@intentius/chant 0.37.2 → 0.39.0

package/src/cli/handlers/components.ts

@@ -350,7 +350,7 @@ export async function runComponentsStatus(ctx: CommandContext): Promise<number>
       const endpointResult = applyLiveEndpoint(
         config.environments,
         environment,
-        plugins.filter((p) => p.describeResources || p.describeStackStatus).map((p) => p.name),
+        plugins.filter((p) => p.describeResources || p.describeStackStatus),
       );
       if (endpointResult.notice) console.error(formatWarning({ message: endpointResult.notice }));
       try {

package/src/cli/handlers/emulator.ts

@@ -1,6 +1,6 @@
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
-import { emulatorLifecycle } from "../../op";
+import { emulatorLifecycle, emulatorsOf } from "../../op";
 import { formatError, formatWarning, formatSuccess } from "../format";
 import type { CommandContext } from "../registry";
 
@@ -48,8 +48,13 @@ export async function runEmulator(ctx: CommandContext): Promise<number> {
     return 1;
   }
 
-  const withEmulator = plugins.filter((p) => p.emulator && (!args.lexicon || p.name === args.lexicon));
-  if (withEmulator.length === 0) {
+  // One entry per emulator, not per lexicon (#1345): fly ships two — mudflaps
+  // for the Machines API and spritzer for Sprites — and reporting a lexicon
+  // would have to pick one of them.
+  const targets = plugins
+    .filter((p) => !args.lexicon || p.name === args.lexicon)
+    .flatMap((p) => emulatorsOf(p.emulator).map((cap) => ({ lexicon: p.name, cap })));
+  if (targets.length === 0) {
     if (args.json) {
       console.log(JSON.stringify({ emulators: [] }));
       return 0;
@@ -63,19 +68,18 @@ export async function runEmulator(ctx: CommandContext): Promise<number> {
   }
 
   const reports: EmulatorReport[] = [];
-  for (const p of withEmulator) {
-    const cap = p.emulator!;
+  for (const { lexicon, cap } of targets) {
     const lc = emulatorLifecycle(cap.spec);
     if (action === "up") {
       const { endpoint } = await lc.up();
-      reports.push({ lexicon: p.name, name: cap.spec.name, endpoint, env: cap.env(endpoint) });
+      reports.push({ lexicon, name: cap.spec.name, endpoint, env: cap.env(endpoint) });
     } else if (action === "down") {
       await lc.down();
-      reports.push({ lexicon: p.name, name: cap.spec.name, endpoint: "", env: {} });
+      reports.push({ lexicon, name: cap.spec.name, endpoint: "", env: {} });
     } else {
       const running = await isRunning(cap.spec.name);
       const endpoint = running ? lc.endpoint(cap.spec.containerPort) : "";
-      reports.push({ lexicon: p.name, name: cap.spec.name, endpoint, env: endpoint ? cap.env(endpoint) : {} });
+      reports.push({ lexicon, name: cap.spec.name, endpoint, env: endpoint ? cap.env(endpoint) : {} });
     }
   }
 

package/src/cli/handlers/graph.test.ts

@@ -3,6 +3,18 @@ import type { ParsedArgs } from "../registry";
 import { DECLARABLE_MARKER, type Declarable } from "../../declarable";
 import { AttrRef } from "../../attrref";
 
+/**
+ * The aws emulator capability, as the real plugin declares it. `--live`
+ * endpoint injection reads the endpoint var off this rather than off a map
+ * keyed by lexicon name (#1345), so a mock that omits it gets no injection —
+ * which is the same thing that would happen in production.
+ */
+const awsEmulatorStub = {
+  spec: { name: "chant-floci", image: "floci/floci:1.5.34", containerPort: 4566, healthPath: "/_localstack/health" },
+  env: (endpoint: string) => ({ AWS_ENDPOINT_URL: endpoint, AWS_ACCESS_KEY_ID: "test" }),
+};
+
+
 const discoverOpsMock = vi.fn();
 vi.mock("../../op/discover", () => ({
   discoverOps: () => discoverOpsMock(),
@@ -10,7 +22,9 @@ vi.mock("../../op/discover", () => ({
 
