@intentius/chant 0.18.9 → 0.18.12

package/dist/cli/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AASnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAsP9E;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AASnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAkR9E;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}

package/dist/cli/handlers/lifecycle.d.ts

@@ -7,6 +7,14 @@ export declare function runLifecycleSnapshot(ctx: CommandContext): Promise<numbe
  * chant lifecycle show <environment> [lexicon]
  */
 export declare function runLifecycleShow(ctx: CommandContext): Promise<number>;
+/**
+ * chant lifecycle rollback [<environment>] --to <ref>
+ *
+ * Open a PR restoring `sourceDir` to a prior git revision (#873). Source-level,
+ * reviewable, no cloud mutation — a human merges, then a gated apply rolls the
+ * env back. The `<env>` positional is PR context.
+ */
+export declare function runLifecycleRollback(ctx: CommandContext): Promise<number>;
 /**
  * chant lifecycle diff <environment> [lexicon]
  */

package/dist/cli/handlers/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/lifecycle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAoBlD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwE/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoC3E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C3E;AA6TD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6G3E;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1E;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAkBD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/E"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAoBlD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwE/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoC3E;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuB/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C3E;AA6TD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6G3E;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1E;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAkBD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/E"}

package/dist/cli/handlers/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/run.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA0ClD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM;;;;GAO5F;AAID,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgEpE;AAoFD,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCtE;AA0CD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CnE;AA2DD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBtE;AAID,2LAA2L;AAC3L,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BtE;AAmCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAchE;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+D1E;AA4ND;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiFrE;AA4KD,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/run.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA0ClD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM;;;;GAO5F;AA8BD,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgEpE;AAoFD,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCtE;AA0CD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CnE;AA2DD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBtE;AAID,2LAA2L;AAC3L,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BtE;AAmCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAchE;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+D1E;AAkOD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiFrE;AAuLD,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE"}

package/dist/graph-ir.d.ts

@@ -93,15 +93,27 @@ export interface IRExport {
     /** Producer-side attribute the output reads (e.g. "Arn"). */
     attr?: string;
 }
+/** A cross-stack import this stack consumes — a `Parameter` fed from another
+ * stack's output at deploy time. A viewer matches an import `name` to another
+ * stack's export `name` to draw the cross-stack edge; the parameter's in-stack
+ * consumers are ordinary `$ref` edges to `node` (#513). */
+export interface IRImport {
+    /** Parameter name — the cross-stack handle (e.g. "clusterArn"). */
+    name: string;
+    /** Logical name of the parameter node. */
+    node: string;
+}
 /** The full graph IR for a project at the default (declarable) detail level. */
 export interface GraphIR {
     nodes: IRNode[];
     edges: IREdge[];
     groups: IRGroups;
-    /** Outputs this stack publishes for other stacks to import. Imports are already
-     * nodes (`AWS::CloudFormation::Parameter` etc.); a viewer matches an import's
-     * name to an export's name to draw the cross-stack edge to its producer (#513). */
+    /** Outputs this stack publishes for other stacks to import (#513). */
     exports?: IRExport[];
+    /** Parameters this stack imports from other stacks. A viewer matches an import's
+     * `name` to another stack's export `name` to draw the cross-stack edge; the
+     * parameter's in-stack consumers are ordinary `$ref` edges to it (#513). */
+    imports?: IRImport[];
 }
 /**
  * Build the graph IR from resolved entities (the output of `discover`). Pure and

package/dist/graph-ir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph-ir.d.ts","sourceRoot":"","sources":["../src/graph-ir.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mCAAmC;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,IAAI,EAAE,KAAK,CAAC;IACZ,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;iFAE6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;iFAI6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACxC;AAED;qFACqF;AACrF,MAAM,WAAW,QAAQ;IACvB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB;;uFAEmF;IACnF,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;CACtB;AA6ID;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CA6ET;AAQD;4EAC4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CA+BzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAUvE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAgC7E"}
+{"version":3,"file":"graph-ir.d.ts","sourceRoot":"","sources":["../src/graph-ir.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mCAAmC;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,IAAI,EAAE,KAAK,CAAC;IACZ,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;iFAE6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;iFAI6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACxC;AAED;qFACqF;AACrF,MAAM,WAAW,QAAQ;IACvB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;2DAG2D;AAC3D,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB,sEAAsE;IACtE,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB;;gFAE4E;IAC5E,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;CACtB;AAwKD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAsFT;AAQD;4EAC4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CA+BzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAUvE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAgC7E"}

