@intentius/chant-lexicon-fountain 0.33.0

package/README.md

@@ -0,0 +1,63 @@
+# @intentius/chant-lexicon-fountain
+
+fountain lexicon plugin for [chant](https://github.com/intentius/chant).
+
+[fountain](https://github.com/BinaryBourbon/fountain) runs coding agents in
+sandboxed VMs. This lexicon declares its workload layer as typed chant
+resources: `Environment` (sandbox baseline), `Vault` (env-var overrides),
+`Agent` (a runnable agent config). Conversations are runs, not resources —
+start them with the `fountainRun` op.
+
+`chant build` serializes to fountain's own manifest YAML (`fountain apply -f`
+accepts it verbatim) plus a `fountain-plan.json` sidecar that `fountainApply`
+reconciles against the API directly.
+
+```ts
+import { Environment, Agent } from "@intentius/chant-lexicon-fountain";
+
+export const env = new Environment({
+  name: "team-env",
+  networking_type: "limited",                    // FTN010 requires explicit intent
+  networking_config: { allowed_hosts: ["github.com"] },
+  metadata: { "managed-by": "chant" },           // enables owned-only reconcile/prune
+});
+
+export const helper = new Agent({
+  name: "helper",
+  model: "anthropic/claude-sonnet-4-6",
+  runtime: "claude",
+  environment: env,                              // typed ref — dangling name = build error
+});
+```
+
+For agents handling anything sensitive, `ConciergeStack` bundles the
+locked-down defaults (deny-all egress, no vault overrides, ownership marker
+on both resources) so loosening any of them is a visible, reviewable
+parameter.
+
+## Development
+
+```bash
+just generate    # regenerate types from the upstream OpenAPI spec
+just validate    # check the generated artifacts
+just docs        # build and serve the docs site
+```
+
+The spec is a rolling endpoint with no release tag to pin, so generation
+falls back to a committed snapshot (`src/spec/fountain-openapi.snapshot.json`)
+when the live endpoint is unreachable. `chant dev coverage` compares the
+generated surface against that spec and reports properties upstream has
+added, plus the request schemas deliberately left unmodeled.
+
+## Project structure
+
+- `src/plugin.ts` — LexiconPlugin with all lifecycle methods
+- `src/serializer.ts` — manifest YAML + `fountain-plan.json` output
+- `src/codegen/`, `src/spec/` — generation pipeline and spec fetch/parse
+- `src/lint/rules/`, `src/lint/post-synth/` — FTN001 (AST) and FTN010–017
+- `src/op/activities/` — `fountainApply` (reconciler) and `fountainRun`
+- `src/composites/` — `ConciergeStack`
+- `src/skills/` — agent skills for authoring, secrets, and locked sandboxes
+- `src/import/`, `src/describe-resources.ts` — adoption and live observation
+- `src/lsp/` — completions and hover
+- `src/generated/` — generated artifacts (do not edit)

package/dist/codegen/docs-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=docs-cli.d.ts.map

package/dist/codegen/docs-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs-cli.d.ts","sourceRoot":"","sources":["../../src/codegen/docs-cli.ts"],"names":[],"mappings":""}

package/dist/codegen/docs.d.ts

@@ -0,0 +1,16 @@
+/**
+ * fountain documentation generator.
+ *
+ * Calls the core docsPipeline with fountain-specific config. The reference
+ * pages (resources, composites, ops, adoption, skills) are declared as
+ * `extraPages` rather than left as hand-written files in docs/: the sidebar is
+ * rebuilt from generated pages on every run, so a page the config does not
+ * know about exists but cannot be navigated to.
+ */
+/**
+ * Generate documentation site for the fountain lexicon.
+ */
+export declare function generateDocs(options?: {
+    verbose?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=docs.d.ts.map

package/dist/codegen/docs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiNH;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDjF"}

package/dist/codegen/generate-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=generate-cli.d.ts.map

package/dist/codegen/generate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-cli.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-cli.ts"],"names":[],"mappings":""}

