@intentius/chant 0.58.0 → 0.59.0

package/src/cli/commands/carve-bridge.test.ts

@@ -5,6 +5,7 @@ import { tmpdir } from "os";
 import { join } from "path";
 import { carveBridge, formatCarveBridge } from "./carve-bridge";
 import { loadHcl2json } from "../../terraform/parse";
+import { registerCarveProvider } from "../../terraform/carve-provider";
 import { readCarveManifest, writeCarveManifest, type CarveManifest } from "../../terraform/manifest";
 
 let parserAvailable = false;
@@ -195,36 +196,258 @@ describe("carveBridge", () => {
     }
   });
 
-  test("refuses a target whose identity attribute is a dotted path (#2015)", async () => {
+  test("refuses a dotted-identity type no provider declares a shape for (#2015, #2034)", async () => {
     if (!parserAvailable) return;
-    const dir = mkdtempSync(join(tmpdir(), "chant-bridge-k8s-"));
+    // A dotted identity attribute is a path into nested values, and a data body
+    // is flat `attr = value` — `spec.metadata.name = "x"` is not valid HCL. The
+    // guard now turns on the missing shape, not on the dot, so the message says
+    // what would lift it.
+    const unregister = registerCarveProvider({
+      name: "carve-bridge-test-nested",
+      tfTypePrefixes: ["nested_"],
+      lexicon: "aws",
+      tiers: { nested_widget: { tier: 1, mapsTo: "Test::Widget" } },
+      identityAttrs: { nested_widget: "spec.metadata.name" },
+    });
+    const dir = mkdtempSync(join(tmpdir(), "chant-bridge-nested-"));
     try {
-      // `kubernetes_manifest` identifies itself by `manifest.metadata.name`.
-      // Rendering that into a data body produced `manifest.metadata.name = "x"`,
-      // which is not valid HCL — and the provider has no manifest data source.
       writeFileSync(
         join(dir, "main.tf"),
-        `resource "kubernetes_manifest" "demo" {\n` +
-          `  manifest = {\n` +
-          `    apiVersion = "v1"\n` +
-          `    kind       = "ConfigMap"\n` +
-          `    metadata = { name = "demo-config" }\n` +
-          `  }\n` +
-          `}\n`,
+        `resource "nested_widget" "demo" {\n  spec {\n    metadata {\n      name = "demo"\n    }\n  }\n}\n`,
       );
       const out = join(dir, "carveout");
-      const res = await carveBridge({ from: dir, select: "kubernetes_manifest.demo", output: out });
+      const res = await carveBridge({ from: dir, select: "nested_widget.demo", output: out });
 
