;AAsBnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AA2I9C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAkfD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA+N3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}

package/dist/cli/commands/lint.js

@@ -6,7 +6,7 @@ import { findInfraFiles, detectLexicons } from "../../index.js";
 import { formatStylish, formatJson, formatSarif } from "../reporters/stylish.js";
 import { loadLocalRules } from "../../lint/rule-loader.js";
 import { loadCoreRules } from "../../lint/rules/index.js";
-import { loadComponentChecks } from "../../lint/rules/comp/index.js";
+import { loadComponentChecks, signalOnlyRootsOf } from "../../lint/rules/comp/index.js";
 import { runComponentChecks } from "../../lint/component-checks.js";
 import { buildCapabilityRegistry } from "../../components/capability-plugin-loader.js";
 import { coreOpChecks, workspaceIdentityGates } from "../../lint/rules/op/index.js";
@@ -363,7 +363,9 @@ async function runComponentCheckDiagnostics(infraPath, sandbox, buildParams) {
     const checks = loadComponentChecks();
     const allCheckIds = new Set(checks.map((c) => c.id));
     const registryContext = await resolveRegistryContext(infraPath);
-    const raw = await runComponentChecks(infraPath, checks, registryContext, sandbox, buildParams);
+    // COMP008 (#4490) reads the project's signalOnly terraform roots.
+    const signalOnlyRoots = await signalOnlyRootsOf(findProjectRoot(infraPath));
+    const raw = await runComponentChecks(infraPath, checks, { ...registryContext, signalOnlyRoots }, sandbox, buildParams);
     const fileDirectivesCache = new Map();
     const fileLevelDisable = (file, checkId) => {
         let directives = fileDirectivesCache.get(file);

package/dist/cli/handlers/components.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"components.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/components.ts"],"names":[],"mappings":"AAsDA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD,OAAO,KAAK,EAAE,KAAK,EAAa,MAAM,4BAA4B,CAAC;AAKnE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+GrF;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiH9E;AA6DD;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;6EAQ6E;AAC7E,wBAAgB,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAMzD;AAuGD,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoT9E;AAED,kEAAkE;AAClE,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM/E"}
+{"version":3,"file":"components.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/components.ts"],"names":[],"mappings":"AAuDA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD,OAAO,KAAK,EAAE,KAAK,EAAa,MAAM,4BAA4B,CAAC;AAKnE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+GrF;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiH9E;AA6DD;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;6EAQ6E;AAC7E,wBAAgB,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAMzD;AAgHD,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoT9E;AAED,kEAAkE;AAClE,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM/E"}

package/dist/cli/handlers/components.js

@@ -28,7 +28,8 @@
  */
 import { resolve, join, dirname } from "node:path";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { getHeadCommit, fetchLifecycle, pushLifecycle, readSnapshot, snapshotStorageKey, StaleLifecycleBranchError } from "../../lifecycle/git.js";
+import { getHeadCommit, fetchLifecycle, pushLifecycle, snapshotStorageKey, StaleLifecycleBranchError } from "../../lifecycle/git.js";
+import { resolveSnapshotStore } from "../../lifecycle/snapshot-store.js";
 import { appendReleaseRecord, readReleaseLedger, listReleaseEnvironments, latestPerComponent, resolveRunId, InvalidReleaseRecordError, } from "../../lifecycle/release-ledger.js";
 import { persistReleasePlan, InvalidReleasePlanError } from "../../lifecycle/plan-ledger.js";
 import { reconcileStatus, liveEvidenceFromChangeSet, compareAcrossEnvironments, mergeLiveEvidence } from "../../lifecycle/status.js";
@@ -416,14 +417,22 @@ async function observeComponentStacks(components, plugins, environment) {
  * snapshot is no baseline, never an error: with none, nothing can have changed
  * since, and the status falls back to identity and presence.
  */
+/** Stores already fetched in this process, so a status over many lexicons fetches once. */
+const fetchedBaselineStores = new WeakSet();
 async function readStatusBaseline(environment, lexicon, stacks) {
     const keys = [...new Set([...stacks.filter((s) => !!s).map((s) => snapshotStorageKey(lexicon, s)), snapshotStorageKey(lexicon)])];
+    // Through the index store (#4519); a store that cannot be built is no baseline, like a missing snapshot.
+    const store = await resolveSnapshotStore().catch(() => null);
+    if (store && !fetchedBaselineStores.has(store)) {
+        fetchedBaselineStores.add(store);
+        await store.fetch();
+    }
     let resources;
     const timestamps = new Map();
     for (const key of keys) {
         let snap;
         try {
-            const content = await readSnapshot(environment, key);
+            const content = store ? await store.readLatest(environment, key) : null;
             snap = content ? JSON.parse(content) : undefined;
         }
         catch {

