@intentius/chant 0.60.0 → 0.62.0

package/src/cli/handlers/operator.ts

@@ -34,7 +34,7 @@ import {
   latestResolutionSince, latestPendingGate, isPendingGateExpired,
   resolveApprovalUrl, isApprovalUrl,
 } from "../../lifecycle/gate-ledger";
-import { pushLifecycle } from "../../lifecycle/git";
+import { pushLifecycle, requireLifecycleLedger } from "../../lifecycle/git";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
 import type { CommandContext } from "../registry";
 
@@ -598,6 +598,39 @@ export async function runOperatorLog(ctx: CommandContext): Promise<number> {
  * is already expired, which supersedes the standing one on an append-only
  * ledger, so the next run decides the gate from scratch.
  */
+/** The ledger branch, named in the warnings below so a reader can go look at it. */
+const LIFECYCLE_BRANCH = "chant/lifecycle";
+
+/**
+ * Push the ledger and say so when it does not land (#2309 review, refs #2310).
+ *
+ * Both write paths here used `pushLifecycle().catch(() => undefined)` and then
+ * printed unconditional success and exited 0. A rejected push — a stale lease,
+ * no credentials, no network — therefore read as a completed approval, which
+ * is the one thing an approval must never do: the operator walks away
+ * believing the gate is answered for everybody, while the resolution exists
+ * only in their own checkout.
+ *
+ * The append is still a correct *local* fact, so this is a warning and not a
+ * failure; the exit code is unchanged.
+ */
+async function reportedPush(consequence: string): Promise<boolean> {
+  try {
+    const pushed = await pushLifecycle();
+    if (pushed) return true;
+    console.error(formatWarning({
+      message: `No remote is configured, so nothing was pushed. ${consequence}`,
+    }));
+    return false;
+  } catch (err) {
+    console.error(formatWarning({
+      message: `The push to the remote was rejected: ${err instanceof Error ? err.message : String(err)}`,
+      hint: consequence,
+    }));
+    return false;
+  }
+}
+
 export async function runApprove(ctx: CommandContext): Promise<number> {
   const opName = ctx.args.path;
   const gate = ctx.args.extraPositional;
@@ -607,6 +640,18 @@ export async function runApprove(ctx: CommandContext): Promise<number> {
   }
 
   if (ctx.args.expire) {
+    // Same guard as the approve path below (#2303): `--expire` reads the
+    // standing fact and appends beside it, so a clone that never fetched the
+    // branch would both fail to see the fact it is expiring and replace the
+    // branch with the expiry alone.
+    try {
+      await requireLifecycleLedger();
+    } catch (err) {
+      console.error(formatError({
+        message: `Cannot expire the gate: ${err instanceof Error ? err.message : String(err)}`,
+      }));
+      return 1;
+    }
     const now = new Date().toISOString();
     const standing = latestPendingGate((await readGateLedger(opName)).pending, gate);
     if (!standing || isPendingGateExpired(standing, now)) {
@@ -622,8 +667,14 @@ export async function runApprove(ctx: CommandContext): Promise<number> {
       expiresAt: now,
       ...(standing.description ? { description: standing.description } : {}),
     });
-    await pushLifecycle().catch(() => undefined);
-    console.error(formatSuccess(`Gate "${gate}" on "${opName}" expired at ${now} — not approved`));
+    const pushed = await reportedPush(
+      `The expiry is recorded locally on ${LIFECYCLE_BRANCH}. Until it reaches the remote, ` +
+        `a run in another checkout still sees the old pending fact.`,
+    );
+    console.error(formatSuccess(
+      `Gate "${gate}" on "${opName}" expired at ${now} — not approved` +
+        (pushed ? "" : " (local only — the push did not land)"),
+    ));
     console.error(formatInfo(
       `The next \`chant run ${opName}\` decides this gate from scratch and records a fresh pending fact.`,
     ));
@@ -682,6 +733,21 @@ export async function recordGateApproval(
     }));
   }
 