       expect(res.ok).toBe(false);
       expect(res.error).toContain("cannot be bridged");
-      expect(res.error).toContain("manifest.metadata.name");
+      expect(res.error).toContain("spec.metadata.name");
+      expect(res.error).toContain("no carve provider declares a data-source shape for it");
+      expect(res.error).toContain("dataSourceShapes");
       expect(res.plan).toBeUndefined();
       expect(existsSync(out)).toBe(false);
+    } finally {
+      unregister();
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+});
+
+/**
+ * `kubernetes_manifest` reads back through a different type (#2034). The
+ * kubernetes provider ships no `kubernetes_manifest` data source — verified
+ * against hashicorp/kubernetes v3.2.1 — so the bridge renders
+ * `data "kubernetes_resource"` from the manifest's own apiVersion, kind and
+ * metadata, and repoints survivors at that data source's attribute path.
+ */
+describe("carveBridge — kubernetes_manifest (#2034)", () => {
+  const MANIFEST_TF = `resource "kubernetes_manifest" "app_config" {
+  manifest = {
+    apiVersion = "v1"
+    kind       = "ConfigMap"
+    metadata = {
+      name      = "app-config"
+      namespace = "apps"
+    }
+    data = {
+      LOG_LEVEL = "info"
+    }
+  }
+}
+`;
+  // Three shapes of inbound reference: the issue's own example, one deeper into
+  // `object`, and one through `manifest` — the attribute the data source does
+  // NOT have, which is why the rewrite maps it rather than only swapping heads.
+  const SURVIVOR_TF = `resource "kubernetes_config_map" "mirror" {
+  metadata {
+    name      = kubernetes_manifest.app_config.object.metadata.name
+    namespace = "apps"
+  }
+  data = {
+    LOG_LEVEL = kubernetes_manifest.app_config.manifest.data.LOG_LEVEL
+    UPSTREAM  = kubernetes_manifest.app_config.object.data.LOG_LEVEL
+  }
+}
+`;
+  const OUTPUTS_TF = `output "app_config_name" {
+  value = kubernetes_manifest.app_config.object.metadata.name
+}
+`;
+
+  async function withManifestEstate<T>(fn: (dir: string) => Promise<T>): Promise<T> {
+    const dir = mkdtempSync(join(tmpdir(), "chant-bridge-manifest-"));
+    try {
+      writeFileSync(join(dir, "manifest.tf"), MANIFEST_TF);
+      writeFileSync(join(dir, "survivor.tf"), SURVIVOR_TF);
+      writeFileSync(join(dir, "outputs.tf"), OUTPUTS_TF);
+      return await fn(dir);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }
+
+  test("bridges to a data \"kubernetes_resource\" block built from the manifest body", async () => {
+    if (!parserAvailable) return;
+    await withManifestEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      const res = await carveBridge({ from: dir, select: "kubernetes_manifest.app_config", output: out });
+      expect(res.ok).toBe(true);
+
+      // The data source is the provider's generic read, not the carved type.
+      expect(res.plan!.dataSources).toHaveLength(1);
+      expect(res.plan!.dataSources[0]).toMatchObject({
+        address: "kubernetes_manifest.app_config",
+        type: "kubernetes_resource",
+        name: "app_config",
+      });
+      expect(res.plan!.dataSources[0].hcl).toBe(
+        `data "kubernetes_resource" "app_config" {\n` +
+          `  api_version = "v1"\n` +
+          `  kind        = "ConfigMap"\n` +
+          `\n` +
+          `  metadata {\n` +
+          `    name      = "app-config"\n` +
+          `    namespace = "apps"\n` +
+          `  }\n` +
+          `}`,
+      );
+      expect(formatCarveBridge(res)).toContain(
+        "data.kubernetes_resource.app_config  (was kubernetes_manifest.app_config)",
+      );
+    });
+  });
+
+  test("the emitted data source parses as HCL and is terraform-fmt clean", async () => {
+    if (!parserAvailable) return;
+    await withManifestEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      await carveBridge({ from: dir, select: "kubernetes_manifest.app_config", output: out });
+      const dsPath = join(out, "kubernetes_manifest-app_config-datasources.tf");
+      const hcl = readFileSync(dsPath, "utf-8");
+
+      // The repo's own parser: `metadata` has to come out as a block, since the
+      // provider declares it Block List (Min 1, Max 1), not an attribute.
+      const parsed = await (await loadHcl2json()).parse("datasources.tf", hcl);
+      const ds = (parsed.data as Record<string, Record<string, unknown[]>>).kubernetes_resource.app_config[0] as Record<
+        string,
+        unknown
+      >;
+      expect(ds.api_version).toBe("v1");
+      expect(ds.kind).toBe("ConfigMap");
+      expect(ds.metadata).toEqual([{ name: "app-config", namespace: "apps" }]);
+
+      // And Terraform's own formatter accepts it byte for byte.
+      try {
+        execFileSync("terraform", ["fmt", "-check", "-diff", dsPath], { stdio: "pipe" });
+      } catch (err) {
