@intentius/chant 0.80.0 → 0.81.0

package/dist/discovery/convergence.d.ts

@@ -1,97 +0,0 @@
-/**
- * The warning release for chant#2527, which converges the discovery walkers.
- *
- * Five walkers decide which files chant reads: source discovery
- * (`./files.ts`'s `findInfraFiles`, behind build, graph, list and explain),
- * lint (`../cli/commands/lint.ts`), component discovery
- * (`../components/discover.ts`), Op discovery (`../op/discover.ts`) and the
- * audit walk (`../audit/discover.ts`). They disagree about dot-directories,
- * git-ignored files, `dist` and child projects. The next release makes them
- * agree:
- *
- * - dot-directories are skipped, except `.github` and `.forgejo` for audit;
- * - git-ignored files are skipped, nested `.gitignore` files included, with
- *   ignore rules evaluated only for paths below the scan root;
- * - `dist` is skipped;
- * - when the scan root is inside a project, a child directory holding a
- *   project config is a boundary (a lint-only `chant.config.json` fragment is
- *   not one); when it is outside a project, every child project is read; Op
- *   discovery always stops at child projects below its root;
- * - the source-root quirk goes: today source and component discovery read
- *   the first child project they meet as the project's own source and skip
- *   every later one.
- *
- * This release changes none of that. It runs after each walk, classifies the
- * files the walk returned (and, where the next release reads more, the
- * subtrees the walk skipped) under the converged rules, and prints one
- * warning per affected group on stderr, naming the `include` or `exclude`
- * glob (#2519) that keeps today's behaviour. The warning goes away only when
- * that glob is in the project config.
- */
-/** The walker a warning is about, which is also how the warning names it. */
-export type DiscoveryWalker = "source" | "lint" | "components" | "ops" | "audit";
-/** Why a file's status changes next release. */
-type Cause = "dot-dir" | "dist" | "child-project" | "source-root" | "git-ignored" | "every-child" | "ignored-above-root";
-interface Change {
-    file: string;
-    /** `skip`: read today, skipped next release. `read`: the reverse. */
-    kind: "skip" | "read";
-    cause: Cause;
-    /** The directory (or, for a lone ignored file, the file) the cause attaches to. */
-    anchor: string;
-}
-export interface DiscoveryWalkInput {
-    walker: DiscoveryWalker;
-    /** The directory the walk started from. */
-    root: string;
-    /** The files the walk returned, absolute. */
-    files: readonly string[];
-    /**
-     * Source and component discovery: the first child project the walk met,
-     * which it read as the project's own source.
-     */
-    sourceRoot?: string | null;
-    /**
-     * Source and component discovery: the child projects the walk skipped
-     * because it had already met one. Read next release when the scan root is
-     * outside a project.
-     */
-    skippedChildren?: readonly string[];
-    /** The walker's file filter, applied to what a skipped child holds. */
-    fileOk?: (name: string, fullPath: string) => boolean | Promise<boolean>;
-    /**
-     * Lint only: the files the walk found before its git-ignore filter dropped
-     * some, and the paths that filter reported ignored. The filter's call
-     * carries the scan root as an extra probe, so no second `git` call is made.
-     */
-    lintIgnored?: {
-        raw: readonly string[];
-        ignored: ReadonlySet<string>;
-    };
-}
-/**
- * Paths `git check-ignore` reports ignored, in one batched call run from
- * `cwd`. A path is reported exactly as given. A tree outside git, a missing
- * `git`, or nothing ignored (exit 1) yields an empty set.
- */
-export declare function gitIgnoredPaths(paths: readonly string[], cwd: string): Set<string>;
-/** The probe for a directory in a `git check-ignore` batch: a trailing slash makes git match it as a directory. */
-export declare function dirProbe(dir: string): string;
-/**
- * Classify a walk's files under the converged rules and return what changes.
- * Exported for tests; {@link warnDiscoveryChanges} is the entry point.
- */
-export declare function discoveryChanges(input: DiscoveryWalkInput): Promise<Change[]>;
-/** Forget which warnings were printed. Tests only. */
-export declare function resetDiscoveryWarnings(): void;
-/**
- * Print, on stderr, what the next release's converged walk will read
- * differently from the walk just made (chant#2527). Each group names its
- * files, what changes, and the `include` or `exclude` glob (#2519) that
- * keeps today's behaviour; a group whose glob is already in the project
- * config is not printed. Each warning prints once per process, however many
- * times a command walks the same tree. Returns the lines printed.