 const discoverMock = vi.fn();
 vi.mock("../../discovery/index", () => ({
-  discover: () => discoverMock(),
+  // Forwards its arguments so a test can assert what the handler passed —
+  // `buildParams` in particular (#1359).
+  discover: (...a: unknown[]) => discoverMock(...a),
 }));
 
 const lintMock = vi.fn();
@@ -62,11 +76,13 @@ vi.mock("../../components/discover", () => ({
   discoverComponents: (...a: unknown[]) => discoverComponentsMock(...a),
 }));
 const loadChantConfigMock = vi.fn();
+const loadChantConfigUpwardMock = vi.fn();
 vi.mock("../../config", async () => {
   const actual = await vi.importActual<typeof import("../../config")>("../../config");
   return {
     ...actual,
     loadChantConfig: (...a: unknown[]) => loadChantConfigMock(...a),
+    loadChantConfigUpward: (...a: unknown[]) => loadChantConfigUpwardMock(...a),
   };
 });
 vi.mock("../../build", () => ({
@@ -124,6 +140,8 @@ describe("runGraph", () => {
     resolveLexMock.mockReset();
     loadChantConfigMock.mockReset();
     loadChantConfigMock.mockResolvedValue({ config: {} });
+    loadChantConfigUpwardMock.mockReset();
+    loadChantConfigUpwardMock.mockResolvedValue({ config: {} });
   });
 
   describe("Op graph (default)", () => {
@@ -186,6 +204,47 @@ describe("runGraph", () => {
       expect(ir.edges).toContainEqual({ from: "subnet", to: "vpc", kind: "ref", viaAttr: "network" });
     });
 