package/dist/cli/handlers/fan-out.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fan-out.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/fan-out.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,EAA+C,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAiB7F,OAAO,EAAmB,KAAK,YAAY,EAAuB,MAAM,0BAA0B,CAAC;AASnG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IACJ,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,UAAU,CAAC,EAAE,OAAO,CAAC;CACjB,GACL,OAAO,CAAC;IAAE,KAAK,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+ErE;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAO9E"}
+{"version":3,"file":"fan-out.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/fan-out.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,EAA+C,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAiB7F,OAAO,EAAmB,KAAK,YAAY,EAAuB,MAAM,0BAA0B,CAAC;AAWnG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IACJ,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,UAAU,CAAC,EAAE,OAAO,CAAC;CACjB,GACL,OAAO,CAAC;IAAE,KAAK,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+ErE;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAO9E"}

package/dist/cli/handlers/fan-out.js

@@ -69,6 +69,8 @@ import { approveCommand, gateIsSealed } from "../../op/gate.js";
 import { getHeadCommit } from "../../lifecycle/git.js";
 import { remainingFanOut } from "../../components/fan-out.js";
 import { readDeployedOutputs } from "../../components/wave-plan.js";
+import { formRunGroups } from "../../components/groups.js";
+import { renderRunGroups, runGroupsReport } from "../../components/run-groups.js";
 import { deployContext, failedRunExitCode } from "../../components/driver.js";
 import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli.js";
 import { formatError, formatInfo, formatWarning } from "../format.js";
@@ -215,6 +217,8 @@ async function fanOut(ctx, projectPath, config) {
         console.error(formatError({ message: signal.error, ...(signal.hint ? { hint: signal.hint } : {}) }));
         return 1;
     }
+    // #4516: one registry finds the declared reads (a template's Fn::ImportValue) that order the fan-out and runs it.
+    const registry = await fanOutRegistry(projectPath, config);
     let derived;
     try {
         derived = await deriveFanOut({
@@ -223,6 +227,7 @@ async function fanOut(ctx, projectPath, config) {
             sandbox: args.sandbox,
             buildParams: paramsResolution.provenance,
             config,
+            registry,
             ...(args.canary?.length ? { canary: args.canary } : {}),
         });
     }
@@ -368,7 +373,6 @@ async function fanOut(ctx, projectPath, config) {
             return 1;
         }
     }
-    const registry = await fanOutRegistry(projectPath, config);
     const env = args.env ?? "local";
     // A completed component's recorded outputs win over a `--seed-outputs`
     // entry for the same name, as a fresh apply's outputs merge over a seed in
@@ -422,10 +426,14 @@ async function fanOut(ctx, projectPath, config) {
     // `--events-json` (#4041) names the run by it too.
     const release = autoReleaseRun(`fan-out-${Date.now()}`);
     const events = await openCliRunEvents(args, { kind: "component", name: `fan-out ${derived.plan.order.join(",")}`, runId: release.runId, cwd: projectPath });
+    // ws-107 (#4465): the components a capability takes as one plan in their
+    // wave and apply as one group; under --wave-gate none forms (ruling 1).
+    const runPlan = await formRunGroups({ components: derived.components, plan: derived.plan, registry, env, ...(waveGate ? { waveGate: true } : {}) });
     let result;
     try {
-        result = await runFanOut(derived.plan, derived.components, registry, {
+        result = await runFanOut(runPlan, derived.components, registry, {
             env,
+            ...(runPlan.groups?.length ? { planGroupsAtWave: true } : {}),
             releaseIdentity: () => (revision ? { revision } : {}),
             componentOutputs,
             ...(targets ? { targets } : {}),
@@ -498,8 +506,13 @@ async function fanOut(ctx, projectPath, config) {
     recordAttempt();
     if (args.json)
         renderFanOutJson(result);
-    else
+    else {
         renderFanOutHuman(result, { ...(gate ? { gate } : {}), ...(waveGate ? { waveGate } : {}) });
+        // #4465: the groups applied as one, and how each member ended.
+        const report = runGroupsReport({ grouped: result.plan.groups?.length || result.plan.fallbacks?.length ? result.plan : runPlan, ...(result.groupOutcomes ? { outcomes: result.groupOutcomes } : {}) });
+        for (const line of renderRunGroups(report, "the same fan-out with --resume"))
+            console.error(formatInfo(line));
+    }
     // A wave whose set moved after its approval stops with both digests named
     // (#3049), the #2300 refusal on a set. Printed on stderr even under --json,
     // since it is the line a CI log reader is looking for.