+        if ((err as NodeJS.ErrnoException).code === "ENOENT") return; // no terraform on this machine
+        throw err;
+      }
+    });
+  });
+
+  test("survivor references follow the data source's own attribute path", async () => {
+    if (!parserAvailable) return;
+    await withManifestEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      const res = await carveBridge({ from: dir, select: "kubernetes_manifest.app_config", output: out });
+      expect(res.ok).toBe(true);
+
+      const survivor = readFileSync(join(out, "survivor.tf"), "utf-8");
+      // The issue's example, and a reference that goes deeper into `object`.
+      expect(survivor).toContain("name      = data.kubernetes_resource.app_config.object.metadata.name");
+      expect(survivor).toContain("UPSTREAM  = data.kubernetes_resource.app_config.object.data.LOG_LEVEL");
+      // `manifest` is an attribute of the resource that the data source does not
+      // have; left alone it would be an "Unsupported attribute" at validate.
+      expect(survivor).toContain("LOG_LEVEL = data.kubernetes_resource.app_config.object.data.LOG_LEVEL");
+      expect(survivor).not.toContain(".manifest.");
+      expect(survivor).not.toMatch(/(?<!data\.)\bkubernetes_manifest\.app_config\b/);
+
+      // An output reading the manifest is repointed the same way (#1638).
+      expect(res.plan!.outputRewrites).toEqual(["output.app_config_name"]);
+      expect(readFileSync(join(out, "outputs.tf"), "utf-8")).toContain(
+        "value = data.kubernetes_resource.app_config.object.metadata.name",
+      );
+
+      // The carved block leaves the survivor source, as for any other type.
+      expect(res.plan!.excised).toEqual(["kubernetes_manifest.app_config"]);
+      expect(readFileSync(join(out, "manifest.tf"), "utf-8").trim()).toBe("");
+    });
+  });
+
+  test("a namespace-less manifest omits the optional argument", async () => {
+    if (!parserAvailable) return;
+    const dir = mkdtempSync(join(tmpdir(), "chant-bridge-clusterwide-"));
+    try {
+      // A cluster-scoped kind has no namespace, and `metadata.namespace` is
+      // optional on the data source — so it is left out, not emitted empty.
+      writeFileSync(
+        join(dir, "main.tf"),
+        `resource "kubernetes_manifest" "reader" {\n` +
+          `  manifest = {\n` +
+          `    apiVersion = "rbac.authorization.k8s.io/v1"\n` +
+          `    kind       = "ClusterRole"\n` +
+          `    metadata = {\n` +
+          `      name = "reader"\n` +
+          `    }\n` +
+          `  }\n` +
+          `}\n`,
+      );
+      writeFileSync(
+        join(dir, "outputs.tf"),
+        `output "reader" {\n  value = kubernetes_manifest.reader.object.metadata.name\n}\n`,
+      );
+      const out = join(dir, "carveout");
+      const res = await carveBridge({ from: dir, select: "kubernetes_manifest.reader", output: out });
+      expect(res.ok).toBe(true);
+      const hcl = res.plan!.dataSources[0].hcl;
+      expect(hcl).toContain('api_version = "rbac.authorization.k8s.io/v1"');
+      expect(hcl).toContain('name = "reader"');
+      expect(hcl).not.toContain("namespace");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("an interpolated manifest name falls back to the TODO body, never a half-written block", async () => {
+    if (!parserAvailable) return;
+    const dir = mkdtempSync(join(tmpdir(), "chant-bridge-interp-"));
+    try {
+      writeFileSync(
+        join(dir, "main.tf"),
+        `variable "suffix" {\n  type = string\n}\n\n` +
+          `resource "kubernetes_manifest" "app_config" {\n` +
+          `  manifest = {\n` +
+          `    apiVersion = "v1"\n` +
+          `    kind       = "ConfigMap"\n` +
+          `    metadata = {\n` +
+          `      name = "app-\${var.suffix}"\n` +
+          `    }\n` +
+          `  }\n` +
+          `}\n`,
+      );
+      writeFileSync(
+        join(dir, "outputs.tf"),
+        `output "name" {\n  value = kubernetes_manifest.app_config.object.metadata.name\n}\n`,
+      );
+      const out = join(dir, "carveout");
+      const res = await carveBridge({ from: dir, select: "kubernetes_manifest.app_config", output: out });
+      expect(res.ok).toBe(true);
+      // `metadata.name` is required on the data source; guessing it would be
+      // worse than saying so.
+      expect(res.plan!.dataSources[0].hcl).toContain("# TODO: identify the resource");
+      expect(res.plan!.dataSources[0].hcl).not.toContain("api_version");
+      // The reference is still repointed, so the survivor plan is one edit away.
+      expect(readFileSync(join(out, "outputs.tf"), "utf-8")).toContain(
+        "value = data.kubernetes_resource.app_config.object.metadata.name",
+      );
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
   });
+});
 