- */
-export declare function warnDiscoveryChanges(input: DiscoveryWalkInput): Promise<string[]>;
-export {};
-//# sourceMappingURL=convergence.d.ts.map

package/dist/discovery/convergence.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"convergence.d.ts","sourceRoot":"","sources":["../../src/discovery/convergence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAUH,6EAA6E;AAC7E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,YAAY,GAAG,KAAK,GAAG,OAAO,CAAC;AAUjF,gDAAgD;AAChD,KAAK,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,eAAe,GAAG,aAAa,GAAG,aAAa,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEzH,UAAU,MAAM;IACd,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAQD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,eAAe,CAAC;IACxB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,uEAAuE;IACvE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE;;;;OAIG;IACH,WAAW,CAAC,EAAE;QAAE,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC;CACxE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAalF;AAED,mHAAmH;AACnH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5C;AA0CD;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA8FnF;AA6DD,sDAAsD;AACtD,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkEvF"}

package/src/cli/commands/audit-walk-warnings.test.ts

@@ -1,156 +0,0 @@
-import { afterEach, beforeAll, describe, expect, test, vi } from "vitest";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { auditCommand, printAuditResult, type AuditCommandOptions } from "./audit";
-import { loadAuditPlugins } from "../../audit/discover";
-
-/**
- * #2528's warning release. `chant audit` warns on stderr about the two changes
- * the next release makes (#2525's exception list), and the report itself stays
- * byte-identical: every test here that runs with a warning also runs the same
- * tree without its cause and compares the JSON.
- */
-
-const NOW = "2026-09-23T00:00:00.000Z";
-const dirs: string[] = [];
-
-function tmpRepo(): string {
-  const dir = mkdtempSync(join(tmpdir(), "chant-2528-"));
-  dirs.push(dir);
-  return dir;
-}
-
-afterEach(() => {
-  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
-  vi.restoreAllMocks();
-});
-
-let plugins: Awaited<ReturnType<typeof loadAuditPlugins>>;
-
-// Loading every audit lexicon is the slow part; once, outside any one test's timeout.
-beforeAll(async () => {
-  plugins = await loadAuditPlugins();
-}, 120_000);
-
-function audit(path: string, extra: Partial<AuditCommandOptions> = {}) {
-  return auditCommand({ path, format: "json", now: NOW, toolVersion: "0.0.0", plugins, ...extra });
-}
-
-/** Print a result the way the CLI does, and split what reached each stream. */
-function printed(result: Awaited<ReturnType<typeof auditCommand>>): { stdout: string; stderr: string } {
-  const out: string[] = [];
-  const err: string[] = [];
-  vi.spyOn(console, "log").mockImplementation((s: string) => void out.push(s));
-  vi.spyOn(console, "error").mockImplementation((s: string) => void err.push(s));
-  printAuditResult(result);
-  vi.restoreAllMocks();
-  return { stdout: out.join("\n"), stderr: err.join("\n") };
-}
-
-describe("a truncated walk is warned about, not yet reported (#2528)", () => {
-  function treeWithTail(): string {
-    const dir = tmpRepo();
-    mkdirSync(join(dir, "a"), { recursive: true });
-    for (let i = 0; i < 5; i++) writeFileSync(join(dir, "a", `${i}.md`), "x");
-    writeFileSync(join(dir, "a", "terraform.tfstate"), "{}");
-    // Past the limit: a state file TF023 would report if the walk reached it.
