@intentius/chant 0.45.0 → 0.49.0

package/src/components/verbs/wrangler.ts

@@ -0,0 +1,241 @@
+/**
+ * `wrangler-deploy` / `wrangler-versions-promote` — the Cloudflare Workers
+ * apply leaves (chant #1293, epic #1296). The epic cedes the Workers plane
+ * entirely to `wrangler` (first-party, schema-backed, already owns the
+ * config format, bindings model, local dev, and deploy) — these two verbs
+ * are a typed wrapper over that CLI, not a reimplementation of it.
+ *
+ * Placement: core, not a cloudflare lexicon. #1293's own analysis weighed
+ * three options — core (generic verb, fastest, costs a little conceptual
+ * tidiness since `wrangler-deploy` shells a specific vendor CLI), a
+ * capability-only cloudflare lexicon (the "correct" home, but `LexiconPlugin`
+ * tier-1 completeness — serializer, lint rules, post-synth, LSP, examples,
+ * docs — is heavy ceremony for three verbs and no resource types), or
+ * generalizing to a `cli-deploy` verb parameterised by tool (tempting, but
+ * premature and it re-opens the verb set the bounded-primitives thesis
+ * depends on staying closed). Core wins on the same precedent `sign`/
+ * `attest-provenance` (./sign.ts) already set: a specific vendor CLI
+ * (`cosign`) shelled out through the injectable `ProcessRunner`
+ * (./process-runner.ts), no cloud-specific SDK client needed the way AWS's
+ * `CloudExecutor` (./cloud-executor.ts) models CloudFormation/ECS/Lambda.
+ * `wrangler` fits that exact shape. Revisit if/when the zone-plane lexicon
+ * (#1294) lands and gives these three verbs a natural cloudflare-owned home.
+ *
+ * `wrangler-versions-promote` is also the direct evidence for #1296's
+ * "three new verbs cover a whole new cloud" claim: Cloudflare's native
+ * Worker version rollback maps onto the existing `RollbackPolicy: "native"`
+ * (../capability.ts) with no compensation code to hand-write — both verbs
+ * here declare a `rollback` (auto-derived "native" per ../capability.ts's
+ * `Capability.rollbackPolicy` doc) that re-promotes to whichever version was
+ * live before the step ran, the same best-effort captured-previous-state
+ * pattern lexicons/aws/src/components/apply.ts's `lambda-deploy` uses for
+ * its alias rollback.
+ *
+ * No real Cloudflare control-plane emulator exists yet (#1295, epic #1296),
+ * so — like ./sign.ts — every real path here shells out through the
+ * injectable `ProcessRunner` and every test substitutes `MockProcessRunner`
+ * (./__tests__/mock-process-runner.ts): no live `wrangler`, no network, ever,
+ * in a test run. CI coverage is plan-shape/invocation-shape assertions only,
+ * per #1293's own "Verification" section.
+ */
+
+import type { Capability } from "../capability";
+import { defaultProcessRunner, q, requireTool, type ProcessRunner } from "./process-runner";
+
+const WRANGLER_TOOL = "wrangler";
+
+/** Distinguishes one deploy target (a wrangler config + optional named environment) from another, so the best-effort previous-version tracking below never conflates two different Workers sharing a process. */
+function targetKey(config: string, env?: string): string {
+  return env ? `${config}#${env}` : config;
+}
+
+function buildWranglerDeployArgs(input: WranglerDeployInput): string {
+  const args = ["wrangler", "deploy", "--config", q(input.config)];
+  if (input.env) args.push("--env", q(input.env));
+  return args.join(" ");
+}
+
+function buildVersionsListArgs(config: string, env?: string): string {
+  const args = ["wrangler", "versions", "list", "--config", q(config), "--json"];
+  if (env) args.push("--env", q(env));
+  return args.join(" ");
+}
+
+function buildVersionsPromoteArgs(config: string, versionId: string, percentage: number, env?: string): string {
+  const args = ["wrangler", "versions", "deploy", q(`${versionId}@${percentage}`), "--config", q(config), "--yes"];
+  if (env) args.push("--env", q(env));
+  return args.join(" ");
+}
+