package/dist/lifecycle/rollback.d.ts

@@ -0,0 +1,23 @@
+/** Branch name for a rollback PR. Pure. */
+export declare function rollbackBranchName(env: string | undefined, shortRef: string): string;
+/** PR title for a rollback. Pure. */
+export declare function rollbackTitle(env: string | undefined, ref: string): string;
+/** PR body — explains that merging + applying completes the rollback. Pure. */
+export declare function rollbackBody(env: string | undefined, ref: string, sourceDir: string): string;
+export interface RollbackResult {
+    /** true when the source already matched the ref — nothing to roll back. */
+    noop: boolean;
+    branch?: string;
+    prUrl?: string;
+}
+/**
+ * Open a rollback PR restoring `sourceDir` to `ref`. Isolated worktree; the
+ * caller's branch is untouched. Throws on an unknown ref or a git/gh failure.
+ */
+export declare function rollbackToRevision(opts: {
+    ref: string;
+    env: string | undefined;
+    sourceDir: string;
+    cwd: string;
+}): Promise<RollbackResult>;
+//# sourceMappingURL=rollback.d.ts.map

package/dist/lifecycle/rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/lifecycle/rollback.ts"],"names":[],"mappings":"AAiBA,2CAA2C;AAC3C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,qCAAqC;AACrC,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAO5F;AAED,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,cAAc,CAAC,CA6B1B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.18.9",
+  "version": "0.18.12",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/build.test.ts

@@ -201,6 +201,39 @@ export const testEntity = {
     expect(existsSync(join(testDir, "dist", "ops", "alb-deploy", "worker.ts"))).toBe(true);
   });
 
+  test("op worker files go to <project>/dist/ops even with no --output (#878)", async () => {
+    // The generated Op worker must land where `chant run <op> --temporal` reads it
+    // (`<project>/dist/ops/<name>/worker.ts`) even when the build has no --output
+    // (a Temporal Op project often has no primary resource manifest to route).
+    const opSerializer: Serializer = {
+      name: "multi",
+      rulePrefix: "MULTI",
+      serialize: () => ({
+        primary: "{}",
+        files: {
+          "ops/durable-hello/workflow.ts": "// workflow\n",
+          "ops/durable-hello/worker.ts": "// worker\n",
+          "ops/durable-hello/activities.ts": "// activities\n",
+        },
+      }),
+    };
+    await writeFile(
+      join(testDir, "infra.ts"),
+      `export const x = { [Symbol.for("chant.declarable")]: true, entityType: "X", lexicon: "multi", kind: "resource", props: {}, attributes: {} };`,
+    );
+
+    const result = await buildCommand({
+      path: testDir,
+      format: "json",
+      serializers: [opSerializer],
+      // no `output`
+    } as BuildOptions);
+
+    expect(result.errors).toEqual([]);
+    expect(existsSync(join(testDir, "dist", "ops", "durable-hello", "worker.ts"))).toBe(true);
+    expect(existsSync(join(testDir, "dist", "ops", "durable-hello", "workflow.ts"))).toBe(true);
+  });
+
   // ── #284 bug 2: array-of-objects must serialize to valid YAML ──────────
   test("yaml format serializes an array of objects to valid, round-trippable YAML", async () => {
     // A serializer that emits a CloudFormation-shaped template with a tag list.

package/src/cli/commands/build.ts

@@ -264,6 +264,34 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
       }
     }
 