+  // Read the branch before appending to it (#2303 finding 2). Without this,
+  // an approve in a clone that never fetched `chant/lifecycle` builds its
+  // commit from an empty tree with no parent and replaces the branch with a
+  // single commit holding only this resolution — the pending fact it is
+  // answering is discarded rather than appended to.
+  try {
+    await requireLifecycleLedger();
+  } catch (err) {
+    console.error(formatError({
+      message: `Cannot record the approval: ${err instanceof Error ? err.message : String(err)}`,
+      hint: "The pending fact this answers lives on that branch; appending without it would drop it.",
+    }));
+    return { ok: false };
+  }
+
   const resolvedBy = opts.actor ?? process.env.GITHUB_ACTOR ?? process.env.GITLAB_USER_LOGIN ?? process.env.USER ?? "unknown";
 
   // #2028: the resolution's link is typed. `--url` wins; otherwise, running
@@ -704,11 +770,15 @@ export async function recordGateApproval(
     ...(opts.note ? { note: opts.note } : {}),
     ...(url ? { url } : {}),
   });
-  await pushLifecycle().catch(() => undefined);
+  const pushed = await reportedPush(
+    `The resolution is recorded locally on ${LIFECYCLE_BRANCH}. Until it reaches the remote, ` +
+      `a run in another checkout will not see it.`,
+  );
 
   console.error(formatSuccess(
     `Gate "${gate}" on "${opName}" resolved by ${record.resolvedBy} at ${record.timestamp}` +
-      (record.url ? ` (${record.url})` : ""),
+      (record.url ? ` (${record.url})` : "") +
+      (pushed ? "" : " (local only — the push did not land)"),
   ));
   return { ok: true, record };
 }

package/src/codegen/json-schema.test.ts

@@ -110,6 +110,91 @@ describe("resolvePropertyType", () => {
     };
     expect(resolvePropertyType({ $ref: "#/definitions/Foo" }, schema, null)).toBe("any");
   });
+
+  // chant #2205 — a branch list beside a real `type` relaxes that type.
+  test("reads the sibling type through a oneOf", () => {
+    const prop: JsonSchemaProperty = {
+      type: "string",
+      oneOf: [{ pattern: "^a" }, { pattern: "^b" }],
+    };
+    expect(resolvePropertyType(prop, emptySchema, defName)).toBe("string");
+  });
+
+  test("reads the sibling $ref through an anyOf", () => {
+    const schema: JsonSchemaDocument = {
+      definitions: { Foo: { properties: { bar: { type: "string" } } } },
+    };
+    const prop: JsonSchemaProperty = {
+      $ref: "#/definitions/Foo",
+      anyOf: [{ required: ["bar"] }],
+    };
+    expect(resolvePropertyType(prop, schema, defName)).toBe("Test_Foo");
+  });
+
+  test("an anyOf branch carrying an enum narrows a string property to that union", () => {
+    // AWS::AmazonMQ::Broker.EngineType: the enum branch beside case-insensitive
+    // patterns for the same two values.
+    const prop: JsonSchemaProperty = {
+      type: "string",
+      anyOf: [
+        { type: "string", enum: ["ACTIVEMQ", "RABBITMQ"] },
+        { pattern: "^[Aa][Cc][Tt][Ii][Vv][Ee][Mm][Qq]$" },
+        { pattern: "^[Rr][Aa][Bb][Bb][Ii][Tt][Mm][Qq]$" },
+      ],
+    };
+    expect(resolvePropertyType(prop, emptySchema, defName)).toBe('"ACTIVEMQ" | "RABBITMQ"');
+  });
+
+  test("a non-string enum branch is left alone", () => {
+    const prop: JsonSchemaProperty = {
+      type: "object",
+      anyOf: [{ enum: ["a", "b"] }],
+    };
+    expect(resolvePropertyType(prop, emptySchema, defName)).toBe("Record<string, any>");
+  });
+
+  test("a branch list with nothing beside it stays 'any'", () => {
+    const prop: JsonSchemaProperty = {
+      oneOf: [
+        { type: "object", properties: { Fixed: { type: "string" } } },
+        { type: "object", properties: { Below: { type: "string" } } },
+      ],
+    };
+    expect(resolvePropertyType(prop, emptySchema, defName)).toBe("any");
+  });
+
+  // chant #2205 — allOf of one $ref and an annotation types as that $ref.
+  test("resolves an allOf of a single $ref plus an annotation", () => {
+    const schema: JsonSchemaDocument = {
+      definitions: { ProtocolType: { type: "string", enum: ["MCP"] } },
+    };
+    const prop: JsonSchemaProperty = {
+      allOf: [{ $ref: "#/definitions/ProtocolType" }, { default: "MCP" }],
+    };
+    expect(resolvePropertyType(prop, schema, defName)).toBe("Test_ProtocolType");
+  });
+
+  test("leaves an allOf that intersects two real shapes as 'any'", () => {
+    const schema: JsonSchemaDocument = {
+      definitions: {
+        A: { properties: { a: { type: "string" } } },
+        B: { properties: { b: { type: "string" } } },
+      },
+    };
+    const prop: JsonSchemaProperty = {
+      allOf: [{ $ref: "#/definitions/A" }, { $ref: "#/definitions/B" }],
+    };
+    expect(resolvePropertyType(prop, schema, defName)).toBe("any");
+  });
+
+  // chant #2205 — `[]` binds tighter than `|`.
+  test("parenthesizes a union inside an array", () => {
+    const prop: JsonSchemaProperty = {
+      type: "array",
+      items: { type: "string", enum: ["arm64", "x86_64"] },
+    };
+    expect(resolvePropertyType(prop, emptySchema, defName)).toBe('("arm64" | "x86_64")[]');
+  });
 });
 
