fix: pinhole tracks chant 0.52 — the pin no longer nests a stale chant (#116)

[lex00]

Closes #116.

pinhole's dependency sat at @intentius/chant ^0.44.3 while chant shipped 0.52.2, so a consumer already on 0.52.x — behold, as of today — resolved its own 0.52 at the top level and carried a second, nested chant@0.44.14 underneath pinhole for good. Dead weight at runtime (pinhole shells the project's own chant bin, not its bundled one), but the two copies would eventually diverge on type identity, since pinhole re-exports chant's IR types rather than keeping a copy.

What pinhole uses chant for

Two things, both narrow:

• Types, at compile time only. src/ir.ts re-exports GraphIR, IRNode, IREdge, IRGroups, IRExport, IRImport, SourceLoc, Layout, Point; src/chant.ts imports GraphIR, Layout, NodeSize. All import type.
• The CLI, at runtime. src/chant.ts resolves chant's bin path (preferring the target project's own install, resolve lexicons from the target project, not pinhole's own node_modules #36) and shells chant graph --format ir|layout and chant lint --format json. chant is --external in both esbuild bundles, so it is never inlined.

Why the bump is a one-liner

The surface moved only by addition between 0.44.3 and 0.52.2:

• IRExport picked up optional value and stack, and GraphIR picked up optional stackExports — both for observed graphs (chant#1279).
• graph-layout.d.ts is byte-identical.
• chant graph still takes --detail, --lens, --up/--down, --env, --node-sizes; chant lint --format json still backs the gate.

So no code change beyond the README's stated floor.

Verification

npm ci from the regenerated lock, then the three gates CI runs — npm run tsc, npm test (19 files, 211 tests), npm run build — all clean.

Beyond the typecheck, rendered a real chant 0.52.2 project end to end (behold's example-argo-estate/app-a): render walked the project's own chant install, shelled graph twice, and painted cards with populated fields, so withResourceAttrs still finds the resource tier where 0.44 left it.

Lock side effect

chant 0.52 moved esbuild to ^0.28.1, which dedupes against pinhole's own devDependency — 27 nested @intentius/chant/node_modules/@esbuild/* entries drop out of the lock.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Rfs1mLVWmwginHnDTg75sG