package/dist/codegen/generate-lexicon.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Lexicon JSON generator — produces lexicon-fountain.json with metadata for the
+ * fly resource and property types.
+ */
+import type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
+import type { FountainParseResult } from "../spec/parse.js";
+import type { NamingStrategy } from "./naming.js";
+export interface FountainLexiconEntry {
+    resourceType: string;
+    kind: "resource" | "property";
+    lexicon: "fountain";
+    /**
+     * Per-property constraints. Named to match core's `LexiconEntry`
+     * contract (and the aws/azure peers) — core reserves bare `constraints`
+     * for the extension-constraint array, and the LSP providers read
+     * property names off this key.
+     */
+    propertyConstraints?: Record<string, PropertyConstraints>;
+}
+/**
+ * Generate the lexicon-fountain.json content.
+ */
+export declare function generateLexiconJSON(results: FountainParseResult[], naming: NamingStrategy): string;
+//# sourceMappingURL=generate-lexicon.d.ts.map

package/dist/codegen/generate-lexicon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-lexicon.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-lexicon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,cAAc,GAAG,MAAM,CA8BlG"}

package/dist/codegen/generate-typescript.d.ts

@@ -0,0 +1,11 @@
+/**
+ * TypeScript declaration file generator — produces index.d.ts with the fly
+ * resource classes (App, Machine, Volume) and their property-type classes.
+ */
+import type { FountainParseResult } from "../spec/parse.js";
+import type { NamingStrategy } from "./naming.js";
+/**
+ * Generate the complete .d.ts file content.
+ */
+export declare function generateTypeScriptDeclarations(results: FountainParseResult[], naming: NamingStrategy): string;
+//# sourceMappingURL=generate-typescript.d.ts.map

package/dist/codegen/generate-typescript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-typescript.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-typescript.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAe/C;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,cAAc,GAAG,MAAM,CA4C7G"}

package/dist/codegen/generate.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Fountain generation pipeline — uses core generatePipeline with
+ * fountain-specific fetch, parse, naming, and generation callbacks.
+ */
+import { type GenerateOptions, type GenerateResult } from "@intentius/chant/codegen/generate";
+export type { GenerateResult };
+/**
+ * Run the full fountain generation pipeline.
+ */
+export declare function generate(opts?: GenerateOptions): Promise<GenerateResult>;
+/**
+ * Write generated artifacts to disk.
+ */
+export declare function writeGeneratedFiles(result: GenerateResult, pkgDir?: string): void;
+//# sourceMappingURL=generate.d.ts.map

package/dist/codegen/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EAEpB,MAAM,mCAAmC,CAAC;AAc3C,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoClF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAWjF"}

package/dist/codegen/naming.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Fountain naming strategy — maps Fountain::V1::{Kind} type names to
+ * user-friendly TypeScript class names.
+ */
+import { NamingStrategy as CoreNamingStrategy } from "@intentius/chant/codegen/naming";
+import { type FountainParseResult } from "../spec/parse.js";
+export { propertyTypeName, extractDefName } from "@intentius/chant/codegen/naming";
+/**
+ * Fountain-specific naming strategy. Extends the core strategy with the fountain config.
+ */
+export declare class NamingStrategy extends CoreNamingStrategy {
+    constructor(results: FountainParseResult[]);
+}
+//# sourceMappingURL=naming.d.ts.map

package/dist/codegen/naming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../src/codegen/naming.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,cAAc,IAAI,kBAAkB,EAGrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAA0C,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEjG,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAqBnF;;GAEG;AACH,qBAAa,cAAe,SAAQ,kBAAkB;gBACxC,OAAO,EAAE,mBAAmB,EAAE;CAO3C"}

package/dist/codegen/package.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Package the fountain lexicon for distribution.
+ */
+export declare function packageLexicon(options?: {
+    verbose?: boolean;
+    force?: boolean;
+}): Promise<{
+    spec: import("packages/core/src").BundleSpec;
+    stats: {
+        resources: number;
+        properties: number;
+        enums: number;
+        ruleCount: number;
+        skillCount: number;
+    };
+}>;
+//# sourceMappingURL=package.d.ts.map