+    // #1339 — `chant graph` discovered source with `params.*` empty, so a
+    // declaration conditioned on a build parameter always took its default:
+    // the graph showed one shape whatever `--param` or a declared `env:`
+    // mapping said, while `chant build` on the same source showed another.
+    describe("build-time parameters reach discovery (#1359)", () => {
+      const withTierParam = (): void => {
+        loadChantConfigUpwardMock.mockResolvedValue({
+          config: { buildParams: { tier: { type: "string", enum: ["light", "prod"], default: "light" } } },
+        });
+      };
+
+      test("--param is resolved and passed to discover", async () => {
+        lintClean(); discovered(); withTierParam();
+        const exit = await runGraph({
+          args: makeArgs({ format: "ir", param: ["tier=prod"] }),
+          plugins: [],
+          serializers: [],
+        });
+        expect(exit).toBe(0);
+        const [, options] = discoverMock.mock.calls[0] as [string, { buildParams?: Array<{ name: string; value: unknown }> }];
+        expect(options.buildParams).toContainEqual(expect.objectContaining({ name: "tier", value: "prod" }));
+      });
+
+      test("a declared default is passed too, so discovery never sees an empty params object", async () => {
+        lintClean(); discovered(); withTierParam();
+        await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+        const [, options] = discoverMock.mock.calls[0] as [string, { buildParams?: Array<{ name: string; value: unknown }> }];
+        expect(options.buildParams).toContainEqual(expect.objectContaining({ name: "tier", value: "light" }));
+      });
+
+      test("an unresolvable parameter stops the graph rather than emitting a default one", async () => {
+        lintClean(); discovered();
+        loadChantConfigUpwardMock.mockResolvedValue({
+          config: { buildParams: { tier: { type: "string", required: true } } },
+        });
+        const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+        expect(exit).toBe(1);
+        expect(stdoutBuf.join("\n")).toBe("");
+      });
+    });
+
     test("lint gate: refuses to emit when source has lint errors", async () => {
       lintMock.mockResolvedValue({ success: false });
       const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
@@ -427,7 +486,7 @@ describe("runGraph", () => {
     test("loads plugins for --live when ctx.plugins is empty", async () => {
       resolveLexMock.mockResolvedValue(["aws"]);
       loadPluginsMock.mockResolvedValue([
-        { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+        { name: "aws", serializer: {}, emulator: awsEmulatorStub, describeResources: () => Promise.resolve({}) },
       ]);
       observeMock.mockResolvedValue({
         observations: [{ lexicon: "aws", resources: { "web-vpc": { type: "AWS::EC2::VPC", status: "OK" } } }],
@@ -448,7 +507,7 @@ describe("runGraph", () => {
     test("--at graphs the recorded snapshot without reading the estate", async () => {
       resolveLexMock.mockResolvedValue(["aws"]);
       loadPluginsMock.mockResolvedValue([
-        { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}),
+        { name: "aws", serializer: {}, emulator: awsEmulatorStub, describeResources: () => Promise.resolve({}),
           enrichLiveAttrs: () => Promise.reject(new Error("must not be called on a replay")) },
       ]);
       replayMock.mockResolvedValue({
@@ -473,7 +532,7 @@ describe("runGraph", () => {
       hasSnapshotMock.mockResolvedValue(true);
       resolveLexMock.mockResolvedValue(["aws"]);
       loadPluginsMock.mockResolvedValue([
-        { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+        { name: "aws", serializer: {}, emulator: awsEmulatorStub, describeResources: () => Promise.resolve({}) },
       ]);
       observeMock.mockResolvedValue({ observations: [], errors: ["could not connect"], warnings: [] });
       const errs: string[] = [];
@@ -489,7 +548,7 @@ describe("runGraph", () => {
       hasSnapshotMock.mockResolvedValue(false);
       resolveLexMock.mockResolvedValue(["aws"]);
       loadPluginsMock.mockResolvedValue([