-    mkdirSync(join(dir, "z"), { recursive: true });
-    writeFileSync(join(dir, "z", "terraform.tfstate"), "{}");
-    return dir;
-  }
-
-  test("the warning names the limit and --max-files, on stderr only", async () => {
-    const dir = treeWithTail();
-    const result = await audit(dir, { maxFiles: 6 });
-    expect(result.warnings).toHaveLength(1);
-    const { stdout, stderr } = printed(result);
-    expect(stdout).toBe(result.output);
-    expect(stderr).toContain(`the scan of ${dir} stopped at 6 files, so part of the tree was not audited.`);
-    expect(stderr).toContain("Raise it with --max-files <n>.");
-    expect(stderr).toContain("From the next release, text and JSON output will also report a truncated scan.");
-    expect(result.findings.map((f) => f.file)).toEqual(["a/terraform.tfstate"]);
-  });
-
-  test("the JSON and text reports are what the same tree gives without the files past the limit", async () => {
-    const dir = treeWithTail();
-    const truncatedJson = await audit(dir, { maxFiles: 6 });
-    const truncatedText = await audit(dir, { maxFiles: 6, format: "stylish" });
-    rmSync(join(dir, "z"), { recursive: true, force: true });
-    const wholeJson = await audit(dir, { maxFiles: 6 });
-    const wholeText = await audit(dir, { maxFiles: 6, format: "stylish" });
-    expect(wholeJson.warnings).toBeUndefined();
-    expect(truncatedJson.output).toBe(wholeJson.output);
-    expect(truncatedText.output).toBe(wholeText.output);
-    expect(printed(truncatedJson).stdout).toBe(printed(wholeJson).stdout);
-  });
-
-  test("--max-files raises the limit, and the default walk does not warn on a small tree", async () => {
-    const dir = treeWithTail();
-    const raised = await audit(dir, { maxFiles: 7 });
-    expect(raised.warnings).toBeUndefined();
-    expect(raised.findings.map((f) => f.file).sort()).toEqual(["a/terraform.tfstate", "z/terraform.tfstate"]);
-    expect((await audit(dir)).warnings).toBeUndefined();
-  });
-});
-
-describe("TF023 warns when a nested .gitignore would change its finding (#2528)", () => {
-  function nestedTree(nested: string | undefined): string {
-    const dir = tmpRepo();
-    mkdirSync(join(dir, "infra"), { recursive: true });
-    writeFileSync(join(dir, ".gitignore"), "node_modules/\n");
-    writeFileSync(join(dir, "infra", "main.tf"), 'resource "null_resource" "a" {}\n');
-    writeFileSync(join(dir, "infra", "terraform.tfstate"), "{}");
-    if (nested !== undefined) writeFileSync(join(dir, "infra", ".gitignore"), nested);
-    return dir;
-  }
-
-  test("fires for the file a nested .gitignore ignores, naming both, and TF023 still reports it", async () => {
-    const dir = nestedTree("*.tfstate\n");
-    const result = await audit(dir);
-    expect(result.findings.filter((f) => f.checkId === "TF023").map((f) => f.file)).toEqual(["infra/terraform.tfstate"]);
-    expect(result.warnings).toEqual([
-      {
-        file: "infra/terraform.tfstate",
-        message: "TF023 reports this path because chant audit reads only the root .gitignore, but infra/.gitignore ignores it.",
-        hint: "From the next release chant audit reads every .gitignore between a file and the scan root, and TF023 will no longer report this path.",
-      },
-    ]);
-    const { stdout, stderr } = printed(result);
-    expect(stdout).toBe(result.output);
-    expect(stderr).toContain("infra/terraform.tfstate");
-    expect(stderr).toContain("infra/.gitignore ignores it");
-  });
-
-  test("does not fire when the nested .gitignore does not cover the file", async () => {
-    const result = await audit(nestedTree("*.log\n"));
-    expect(result.findings.some((f) => f.checkId === "TF023")).toBe(true);
-    expect(result.warnings).toBeUndefined();
-  });
-
-  test("does not fire when the root .gitignore already drops the file", async () => {
-    const dir = nestedTree("*.tfstate\n");
-    writeFileSync(join(dir, ".gitignore"), "*.tfstate\n");
-    const result = await audit(dir);
-    expect(result.findings.some((f) => f.checkId === "TF023")).toBe(false);
-    expect(result.warnings).toBeUndefined();
-  });
-
-  test("stdout JSON and the text report are byte-identical with and without the nested .gitignore", async () => {
-    const dir = nestedTree("*.tfstate\n");
-    const withJson = await audit(dir);
-    const withText = await audit(dir, { format: "stylish" });
-    const withSarif = await audit(dir, { format: "sarif" });
-    rmSync(join(dir, "infra", ".gitignore"));
-    const withoutJson = await audit(dir);
-    const withoutText = await audit(dir, { format: "stylish" });
-    const withoutSarif = await audit(dir, { format: "sarif" });
-    expect(withJson.warnings).toHaveLength(1);
-    expect(withoutJson.warnings).toBeUndefined();
-    expect(withJson.output).toBe(withoutJson.output);
-    expect(withText.output).toBe(withoutText.output);
-    expect(withSarif.output).toBe(withoutSarif.output);
-    expect(printed(withJson).stdout).toBe(printed(withoutJson).stdout);
-    JSON.parse(printed(withJson).stdout);
-  });
-});

package/src/components/unbound-gate-approval.test.ts

@@ -1,82 +0,0 @@
-/**
- * The warning a release ahead of environment- and plan-bound component gate
- * approvals (chant #2574). The gate decision itself must not change.