package/dist/codegen/package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../../src/codegen/package.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;;;;;;;;;GAqBpF"}

package/dist/composites/concierge-stack.d.ts

@@ -0,0 +1,44 @@
+/**
+ * ConciergeStack — a locked-down Environment + Agent pair with the
+ * secure-by-construction defaults for agents that touch anything
+ * sensitive:
+ *
+ *   - `networking_type: limited` with an explicit allowlist (empty =
+ *     deny-all egress — fountain's isolation mode)
+ *   - `allowed_vault_ids: []` — no conversation may override the
+ *     reviewed environment at spawn
+ *   - the `managed-by: chant` marker on both, so owned-only
+ *     reconcile/prune and drift filtering see them
+ *
+ * Loosening any of it is a visible, reviewable act: pass an allowlist,
+ * pass vault ids, or drop to the raw classes.
+ */
+import { Environment, Agent } from "../generated/index.js";
+export interface ConciergeStackOpts {
+    /** Base name; the environment is `<name>-env`, the agent `<name>`. */
+    name: string;
+    /** Canonical provider/model_id. */
+    model: string;
+    /** Agent runtime. Default "claude". */
+    runtime?: "claude" | "codex" | "gemini" | "opencode";
+    /** Egress allowlist. Default [] — deny all egress. */
+    allowedHosts?: string[];
+    /** Vaults that may attach at conversation create. Default [] — none. */
+    allowedVaultIds?: string[];
+    /** Skill installs. Pin github-sourced entries with `ref`. */
+    skills?: Array<Record<string, unknown>>;
+    /** MCP server definitions (use ${VAR} references for secrets). */
+    mcpServers?: Record<string, unknown>;
+    /** System prompt. */
+    system?: string;
+    /** Extra environment fields (packages, env_vars, setup_script, repositories). */
+    environment?: Record<string, unknown>;
+    /** Extra metadata merged over the managed-by marker. */
+    metadata?: Record<string, unknown>;
+}
+export interface ConciergeStackResources {
+    environment: InstanceType<typeof Environment>;
+    agent: InstanceType<typeof Agent>;
+}
+export declare function ConciergeStack(opts: ConciergeStackOpts): ConciergeStackResources;
+//# sourceMappingURL=concierge-stack.d.ts.map

package/dist/composites/concierge-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concierge-stack.d.ts","sourceRoot":"","sources":["../../src/composites/concierge-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;IACrD,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,6DAA6D;IAC7D,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,KAAK,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;CACnC;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,uBAAuB,CAwBhF"}

package/dist/coverage.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Coverage analysis for the fountain lexicon.
+ *
+ * The shared `computeCoverage` measures CloudFormation-shaped dimensions
+ * (lifecycle flags, return attributes, extension constraints) that a
+ * three-kind OpenAPI lexicon has no analog for — it would report 0% on
+ * everything and mean nothing. What fountain actually needs to know is
+ * whether its generated surface still matches upstream, because the spec
+ * is a rolling endpoint with no release tag to pin (see spec/fetch.ts):
+ *
+ *   1. Property coverage — request-schema properties per modeled kind vs
+ *      what the committed surface baseline exposes. A gap means upstream
+ *      added a field and `just generate` has not been rerun.
+ *   2. Kind coverage — which request-shaped schemas are modeled as
+ *      declarables, and which are deliberately not (with the reason), so
+ *      an unmodeled kind is a decision on record rather than an omission.
+ */
+/** Request schemas with no typed resource, and why. */
+export declare const EXCLUDED_KINDS: Record<string, string>;
+export interface KindCoverage {
+    kind: string;
+    specProps: number;
+    modeledProps: number;
+    /** In the upstream request schema, absent from the generated surface. */
+    missing: string[];
+    /** In the generated surface, absent from the upstream request schema. */
+    stale: string[];
+}
+export interface FountainCoverageReport {
+    kinds: KindCoverage[];
+    /** Request schemas modeled as declarables. */
+    modeledKinds: string[];
+    /** Request schemas deliberately not modeled → reason. */
+    excludedKinds: Record<string, string>;
+    /** Request schemas neither modeled nor on the exclusion list. */
+    unaccountedKinds: string[];
+    /** Modeled properties as a percentage of upstream request properties. */
+    overallPct: number;
+}
+interface SurfaceSnapshot {
+    entries: Record<string, {
+        kind: string;
+        props?: string[];
+    }>;
+}
+export declare function computeFountainCoverage(specJSON: string | Buffer, surface: SurfaceSnapshot): FountainCoverageReport;
+export declare function formatSummary(report: FountainCoverageReport): string;
+export declare function formatVerbose(report: FountainCoverageReport): string;
+/** Run coverage analysis for the fountain lexicon. */
+export declare function analyzeFountainCoverage(opts?: {
+    basePath?: string;
+    verbose?: boolean;
+    minOverall?: number;
+}): Promise<FountainCoverageReport>;
+export {};
+//# sourceMappingURL=coverage.d.ts.map