 describe("resolveRef", () => {
@@ -129,6 +214,80 @@ describe("resolveRef", () => {
     };
     expect(resolveRef("#/definitions/Count", schema, defName)).toBe("number");
   });
+
+  // chant #2205 — CloudFormation names its list shapes, and a `$ref` to one
+  // used to fall through to "any".
+  test("resolves an array definition through its items", () => {
+    const schema: JsonSchemaDocument = {
+      definitions: {
+        TagList: { type: "array", items: { $ref: "#/definitions/Tag" } },
+        Tag: { properties: { Key: { type: "string" }, Value: { type: "string" } } },
+      },
+    };
+    expect(resolveRef("#/definitions/TagList", schema, defName)).toBe("Test_Tag[]");
+  });
+
+  test("resolves an array definition of scalars", () => {
+    const schema: JsonSchemaDocument = {
+      definitions: { Names: { type: "array", items: { type: "string" } } },
+    };
+    expect(resolveRef("#/definitions/Names", schema, defName)).toBe("string[]");
+  });
+
+  test("resolves an array definition with no items to 'any[]'", () => {
+    const schema: JsonSchemaDocument = {
+      definitions: { Loose: { type: "array" } },
+    };
+    expect(resolveRef("#/definitions/Loose", schema, defName)).toBe("any[]");
+  });
+
+  test("parenthesizes a union inside an array definition", () => {
+    const schema: JsonSchemaDocument = {
+      definitions: { Modes: { type: "array", items: { type: "string", enum: ["b", "a"] } } },
+    };
+    expect(resolveRef("#/definitions/Modes", schema, defName)).toBe('("a" | "b")[]');
+  });
+
+  test("a list definition that reaches itself terminates", () => {
+    const schema: JsonSchemaDocument = {
+      definitions: { Tree: { type: "array", items: { $ref: "#/definitions/Tree" } } },
+    };
+    expect(resolveRef("#/definitions/Tree", schema, defName)).toBe("any[]");
+  });
+
+  test("a definition that is an allOf of one $ref resolves as that $ref", () => {
+    const schema: JsonSchemaDocument = {
+      definitions: {
+        Wrapped: { allOf: [{ $ref: "#/definitions/Inner" }, { default: "x" }] },
+        Inner: { properties: { a: { type: "string" } } },
+      },
+    };
+    expect(resolveRef("#/definitions/Wrapped", schema, defName)).toBe("Test_Inner");
+  });
+
+  test("a definition that is a sum of object branches stays 'any'", () => {
+    const schema: JsonSchemaDocument = {
+      definitions: {
+        FieldPosition: {
+          oneOf: [
+            { type: "object", properties: { Fixed: { type: "string" } } },
+            { type: "object", properties: { Below: { type: "string" } } },
+          ],
+        },
+      },
+    };
+    expect(resolveRef("#/definitions/FieldPosition", schema, defName)).toBe("any");
+  });
+
+  test("a nested list definition resolves through both hops", () => {
+    const schema: JsonSchemaDocument = {
+      definitions: {
+        Matrix: { type: "array", items: { $ref: "#/definitions/Row" } },
+        Row: { type: "array", items: { type: "number" } },
+      },
+    };
+    expect(resolveRef("#/definitions/Matrix", schema, defName)).toBe("number[][]");
+  });
 });
 