package/dist/cli/handlers/graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/graph.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAYhE,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,aAAa,CAAC;AAgE9D;;;;;;;;;GASG;AACH;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;AAkbD,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAQD,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,eAAe,CAoBtF"}
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/graph.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAYhE,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,aAAa,CAAC;AAgE9D;;;;;;;;;GASG;AACH;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;AAqcD,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAQD,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,eAAe,CAoBtF"}

package/dist/cli/handlers/graph.js

@@ -2,7 +2,7 @@ import { isAbsolute, relative, resolve } from "node:path";
 import { discoverOps } from "../../op/discover.js";
 import { discover } from "../../discovery/index.js";
 import { partitionByLexicon, computeStackGraph, build } from "../../build.js";
-import { applyLexiconOutputs, buildGraphIr, buildLiveGraphIr, collectUnobserved, overlayGraphs, sourceOverlayGraphs, GRAPH_IR_VERSION } from "../../graph-ir.js";
+import { applyLexiconOutputs, buildGraphIr, buildLiveGraphIr, collectUnobserved, overlayGraphs, sourceOverlayGraphs, withInstanceNodes, GRAPH_IR_VERSION } from "../../graph-ir.js";
 import { behaviourOverlay } from "../../behaviour-overlay.js";
 import { applyBehaviourOverlay, behaviourRequestFromIr } from "../../behaviour-graph.js";
 import { buildDeclaredPerStack } from "../../graph-declared.js";
@@ -274,6 +274,8 @@ async function runGraphLive(ctx, format) {
     let observations;
     // Facts about absent entities (#4372), carried onto the overlay's nodes.
     let annotations;
+    // Which read answered each root (#4452), carried onto the IR as written.
+    let rootReads;
     // A replay is a graph of what was recorded, so it must not reach the provider
     // at all — not for observation and not for enrichment. Anything that quietly
     // called out would make `--at` a live read with an older label on it.
@@ -304,6 +306,7 @@ async function runGraphLive(ctx, format) {
             });
             observations = observeResult.observations;
             annotations = observeResult.annotations;
+            rootReads = observeResult.rootReads;
             const { errors, warnings, notes = [] } = observeResult;
             for (const e of errors)
                 console.error(formatWarning({ message: e }));
@@ -365,7 +368,13 @@ async function runGraphLive(ctx, format) {
     let containment = [];
     if (catalogs.length > 0) {
         const reconstructed = reconstructEdges(ir.nodes, mergeCatalogs(catalogs));
-        ir = { ...ir, edges: reconstructed.edges };
+        // Merge, never replace, as `search --live` does (#1273). An observation
+        // can carry edges of its own (terraform's state dependencies, #4520's
+        // engine facts), and a catalog on one observing lexicon used to wipe every
+        // lexicon's: the reason terraform's catalog stayed off its plugin until
+        // #4535.
+        const seen = new Set(ir.edges.map((e) => `${e.from}|${e.to}|${e.viaAttr ?? ""}`));
+        ir = { ...ir, edges: [...ir.edges, ...reconstructed.edges.filter((e) => !seen.has(`${e.from}|${e.to}|${e.viaAttr ?? ""}`))] };
         containment = reconstructed.containment;
     }
     // Drift overlay: classify each resource against declared source (managed /
@@ -411,7 +420,9 @@ async function runGraphLive(ctx, format) {
             }
             else {
                 await mergeGraphOps(declared.entities, declared.sourceFiles, projectPath);
-                const declaredIr = withLexiconEdges(buildGraphIr(declared.entities, projectPath), plugins, declared.entities);
+                // Instance nodes (#4454) on the declared side too, so a live instance
+                // meets its declared node and an unread one is painted alone.
+                const declaredIr = withInstanceNodes(withLexiconEdges(buildGraphIr(declared.entities, projectPath), plugins, declared.entities), declared.entities);
                 ir =
                     args.overlayAnchor === "live"
                         ? overlayGraphs(ir, declaredIr, overlayOpts)
@@ -467,6 +478,11 @@ async function runGraphLive(ctx, format) {
             ir = { ...ir, groups: { ...ir.groups, byContainer } };
         }
     }
+    // The structured read report (#4452) goes on last, past the overlay, lens
+    // and detail passes that each build a fresh IR, so it is in every format's
+    // IR whatever those kept.
+    if (rootReads && Object.keys(rootReads).length > 0)
+        ir = { ...ir, rootReads };
     return emitIr(ir, ctx, format);
 }
 /**
@@ -858,7 +874,9 @@ async function runGraphView(ctx, format) {
     await mergeGraphOps(result.entities, result.sourceFiles, projectPath);
     // Build the base IR, focus with a lens (declarable-level, most precise), then
     // apply the detail tier — so e.g. blast:<resource> works before any collapse.
-    let ir = buildGraphIr(result.entities, projectPath);
+    // Instance nodes (#4454) go on here, not in `buildGraphIr`, so search and
+    // the other readers of the base IR still count one node per block.
+    let ir = withInstanceNodes(buildGraphIr(result.entities, projectPath), result.entities);
     // The declared half of the epic's delta (#2355): this path predicts the
     // file, the live path predicts the account. Same helper, so the two shapes
     // reach the engine by one route and stay comparable.