package/dist/coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../src/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,uDAAuD;AACvD,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKjD,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yEAAyE;IACzE,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC7D;AAOD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,MAAM,EACzB,OAAO,EAAE,eAAe,GACvB,sBAAsB,CAiDxB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAGpE;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CA0BpE;AAED,sDAAsD;AACtD,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAsBlC"}

package/dist/describe-resources.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Live introspection of fountain resources — the read-back seam for chant's
+ * plan/drift machinery.
+ *
+ * Drives core's observer harness (`observeEntities`, #1201) rather than
+ * re-deriving its control flow: bind-or-not-observe-all with a typed reason,
+ * per-entity tri-state routing, and a read throw degrading to `read-failed`
+ * rather than a silent absence that would classify as a spurious `create`.
+ * What this lexicon supplies is the adapter — the transport and the per-entity
+ * read.
+ *
+ * The read is a lookup, not a fetch: fountain has no per-resource-by-name
+ * endpoint, so the adapter lists each declared kind once
+ * (GET /api/environments|vaults|agents) and indexes it by name. The list
+ * promise is cached per kind, so concurrent reads share one request and a
+ * failed list marks only that kind's entities read-failed.
+ *
+ * Ownership comes from the `managed-by: chant` metadata marker (fountain#137
+ * gave all three kinds the channel). Endpoint + auth reuse the applier
+ * verbatim (FOUNTAIN_ENDPOINT / FOUNTAIN_TOKEN), so plan reads the same
+ * instance fountainApply writes. Secret *values* never appear anywhere on
+ * this path — the API is write-only for values; the secrets sub-resource is
+ * not read here at all.
+ */
+import type { ObservationResult } from "@intentius/chant/lexicon";
+import { type FountainHttp } from "./op/activities/fountain-apply.js";
+export interface DescribeResourcesOptions {
+    environment: string;
+    buildOutput: string;
+    entityNames: string[];
+    entities: Map<string, {
+        entityType: string;
+        props: Record<string, unknown>;
+    }>;
+    /** Restrict to chant-owned resources. */
+    owned?: boolean;
+    /** Endpoint override (tests). Defaults to resolveEndpoint(). */
+    endpoint?: string;
+}
+/**
+ * `http` is injectable for tests; the default reuses the applier's fetch
+ * client (bearer token from FOUNTAIN_TOKEN).
+ */
+export declare function describeResources(options: DescribeResourcesOptions, http?: FountainHttp): Promise<ObservationResult>;
+//# sourceMappingURL=describe-resources.d.ts.map

package/dist/describe-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,0BAA0B,CAAC;AAOpF,OAAO,EAML,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AAWxC,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,yCAAyC;IACzC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAqHD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAQ5B"}

package/dist/detect.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Detection helpers — is this input a fountain artifact?
+ */
+/** A fountain manifest document (parsed): apiVersion fountain.dev/v1 + known kind. */
+export declare function isFountainManifest(doc: unknown): boolean;
+/** The serializer's fountain-plan.json shape: entity name → { kind, spec }. */
+export declare function isFountainPlan(data: unknown): boolean;
+/** Template detection for the plugin: raw string input (YAML or JSON). */
+export declare function detectFountainTemplate(data: unknown): boolean;
+//# sourceMappingURL=detect.d.ts.map