-        { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+        { name: "aws", serializer: {}, emulator: awsEmulatorStub, describeResources: () => Promise.resolve({}) },
       ]);
       observeMock.mockResolvedValue({ observations: [], errors: ["could not connect"], warnings: [] });
       const errs: string[] = [];
@@ -515,7 +574,7 @@ describe("runGraph", () => {
     test("single-stack project (no components): observeResources gets an empty stacks list", async () => {
       resolveLexMock.mockResolvedValue(["aws"]);
       loadPluginsMock.mockResolvedValue([
-        { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+        { name: "aws", serializer: {}, emulator: awsEmulatorStub, describeResources: () => Promise.resolve({}) },
       ]);
       observeMock.mockResolvedValue({ observations: [], errors: [], warnings: [] });
       const exit = await runGraph({ args: makeArgs({ format: "ir", live: true, env: "prod" }), plugins: [], serializers: [] });
@@ -533,7 +592,7 @@ describe("runGraph", () => {
     test("multi-stack component project: resolves each component's cfn-deploy stack(s) and passes them to observeResources", async () => {
       resolveLexMock.mockResolvedValue(["aws"]);
       loadPluginsMock.mockResolvedValue([
-        { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+        { name: "aws", serializer: {}, emulator: awsEmulatorStub, describeResources: () => Promise.resolve({}) },
       ]);
       discoverComponentsMock.mockResolvedValue({
         errors: [],
@@ -580,7 +639,7 @@ describe("runGraph", () => {
     test("ChantConfig.stacks: observeResources gets every declared stack, with its region and src", async () => {
       resolveLexMock.mockResolvedValue(["aws"]);
       loadPluginsMock.mockResolvedValue([
-        { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+        { name: "aws", serializer: {}, emulator: awsEmulatorStub, describeResources: () => Promise.resolve({}) },
       ]);
       loadChantConfigMock.mockResolvedValue({
         config: {
@@ -609,7 +668,7 @@ describe("runGraph", () => {
     test("ChantConfig.stacks: a stack also derived from a component is not observed twice", async () => {
       resolveLexMock.mockResolvedValue(["aws"]);
       loadPluginsMock.mockResolvedValue([
-        { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+        { name: "aws", serializer: {}, emulator: awsEmulatorStub, describeResources: () => Promise.resolve({}) },
       ]);
       discoverComponentsMock.mockResolvedValue({
         errors: [],
@@ -636,7 +695,7 @@ describe("runGraph", () => {
     test("component discovery errors: falls back to the single-stack path with a warning", async () => {
       resolveLexMock.mockResolvedValue(["aws"]);
       loadPluginsMock.mockResolvedValue([
-        { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+        { name: "aws", serializer: {}, emulator: awsEmulatorStub, describeResources: () => Promise.resolve({}) },
       ]);
       discoverComponentsMock.mockResolvedValue({ errors: [{ message: "bad component" }], sourceFiles: [], components: new Map() });
       observeMock.mockResolvedValue({ observations: [], errors: [], warnings: [] });
@@ -667,7 +726,7 @@ describe("runGraph", () => {
         });
         resolveLexMock.mockResolvedValue(["aws"]);
         loadPluginsMock.mockResolvedValue([
-          { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+          { name: "aws", serializer: {}, emulator: awsEmulatorStub, describeResources: () => Promise.resolve({}) },
         ]);
         let seenDuringObserve: string | undefined;
         observeMock.mockImplementation(async () => {
@@ -688,7 +747,7 @@ describe("runGraph", () => {
         });
         resolveLexMock.mockResolvedValue(["aws"]);
         loadPluginsMock.mockResolvedValue([
-          { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+          { name: "aws", serializer: {}, emulator: awsEmulatorStub, describeResources: () => Promise.resolve({}) },
         ]);
         let seenDuringObserve: string | undefined;
         observeMock.mockImplementation(async () => {