+/** Thrown when `wrangler deploy`'s stdout carries no parseable Version ID — fail-closed rather than returning a capability output downstream steps (`wrangler-versions-promote`, wired via `"@Deploy.versionId"`) would silently receive as `undefined`. */
+export class WranglerVersionIdNotFoundError extends Error {
+  constructor(public readonly stdout: string) {
+    super(`wrangler-deploy: could not find a Version ID in wrangler's output. Got:\n${stdout}`);
+    this.name = "WranglerVersionIdNotFoundError";
+  }
+}
+
+// wrangler's deploy/versions-upload output names the new version as e.g.
+// "Version ID: 07bcb198-... " (gradual deployments) — accept either "Version
+// ID:" or the bare "Version:" wording across wrangler versions, and require a
+// UUID-shaped token so a stray "Version: 2" summary line can't be mistaken
+// for it.
+const VERSION_ID_RE = /Version(?: ID)?:\s*([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})/;
+
+/** Extract the deployed Worker version id from `wrangler deploy`'s stdout. Exported so tests can assert on it directly, mirroring ./sign.ts's `buildSignArgs`. */
+export function parseWranglerVersionId(stdout: string): string {
+  const match = VERSION_ID_RE.exec(stdout);
+  if (!match) throw new WranglerVersionIdNotFoundError(stdout);
+  return match[1]!;
+}
+
+interface WranglerVersionsListEntry {
+  id: string;
+  percentage?: number;
+}
+
+/**
+ * Best-effort: the currently-live (100%) version id, from `wrangler versions
+ * list --json` — `undefined` for a first deploy (no versions yet) or if
+ * listing fails/parses oddly. Never throws: capturing "what to roll back to"
+ * must not block the deploy/promote itself, the same fail-soft stance
+ * `lambda-deploy`'s alias-version capture takes.
+ */
+async function currentLiveVersionId(
+  runner: ProcessRunner,
+  config: string,
+  env?: string,
+): Promise<string | undefined> {
+  try {
+    const { stdout } = await runner.run(buildVersionsListArgs(config, env));
+    const entries = JSON.parse(stdout) as WranglerVersionsListEntry[];
+    return entries.find((entry) => entry.percentage === 100)?.id;
+  } catch {
+    return undefined;
+  }
+}
+
+// ── wrangler-deploy ──────────────────────────────────────────────────────────
+
+export interface WranglerDeployInput {
+  /** Path to the Worker's `wrangler.jsonc`/`wrangler.toml`. */
+  config: string;
+  /** Named environment within the config (`wrangler deploy --env <env>`). */
+  env?: string;
+}
+
+export interface WranglerDeployOutput {
+  /** The version id wrangler assigned this deploy — wire into `wrangler-versions-promote` (e.g. `"@Deploy.versionId"`). */
+  versionId: string;
+}
+
+/**
+ * Deploy a Worker from a `wrangler.jsonc`/`wrangler.toml` via `wrangler
+ * deploy`, and return the version id it published — the analogue of
+ * `lambda-deploy` (../../lexicons/aws/src/components/apply.ts) for the
+ * Workers plane.
+ *
+ * Rollback: `wrangler-versions-promote` back to whichever version was live
+ * before this step ran (captured up front via `wrangler versions list`, the
+ * same best-effort captured-previous pattern `lambda-deploy` uses for its
+ * alias). A no-op on a first deploy — nothing was live to restore.
+ */
+export function createWranglerDeployCapability(
+  processRunner: ProcessRunner = defaultProcessRunner(),
+): Capability<WranglerDeployInput, WranglerDeployOutput> {
+  const previousVersionByTarget = new Map<string, string | undefined>();
+
+  return {
+    kind: "wrangler-deploy",
+    async run(_ctx, input) {
+      await requireTool(processRunner, WRANGLER_TOOL, `deploy the Worker in ${input.config}`);
+      const target = targetKey(input.config, input.env);
+      if (!previousVersionByTarget.has(target)) {
+        previousVersionByTarget.set(target, await currentLiveVersionId(processRunner, input.config, input.env));
+      }
+
+      const { stdout } = await processRunner.run(buildWranglerDeployArgs(input));
+      return { versionId: parseWranglerVersionId(stdout) };
+    },
+    async rollback(_ctx, input) {
+      const target = targetKey(input.config, input.env);
+      const previousVersionId = previousVersionByTarget.get(target);