+    // Op worker artifacts (`ops/<name>/{workflow,worker,activities}.ts`) always
+    // go to `<project>/dist/ops/` — the fixed location `chant run <op> --temporal`
+    // reads (`join(projectPath, "dist", "ops", ...)`) — independent of `--output`,
+    // which routes the primary resource manifest. Without this, a bare `chant build`
+    // only printed them to stderr and `--output foo.yaml` scattered them next to
+    // `foo.yaml`, so the durable-run worker was never where `run --temporal` looks.
+    const projectDist = resolve(options.path ?? ".", "dist");
+    let opsWritten = 0;
+    for (const [filename, content] of [...additionalFiles]) {
+      if (!filename.startsWith("ops/")) continue;
+      additionalFiles.delete(filename);
+      try {
+        const targetPath = join(projectDist, filename);
+        mkdirSync(dirname(targetPath), { recursive: true });
+        writeFileSync(targetPath, content);
+        opsWritten += 1;
+      } catch (err) {
+        errors.push(
+          formatError({
+            message: `Failed to write Op worker file ${filename}: ${err instanceof Error ? err.message : String(err)}`,
+          }),
+        );
+      }
+    }
+    if (opsWritten > 0) {
+      console.error(formatInfo(`Wrote ${opsWritten} Op worker file(s) under ${join(options.path ?? ".", "dist", "ops")}/`));
+    }
+
     if (options.output) {
       // Write to file — ensure parent directories exist for both the primary
       // output path and any nested additional-file paths (e.g. ops/<name>/...).

package/src/cli/handlers/lifecycle.ts

@@ -6,6 +6,7 @@ import { computeBuildDigest, diffDigests } from "../../lifecycle/digest";
 import { diffLive, diffLiveArtifacts, diffSnapshots, type LiveDiffResult, type LiveArtifactDiffResult, type SnapshotDiffResult } from "../../lifecycle/live-diff";
 import { buildChangeSet, renderChangeSet, gitlabMrReport, type ChangeSet } from "../../lifecycle/change-set";
 import { affectedStacks } from "../../lifecycle/affected";
+import { rollbackToRevision } from "../../lifecycle/rollback";
 import { loadChantConfig } from "../../config";
 import { formatError, formatWarning, formatSuccess, formatBold } from "../format";
 import type { CommandContext } from "../registry";
@@ -146,6 +147,38 @@ export async function runLifecycleShow(ctx: CommandContext): Promise<number> {
   return 0;
 }
 
+/**
+ * chant lifecycle rollback [<environment>] --to <ref>
+ *
+ * Open a PR restoring `sourceDir` to a prior git revision (#873). Source-level,
+ * reviewable, no cloud mutation — a human merges, then a gated apply rolls the
+ * env back. The `<env>` positional is PR context.
+ */
+export async function runLifecycleRollback(ctx: CommandContext): Promise<number> {
+  const { args } = ctx;
+  const environment = args.extraPositional; // optional — PR context/title
+  const ref = args.migrateTo; // the --to value
+  if (!ref) {
+    console.error(formatError({ message: "Target revision required: chant lifecycle rollback [<env>] --to <ref>" }));
+    return 1;
+  }
+  const { config } = await loadChantConfig(resolve("."));
+  const sourceDir = config.sourceDir ?? ".";
+  try {
+    const result = await rollbackToRevision({ ref, env: environment, sourceDir, cwd: resolve(".") });
+    if (result.noop) {
+      console.error(formatSuccess(`${sourceDir} already matches ${ref} — nothing to roll back`));
+      return 0;
+    }
+    console.log(result.prUrl); // the PR URL — the consumer (behold) reads this from stdout
+    console.error(formatSuccess(`Opened rollback PR on ${result.branch}`));
+    return 0;
+  } catch (err) {
+    console.error(formatError({ message: `rollback failed — ${err instanceof Error ? err.message : String(err)}` }));
+    return 1;
+  }
+}
+
 /**
  * chant lifecycle diff <environment> [lexicon]
  */

package/src/cli/handlers/run.ts

@@ -59,6 +59,32 @@ export async function makeTemporalClient(profileName: string | undefined, projec
   return { client, profile, config };
 }
 