package/src/cli/handlers/graph.ts

@@ -7,7 +7,7 @@ import { buildDeclaredPerStack } from "../../graph-declared";
 import { reconstructEdges, mergeCatalogs, containmentGroups, type ReferenceCatalog, type ContainmentPair } from "../../graph-refs";
 import { observeResources } from "../../lifecycle/observe";
 import { replaySnapshots, hasSnapshot } from "../../lifecycle/replay";
-import { loadChantConfig, environmentNames } from "../../config";
+import { loadChantConfig, environmentNames, loadChantConfigUpward, type ChantConfig } from "../../config";
 import { applyLiveEndpoint } from "../../live-endpoint";
 import { applyDetail, type DetailLevel } from "../../graph-detail";
 import { applyLens, parseLens } from "../../graph-lens";
@@ -20,9 +20,42 @@ import { readFileSync } from "node:fs";
 import { formatError, formatWarning, formatBold } from "../format";
 import type { CommandContext } from "../registry";
 import { computeComponentGraph, generateComponentsPipeline } from "../../components/cli-support";
+import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli";
+import type { BuildParamProvenance } from "../../provenance";
 import { discoverComponents } from "../../components/discover";
 import { cfnDeployStacks } from "./components";
 
+
+/**
+ * Resolve this invocation's declared build-time parameters, the same way
+ * `chant build` does, so `discover()` sees the values the source will read.
+ *
+ * Without this `chant graph` discovered source with `params.*` empty, so every
+ * declaration conditioned on a parameter took its default — a project whose
+ * tier is a `buildParams` entry graphed as one tier whatever `--param tier=`
+ * or the declared `env:` mapping said, while `chant build` on the same source
+ * and the same environment emitted a different resource set. Two commands
+ * disagreeing about what the source says.
+ *
+ * Returns `undefined` when resolution failed, having printed why — the caller
+ * should stop rather than graph something that will not build.
+ */
+async function graphBuildParams(
+  ctx: CommandContext,
+  projectPath: string,
+): Promise<BuildParamProvenance[] | undefined> {
+  const { config } = await loadChantConfigUpward(projectPath).catch(() => ({ config: {} as ChantConfig }));
+  const resolution = resolveCliBuildParams(config.buildParams, {
+    cli: parseParamFlags(ctx.args.param),
+    paramsFile: ctx.args.paramsFile,
+  });
+  if (!resolution.success) {
+    for (const message of resolution.errors) console.error(message);
+    return undefined;
+  }
+  return resolution.provenance;
+}
+
 /**
  * `chant graph` — the Op dependency graph by default; `--stacks` renders the
  * cross-stack apply-ordering graph (edges, order, waves) chant computes from
@@ -158,7 +191,7 @@ async function runGraphLive(
     // exported e.g. AWS_ENDPOINT_URL. Ambient always wins when it's already set.
     // Scoped to just this describe/enrich pass — restored in `finally` so it
     // never leaks into a later invocation in the same process.
-    const endpointResult = applyLiveEndpoint(config.environments, environment, observing.map((p) => p.name));
+    const endpointResult = applyLiveEndpoint(config.environments, environment, observing);
     if (endpointResult.notice) console.error(formatWarning({ message: endpointResult.notice }));
 
     let ir: GraphIR;
@@ -271,7 +304,10 @@ async function runGraphLive(
           ? overlayGraphs(ir, declaredIr, overlayOpts)
           : sourceOverlayGraphs(declaredIr, ir, overlayOpts);
     } else {
-      const declared = await discover(resolve(args.src ?? config.sourceDir ?? "."));
+      const declaredParams = await graphBuildParams(ctx, projectPath);
+      const declared = await discover(resolve(args.src ?? config.sourceDir ?? "."), {
+        ...(declaredParams ? { buildParams: declaredParams } : {}),
+      });
       if (declared.errors.length === 0) {
         const declaredIr = buildGraphIr(declared.entities, projectPath);
         ir =
@@ -487,7 +523,10 @@ async function runGraphView(
     return 1;
   }
 
-  const result = await discover(projectPath);
+  const buildParams = await graphBuildParams(ctx, projectPath);
+  if (!buildParams) return 1;
+
+  const result = await discover(projectPath, { buildParams });
   if (result.errors.length > 0) {
     for (const e of result.errors) console.error(formatError({ message: e.message }));
     return 1;
@@ -596,7 +635,9 @@ async function runOpGraph(): Promise<number> {
 
 async function runStackGraph(ctx: CommandContext): Promise<number> {
   const projectPath = resolve(ctx.args.path === "." ? "." : ctx.args.path);
-  const result = await discover(projectPath);
+  const buildParams = await graphBuildParams(ctx, projectPath);
+  if (!buildParams) return 1;
+  const result = await discover(projectPath, { buildParams });
   if (result.errors.length > 0) {
     for (const e of result.errors) console.error(formatError({ message: e.message }));
     return 1;

package/src/cli/handlers/lifecycle.test.ts

@@ -5,6 +5,18 @@ import type { LexiconPlugin, ResourceMetadata } from "../../lexicon";
 import type { BuildResult } from "../../build";
 import type { ParsedArgs } from "../registry";
 
+/**
+ * The aws emulator capability, as the real plugin declares it. `--live`
+ * endpoint injection reads the endpoint var off this rather than off a map
+ * keyed by lexicon name (#1345), so a mock that omits it gets no injection —
+ * the same thing that would happen in production.
+ */
+const awsEmulatorStub = {
+  spec: { name: "chant-floci", image: "floci/floci:1.5.34", containerPort: 4566, healthPath: "/_localstack/health" },
+  env: (endpoint: string) => ({ AWS_ENDPOINT_URL: endpoint, AWS_ACCESS_KEY_ID: "test" }),
+};
+
+
 const buildMock = vi.fn();
 const fetchLifecycleMock = vi.fn();
 const readSnapshotMock = vi.fn();
@@ -123,6 +135,7 @@ describe("runLifecycleDiff --live", () => {
     const plugins: LexiconPlugin[] = [
       createMockPlugin({
         name: "aws",
+        emulator: awsEmulatorStub,
         describeResources: staticDescribeResources({
           bucket: meta({ status: "UPDATE_COMPLETE" }),
         }),
@@ -186,6 +199,7 @@ describe("runLifecycleDiff --live", () => {
     const plugins: LexiconPlugin[] = [
       createMockPlugin({
         name: "aws",
+        emulator: awsEmulatorStub,
         describeResources: async () => { throw new Error("Unable to locate credentials"); },
       }),
     ];
@@ -211,7 +225,7 @@ describe("runLifecycleDiff --live", () => {
     loadChantConfigMock.mockResolvedValue({ config: { sourceDir: "src" } });
 