+      if (!previousVersionId) return; // first deploy — nothing was live before it.
+      await requireTool(processRunner, WRANGLER_TOOL, `roll back the Worker in ${input.config}`);
+      await processRunner.run(buildVersionsPromoteArgs(input.config, previousVersionId, 100, input.env));
+    },
+  };
+}
+
+/** Default `wrangler-deploy` capability, backed by the real `ProcessRunner`. */
+export const wranglerDeployCapability: Capability<WranglerDeployInput, WranglerDeployOutput> =
+  createWranglerDeployCapability();
+
+// ── wrangler-versions-promote ─────────────────────────────────────────────────
+
+export interface WranglerVersionsPromoteInput {
+  /** Path to the Worker's `wrangler.jsonc`/`wrangler.toml`. */
+  config: string;
+  /** Version id to promote — typically wired from a prior `wrangler-deploy` step (`"@Deploy.versionId"`) or a prior version id when this step composes as an explicit rollback. */
+  versionId: string;
+  /** Traffic percentage to route to `versionId`. Default: 100 (full promote/rollback). Below 100 is the gradual-deployment lever. */
+  percentage?: number;
+  /** Named environment within the config (`wrangler versions deploy --env <env>`). */
+  env?: string;
+}
+
+export interface WranglerVersionsPromoteOutput {
+  /** The version id that was promoted. */
+  versionId: string;
+  /** The traffic percentage actually routed to it. */
+  percentage: number;
+}
+
+/**
+ * Promote a Worker version to (some percentage of) live traffic via
+ * `wrangler versions deploy <version-id>@<percentage> --yes` — both the
+ * gradual-deployment lever (`percentage` < 100) and, at `percentage: 100`,
+ * the rollback mechanism: Cloudflare's native version rollback is a promote
+ * to a prior version id, not a redeploy, so this same verb composes as the
+ * explicit compensation step a component wires up (#1293's "verification"
+ * example: forced failure after `wrangler-deploy` -> `wrangler-versions-promote`
+ * back to the prior version, no hand-written compensation needed).
+ *
+ * Also declares its own `rollback` (native, no `rollbackPolicy` override
+ * needed — see ../capability.ts): re-promotes to whichever version was live
+ * before *this* promote call, for the case where the promote step itself is
+ * composed directly (not just as `wrangler-deploy`'s compensation).
+ */
+export function createWranglerVersionsPromoteCapability(
+  processRunner: ProcessRunner = defaultProcessRunner(),
+): Capability<WranglerVersionsPromoteInput, WranglerVersionsPromoteOutput> {
+  const previousVersionByTarget = new Map<string, string | undefined>();
+
+  return {
+    kind: "wrangler-versions-promote",
+    async run(_ctx, input) {
+      await requireTool(processRunner, WRANGLER_TOOL, `promote version ${input.versionId} in ${input.config}`);
+      const percentage = input.percentage ?? 100;
+      const target = targetKey(input.config, input.env);
+      if (!previousVersionByTarget.has(target)) {
+        previousVersionByTarget.set(target, await currentLiveVersionId(processRunner, input.config, input.env));
+      }
+
+      await processRunner.run(buildVersionsPromoteArgs(input.config, input.versionId, percentage, input.env));
+      return { versionId: input.versionId, percentage };
+    },
+    async rollback(_ctx, input) {
+      const target = targetKey(input.config, input.env);
+      const previousVersionId = previousVersionByTarget.get(target);
+      if (!previousVersionId) return; // nothing was live before this promote.
+      await requireTool(processRunner, WRANGLER_TOOL, `roll back version promotion in ${input.config}`);
+      await processRunner.run(buildVersionsPromoteArgs(input.config, previousVersionId, 100, input.env));
+    },
+  };
+}
+
+/** Default `wrangler-versions-promote` capability, backed by the real `ProcessRunner`. */
+export const wranglerVersionsPromoteCapability: Capability<
+  WranglerVersionsPromoteInput,
+  WranglerVersionsPromoteOutput
+> = createWranglerVersionsPromoteCapability();