- */
-
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { CapabilityRegistry } from "./capability";
-import { runComponentDeploy, type DriverComponent } from "./driver";
-import { memoryGateLedgerPort } from "../op/gate";
-import type { GateResolutionRecord, PendingGateRecord } from "../lifecycle/gate-ledger";
-import { resetUnboundGateApprovalWarnings, warnOnUnboundComponentApproval } from "./unbound-gate-approval";
-
-const NOW = "2026-09-05T12:00:00.000Z";
-
-const component: DriverComponent = {
-  name: "search-service",
-  deploy: [{ phase: "Apply", steps: [{ kind: "gate", gate: "approve-prod" }, { kind: "ecs-deploy" }] }],
-};
-
-const pending: PendingGateRecord = {
-  version: 1, kind: "pending", op: "search-service", gate: "approve-prod",
-  timestamp: "2026-09-05T10:00:00.000Z", expiresAt: "2026-09-07T10:00:00.000Z",
-};
-
-const unbound: GateResolutionRecord = {
-  version: 1, op: "search-service", gate: "approve-prod",
-  resolvedBy: "alex", timestamp: "2026-09-05T11:00:00.000Z",
-};
-
-function registry(calls: string[]): CapabilityRegistry {
-  const r = new CapabilityRegistry();
-  r.register({ kind: "ecs-deploy", async run() { calls.push("ecs-deploy"); return { ok: true }; } });
-  return r;
-}
-
-describe("warnOnUnboundComponentApproval (#2574)", () => {
-  let warn: ReturnType<typeof vi.spyOn>;
-  beforeEach(() => {
-    resetUnboundGateApprovalWarnings();
-    warn = vi.spyOn(console, "warn").mockImplementation(() => {});
-  });
-  afterEach(() => warn.mockRestore());
-
-  it("warns once per component and gate when the approval records no plan", () => {
-    expect(warnOnUnboundComponentApproval("search-service", "approve-prod", "prod", unbound)).toBe(true);
-    expect(warnOnUnboundComponentApproval("search-service", "approve-prod", "staging", unbound)).toBe(false);
-    expect(warnOnUnboundComponentApproval("orders-table", "approve-prod", "prod", { ...unbound, op: "orders-table" })).toBe(true);
-    expect(warn).toHaveBeenCalledTimes(2);
-    const line = String(warn.mock.calls[0]![0]);
-    expect(line).toContain('gate "approve-prod" on component "search-service" passed in "prod"');
-    expect(line).toContain("From the next chant release");
-    expect(line).toContain("chant approve search-service approve-prod");
-    expect(line).toContain("issues/2574");
-  });
-
-  it("says nothing for an approval that records a plan", () => {
-    const bound = { ...unbound, planDigest: `sha256:${"a".repeat(64)}` };
-    expect(warnOnUnboundComponentApproval("search-service", "approve-prod", "prod", bound)).toBe(false);
-    expect(warn).not.toHaveBeenCalled();
-  });
-
-  it("a deploy passes the gate exactly as before, and warns", async () => {
-    const calls: string[] = [];
-    const result = await runComponentDeploy(
-      component, { env: "prod", component: "search-service" }, registry(calls), {}, undefined,
-      { port: memoryGateLedgerPort({ pending: [pending], resolutions: [unbound] }), now: NOW },
-    );
-    expect(result.status).toBe("ok");
-    expect(calls).toEqual(["ecs-deploy"]);
-    expect(warn).toHaveBeenCalledTimes(1);
-  });
-
-  it("a gated deploy does not warn", async () => {
-    const calls: string[] = [];
-    const result = await runComponentDeploy(
-      component, { env: "prod", component: "search-service" }, registry(calls), {}, undefined,
-      { port: memoryGateLedgerPort(), now: NOW },
-    );
-    expect(result.status).toBe("gated");
-    expect(warn).not.toHaveBeenCalled();
-  });
-});

package/src/components/unbound-gate-approval.ts

@@ -1,51 +0,0 @@
-/**
- * The warning a release ahead of environment- and plan-bound component gate
- * approvals (chant #2574).