 describe("extractConstraints", () => {

package/src/codegen/json-schema.ts

@@ -20,6 +20,7 @@ export interface JsonSchemaProperty {
   items?: JsonSchemaProperty;
   oneOf?: JsonSchemaProperty[];
   anyOf?: JsonSchemaProperty[];
+  allOf?: JsonSchemaProperty[];
   properties?: Record<string, JsonSchemaProperty>;
   required?: string[];
   enum?: string[];
@@ -54,6 +55,9 @@ export interface PropertyConstraints {
 
 // --- Functions ---
 
+/** Shared empty cycle guard, so the common call allocates nothing. */
+const EMPTY_SEEN: ReadonlySet<string> = new Set<string>();
+
 /**
  * Get the primary type from a type field that can be string or string[].
  * Returns first non-"null" type, or "any" if empty.
@@ -67,6 +71,66 @@ export function primaryType(type: string | string[] | undefined): string {
   return type.length > 0 ? type[0] : "any";
 }
 
+/** The branch list a property carries under `oneOf` or `anyOf`, or undefined. */
+function branchesOf(prop: JsonSchemaProperty): JsonSchemaProperty[] | undefined {
+  if (prop.oneOf && prop.oneOf.length > 0) return prop.oneOf;
+  if (prop.anyOf && prop.anyOf.length > 0) return prop.anyOf;
+  return undefined;
+}
+
+/** A union of string literals, sorted, from a list of enum values. */
+function enumUnion(values: string[]): string {
+  return [...values].sort().map((v) => JSON.stringify(v)).join(" | ");
+}
+
+/**
+ * `T[]`, parenthesized when `T` is a union.
+ *
+ * `[]` binds tighter than `|`, so an unparenthesized `"a" | "b"[]` reads as
+ * `"a" | ("b"[])`: it accepts the bare string `"a"` and rejects `["a"]`.
+ */
+function arrayOf(itemType: string): string {
+  return itemType.includes(" | ") ? `(${itemType})[]` : `${itemType}[]`;
+}
+
+/**
+ * The branch of a `oneOf`/`anyOf` that narrows a string property to an enum.
+ *
+ * CloudFormation writes several string properties as a `type: "string"` beside
+ * a branch list whose first branch is the real enum and whose other branches
+ * are case-insensitive `pattern`s for the same values (`AWS::AmazonMQ::Broker`'s
+ * `EngineType`). The branch list relaxes the enum rather than summing shapes, so
+ * the enum is the useful type. Only strings qualify: anything else is a real sum.
+ */
+function relaxedEnumBranch(
+  prop: JsonSchemaProperty,
+  branches: JsonSchemaProperty[],
+): string[] | undefined {
+  if (prop.type !== undefined && primaryType(prop.type) !== "string") return undefined;
+  for (const b of branches) {
+    if (!b.enum || b.enum.length === 0) continue;
+    if (b.type !== undefined && primaryType(b.type) !== "string") return undefined;
+    if (!b.enum.every((v) => typeof v === "string")) return undefined;
+    return b.enum;
+  }
+  return undefined;
+}
+
+/**
+ * The single content-bearing branch of an `allOf`, when that is the whole shape.
+ *
+ * Every `allOf` in the CloudFormation Registry is one `$ref` beside an
+ * annotation object (`{ "default": "MCP" }`), which types exactly as the `$ref`
+ * alone. An `allOf` that intersects two real shapes has no single answer and is
+ * left to the caller.
+ */
+function soleTypedBranch(branches: JsonSchemaProperty[]): JsonSchemaProperty | undefined {
+  const typed = branches.filter(
+    (b) => b.$ref || b.type || b.properties || b.items || (b.enum && b.enum.length > 0) || branchesOf(b),
+  );
+  return typed.length === 1 ? typed[0] : undefined;
+}
+
 /**
  * Resolve a schema property to its TypeScript type string.
  *
@@ -75,28 +139,43 @@ export function primaryType(type: string | string[] | undefined): string {
  * @param resolveDefName - Callback to produce a TypeScript name from a definition.
  *   Receives (defName: string) and should return the TS type name for that definition.
  *   When null, $ref to object definitions resolves to "any".
+ * @param seen - Definition names already on the current resolution path, so a
+ *   list definition that reaches itself terminates instead of recursing forever.
  */
 export function resolvePropertyType(
   prop: JsonSchemaProperty | undefined,
   schema: JsonSchemaDocument,
   resolveDefName: ((defName: string) => string) | null,
+  seen: ReadonlySet<string> = EMPTY_SEEN,
 ): string {
   if (!prop) return "any";
 