+/**
+ * Register the Keyword search attributes the generated workflow upserts
+ * (`OpName`, `Phase`, plus any op-declared) on the namespace, so the first
+ * workflow task does not fail with `BadSearchAttributes`. Registered one at a
+ * time so an already-present attribute (`ALREADY_EXISTS`) does not block the
+ * rest. Only used for the autoStart dev server — a real server (autoStart=false)
+ * is expected to have these pre-registered (it may reject registration).
+ */
+async function ensureSearchAttributes(client: unknown, namespace: string, names: string[]): Promise<void> {
+  const operatorService = (
+    client as { connection?: { operatorService?: { addSearchAttributes?: (r: unknown) => Promise<unknown> } } }
+  ).connection?.operatorService;
+  if (!operatorService?.addSearchAttributes) return;
+  const KEYWORD = 2; // Temporal IndexedValueType KEYWORD
+  for (const name of names) {
+    try {
+      await operatorService.addSearchAttributes({ namespace, searchAttributes: { [name]: KEYWORD } });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (!/already|exists/i.test(msg)) {
+        console.error(formatWarning({ message: `Could not register search attribute "${name}": ${msg}` }));
+      }
+    }
+  }
+}
+
 // ── chant run list ──────────────────────────────────���─────────────────────────
 
 export async function runOpList(ctx: CommandContext): Promise<number> {
@@ -803,6 +829,12 @@ async function runComponentTemporal(ctx: CommandContext, selector: string): Prom
     return 1;
   }
 
+  // Register the search attributes the generated component workflow upserts
+  // (ComponentName/Phase) on the autoStart dev server (mirrors runOpTemporal).
+  if (profile.autoStart) {
+    await ensureSearchAttributes(client, profile.namespace, ["ComponentName", "Phase"]);
+  }
+
   const profileName = ctx.args.profile ??
     (((chantConfig as Record<string, unknown>).temporal as Record<string, unknown> | undefined)?.defaultProfile as string | undefined) ??
     "local";
@@ -1098,6 +1130,17 @@ async function runOpTemporal(ctx: CommandContext): Promise<number> {
     return 1;
   }
 
+  // On the autoStart dev server, register the search attributes the generated
+  // workflow upserts (OpName/Phase + any op-declared) so the first workflow task
+  // does not fail with BadSearchAttributes.
+  if (profile.autoStart) {
+    await ensureSearchAttributes(client, profile.namespace, [
+      "OpName",
+      "Phase",
+      ...Object.keys((config as { searchAttributes?: Record<string, string> }).searchAttributes ?? {}),
+    ]);
+  }
+
   // Spawn worker process
   const profileName = ctx.args.profile ??
     (((chantConfig as Record<string, unknown>).temporal as Record<string, unknown> | undefined)?.defaultProfile as string | undefined) ??

package/src/cli/main.ts

@@ -16,7 +16,7 @@ import { runInit, runInitLexicon } from "./handlers/init";
 import { runList, runDescribe, runImport, runAudit, runUpdate, runDoctor } from "./handlers/misc";
 import { runVendor } from "./handlers/vendor";
 import { runMigrate } from "./handlers/migrate";
-import { runLifecycleSnapshot, runLifecycleShow, runLifecycleDiff, runLifecyclePlan, runLifecycleAffected, runLifecycleLog, runLifecycleUnknown } from "./handlers/lifecycle";
+import { runLifecycleSnapshot, runLifecycleShow, runLifecycleDiff, runLifecycleRollback, runLifecyclePlan, runLifecycleAffected, runLifecycleLog, runLifecycleUnknown } from "./handlers/lifecycle";
 import { runComponentsStatus, runComponentsReleaseRecord, runComponentsUnknown } from "./handlers/components";
 import { runGraph } from "./handlers/graph";
 import { runOp, runOpList, runOpStatus, runOpSignal, runOpCancel, runOpLog } from "./handlers/run";
@@ -445,6 +445,7 @@ const registry: CommandDef[] = [
   { name: "lifecycle snapshot", requiresPlugins: true, handler: runLifecycleSnapshot },
   { name: "lifecycle show", handler: runLifecycleShow },
   { name: "lifecycle diff", requiresPlugins: true, handler: runLifecycleDiff },
+  { name: "lifecycle rollback", handler: runLifecycleRollback },
   { name: "lifecycle plan", requiresPlugins: true, handler: runLifecyclePlan },
   { name: "lifecycle affected", requiresPlugins: true, handler: runLifecycleAffected },
   { name: "lifecycle log", handler: runLifecycleLog },