package/dist/cli/handlers/index-cloud.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `chant index <substrate>` as a registry command (chant#4532).
+ *
+ * At the terminal, main() hands `index`'s raw argv straight to
+ * `runCloudIndex` (../../lifecycle/cloud-index.ts), because its flags are its
+ * own. This entry is for a caller that has already parsed a command line
+ * with core's parser (the ACP server asks the registry whether a word is a
+ * verb): it rebuilds the words that parser keeps (the substrate, `--json`,
+ * `--help`), and refuses when the parsed line carried an action flag core's
+ * parser knows, so the read-only rule holds on this path too.
+ */
+import type { CommandContext } from "../registry.js";
+export declare function runIndexCommand(ctx: CommandContext): Promise<number>;
+//# sourceMappingURL=index-cloud.d.ts.map

package/dist/cli/handlers/index-cloud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-cloud.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/index-cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkB1E"}

package/dist/cli/handlers/index-cloud.js

@@ -0,0 +1,22 @@
+export async function runIndexCommand(ctx) {
+    const { runCloudIndex } = await import("../../lifecycle/cloud-index.js");
+    const a = ctx.args;
+    const action = a.fix ? "--fix" : a.live ? "--live" : a.write ? "--write" : a.yes ? "--yes" : a.op ? "--op" : undefined;
+    const words = [...(a.positionals ?? (a.path && a.path !== "." ? [a.path] : []))];
+    if (words[0] === "diff") {
+        // #4533 — `chant index diff <a> [<b>]` reads two stored versions; it takes no action flag either.
+        if (action) {
+            process.stderr.write(`chant index diff: refused ${action}: the diff only reads the store\n`);
+            return 2;
+        }
+        const { runIndexDiff } = await import("./index-diff.js");
+        return runIndexDiff([...words.slice(1), ...(a.json ? ["--json"] : []), ...(a.help ? ["--help"] : [])]);
+    }
+    if (action)
+        words.push(action);
+    if (a.json)
+        words.push("--json");
+    if (a.help)
+        words.push("--help");
+    return runCloudIndex(words);
+}

package/dist/cli/handlers/index-diff.d.ts

@@ -0,0 +1,18 @@
+import { type StorePlan } from "../../lifecycle/cloud-index.js";
+import { type IndexDiff } from "../../lifecycle/index-diff.js";
+import { type SnapshotStore } from "../../lifecycle/snapshot-store.js";
+export declare const INDEX_DIFF_USAGE = "chant index diff <a> [<b>] [--store <spec>] [--json]\n\nWhat changed between two versions of one index scope: nodes added and\nremoved, properties changed, edges added and removed. A node is removed only\nwhere the later read listed its type and location; elsewhere it is not\nobserved. Two versions of different scopes are refused.\n\n  <a>              <scopeKey>/<version>, or <scopeKey> for its latest version\n  <b>              <scopeKey>/<version>, or a version name in <a>'s scope.\n                   Absent: the version before <a> against <a> (a scope alone:\n                   its last two versions)\n  --store <spec>   the store to read, as chant index takes it (local,\n                   local:<dir>, git-ref, git-ref:<ref>, s3,\n                   s3://<bucket>[/<prefix>]). Default: the project's store,\n                   else chant's per-user store\n  --json           the diff as JSON\n";
+export interface IndexDiffRunOptions {
+    cwd?: string;
+    env?: Record<string, string | undefined>;
+    home?: string;
+    stdout?: (s: string) => void;
+    stderr?: (s: string) => void;
+    /** Open the planned store; tests pass a fake. */
+    openStore?: (plan: StorePlan, cwd: string) => Promise<Pick<SnapshotStore, "kind" | "listIndex" | "readIndexAt" | "fetch">>;
+}
+/** The diff as text, one line per change. */
+export declare function renderIndexDiff(d: IndexDiff): string;
+/** `chant index diff`'s argv (the words after `diff`). Exit 0 on a diff, 1 on a refusal, 2 on a usage error. */
+export declare function runIndexDiff(argv: readonly string[], o?: IndexDiffRunOptions): Promise<number>;
+//# sourceMappingURL=index-diff.d.ts.map

package/dist/cli/handlers/index-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-diff.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/index-diff.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAsD,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACjH,OAAO,EAAqF,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC/I,OAAO,EAAkE,KAAK,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpI,eAAO,MAAM,gBAAgB,g5BAgB5B,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,iDAAiD;IACjD,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC;CAC5H;AAeD,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CA0BpD;AAED,gHAAgH;AAChH,wBAAsB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsDxG"}