- *
- * A component gate approval is keyed by the component and the gate name only,
- * so an approval given for one environment, or for one deploy, can pass the
- * same gate later on another environment or on a promote or rollback. The
- * next release binds each approval to the environment and the plan digest it
- * was given for, the way Op gates bind a plan since #2300, and refuses an
- * approval that records neither.
- *
- * This release only says so. When a component gate passes on an approval that
- * records no plan, the driver prints one warning per component and gate, per
- * process. The decision itself is unchanged.
- */
-
-import type { GateResolutionRecord } from "../lifecycle/gate-ledger";
-import { approveCommand } from "../op/gate";
-
-/** `component\0gate` pairs already warned about in this process. */
-const warned = new Set<string>();
-
-/** Forget which gates were warned about. For tests. */
-export function resetUnboundGateApprovalWarnings(): void {
-  warned.clear();
-}
-
-/**
- * Warn once for `component`'s `gate` when the approval that just passed it in
- * `env` records no plan. Returns whether a warning was printed.
- */
-export function warnOnUnboundComponentApproval(
-  component: string,
-  gate: string,
-  env: string,
-  resolution: GateResolutionRecord,
-): boolean {
-  if (resolution.planDigest !== undefined) return false;
-  const key = `${component}\0${gate}`;
-  if (warned.has(key)) return false;
-  warned.add(key);
-  console.warn(
-    `[chant] warning: gate "${gate}" on component "${component}" passed in "${env}" on an approval by ` +
-      `${resolution.resolvedBy} at ${resolution.timestamp} that records no environment and no plan. ` +
-      "From the next chant release, a component gate approval counts only for the environment and plan " +
-      "digest it was given for, and approvals recorded before then are refused. After upgrading, run the " +
-      `deploy again and approve the gate it stops at with \`${approveCommand(component, gate)}\`. ` +
-      "See https://github.com/INTENTIUS/chant/issues/2574",
-  );
-  return true;
-}

package/src/discovery/convergence.test.ts

@@ -1,231 +0,0 @@
-import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, realpathSync } from "node:fs";
-import { execFileSync } from "node:child_process";
-import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
-import { findInfraFiles } from "./files";
-import { resetDiscoveryWarnings, warnDiscoveryChanges } from "./convergence";
-import { discoverComponents } from "../components/discover";
-
-/**
- * chant#2527's warning release. Each category of file whose discovery status
- * changes when the walkers converge gets a warning naming the file, the
- * change and the glob that keeps today's behaviour, while the walker's
- * returned list stays exactly what it is today. Lint's category lives in
- * `../cli/commands/lint.test.ts`, the Op category in
- * `../op/discover-convergence.test.ts`.
- */
-
-let dir: string;
-let stderr: string[];
-
-function write(rel: string, body = "export const x = 1;\n"): void {
-  mkdirSync(dirname(join(dir, rel)), { recursive: true });
-  writeFileSync(join(dir, rel), body);
-}
-
-/** A project config (it declares a project-level key, so it is no lint-only fragment). */
-function project(rel = ".", extra: Record<string, unknown> = {}): void {
-  write(join(rel, "chant.config.json"), JSON.stringify({ lexicons: ["aws"], ...extra }));
-}
-
-const rel = (files: string[]): string[] => files.map((f) => f.slice(dir.length + 1)).sort();
-
-beforeEach(() => {
-  dir = realpathSync(mkdtempSync(join(tmpdir(), "chant-2527-")));
-  resetDiscoveryWarnings();
-  stderr = [];
-  vi.spyOn(console, "error").mockImplementation((...args: unknown[]) => void stderr.push(args.join(" ")));
-  vi.spyOn(process, "cwd").mockReturnValue(dir);
-});
-
-afterEach(() => {
-  vi.restoreAllMocks();
-  rmSync(dir, { recursive: true, force: true });
-});
-
-describe("source discovery warns about files the converged walker reads differently (#2527)", () => {
-  test("a .ts file in a dot-directory", async () => {
-    project();
-    write("src/app.ts");
-    write(".cache/gen.ts");
-
-    expect(rel(await findInfraFiles(dir))).toEqual([".cache/gen.ts", "src/app.ts"]);
-    expect(stderr).toEqual([
-      "warning: Source discovery (build, graph, list, explain) under the current directory changes in the next release (chant#2527):\n" +