package/dist/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIxD;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CASrD;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAU7D"}

package/dist/entity-props.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Read an entity's authored props regardless of representation.
+ *
+ * Real runtime instances (createResource/createProperty) keep authored
+ * props under the non-enumerable `.props` — enumerating the instance
+ * yields its AttrRefs, not its inputs. Plain objects (parsed data, test
+ * fixtures) carry props as own fields. Every fountain consumer of entity
+ * props goes through here so both shapes behave identically.
+ */
+export declare function propsOf(entity: unknown): Record<string, unknown>;
+//# sourceMappingURL=entity-props.d.ts.map

package/dist/entity-props.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-props.d.ts","sourceRoot":"","sources":["../src/entity-props.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYhE"}

package/dist/export-resources.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Live export — read fountain resources back as import IR for
+ * `chant import --from`. The adoption path: an org with UI-built
+ * environments/vaults/agents gets typed leaf files.
+ *
+ * Server-written fields are stripped to the authored shape; an agent's
+ * `environment_id` is resolved back to the exported environment's logical
+ * name so the generated code carries a reviewable reference. Secret
+ * *values* never leave fountain (write-only upstream) and secret *keys*
+ * cannot round-trip into typed code yet — the request schema has no
+ * secrets field (they are a sub-resource; fountain#148's reference model
+ * would change this) — so environments export without their secrets and
+ * the caller is warned per environment that carries any.
+ */
+import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
+import { type FountainHttp } from "./op/activities/fountain-apply.js";
+export interface ExportResourcesOptions {
+    environment: string;
+    selector?: ResourceSelector;
+    owned?: boolean;
+    verbatim?: boolean;
+    endpoint?: string;
+    /** Injectable for tests. */
+    http?: FountainHttp;
+    /** Warning sink (defaults to console.error). */
+    warn?: (msg: string) => void;
+}
+export declare function exportResources(options: ExportResourcesOptions): Promise<ExportedTemplate>;
+//# sourceMappingURL=export-resources.d.ts.map

package/dist/export-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-resources.d.ts","sourceRoot":"","sources":["../src/export-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEnF,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AASxC,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,gDAAgD;IAChD,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2DhG"}

package/dist/generated/index.d.ts

@@ -0,0 +1,5 @@
+export declare const Agent: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const Environment: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const Vault: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const Repository: new (props: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, unknown>;
+//# sourceMappingURL=index.d.ts.map

package/dist/generated/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generated/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,KAAK,+IAAuH,CAAC;AAC1I,eAAO,MAAM,WAAW,+IAA6H,CAAC;AACtJ,eAAO,MAAM,KAAK,+IAAuH,CAAC;AAE1I,eAAO,MAAM,UAAU,0GAAyD,CAAC"}

package/dist/generated/runtime.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";
+//# sourceMappingURL=runtime.d.ts.map

package/dist/generated/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/generated/runtime.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/import/generator.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Fountain TypeScript generator.
+ *
+ * Converts import IR from {@link FountainParser} into typed chant
+ * TypeScript: `import { Environment, ... } from
+ * "@intentius/chant-lexicon-fountain";` plus one `export const` per
+ * resource. `repositories` entries are wrapped in `new Repository({...})`
+ * — the one nested property declarable on the fountain surface.
+ */
+import type { TypeScriptGenerator, GeneratedFile } from "@intentius/chant/import/generator";
+import type { TemplateIR } from "@intentius/chant/import/parser";
+export declare class FountainGenerator implements TypeScriptGenerator {
+    generate(ir: TemplateIR): GeneratedFile[];
+}
+//# sourceMappingURL=generator.d.ts.map

package/dist/import/generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/import/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAUjE,qBAAa,iBAAkB,YAAW,mBAAmB;IAC3D,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,aAAa,EAAE;CAuB1C"}