package/src/graph-ir.test.ts

@@ -5,11 +5,17 @@ import { AttrRef } from "./attrref";
 import { LexiconOutput } from "./lexicon-output";
 import { resolveAttrRefs } from "./discovery/resolve";
 import { setProvenance } from "./provenance";
+import { INTRINSIC_MARKER } from "./intrinsic";
 
 function decl<T extends object>(base: T): Declarable & T {
   return { [DECLARABLE_MARKER]: true, ...base } as Declarable & T;
 }
 
+/** A `Ref`-style intrinsic (CloudFormation `{ Ref: name }` shape). */
+function ref(targetName: string): object {
+  return { [INTRINSIC_MARKER]: true, toJSON: () => ({ Ref: targetName }) };
+}
+
 describe("buildGraphIr", () => {
   test("emits a node per resource with kind, lexicon, and scrubbed attrs", () => {
     const vpc = decl({ lexicon: "gcp", entityType: "Vpc", props: { autoCreateSubnetworks: false } });
@@ -26,6 +32,35 @@ describe("buildGraphIr", () => {
     expect(ir.nodes[0].attrs).not.toHaveProperty("entityType");
   });
 
+  test("resolves a Ref-to-node intrinsic into an edge + $ref, and lists parameter imports (#513)", () => {
+    const cluster = decl({ lexicon: "aws", entityType: "AWS::CloudFormation::Parameter" });
+    const service = decl({ lexicon: "aws", entityType: "AWS::ECS::Service", props: { Cluster: ref("clusterArn") } });
+    const entities = new Map<string, Declarable>([
+      ["clusterArn", cluster],
+      ["service", service],
+    ]);
+    resolveAttrRefs(entities);
+
+    const ir = buildGraphIr(entities);
+    // The Ref becomes a real dependency edge, not a dropped intrinsic.
+    expect(ir.edges).toContainEqual({ from: "service", to: "clusterArn", kind: "ref", viaAttr: "Cluster" });
+    // attrs mirror the edge as a $ref envelope, not {$intrinsic}.
+    expect(ir.nodes.find((n) => n.id === "service")!.attrs.Cluster).toEqual({ $ref: "clusterArn" });
+    // Parameter nodes are surfaced as import handles.
+    expect(ir.imports).toEqual([{ name: "clusterArn", node: "clusterArn" }]);
+  });
+
+  test("a Ref to a non-node (pseudo-parameter) stays an opaque intrinsic — no phantom edge (#513)", () => {
+    const service = decl({ lexicon: "aws", entityType: "AWS::ECS::Service", props: { Region: ref("AWS::Region") } });
+    const entities = new Map<string, Declarable>([["service", service]]);
+    resolveAttrRefs(entities);
+
+    const ir = buildGraphIr(entities);
+    expect(ir.edges).toEqual([]);
+    expect(ir.nodes[0].attrs.Region).toEqual({ $intrinsic: true });
+    expect(ir.imports).toBeUndefined();
+  });
+
   test("derives ref edges labelled with the consumer property", () => {
     const vpc = decl({ lexicon: "gcp", entityType: "Vpc" });
     const subnet = decl({ lexicon: "gcp", entityType: "Subnet", props: { network: new AttrRef(vpc, "id") } });