-        "  .cache/gen.ts: .cache/ is a dot-directory. Every walker skips dot-directories from the next release. " +
-        'To keep reading it after the change, add ".cache" to include in chant.config.json, which the next release honours.',
-    ]);
-  });
-
-  test("a git-ignored .ts file, ignored by a nested .gitignore", async () => {
-    execFileSync("git", ["init", "-q"], { cwd: dir });
-    project();
-    write("src/app.ts");
-    write("src/vendored.ts");
-    write("src/.gitignore", "vendored.ts\n");
-
-    expect(rel(await findInfraFiles(dir))).toEqual(["src/app.ts", "src/vendored.ts"]);
-    expect(stderr).toHaveLength(1);
-    expect(stderr[0]).toContain(
-      "  src/vendored.ts is git-ignored. Every walker skips git-ignored files from the next release. " +
-        'To keep reading it after the change, add "src/vendored.ts" to include in chant.config.json, which the next release honours.',
-    );
-  });
-
-  test("an ignored directory is named once, by its outermost ignored path", async () => {
-    execFileSync("git", ["init", "-q"], { cwd: dir });
-    project();
-    write("src/app.ts");
-    write(".gitignore", "vendor/\n");
-    for (const name of ["a", "b", "c", "d"]) write(`vendor/lib/${name}.ts`);
-
-    expect(rel(await findInfraFiles(dir))).toHaveLength(5);
-    expect(stderr[0]).toContain("  4 files under vendor/: vendor/ is git-ignored.");
-    expect(stderr[0]).toContain('add "vendor" to include in chant.config.json, which the next release honours.');
-  });
-
-  test("a .ts file under dist", async () => {
-    project();
-    write("src/app.ts");
-    write("dist/out.ts");
-
-    expect(rel(await findInfraFiles(dir))).toEqual(["dist/out.ts", "src/app.ts"]);
-    expect(stderr[0]).toContain(
-      "  dist/out.ts: dist/ is a dist directory. Every walker skips dist from the next release. " +
-        'To keep reading it after the change, add "dist" to include in chant.config.json, which the next release honours.',
-    );
-  });
-
-  test("a nested child project whose chant.config.json declares a project", async () => {
-    project();
-    write("src/app.ts");
-    project("stacks/east");
-    write("stacks/east/east.ts");
-    // A lint-only fragment is not a boundary: no warning for this one.
-    write("stacks/west/chant.config.json", JSON.stringify({ rules: { COR004: "off" } }));
-    write("stacks/west/west.ts");
-
-    expect(rel(await findInfraFiles(dir))).toEqual(["src/app.ts", "stacks/east/east.ts", "stacks/west/west.ts"]);
-    expect(stderr).toHaveLength(1);
-    expect(stderr[0]).toContain(
-      "  stacks/east/east.ts: stacks/east/ is a child project with its own chant.config. " +
-        "Discovery stops at child projects from the next release. " +
-        'To keep reading it after the change, add "stacks/east" to include in chant.config.json, which the next release honours.',
-    );
-    expect(stderr[0]).not.toContain("west");
-  });
-
-  test("the first child project met is no longer read as the project's own source (the quirk)", async () => {
-    project();
-    write("app/chant.config.ts", "export default {};\n");
-    write("app/main.ts");
-
-    expect(rel(await findInfraFiles(dir))).toEqual(["app/chant.config.ts", "app/main.ts"]);
-    expect(stderr[0]).toContain(
-      "  app/chant.config.ts, app/main.ts: app/ is a child project with its own chant.config, " +
-        "read today as this project's own source because the walk met it first. " +
-        "From the next release discovery stops there, as at any child project. " +
-        'To keep reading them after the change, add "app" to include in chant.config.json, which the next release honours.',
-    );
-  });
-
-  test("the glob in the config is the fix: with it, nothing is printed and the list is the same", async () => {
-    project(".", { include: [".cache", "dist"] });
-    write("src/app.ts");
-    write(".cache/gen.ts");
-    write("dist/out.ts");
-
-    expect(rel(await findInfraFiles(dir))).toEqual([".cache/gen.ts", "dist/out.ts", "src/app.ts"]);
-    expect(stderr).toEqual([]);
-  });
-
-  test("a clean project prints nothing", async () => {
-    execFileSync("git", ["init", "-q"], { cwd: dir });
-    project();
-    write(".gitignore", "node_modules/\n.chant/types/\n");
-    write("src/app.ts");
-    write("src/lib/util.ts");
-    write("node_modules/dep/index.ts");
-    // chant init's generated type stubs: read today, never worth a warning.