     const plugins: LexiconPlugin[] = [
-      createMockPlugin({ name: "aws", describeResources: staticDescribeResources({}) }),
+      createMockPlugin({ name: "aws", emulator: awsEmulatorStub, describeResources: staticDescribeResources({}) }),
     ];
     const exit = await runLifecycleDiff({
       args: makeArgs({ path: "diff", extraPositional: "prod", extraPositional2: "aws", live: true }),
@@ -231,7 +245,7 @@ describe("runLifecycleDiff --live", () => {
     loadChantConfigMock.mockResolvedValue({ config: { sourceDir: "src" } });
 
     const plugins: LexiconPlugin[] = [
-      createMockPlugin({ name: "aws", describeResources: staticDescribeResources({}) }),
+      createMockPlugin({ name: "aws", emulator: awsEmulatorStub, describeResources: staticDescribeResources({}) }),
     ];
     const exit = await runLifecycleDiff({
       args: makeArgs({ path: "diff", extraPositional: "prod", extraPositional2: "aws", live: true, src: "infra" }),
@@ -259,6 +273,7 @@ describe("runLifecycleDiff --live", () => {
     const plugins: LexiconPlugin[] = [
       createMockPlugin({
         name: "aws",
+        emulator: awsEmulatorStub,
         describeResources: async (options: { stack?: string }) => {
           observedStacks.push(options.stack);
           return {};
@@ -371,6 +386,7 @@ describe("runLifecycleDiff --live", () => {
     const withDeep = (over: Parameters<typeof createMockPlugin>[0] = {}) =>
       createMockPlugin({
         name: "aws",
+        emulator: awsEmulatorStub,
         describeResources: staticObservation({ bucket: meta() }),
         observeResourcesDeep: staticDeepObservation({
           bucket: {
@@ -501,6 +517,7 @@ describe("runLifecycleDiff --live", () => {
       const plugins: LexiconPlugin[] = [
         createMockPlugin({
           name: "aws",
+          emulator: awsEmulatorStub,
           describeResources: async () => {
             seenDuringDescribe = process.env.AWS_ENDPOINT_URL;
             return {};
@@ -533,6 +550,7 @@ describe("runLifecycleDiff --live", () => {
       const plugins: LexiconPlugin[] = [
         createMockPlugin({
           name: "aws",
+          emulator: awsEmulatorStub,
           describeResources: async () => {
             seenDuringDescribe = process.env.AWS_ENDPOINT_URL;
             return {};
@@ -575,7 +593,7 @@ describe("runLifecyclePlan", () => {
   test("happy path: proposes a create for a declared, unobserved-nowhere-else entity", async () => {
     buildMock.mockResolvedValue(makeBuildResult({ aws: ["bucket"] }));
     const plugins: LexiconPlugin[] = [
-      createMockPlugin({ name: "aws", describeResources: staticDescribeResources({}) }),
+      createMockPlugin({ name: "aws", emulator: awsEmulatorStub, describeResources: staticDescribeResources({}) }),
     ];
     const exit = await runLifecyclePlan({
       args: makeArgs({ path: "plan", extraPositional: "prod" }),
@@ -608,6 +626,7 @@ describe("runLifecyclePlan", () => {
       const plugins: LexiconPlugin[] = [
         createMockPlugin({
           name: "aws",
+          emulator: awsEmulatorStub,
           describeResources: async () => {
             seenDuringDescribe = process.env.AWS_ENDPOINT_URL;
             return {};
@@ -638,6 +657,7 @@ describe("runLifecyclePlan", () => {
       const plugins: LexiconPlugin[] = [
         createMockPlugin({
           name: "aws",
+          emulator: awsEmulatorStub,
           describeResources: async () => {
             seenDuringDescribe = process.env.AWS_ENDPOINT_URL;
             return {};
@@ -720,6 +740,7 @@ describe("runLifecycleSnapshot", () => {
     const plugins: LexiconPlugin[] = [
       createMockPlugin({
         name: "aws",
+        emulator: awsEmulatorStub,
         describeResources: staticDescribeResources({ bucket: meta() }),
       }),
     ];
@@ -842,7 +863,7 @@ describe("runLifecycleSnapshot", () => {
         return { snapshots: [], commit: "sha", warnings: [], errors: [] };
       });
       const plugins: LexiconPlugin[] = [
-        createMockPlugin({ name: "aws", describeResources: staticDescribeResources({}) }),
+        createMockPlugin({ name: "aws", emulator: awsEmulatorStub, describeResources: staticDescribeResources({}) }),
       ];
       const exit = await runLifecycleSnapshot({
         args: makeArgs({ command: "state", path: "snapshot", extraPositional: "floci" }),