-  // Handle oneOf/anyOf → any
-  if ((prop.oneOf && prop.oneOf.length > 0) || (prop.anyOf && prop.anyOf.length > 0)) {
-    return "any";
+  // `allOf` of one real branch and some annotations types as that branch.
+  if (prop.allOf && prop.allOf.length > 0 && !prop.$ref && !prop.type && !prop.enum) {
+    const sole = soleTypedBranch(prop.allOf);
+    if (sole) return resolvePropertyType(sole, schema, resolveDefName, seen);
+  }
+
+  const branches = branchesOf(prop);
+  if (branches) {
+    // A branch list beside a `type` relaxes that type; the enum branch, when
+    // there is one, is the narrowest reading of it.
+    const relaxed = relaxedEnumBranch(prop, branches);
+    if (relaxed) return enumUnion(relaxed);
+    // With nothing beside it the branch list is a sum of shapes, which this
+    // emitter does not express yet (chant #2278).
+    if (!prop.$ref && !prop.type && !(prop.enum && prop.enum.length > 0)) return "any";
+    // Otherwise fall through and read the sibling keywords.
   }
 
   // Handle $ref
   if (prop.$ref) {
-    return resolveRef(prop.$ref, schema, resolveDefName);
+    return resolveRef(prop.$ref, schema, resolveDefName, seen);
   }
 
   // Inline enum → union of string literals
   if (prop.enum && prop.enum.length > 0) {
-    const sorted = [...prop.enum].sort();
-    return sorted.map((v) => JSON.stringify(v)).join(" | ");
+    return enumUnion(prop.enum);
   }
 
   const pt = primaryType(prop.type);
@@ -111,8 +190,7 @@ export function resolvePropertyType(
       return "boolean";
     case "array":
       if (prop.items) {
-        const itemType = resolvePropertyType(prop.items, schema, resolveDefName);
-        return `${itemType}[]`;
+        return arrayOf(resolvePropertyType(prop.items, schema, resolveDefName, seen));
       }
       return "any[]";
     case "object":
@@ -134,6 +212,7 @@ export function resolveRef(
   ref: string,
   schema: JsonSchemaDocument,
   resolveDefName: ((defName: string) => string) | null,
+  seen: ReadonlySet<string> = EMPTY_SEEN,
 ): string {
   const prefix = "#/definitions/";
   if (!ref.startsWith(prefix)) return "any";
@@ -141,6 +220,8 @@ export function resolveRef(
   const defName = ref.slice(prefix.length);
   const def = schema.definitions?.[defName];
   if (!def) return "any";
+  // A list definition whose items reach it again would recurse without end.
+  if (seen.has(defName)) return "any";
 