package/dist/import/parser.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Fountain template parser.
+ *
+ * Turns fountain manifests (the `fountain apply -f` YAML, single or
+ * multi-document) or the serializer's fountain-plan.json into the import IR
+ * for conversion to chant TypeScript. Server-written read-only fields are
+ * dropped so the IR is the declared shape. `logicalId` is `metadata.name`
+ * (manifests) or the plan's entity name.
+ */
+import type { TemplateParser, TemplateIR } from "@intentius/chant/import/parser";
+import { BaseValueParser } from "@intentius/chant/import/base-parser";
+/** Server-written read-only fields — never part of the authored shape. */
+export declare const SERVER_FIELDS: string[];
+export declare class FountainParser extends BaseValueParser implements TemplateParser {
+    protected dispatchIntrinsic(): unknown | null;
+    parse(input: string): TemplateIR;
+    private resource;
+}
+//# sourceMappingURL=parser.d.ts.map

package/dist/import/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAc,MAAM,gCAAgC,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAItE,0EAA0E;AAC1E,eAAO,MAAM,aAAa,UAA4F,CAAC;AAYvH,qBAAa,cAAe,SAAQ,eAAgB,YAAW,cAAc;IAC3E,SAAS,CAAC,iBAAiB,IAAI,OAAO,GAAG,IAAI;IAM7C,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAsChC,OAAO,CAAC,QAAQ;CASjB"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { fountainPlugin } from "./plugin.js";
+export { fountainSerializer } from "./serializer.js";
+export * from "./generated/index.js";
+export { fountainApply, fountainRun, DEFAULT_FOUNTAIN_BASE_URL } from "./op/activities/index.js";
+export type { FountainApplyArgs, FountainApplySummary, FountainRunArgs, FountainRunResult } from "./op/activities/index.js";
+export { ConciergeStack } from "./composites/concierge-stack.js";
+export type { ConciergeStackOpts, ConciergeStackResources } from "./composites/concierge-stack.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGlD,cAAc,mBAAmB,CAAC;AAIlC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACxF,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGnH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/init-templates.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `chant init` scaffolding for fountain projects.
+ *
+ * Two templates. The default is the concierge posture — a locked sandbox
+ * declared through `ConciergeStack`, since an agent environment that reaches
+ * anything real should start closed and be opened by explicit parameter. The
+ * `open` template is the loose counterpart for a research sandbox that touches
+ * nothing sensitive, and says so in a comment rather than leaving a reader to
+ * infer that the difference was deliberate.
+ */
+import type { InitTemplateSet } from "@intentius/chant/lexicon";
+export declare function fountainInitTemplates(template?: string): InitTemplateSet;
+//# sourceMappingURL=init-templates.d.ts.map

package/dist/init-templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-templates.d.ts","sourceRoot":"","sources":["../src/init-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AA2ChE,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAKxE"}