package/src/cli/handlers/lifecycle.ts

@@ -135,7 +135,7 @@ export async function runLifecycleSnapshot(ctx: CommandContext): Promise<number>
   // #1166 — same self-sufficiency as `chant graph --live`: a snapshot is
   // always a live read, so an environment's declared endpoint applies here
   // too, unless the ambient shell already set it.
-  const endpointResult = applyLiveEndpoint(config.environments, environment, observingPlugins.map((p) => p.name));
+  const endpointResult = applyLiveEndpoint(config.environments, environment, observingPlugins);
   if (endpointResult.notice) console.error(formatWarning({ message: endpointResult.notice }));
 
   // Build every stack first, so the ambient scan (#1278) can be bounded by the
@@ -349,7 +349,7 @@ export async function runLifecycleDiff(ctx: CommandContext): Promise<number> {
   // Floci), so `--live` is self-sufficient even when the ambient shell never
   // exported e.g. AWS_ENDPOINT_URL. Ambient always wins when it's already set.
   // Scoped to just the live reads below — restored in `finally`.
-  const liveLexicons = args.live ? plugins.filter((p) => p.describeResources || p.listArtifacts).map((p) => p.name) : [];
+  const liveLexicons = args.live ? plugins.filter((p) => p.describeResources || p.listArtifacts) : [];
   const endpointResult = applyLiveEndpoint(config.environments, environment, liveLexicons);
   if (endpointResult.notice) console.error(formatWarning({ message: endpointResult.notice }));
 
@@ -597,6 +597,16 @@ async function runLifecycleDiffDigest(args: DigestDiffArgs): Promise<number> {
     for (const name of diff.unchanged) {
       console.log(name.padEnd(20) + "unchanged".padEnd(12) + (currentDigest.resources[name]?.type ?? ""));
     }
+
+    // chant #1442 — a lexicon bump can change emitted output with no source
+    // change, so every resource above can read "unchanged" while the build is
+    // not the same build. Printed under the table rather than as a row: no
+    // resource's declaration moved, the thing that interpreted them did.
+    for (const change of diff.lexiconVersionChanges) {
+      const from = change.previous ?? "(absent)";
+      const to = change.current ?? "(absent)";
+      console.log(`\nlexicon ${change.lexicon}: ${from} → ${to}`);
+    }
   }
 