   // String enum → named type (via resolveDefName) or string
   if (isEnumDefinition(def)) {
@@ -161,9 +242,26 @@ export function resolveRef(
       case "number": return "number";
       case "boolean": return "boolean";
       case "object": return "Record<string, any>";
+      // CloudFormation names its list shapes: `Tags` is a `$ref` to a `TagList`
+      // definition whose items are the `Tag` definition one hop away. Resolve
+      // through `items` the way the inline `array` case does. (chant #2205)
+      case "array": {
+        if (!def.items) return "any[]";
+        const nested = new Set(seen);
+        nested.add(defName);
+        return arrayOf(resolvePropertyType(def.items, schema, resolveDefName, nested));
+      }
     }
   }
 
+  // An `allOf`/`oneOf`/`anyOf` definition types as its property form would.
+  if (def.allOf || def.oneOf || def.anyOf) {
+    const nested = new Set(seen);
+    nested.add(defName);
+    const viaBranches = resolvePropertyType(def, schema, resolveDefName, nested);
+    if (viaBranches !== "any") return viaBranches;
+  }
+
   return "any";
 }
 

package/src/graph-ir.test.ts

@@ -224,3 +224,66 @@ describe("buildGraphIr", () => {
     expect(JSON.stringify(buildGraphIr(reordered))).toEqual(JSON.stringify(ir));
   });
 });
+
+/**
+ * The two duck-typed channels an entity may carry beside its `props` (#2265,
+ * #2266), for a lexicon whose references are strings in someone else's syntax
+ * rather than `AttrRef` objects. Asserted here with a made-up lexicon rather
+ * than terraform's, because what is being checked is that this module reads
+ * the channels without knowing anything about who filled them.
+ */
+describe("entity-declared references and stacks", () => {
+  test("turns a declared reference into an edge, with both attribute names", () => {
+    const vpc = decl({ lexicon: "hcl", entityType: "Vpc" });
+    const subnet = decl({
+      lexicon: "hcl",
+      entityType: "Subnet",
+      props: { vpc_id: "${aws_vpc.main.id}" },
+      references: [{ to: "vpc", viaAttr: "vpc_id", toAttr: "id" }],
+    });
+    const entities = new Map<string, Declarable>([
+      ["vpc", vpc],
+      ["subnet", subnet],
+    ]);
+    resolveAttrRefs(entities);
+
+    const ir = buildGraphIr(entities);
+    expect(ir.edges).toEqual([{ from: "subnet", to: "vpc", kind: "ref", viaAttr: "vpc_id", toAttr: "id" }]);
+    // The reference channel is metadata about the graph, not declared config,
+    // so it never lands in attrs; the string it was resolved from still does.
+    expect(ir.nodes.find((n) => n.id === "subnet")!.attrs).toEqual({ vpc_id: "${aws_vpc.main.id}" });
+  });
+
+  test("drops a declared reference to a self or to something that is not a node", () => {
+    const a = decl({
+      lexicon: "hcl",
+      entityType: "Vpc",
+      references: [
+        { to: "a", viaAttr: "self" },
+        { to: "nowhere", viaAttr: "gone" },
+      ],
+    });
+    const entities = new Map<string, Declarable>([["a", a]]);
+    resolveAttrRefs(entities);
+    expect(buildGraphIr(entities).edges).toEqual([]);
+  });
+
+  test("keys byStack by the unit an entity names, and leaves byLexicon alone", () => {
+    const app = decl({ lexicon: "hcl", entityType: "Vpc", stack: "app" });
+    const net = decl({ lexicon: "hcl", entityType: "Vpc", stack: "network" });
+    // An entity that names no unit still falls back to the lexicon partition,
+    // which is every other lexicon's behaviour and stays unchanged.
+    const plain = decl({ lexicon: "gcp", entityType: "Vpc" });
+    const entities = new Map<string, Declarable>([
+      ["app/vpc", app],
+      ["network/vpc", net],
+      ["plain", plain],
+    ]);
+    resolveAttrRefs(entities);
+
+    const ir = buildGraphIr(entities);
+    expect(ir.groups.byStack).toEqual({ app: ["app/vpc"], gcp: ["plain"], network: ["network/vpc"] });
+    expect(ir.groups.byLexicon).toEqual({ gcp: ["plain"], hcl: ["app/vpc", "network/vpc"] });
+    expect(ir.nodes.find((n) => n.id === "app/vpc")!.attrs).not.toHaveProperty("stack");
+  });
+});