package/src/config.test.ts

@@ -6,9 +6,12 @@ import {
   resolveAutoReleaseDisabled,
   resolveFoldEnabled,
   resolveSbomFormat,
+  resolveKnowledgeDir,
   environmentName,
   environmentNames,
   environmentEndpoint,
+  matchesEnvironmentPattern,
+  matchesDeclaredEnvironment,
 } from "./config";
 import { writeFileSync, mkdirSync, rmSync } from "fs";
 import { join } from "path";
@@ -336,6 +339,44 @@ describe("environmentName / environmentNames / environmentEndpoint (#1166)", ()
     expect(environmentEndpoint(environments, "unknown")).toBeUndefined(); // not declared at all
     expect(environmentEndpoint(undefined, "floci")).toBeUndefined();
   });
+
+  test("environmentEndpoint resolves through a pattern entry, literal entry winning (#1221)", () => {
+    const environments = [
+      { name: "pr-special", endpoint: "http://special:1111" },
+      { name: "pr-*", endpoint: "http://preview:4566" },
+    ];
+    expect(environmentEndpoint(environments, "pr-42")).toBe("http://preview:4566");
+    expect(environmentEndpoint(environments, "pr-special")).toBe("http://special:1111"); // literal wins over the pattern
+    expect(environmentEndpoint(environments, "prod")).toBeUndefined();
+  });
+});
+
+describe("environment glob patterns (#1221)", () => {
+  test("matchesEnvironmentPattern: a * matches any run of characters, anchored", () => {
+    expect(matchesEnvironmentPattern("pr-*", "pr-42")).toBe(true);
+    expect(matchesEnvironmentPattern("pr-*", "pr-")).toBe(true); // empty run is a run
+    expect(matchesEnvironmentPattern("pr-*", "pr")).toBe(false);
+    expect(matchesEnvironmentPattern("pr-*", "xpr-42")).toBe(false); // anchored at the start
+    expect(matchesEnvironmentPattern("*-preview", "42-preview")).toBe(true);
+    expect(matchesEnvironmentPattern("*-preview", "42-preview-old")).toBe(false); // anchored at the end
+    expect(matchesEnvironmentPattern("test-*-eu", "test-a-eu")).toBe(true);
+    expect(matchesEnvironmentPattern("test-*-eu", "test-a-us")).toBe(false);
+  });
+
+  test("matchesEnvironmentPattern without a * is plain equality", () => {
+    expect(matchesEnvironmentPattern("prod", "prod")).toBe(true);
+    expect(matchesEnvironmentPattern("prod", "prod2")).toBe(false);
+  });
+
+  test("matchesDeclaredEnvironment: literal first, then pattern, across entry forms", () => {
+    const environments = ["dev", "prod", "pr-*", { name: "test-*", endpoint: "http://localhost:4566" }];
+    expect(matchesDeclaredEnvironment(environments, "prod")).toBe(true);
+    expect(matchesDeclaredEnvironment(environments, "pr-42")).toBe(true);
+    expect(matchesDeclaredEnvironment(environments, "test-suite-a")).toBe(true); // object-form pattern entry
+    expect(matchesDeclaredEnvironment(environments, "stage")).toBe(false);
+    expect(matchesDeclaredEnvironment(undefined, "prod")).toBe(false);
+    expect(matchesDeclaredEnvironment([], "prod")).toBe(false);
+  });
 });
 
 describe("resolveFoldEnabled (#1134 — fold is the default build path)", () => {
@@ -393,3 +434,17 @@ describe("resolveSbomFormat (#606)", () => {
     expect(resolveSbomFormat({}, "cyclonedx")).toBe("cyclonedx");
   });
 });
+
+describe("resolveKnowledgeDir (#1864, design #1059)", () => {
+  test("convention: knowledge/ beside the project root when config is silent", () => {
+    expect(resolveKnowledgeDir({}, "/proj")).toBe(join("/proj", "knowledge"));
+  });
+
+  test("config override honored", () => {
+    expect(resolveKnowledgeDir({ knowledge: { dir: "docs/knowledge" } }, "/proj")).toBe(join("/proj", "docs/knowledge"));
+  });
+
+  test("an empty knowledge object still falls back to the convention name", () => {
+    expect(resolveKnowledgeDir({ knowledge: {} }, "/proj")).toBe(join("/proj", "knowledge"));
+  });
+});

package/src/config.ts

@@ -44,6 +44,56 @@ export function environmentNames(environments: EnvironmentDeclaration[] | undefi
   return environments?.map(environmentName);
 }
 