package/src/graph-ir.ts

@@ -107,15 +107,28 @@ export interface IRExport {
   attr?: string;
 }
 
+/** A cross-stack import this stack consumes — a `Parameter` fed from another
+ * stack's output at deploy time. A viewer matches an import `name` to another
+ * stack's export `name` to draw the cross-stack edge; the parameter's in-stack
+ * consumers are ordinary `$ref` edges to `node` (#513). */
+export interface IRImport {
+  /** Parameter name — the cross-stack handle (e.g. "clusterArn"). */
+  name: string;
+  /** Logical name of the parameter node. */
+  node: string;
+}
+
 /** The full graph IR for a project at the default (declarable) detail level. */
 export interface GraphIR {
   nodes: IRNode[];
   edges: IREdge[];
   groups: IRGroups;
-  /** Outputs this stack publishes for other stacks to import. Imports are already
-   * nodes (`AWS::CloudFormation::Parameter` etc.); a viewer matches an import's
-   * name to an export's name to draw the cross-stack edge to its producer (#513). */
+  /** Outputs this stack publishes for other stacks to import (#513). */
   exports?: IRExport[];
+  /** Parameters this stack imports from other stacks. A viewer matches an import's
+   * `name` to another stack's export `name` to draw the cross-stack edge; the
+   * parameter's in-stack consumers are ordinary `$ref` edges to it (#513). */
+  imports?: IRImport[];
 }
 
 /** A node is anything that serializes to a resource — not a property or output. */
@@ -134,6 +147,22 @@ function relFile(file: string | undefined, projectPath?: string): string | undef
   return file;
 }
 
+/** The logical name a `Ref`-style intrinsic points at, or undefined. Lexicon-
+ * agnostic: reads the intrinsic's `toJSON()` for the CloudFormation `{ Ref: name }`
+ * shape (aws `RefIntrinsic` etc.). A `Ref` to a node is a real dependency edge,
+ * not an opaque intrinsic (#513) — so we resolve it rather than flatten it. */
+function refIntrinsicTarget(value: unknown): string | undefined {
+  try {
+    const json = (value as { toJSON?: () => unknown }).toJSON?.();
+    if (json && typeof json === "object" && typeof (json as { Ref?: unknown }).Ref === "string") {
+      return (json as { Ref: string }).Ref;
+    }
+  } catch {
+    // Unresolvable at graph-build time — leave it as an opaque intrinsic.
+  }
+  return undefined;
+}
+
 /** Resolve the producer (logical name) an AttrRef points at. */
 function refTarget(ref: AttrRef, reverse: Map<object, string>): string | undefined {
   // Nested refs (under `props`) aren't assigned a logical name by resolveAttrRefs,
@@ -143,7 +172,7 @@ function refTarget(ref: AttrRef, reverse: Map<object, string>): string | undefin
 }
 
 /** Project a value into a JSON-safe, scrubbed form. References become `{ $ref }`. */
-function project(value: unknown, seen: Set<unknown>, reverse: Map<object, string>): unknown {
+function project(value: unknown, seen: Set<unknown>, reverse: Map<object, string>, nodeIds: Set<string>): unknown {
   if (value === null) return null;
   const t = typeof value;
   if (t === "string" || t === "number" || t === "boolean") return value;
@@ -157,8 +186,12 @@ function project(value: unknown, seen: Set<unknown>, reverse: Map<object, string
     const to = refTarget(value, reverse);
     return { $ref: to ? `${to}.${value.attribute}` : value.attribute } satisfies AttrRefEnvelope;
   }
-  // Other intrinsics (interpolations, pseudo-parameters): mark, don't inline.
   if ((value as Record<symbol, unknown>)[INTRINSIC_MARKER] === true) {
+    // A `Ref` to a known node is a real reference — surface it as `$ref` so attrs
+    // match the edge (#513). Other intrinsics (interpolations, pseudo-parameters,
+    // Ref to a non-node) stay opaque.
+    const to = refIntrinsicTarget(value);
+    if (to && nodeIds.has(to)) return { $ref: to } satisfies AttrRefEnvelope;
     return { $intrinsic: true };
   }
 