   return 0;
@@ -1043,7 +1053,13 @@ export async function runLifecyclePlan(ctx: CommandContext): Promise<number> {
   // declare its own endpoint, applied here unless the ambient shell already
   // set it. `chant lifecycle plan` is always a live read (no `--live` flag of
   // its own), so this applies unconditionally.
-  const endpointResult = applyLiveEndpoint(config.environments, environment, lexicons);
+  // Names here, plugins there: the endpoint vars come from each lexicon's own
+  // emulator capability (#1345), so this needs the loaded plugin, not the name.
+  const endpointResult = applyLiveEndpoint(
+    config.environments,
+    environment,
+    lexicons.map((name) => plugins.find((p) => p.name === name)).filter((p) => p !== undefined),
+  );
   if (endpointResult.notice) console.error(formatWarning({ message: endpointResult.notice }));
 
   try {

package/src/cli/handlers/run-client.ts

@@ -116,7 +116,9 @@ export function resolveProfile(
   config: Record<string, unknown>,
   profileName?: string,
 ): WorkerProfile {
-  const temporal = config.temporal as Record<string, unknown> | undefined;
+  // #1344 — the temporal lexicon declares this namespace and core validates it
+  // at load, so this reads a checked value rather than asserting one.
+  const temporal = (config as { temporal?: Record<string, unknown> }).temporal;
   if (!temporal?.profiles) {
     throw new Error(
       'No temporal.profiles found in chant.config.ts. Add a profile to use `chant run`.',

package/src/cli/handlers/search-kind.test.ts

@@ -0,0 +1,45 @@
+import { describe, it, expect } from "vitest";
+import { resolveKindTerms, type Term } from "./search";
+import type { IRNode } from "../../graph-ir";
+
+const nodes = [
+  { id: "vpc", kind: "AWS::EC2::VPC", lexicon: "aws", attrs: {} },
+  { id: "att", kind: "AWS::EC2::VPCGatewayAttachment", lexicon: "aws", attrs: {} },
+  { id: "sub", kind: "AWS::EC2::Subnet", lexicon: "aws", attrs: {} },
+  { id: "assoc", kind: "AWS::EC2::SubnetRouteTableAssociation", lexicon: "aws", attrs: {} },
+  { id: "igw", kind: "AWS::EC2::InternetGateway", lexicon: "aws", attrs: {} },
+] as IRNode[];
+
+const resolve = (a: string) => {
+  const t: Term = { kind: "kind", a };
+  resolveKindTerms([t], nodes);
+  return t.kinds ? [...t.kinds].sort() : undefined;
+};
+
+describe("a kind term means the kind, not any type containing its letters", () => {
+  it("EC2::VPC is the VPC, not the gateway attachment", () => {
+    // The estate has 6 VPCs and answered 9. VPCGatewayAttachment contains the
+    // characters "EC2::VPC" and is not a VPC.
+    expect(resolve("EC2::VPC")).toEqual(["AWS::EC2::VPC"]);
+  });
+
+  it("Subnet is the subnet, not the route table association", () => {
+    expect(resolve("Subnet")).toEqual(["AWS::EC2::Subnet"]);
+  });
+
+  it("a full type still resolves to itself", () => {
+    expect(resolve("AWS::EC2::Subnet")).toEqual(["AWS::EC2::Subnet"]);
+  });
+
+  it("a genuine substring search still works", () => {
+    // Nothing lines up with a `::` boundary here, so the documented substring
+    // rule applies and finds both gateway-ish kinds.
+    expect(resolve("Gateway")).toBeUndefined();
+  });
+
+  it("resolves inside an edge sub-term, where the negation lives", () => {
+    const t: Term = { kind: "edge", a: "", dir: "in", sub: { kind: "kind", a: "EC2::VPC" } };
+    resolveKindTerms([t], nodes);
+    expect(t.sub?.kinds && [...t.sub.kinds]).toEqual(["AWS::EC2::VPC"]);
+  });
+});