+/**
+ * Whether a declared environment name is a glob pattern rather than a literal
+ * (#1221) — it contains at least one `*`.
+ */
+export function isEnvironmentPattern(declaredName: string): boolean {
+  return declaredName.includes("*");
+}
+
+/**
+ * Anchored `*`-glob match (#1221): each `*` in `pattern` matches any run of
+ * characters (possibly empty); everything else matches itself. Deliberately
+ * the whole surface — no `?`, no character classes, no regex. A pattern with
+ * no `*` degenerates to string equality.
+ */
+export function matchesEnvironmentPattern(pattern: string, name: string): boolean {
+  const parts = pattern.split("*");
+  if (parts.length === 1) return pattern === name;
+  const first = parts[0];
+  const last = parts[parts.length - 1];
+  if (!name.startsWith(first)) return false;
+  let cursor = first.length;
+  for (let i = 1; i < parts.length - 1; i++) {
+    const part = parts[i];
+    if (part === "") continue;
+    const at = name.indexOf(part, cursor);
+    if (at === -1) return false;
+    cursor = at + part.length;
+  }
+  return name.length - cursor >= last.length && name.endsWith(last);
+}
+
+/**
+ * Environment-membership test (#1221): is `name` covered by this project's
+ * declared `environments`? A literal entry matches by equality; an entry
+ * containing `*` matches as a glob pattern (`"pr-*"` covers `pr-42`).
+ * Literals are checked first across the whole list, then patterns — so a
+ * name that is declared outright never depends on pattern order. `undefined`
+ * / empty `environments` returns `false`; callers that treat "no declared
+ * environments" as "anything goes" (e.g. {@link unknownEnvError} in
+ * `./env.ts`) guard that case themselves.
+ */
+export function matchesDeclaredEnvironment(
+  environments: EnvironmentDeclaration[] | undefined,
+  name: string,
+): boolean {
+  const names = environmentNames(environments) ?? [];
+  if (names.includes(name)) return true;
+  return names.some((declared) => isEnvironmentPattern(declared) && matchesEnvironmentPattern(declared, name));
+}
+
 /**
  * The endpoint `name` declares (chant #1166) — `undefined` for a bare-string
  * entry, an entry with no `endpoint` set, or a name this project doesn't
@@ -51,9 +101,16 @@ export function environmentNames(environments: EnvironmentDeclaration[] | undefi
  * it injects this into the ambient env var each observing lexicon's CLI
  * shell-out reads (e.g. `AWS_ENDPOINT_URL`), unless that var is already set —
  * ambient always wins.
+ *
+ * A pattern entry (#1221) can carry an endpoint too: `{ name: "pr-*",
+ * endpoint }` supplies the endpoint for every `pr-<n>` environment. A literal
+ * entry always wins over a pattern — declaring `pr-special` alongside
+ * `pr-*` resolves `pr-special` to the literal entry's endpoint (or none).
  */
 export function environmentEndpoint(environments: EnvironmentDeclaration[] | undefined, name: string): string | undefined {
-  const found = environments?.find((e) => environmentName(e) === name);
+  const found =
+    environments?.find((e) => environmentName(e) === name) ??
+    environments?.find((e) => isEnvironmentPattern(environmentName(e)) && matchesEnvironmentPattern(environmentName(e), name));
   return found && typeof found !== "string" ? found.endpoint : undefined;
 }
 
@@ -124,6 +181,9 @@ export const ChantConfigSchema = z.object({
     scanner: z.enum(["grype", "trivy"]).optional(),
     vexSources: z.array(z.string()).optional(),
   }).optional(),
+  knowledge: z.object({
+    dir: z.string().min(1).optional(),
+  }).optional(),
 }).passthrough();
 
 /**
@@ -343,6 +403,21 @@ export interface ChantConfig {
     /** Default VEX document paths (OpenVEX/CycloneDX) applied to every gate. Read where the gate step is composed. */
     vexSources?: string[];
   };
+
+  /**
+   * OKF knowledge bundle location (#1864, design #1059, epic #1057) — the
+   * *input* side of `chant explain --format okf` (#1058): a project may
+   * author knowledge as an OKF v0.2 bundle (a directory of markdown files
+   * with YAML frontmatter) that `./okf-read.ts`'s `loadOkfBundle` reads and
+   * binds to discovered entities via each concept's `binds` frontmatter key.
+   * Convention-first: `knowledge/` beside `chant.config.ts` is used when this
+   * is unset. Set `dir` only when that name is already taken by something
+   * else in the project. See {@link resolveKnowledgeDir}.
+   */
+  knowledge?: {
+    /** Bundle directory, relative to the project root. Defaults to `"knowledge"`. */
+    dir?: string;
+  };
 }
 