@@ -168,20 +201,20 @@ function project(value: unknown, seen: Set<unknown>, reverse: Map<object, string
   // Nested declarables (e.g. an inlined property-kind resource) keep their
   // config in a non-enumerable `props` bag, like top-level nodes — project that.
   if (isDeclarable(value)) {
-    const out = projectConfig(value, seen, reverse);
+    const out = projectConfig(value, seen, reverse, nodeIds);
     seen.delete(value);
     return out;
   }
 
   if (Array.isArray(value)) {
-    const out = value.map((v) => project(v, seen, reverse)).filter((v) => v !== undefined);
+    const out = value.map((v) => project(v, seen, reverse, nodeIds)).filter((v) => v !== undefined);
     seen.delete(value);
     return out;
   }
 
   const out: Record<string, unknown> = {};
   for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
-    const p = project(v, seen, reverse);
+    const p = project(v, seen, reverse, nodeIds);
     if (p !== undefined) out[k] = p;
   }
   seen.delete(value);
@@ -212,10 +245,11 @@ function projectConfig(
   entity: Declarable,
   seen: Set<unknown>,
   reverse: Map<object, string>,
+  nodeIds: Set<string>,
 ): Record<string, unknown> {
   const out: Record<string, unknown> = {};
   for (const [k, v] of configRoots(entity)) {
-    const p = project(v, seen, reverse);
+    const p = project(v, seen, reverse, nodeIds);
     if (p !== undefined) out[k] = p;
   }
   return out;
@@ -239,7 +273,13 @@ function collectEdges(
       }
       return;
     }
-    if ((value as Record<symbol, unknown>)[INTRINSIC_MARKER] === true) return;
+    if ((value as Record<symbol, unknown>)[INTRINSIC_MARKER] === true) {
+      // A `Ref` to a known node (a Parameter, or a resource) is a real dependency
+      // — resolve it to an edge instead of dropping it as an opaque intrinsic (#513).
+      const to = refIntrinsicTarget(value);
+      if (to && to !== from && nodeIds.has(to)) edges.push({ from, to, kind: "ref", viaAttr });
+      return;
+    }
     if (seen.has(value)) return;
     seen.add(value);
     if (Array.isArray(value)) {
@@ -287,7 +327,7 @@ export function buildGraphIr(
       id: name,
       kind: entity.entityType,
       lexicon: entity.lexicon,
-      attrs: projectConfig(entity, new Set(), reverse),
+      attrs: projectConfig(entity, new Set(), reverse, nodeIds),
     };
     if (prov?.composite) node.compositeParent = prov.composite;
     if (prov?.compositeInstance) node.compositeInstance = prov.compositeInstance;
@@ -339,8 +379,17 @@ export function buildGraphIr(
   }
   exports.sort((a, b) => a.name.localeCompare(b.name));
 
+  // Cross-stack imports: parameter nodes are the handles this stack imports by,
+  // matched to another stack's export names (#513). Detected by kind — the aws
+  // `Parameter` is the cross-stack input mechanism.
+  const imports: IRImport[] = nodes
+    .filter((n) => /(^|::)Parameter$/i.test(n.kind))
+    .map((n) => ({ name: n.id, node: n.id }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+
   const ir: GraphIR = { nodes, edges, groups };
   if (exports.length) ir.exports = exports;
+  if (imports.length) ir.imports = imports;
   return ir;
 }
 

package/src/lifecycle/rollback.test.ts

@@ -0,0 +1,25 @@
+import { describe, test, expect } from "vitest";
+import { rollbackBranchName, rollbackTitle, rollbackBody } from "./rollback";
+
+describe("rollback helpers (#873)", () => {
+  test("branch name includes env and short ref", () => {
+    expect(rollbackBranchName("prod", "a1b2c3d")).toBe("chant/rollback-prod-a1b2c3d");
+  });
+
+  test("branch name falls back to 'src' when env is absent", () => {
+    expect(rollbackBranchName(undefined, "a1b2c3d")).toBe("chant/rollback-src-a1b2c3d");
+  });
+
+  test("title names the env and ref", () => {
+    expect(rollbackTitle("prod", "v1.2.0")).toBe("rollback prod source to v1.2.0");
+    expect(rollbackTitle(undefined, "v1.2.0")).toBe("rollback source to v1.2.0");
+  });
+
+  test("body references the sourceDir, ref, and the gated-apply step", () => {
+    const body = rollbackBody("prod", "abc123", "src");
+    expect(body).toContain("`src`");
+    expect(body).toContain("`abc123`");
+    expect(body).toContain("the prod environment");
+    expect(body).toMatch(/approval gate|Sync|apply/i);
+  });
+});