-    write(".chant/types/core/index.d.ts");
-
-    expect(rel(await findInfraFiles(dir))).toEqual([".chant/types/core/index.d.ts", "src/app.ts", "src/lib/util.ts"]);
-    expect(stderr).toEqual([]);
-  });
-
-  test("a project-local lexicon named by module path (#2520) prints nothing", async () => {
-    execFileSync("git", ["init", "-q"], { cwd: dir });
-    write("chant.config.json", JSON.stringify({ lexicons: [{ name: "local", module: "./lexicon/index.ts" }] }));
-    write("lexicon/index.ts");
-    write("lexicon/rules/r1.ts");
-    write("src/app.ts");
-
-    expect(rel(await findInfraFiles(dir))).toEqual(["lexicon/index.ts", "lexicon/rules/r1.ts", "src/app.ts"]);
-    expect(stderr).toEqual([]);
-  });
-
-  test("a project-local lexicon's config still yields the glob when something else warns", async () => {
-    write("chant.config.json", JSON.stringify({ lexicons: [{ name: "local", module: "./lexicon/index.ts" }], include: [".cache"] }));
-    write("lexicon/index.ts");
-    write(".cache/gen.ts");
-    write("dist/out.ts");
-
-    expect(rel(await findInfraFiles(dir))).toEqual([".cache/gen.ts", "dist/out.ts", "lexicon/index.ts"]);
-    expect(stderr).toHaveLength(1);
-    expect(stderr[0]).not.toContain(".cache");
-    expect(stderr[0]).toContain('add "dist" to include in chant.config.json');
-  });
-
-  test("a warning prints once per process, however often the tree is walked", async () => {
-    project();
-    write(".cache/gen.ts");
-    await findInfraFiles(dir);
-    await findInfraFiles(dir);
-    expect(stderr).toHaveLength(1);
-  });
-});
-
-describe("component discovery outside a project reads every child project next release (#2527)", () => {
-  test("the second child project's component is named, with the exclude glob", async () => {
-    // No config and no .git/package.json at or above `dir`: outside a project.
-    write("one/chant.config.ts", "export default {};\n");
-    write("one/one.component.ts");
-    write("two/chant.config.ts", "export default {};\n");
-    write("two/two.component.ts");
-
-    const { sourceFiles } = await discoverComponents(dir);
-    // Today: whichever child the walk met first, and only that one.
-    expect(sourceFiles).toHaveLength(1);
-    const [read] = rel(sourceFiles);
-    const skipped = read.startsWith("one/") ? "two" : "one";
-
-    expect(stderr).toHaveLength(1);
-    expect(stderr[0]).toContain(
-      `warning: Component discovery under the current directory changes in the next release (chant#2527):\n` +
-        `  ${skipped}/${skipped}.component.ts: ${skipped}/ is a child project, skipped today ` +
-        "because the walk met another child project first. From the next release every child project is read, " +
-        "since the current directory is not inside a chant project. " +
-        `To keep skipping it, add "${skipped}" to exclude in chant.config.ts (a new file).`,
-    );
-  });
-});
-
-describe("the audit walk (#2527)", () => {
-  test("warns about a git-ignored candidate and leaves Terraform state to TF023", async () => {
-    execFileSync("git", ["init", "-q"], { cwd: dir });
-    write(".gitignore", ".env\n");
-    write(".env", "TOKEN=x\n");
-    write("k8s/deploy.yaml", "kind: Deployment\n");
-
-    const lines = await warnDiscoveryChanges({
-      walker: "audit",
-      root: dir,
-      files: [join(dir, ".env"), join(dir, "k8s/deploy.yaml"), join(dir, ".github/workflows/ci.yml")],
-    });
-    expect(lines).toEqual([
-      "  .env is git-ignored. Every walker skips git-ignored files from the next release. " +
-        'To keep reading it after the change, add ".env" to include in chant.config.ts (a new file), which the next release honours.',
-    ]);
-  });
-});