+describe("carveBridge — formatting", () => {
   test("formatCarveBridge summarizes data sources, rewires, and safety", async () => {
     if (!parserAvailable) return;
     await withEstate(async (dir) => {

package/src/cli/commands/carve-bridge.ts

@@ -14,8 +14,8 @@ import { join, basename, relative, resolve } from "path";
 import { cdkNotSupported, isCloudAssembly } from "../../cdk/assembly";
 import { parseTerraformDir, Hcl2JsonNotInstalled } from "../../terraform/parse";
 import { boundaryReport, type CarveReport } from "../../terraform/carve";
-import { generateBridge, type BridgePlan, type CarvedIdentity } from "../../terraform/bridge";
-import { identityAttrOf, canBridge } from "../../terraform/tier-map";
+import { generateBridge, type BridgePlan, type CarvedDataSource } from "../../terraform/bridge";
+import { identityAttrOf, canBridge, dataSourceShapeOf } from "../../terraform/tier-map";
 import { resolveCarveManifest, writeCarveManifest, type CarveManifest } from "../../terraform/manifest";
 import { newFileDiff, unifiedDiff } from "../../terraform/unified-diff";
 
@@ -76,13 +76,13 @@ export async function carveBridge(opts: CarveBridgeOptions): Promise<CarveBridge
     if (!found) return { ok: false, error: `${select} not found in ${opts.from}` };
     report = found;
 
-    // Refuse a carve set whose data source cannot be written as valid HCL: a
-    // dotted identity attribute is a path into nested blocks, and a data body
-    // is flat `attr = value`. `kubernetes_manifest` is the standing case — the
-    // provider has no `kubernetes_manifest` data source either; its generic
-    // read is `kubernetes_resource`, a different shape. Emit adopting the type
-    // (#999) does not lift this: reading a manifest out of state and reading it
-    // back through a data source are separate problems (#2034).
+    // Refuse a carve set no provider says how to read back. A dotted identity
+    // attribute is a path into nested values and a data body is flat
+    // `attr = value`, so such a type bridges only once its provider declares a
+    // data-source shape — the data type, its arguments and where each comes
+    // from in the carved body (#2034). `kubernetes_manifest` declares one now:
+    // `data "kubernetes_resource"`, built from the manifest's apiVersion,
+    // kind and metadata.
     const carvedTypes = report.carveSet.map((m) => m.type).filter((t): t is string => t !== undefined);
     const unbridgeable = [...new Set(carvedTypes.filter((t) => !canBridge(t)))];
     if (unbridgeable.length) {
@@ -91,21 +91,25 @@ export async function carveBridge(opts: CarveBridgeOptions): Promise<CarveBridge
         error:
           `${select} cannot be bridged: ${unbridgeable
             .map((t) => `${t} identifies itself by \`${identityAttrOf(t)}\``)
-            .join(", ")}, a path into nested blocks that a Terraform data source body cannot express. ` +
-          `Bridging these types needs a data-source mapping — see chant issue #2034.`,
+            .join(", ")}, a path into nested values that a flat Terraform data source body cannot express, ` +
+          `and no carve provider declares a data-source shape for it. A provider contributes one through ` +
+          `\`dataSourceShapes\` (see \`kubernetes_manifest\` reading back as \`data "kubernetes_resource"\`, chant issue #2034).`,
       };
     }
 
-    // Physical identities for the carved resources, for the data sources.
-    const identities = new Map<string, CarvedIdentity>();
+    // How each carved resource is read back, and the literals to render the
+    // data-source body from. The shape comes from the provider, the values from
+    // the parsed block (`dataSourceValues`, a superset of the old identity).
+    const readBacks = new Map<string, CarvedDataSource>();
     for (const node of graph.nodes) {
-      if (node.type && node.identity) {
-        identities.set(node.address, { attr: identityAttrOf(node.type), value: node.identity });
-      }
+      if (!node.type) continue;
+      const shape = dataSourceShapeOf(node.type);
+      if (!shape) continue;
+      readBacks.set(node.address, { shape, values: node.dataSourceValues ?? {} });
     }
 
     const files = listTfFiles(opts.from).map((path) => ({ path, content: readFileSync(path, "utf-8") }));
-    plan = generateBridge(report, files, identities);
+    plan = generateBridge(report, files, readBacks);
   } catch (err) {
     if (err instanceof Hcl2JsonNotInstalled) return { ok: false, error: err.message };
     return { ok: false, error: `Failed to build the bridge: ${err instanceof Error ? err.message : String(err)}` };

package/src/cli/commands/carve-emit-k8s.test.ts

@@ -239,24 +239,31 @@ describe("carve emit — kubernetes_manifest (#999)", () => {
     });
   });
 