package/dist/integrity.json

@@ -0,0 +1,21 @@
+{
+  "algorithm": "sha256",
+  "artifacts": {
+    "manifest.json": "757017e21fc2f8173e8da69305a7f4311ccd8830785f9e86c552e9991a5a804e",
+    "meta.json": "6666b7a77db9210a329219c6a5e107e5ae8794a34542f7310ce16d9bf95c64f5",
+    "types/index.d.ts": "1dfdcba184fffcf464dac7d1d71ef7abed2ae02a8d638c0de50e0b0317b7eb01",
+    "rules/ftn001-no-secret-literals.ts": "897a4ce1ec790b3c1540d32892603bd33ff4bf30eb6ba4cd2565dee356d4962e",
+    "rules/ftn010-networking-explicit.ts": "29d62025b456b207758a32d463b686e1acc5f1d39e36a6e8999946df26bbe1fc",
+    "rules/ftn011-no-unrestricted-networking.ts": "2bf44295dfa5825a7863e49514f75ea9a74fe2658869d908a50de3a287a398a8",
+    "rules/ftn012-no-cloud-credential-env.ts": "7eda629bd48b650d711205ebd75a70b358646e7168aac944771db4e40808ba60",
+    "rules/ftn013-substitution-resolvable.ts": "1425ca7de9494725ad4ec0bcb22abc30cff718d3fc3816fb86322897ebcaf451",
+    "rules/ftn014-vault-shadowing.ts": "e966a441c52f57fee059e3e4834da2c5f9d12c71e551924beebd7d0740f714e1",
+    "rules/ftn015-mcp-secret-env-substitution.ts": "88dc87c8f403a2fe48ee43bc4a4678d95273dba810135c8e74750f1bd62d2564",
+    "rules/ftn016-runtime-model-valid.ts": "b4aa86267a411678fe6a8ae3556fd9b34cf1c15aaecfe99790216d529a494f44",
+    "rules/ftn017-unique-resource-names.ts": "866f3f385083f96b6e8a18fa6f5624bab43752c5d22e7291e95835e62745d26c",
+    "skills/chant-fountain.md": "71c077dbeb40a95cb3a341d99a54eaefc321e07ba789c8b92574f385f9983f3f",
+    "skills/chant-fountain-secrets.md": "6b968e76ed135adde9e5970495beb752e4d9bcf7b02a2a9501fc18b58676d01e",
+    "skills/chant-fountain-locked-sandboxes.md": "de82f06cb3a08ba6bf3ae45fb9869e21d6da18b9ebe0fc769da8aebaceea7dd1"
+  },
+  "composite": "4e29aaf0b03c36a53922b819db6851256b3e5b15f1daa9016d14b96874285ccc"
+}

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The fountain lexicon's chant audit catalog — metadata for the FTN rules,
+ * contributed via `fountainPlugin.auditCatalog()` (#687).
+ *
+ * Every entry carries `yamlBased: false`, which is not an oversight: all of
+ * fountain's checks read the chant model (`ctx.entities`), not the emitted
+ * manifests (`ctx.outputs`), because the facts they need — which Environment
+ * an Agent references, which keys a Vault shadows — live in the typed graph
+ * and are flattened by the time YAML exists. So they fire on `chant build`
+ * and cannot fire on an audit of standalone fountain YAML. `auditRule()`
+ * hardcodes `yamlBased: true`, so these are constructed directly.
+ */
+import type { RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const fountainAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAwB1E,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAqEzD,CAAC"}

package/dist/lint/post-synth/ftn010-networking-explicit.d.ts

@@ -0,0 +1,11 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * FTN010: Environments must state their networking intent.
+ *
+ * Fountain defaults `networking_type` to `unrestricted` when omitted —
+ * an open-network sandbox by silence. Every declared Environment must set
+ * `networking_type` explicitly so the security posture is a reviewed,
+ * diffable decision.
+ */
+export declare const networkingExplicitCheck: PostSynthCheck;
+//# sourceMappingURL=ftn010-networking-explicit.d.ts.map

package/dist/lint/post-synth/ftn010-networking-explicit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ftn010-networking-explicit.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/ftn010-networking-explicit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAyBrC,CAAC"}

package/dist/lint/post-synth/ftn011-no-unrestricted-networking.d.ts

@@ -0,0 +1,11 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * FTN011: `unrestricted` networking is a warning by default.
+ *
+ * Fountain sandboxes run untrusted agent code; an open-network sandbox is
+ * a real posture some workloads need, but it should read as a deliberate
+ * exception in review. Projects hosting untrusted-agent environments
+ * (concierge-class) should promote this to error via project rules.
+ */
+export declare const noUnrestrictedNetworkingCheck: PostSynthCheck;
+//# sourceMappingURL=ftn011-no-unrestricted-networking.d.ts.map

package/dist/lint/post-synth/ftn011-no-unrestricted-networking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ftn011-no-unrestricted-networking.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/ftn011-no-unrestricted-networking.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,EAAE,cAwB3C,CAAC"}

package/dist/lint/post-synth/ftn012-no-cloud-credential-env.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const noCloudCredentialEnvCheck: PostSynthCheck;
+//# sourceMappingURL=ftn012-no-cloud-credential-env.d.ts.map