 /**
@@ -726,6 +801,18 @@ export function resolveVulnPolicy(config: ChantConfig): Partial<VulnPolicy> {
   return out;
 }
 
+/**
+ * Resolve the OKF knowledge bundle directory (#1864, design #1059):
+ * `knowledge.dir` relative to `projectPath` when configured, else the
+ * `knowledge/` convention beside `chant.config.ts`. Never checks existence —
+ * a project with no bundle yet resolves a path all the same, and
+ * `okf-read.ts`'s `loadOkfBundle` treats a missing directory as an empty
+ * bundle rather than an error.
+ */
+export function resolveKnowledgeDir(config: ChantConfig, projectPath: string): string {
+  return join(projectPath, config.knowledge?.dir ?? "knowledge");
+}
+
 /**
  * Validate and normalize a raw config object into ChantConfig shape.
  */

package/src/deep-observation.test.ts

@@ -48,6 +48,25 @@ describe("normalizeDeepProperties", () => {
     expect(Object.keys(out.mid as Record<string, unknown>)).toEqual(["a", "z"]);
   });
 
+  test("the mask hook collapses a structural secret path to MASKED, on either side (#1830)", () => {
+    const hooks: DeepNormalizationHooks = {
+      mask: (n) => n.entityType === "K8s::Core::Secret" && n.pattern.startsWith("data."),
+    };
+    for (const side of ["declared", "live"] as const) {
+      const out = normalizeDeepProperties(
+        { data: { "app.conf": "c2VjcmV0LWJ5dGVz" }, type: "Opaque" },
+        { entityType: "K8s::Core::Secret", side, hooks },
+      );
+      expect(out).toEqual({ data: { "app.conf": MASKED }, type: "Opaque" });
+    }
+    // Another entity type sails through the same hook untouched.
+    const other = normalizeDeepProperties(
+      { data: { "app.conf": "plain" } },
+      { entityType: "K8s::Core::ConfigMap", side: "live", hooks },
+    );
+    expect(other).toEqual({ data: { "app.conf": "plain" } });
+  });
+
   test("leaves array order alone with no ordering hook", () => {
     const out = normalizeDeepProperties({ Tags: [{ Key: "z" }, { Key: "a" }] }, { entityType: "T", side: "live" });
     expect(out.Tags).toEqual([{ Key: "z" }, { Key: "a" }]);

package/src/deep-observation.ts

@@ -266,6 +266,20 @@ export interface DeepNormalizationHooks {
    * reads as permanent drift.
    */
   unresolved?(node: DeepNode): boolean;
+  /**
+   * Return true when this value is secret material the diff must never hold —
+   * it is collapsed to {@link MASKED} on BOTH sides (the hook runs over the
+   * declared and the live tree alike), so presence and key names still
+   * classify while values never reach a diff row, a log line, or a snapshot.
+   *
+   * The pass masks by key name on its own ({@link isSensitiveKey}); this hook
+   * exists for the lexicons whose secret-bearing paths are structural rather
+   * than name-shaped — a Kubernetes Secret's `data` carries arbitrary key
+   * names (`app.conf`), and #1365 decision 6 draws the hard line: drift on a
+   * secret observes presence, declared key-set, and metadata — never a value
+   * or a value-derived hash.
+   */
+  mask?(node: DeepNode): boolean;
 }
 
 /** Everything the pass needs besides the tree itself. */
@@ -405,6 +419,9 @@ export function normalizeDeepProperties(
 
   const normalizeValue = (value: unknown, path: string, pattern: string, key: string): unknown => {
     if (isSensitiveKey(key)) return MASKED;
+    // The lexicon's structural mask — same collapse, path-shaped rather than
+    // key-named (a k8s Secret's `data.*` no matter what the key is called).
+    if (hooks?.mask?.(nodeOf(path, pattern, key, value))) return MASKED;
     // A value the lexicon says cannot be known without deploying — an
     // expression-string reference — collapses exactly like a class-instance
     // intrinsic does below.