-  test("bridge still refuses the carved manifest, so emit writes no half-bridged estate", async () => {
+  test("emit then bridge compose on the same manifest (#2034)", async () => {
     if (!parserAvailable) return;
     await withEstate(async (dir) => {
       const out = join(dir, "carveout");
       const emitted = await carveEmit(
-        { from: dir, select: "kubernetes_manifest.app_config", statePath: join(dir, "terraform.tfstate"), output: out },
+        { from: dir, select: "kubernetes_manifest.web_cert", statePath: join(dir, "terraform.tfstate"), output: out },
         { plugins: [], liveImport: fakeImport() },
       );
       expect(emitted.ok).toBe(true);
 
-      // Emit does not unlock bridge: `manifest.metadata.name` is a path into
-      // nested blocks and a data-source body is flat `attr = value`, so the
-      // survivors' references cannot be repointed yet.
-      const bridged = await carveBridge({ from: dir, select: "kubernetes_manifest.app_config", output: out });
-      expect(bridged.ok).toBe(false);
-      expect(bridged.error).toContain("cannot be bridged");
-      expect(bridged.error).toContain("manifest.metadata.name");
-      expect(existsSync(join(out, "kubernetes_manifest-app_config-runbook.md"))).toBe(false);
+      // Bridge used to refuse here: `manifest.metadata.name` is a path into the
+      // body, and a data-source body is flat `attr = value`. It now reads the
+      // manifest back through the shape the kubernetes provider declares, so
+      // the target the emit manifest recorded bridges without --select.
+      const bridged = await carveBridge({ from: dir, output: out });
+      expect(bridged.ok).toBe(true);
+      expect(bridged.plan!.target).toBe("kubernetes_manifest.web_cert");
+      expect(existsSync(join(out, "kubernetes_manifest-web_cert-runbook.md"))).toBe(true);
+
+      // Nothing reads the Certificate, so there is no data source to write —
+      // but its own block still has to leave the survivor source, or the next
+      // apply re-creates what `terraform state rm` released.
+      expect(bridged.plan!.dataSources).toEqual([]);
+      expect(bridged.plan!.excised).toEqual(["kubernetes_manifest.web_cert"]);
+      expect(readFileSync(join(out, "main.tf"), "utf-8")).not.toContain('resource "kubernetes_manifest" "web_cert"');
     });
   });
 });