package/src/lifecycle/rollback.ts

@@ -0,0 +1,83 @@
+/**
+ * lifecycle rollback (#873) — open a PR that restores the source to a prior git
+ * revision. Rollback = make an env match a past state of the declared source; the
+ * PR's diff *is* the rollback delta. No cloud mutation here — a human merges, then
+ * the existing gated apply rolls the env back.
+ *
+ * Runs entirely in an isolated `git worktree` (like {@link ./affected}), so the
+ * caller's working branch/tree is never touched — important because the consumer
+ * (behold) serves a live checkout.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const execFileAsync = promisify(execFile);
+
+/** Branch name for a rollback PR. Pure. */
+export function rollbackBranchName(env: string | undefined, shortRef: string): string {
+  return `chant/rollback-${env ?? "src"}-${shortRef}`;
+}
+
+/** PR title for a rollback. Pure. */
+export function rollbackTitle(env: string | undefined, ref: string): string {
+  return `rollback ${env ? env + " " : ""}source to ${ref}`;
+}
+
+/** PR body — explains that merging + applying completes the rollback. Pure. */
+export function rollbackBody(env: string | undefined, ref: string, sourceDir: string): string {
+  const target = env ? `the ${env} environment` : "the environment";
+  return (
+    `Restores \`${sourceDir}\` to its state at \`${ref}\`.\n\n` +
+    `The diff below is the rollback delta. Merge this PR, then apply (Sync) to roll ${target} back — ` +
+    `a destructive apply still passes through its approval gate. No cloud change was made by opening this PR.`
+  );
+}
+
+export interface RollbackResult {
+  /** true when the source already matched the ref — nothing to roll back. */
+  noop: boolean;
+  branch?: string;
+  prUrl?: string;
+}
+
+/**
+ * Open a rollback PR restoring `sourceDir` to `ref`. Isolated worktree; the
+ * caller's branch is untouched. Throws on an unknown ref or a git/gh failure.
+ */
+export async function rollbackToRevision(opts: {
+  ref: string;
+  env: string | undefined;
+  sourceDir: string;
+  cwd: string;
+}): Promise<RollbackResult> {
+  const { ref, env, sourceDir, cwd } = opts;
+  const git = (args: string[], wd: string): Promise<{ stdout: string }> => execFileAsync("git", args, { cwd: wd });
+
+  const repoRoot = (await git(["rev-parse", "--show-toplevel"], cwd)).stdout.trim();
+  // Verify the ref resolves to a commit (throws with a clear message otherwise).
+  await execFileAsync("git", ["rev-parse", "--verify", `${ref}^{commit}`], { cwd: repoRoot });
+  const shortRef = (await git(["rev-parse", "--short", ref], repoRoot)).stdout.trim();
+  const branch = rollbackBranchName(env, shortRef);
+  const wt = join(tmpdir(), `chant-rollback-${shortRef}-${process.pid}`);
+
+  await git(["worktree", "add", wt, "-b", branch, "HEAD"], repoRoot);
+  try {
+    // Restore just the source tree to the target revision (stages the changes).
+    await git(["checkout", ref, "--", sourceDir], wt);
+    const staged = (await git(["status", "--porcelain", "--", sourceDir], wt)).stdout.trim();
+    if (!staged) return { noop: true };
+
+    await git(["commit", "-m", rollbackTitle(env, ref)], wt);
+    await git(["push", "-u", "origin", branch], wt);
+    const { stdout } = await execFileAsync(
+      "gh",
+      ["pr", "create", "--title", rollbackTitle(env, ref), "--body", rollbackBody(env, ref, sourceDir), "--head", branch],
+      { cwd: wt },
+    );
+    return { noop: false, branch, prUrl: stdout.trim() };
+  } finally {
+    await git(["worktree", "remove", "--force", wt], repoRoot).catch(() => {});
+  }
+}