package/src/cli/commands/lint.test.ts

@@ -1,5 +1,6 @@
 import { describe, test, expect, beforeEach, afterEach } from "vitest";
-import { lintCommand, isLintRule, loadPluginRules, type LintOptions } from "./lint";
+import { lintCommand, isLintRule, loadPluginRules, LEXICON_RESOLUTION_RULE_ID, type LintOptions } from "./lint";
+import { loadPlugins, resolveProjectLexicons } from "../plugins";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
@@ -541,3 +542,147 @@ describe("lintCommand — git-ignored files are not linted", () => {
     expect(result.diagnostics.some((d) => d.file.includes("authored.ts") && d.ruleId === "EVL003")).toBe(true);
   });
 });
+
+/**
+ * chant #2222 (epic #2215 sub-issue 7) — `chant lint` used to print "No
+ * problems found" and exit 0 on a project whose declared lexicon could not be
+ * resolved, the state `chant build` refuses outright. These pin both halves:
+ * the failure is now reported, and the one case the old `catch` legitimately
+ * covered (a project that declares no lexicon at all) still lints quietly.
+ */
+describe("lintCommand — a declared lexicon that cannot be resolved (#2222)", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-lint-lexicon-${Date.now()}-${Math.random()}`);
+    await mkdir(join(testDir, "src"), { recursive: true });
+    await writeFile(join(testDir, "src", "clean.ts"), `export const x = 1;\n`);
+    process.env.NO_COLOR = "1";
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+    delete process.env.NO_COLOR;
+  });
+
+  /** The message `chant build` prints after `error: ` for the same project. */
+  async function buildsMessageFor(dir: string): Promise<string> {
+    try {
+      await loadPlugins(await resolveProjectLexicons(dir));
+    } catch (err) {
+      return err instanceof Error ? err.message : String(err);
+    }
+    throw new Error(`expected ${dir} to fail lexicon resolution`);
+  }
+
+  test("a declared lexicon whose package is not installed fails the lint", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `export default { lexicons: ["not-a-real-lexicon"] };\n`,
+    );
+
+    const result = await lintCommand({ path: testDir, format: "stylish" });
+
+    expect(result.success).toBe(false);
+    expect(result.errorCount).toBe(1);
+    const diag = result.diagnostics.find((d) => d.ruleId === LEXICON_RESOLUTION_RULE_ID);
+    expect(diag).toBeDefined();
+    expect(diag!.severity).toBe("error");
+    expect(diag!.file).toBe(join(testDir, "chant.config.ts"));
+    // Byte-for-byte what `chant build` reports, not a second wording.
+    expect(diag!.message).toBe(await buildsMessageFor(testDir));
+    expect(result.output).not.toContain("No problems found");
+  });
+
+  test("a chant.config that cannot be loaded at all fails the lint with its own error", async () => {
+    // The shape found in the wild: the config imports the lexicon package, so
+    // it throws before `lexicons` is ever read.
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `import { thing } from "@intentius/chant-lexicon-not-a-real-lexicon";\n` +
+        `export default { lexicons: ["aws"], thing };\n`,
+    );
+
+    const result = await lintCommand({ path: testDir, format: "stylish" });
+
+    expect(result.success).toBe(false);
+    const diag = result.diagnostics.find((d) => d.ruleId === LEXICON_RESOLUTION_RULE_ID);
+    expect(diag).toBeDefined();
+    expect(diag!.message).toBe(await buildsMessageFor(testDir));
+    expect(diag!.message).toContain("@intentius/chant-lexicon-not-a-real-lexicon");
+  });
+
+  test("the failure reaches --format json", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `export default { lexicons: ["not-a-real-lexicon"] };\n`,
+    );
+
+    const result = await lintCommand({ path: testDir, format: "json" });
+
+    const parsed = JSON.parse(result.output) as Array<Record<string, unknown>>;
+    const entry = parsed.find((d) => d.ruleId === LEXICON_RESOLUTION_RULE_ID);
+    expect(entry).toBeDefined();
+    expect(entry!.severity).toBe("error");
+    expect(entry!.message).toBe(await buildsMessageFor(testDir));
+  });
+
+  test("the failure reaches --format sarif as an error-level result", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `export default { lexicons: ["not-a-real-lexicon"] };\n`,
+    );
+
+    const result = await lintCommand({ path: testDir, format: "sarif" });
+
+    const sarif = JSON.parse(result.output) as {
+      runs: Array<{ results: Array<{ ruleId: string; level: string; message: { text: string } }> }>;
+    };
+    const found = sarif.runs[0].results.find((r) => r.ruleId === LEXICON_RESOLUTION_RULE_ID);
+    expect(found).toBeDefined();
+    expect(found!.level).toBe("error");
+    expect(found!.message.text).toBe(await buildsMessageFor(testDir));
+  });
+
+  test("--fix does not drop the diagnostic", async () => {
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      `export default { lexicons: ["not-a-real-lexicon"] };\n`,
+    );
+
+    const result = await lintCommand({ path: testDir, format: "stylish", fix: true });
+
+    expect(result.success).toBe(false);
+    expect(result.diagnostics.some((d) => d.ruleId === LEXICON_RESOLUTION_RULE_ID)).toBe(true);
+  });
+
+  // The case the swallowed `catch` was written for, and the one that must not
+  // change: no `chant.config.*`, no lexicon import in any source file. The
+  // detection fallback throws "No lexicon detected in infrastructure files",
+  // which is a project that lints under the core rules alone.
+  test("a project with no chant.config at all still lints clean", async () => {
+    const result = await lintCommand({ path: testDir, format: "stylish" });
+
+    expect(result.success).toBe(true);
+    expect(result.diagnostics.some((d) => d.ruleId === LEXICON_RESOLUTION_RULE_ID)).toBe(false);
+    expect(result.output).toContain("No problems found");
+  });
+
+  test("a chant.config that declares no lexicons still lints clean", async () => {
+    await writeFile(join(testDir, "chant.config.ts"), `export default {};\n`);
+
+    const result = await lintCommand({ path: testDir, format: "stylish" });
+
+    expect(result.success).toBe(true);
+    expect(result.diagnostics.some((d) => d.ruleId === LEXICON_RESOLUTION_RULE_ID)).toBe(false);
+  });
+
+  test("a declared lexicon that does resolve lints clean", async () => {
+    await writeFile(join(testDir, "chant.config.ts"), `export default { lexicons: ["aws"] };\n`);
+
+    const result = await lintCommand({ path: testDir, format: "stylish" });
+
+    expect(result.success).toBe(true);
+    expect(result.diagnostics.some((d) => d.ruleId === LEXICON_RESOLUTION_RULE_ID)).toBe(false);
+  });
+});