@intentius/chant-lexicon-helm 0.53.1 → 0.54.1

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "816f563c3e8797335edeee248215b216c57f786d8f80780d4997839ab259bbb3",
+    "manifest.json": "2dafdf3357b31ae4e71eb1a9d231ab393023c53d6a8c418b6eb2d4f4653e44c9",
     "meta.json": "14243c5730a07c6a6edc35ddd351438547d58df5cf345f2233a355b0c7611ccc",
     "types/index.d.ts": "5377696ca8698cd2999e4680feb8e8e4b54a7b49fb603a87b2f27356114d1794",
     "rules/chart-metadata.ts": "8f3377e893d5e2828460b7fe5924fca098334245a9a2fdb90f6b67e490eaf091",
@@ -30,11 +30,11 @@
     "rules/whm407.ts": "200190f5de2d86d2bcc5aee0b5ce4807919ec727b1fc14576ea17b9b3073838b",
     "rules/whm501.ts": "e6afa7c0eface9820380bf189fe8be58f4a6997dd5b74f76335022650616d080",
     "rules/whm502.ts": "c3ed7b4b5215d96e46eba758aca2171928d8f8fb1eb20452ea6b4393672755b0",
-    "rules/whm503.ts": "72808bba7c66ef71757a2dc73c9c3afff5980fd729bbdd5ba00af9c0c2213304",
+    "rules/whm503.ts": "84c2c4d3e261d12a1dbeee974af02d512ccdc5c0495119c0d6f997619db019dd",
     "rules/whm504.ts": "15c03b47c271270eee93de45310ff6dfc2665dfe221d457665a638cfd9637005",
     "skills/chant-helm.md": "828a169f9275c58df0a079287befb14c450ad8a92257e3cb6960450221941973",
     "skills/chant-helm-patterns.md": "9e79e6a46391da46709d8aa57e2825a7cd9eb981cd923f02ad60836c49b2561e",
     "skills/chant-helm-security.md": "bfc367eabceed2e84f1cf94501b407df78aeed963cec104f24a321d0962063c9"
   },
-  "composite": "ed37bd53ac897b52e32634e217895250b330336de9b4bf1834a90fa6043680fe"
+  "composite": "35076abd609245fabdb6d5e6067e82654eba0b56b705c5b0c0eb96de8d9c403f"
 }

package/dist/lint/post-synth/whm503.d.ts

@@ -19,7 +19,7 @@
  * non-empty.
  */
 import type { PostSynthCheck, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import type { HelmRenderRecord } from "../../render.js";
+import type { HelmRenderRecord } from "../../render-records.js";
 /**
  * Scan a set of `HelmRenderRecord`s for pinned renders whose stored artifact
  * carries a `Secret` document with populated `data`/`stringData`. Exported

package/dist/lint/post-synth/whm503.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"whm503.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/whm503.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAoB,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAcrD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB,mBAAmB,EAAE,CAwCvB;AAED,eAAO,MAAM,MAAM,EAAE,cAUpB,CAAC"}
+{"version":3,"file":"whm503.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/whm503.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAoB,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAM9G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAc7D;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB,mBAAmB,EAAE,CAwCvB;AAED,eAAO,MAAM,MAAM,EAAE,cAUpB,CAAC"}

package/dist/list-artifacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-artifacts.d.ts","sourceRoot":"","sources":["../src/list-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAwBjE,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAoD5C"}
+{"version":3,"file":"list-artifacts.d.ts","sourceRoot":"","sources":["../src/list-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA4DjE,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CA0E5C"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "helm",
-  "version": "0.53.1",
+  "version": "0.54.1",
   "chantVersion": ">=0.1.0",
   "namespace": "Helm",
   "intrinsics": [

package/dist/render-records.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The in-process ledger of `HelmRender` invocations — split out of
+ * `./render.ts` so a post-synth check can read it without importing the
+ * render machinery (#1979 follow-up, found by the hosted audit's bump).
+ *
+ * WHM503 (`./lint/post-synth/whm503.ts`) scans these records, and post-synth
+ * barrels are edge-imported by the hosted audit service: everything they
+ * reach through static imports must be safe to initialize on workerd.
+ * `render.ts` is not — it imports the full `@intentius/chant` barrel, whose
+ * static graph reaches the TypeScript compiler (fold-import), and
+ * TypeScript's own module init touches `__filename`, which crashes the
+ * worker at startup. This module carries only the record shape and the
+ * ledger, imports nothing but a type, and keeps the barrel edge-clean;
+ * `render.ts` re-exports it all, so the lexicon's public surface is
+ * unchanged.
+ */
+import type { HelmCapabilityProfile } from "./config.js";
+/**
+ * What one `HelmRender` invocation recorded about itself. `capabilityProfile`
+ * is the profile identity the render was pinned against; `undefined` means
+ * the render was unpinned and its bytes depend on the local helm binary's
+ * defaults.
+ *
+ * Pinned renders (profile present — the v1 gate, see #1237) also carry the
+ * digest pair:
+ *
+ * - `inputDigest` — `sha256:` over the canonical JSON of the declared inputs
+ *   (chart reference, version, values, capability facts). Shared with the
+ *   release-ledger digest #1243 records on deploy, via `helmInputDigest`.
+ *   Answers "same inputs?" without touching any bytes.
+ * - `contentDigest` — `sha256:` over the canonical rendered bytes
+ *   (`canonicalizeRender`). The artifact identity: answers "same bytes on
+ *   the cluster?".
+ *
+ * They diverge exactly when the render is not a function of its declared
+ * inputs — `renderStability` in ./render-digest.ts names that.
+ *
+ * Unpinned renders record neither digest. Their bytes are a function of the
+ * local helm binary's defaulted capabilities, so a digest over them would
+ * assert an identity the render does not have — it would differ across
+ * machines that did nothing differently, and equal digests would still
+ * prove nothing about a cluster. No digest is the honest record.
+ */
+export interface HelmRenderRecord {
+    /** The render's logical name (`HelmRenderProps.name`) — also the helm release name baked into the bytes. */
+    name: string;
+    chart: string;
+    version?: string;
+    capabilityProfile?: HelmCapabilityProfile;
+    /** Input-side identity (#1237/#1243). Present only for pinned renders. */
+    inputDigest?: string;
+    /** Content-side identity over canonical rendered bytes (#1237). Present only for pinned renders. */
+    contentDigest?: string;
+    /**
+     * The build-time coalesced-values probe's digest (#1251), present only
+     * when the probe ran — a pinned render of a local chart (the probe needs
+     * the chart source on disk, so a repo-fetched chart never gets one).
+     */
+    coalescedValuesDigest?: string;
+}
+/** Append one invocation's record (called by `HelmRender`, ./render.ts). */
+export declare function recordHelmRender(record: HelmRenderRecord): void;
+/** Every render recorded in this process, in invocation order. */
+export declare function getHelmRenderRecords(): readonly HelmRenderRecord[];
+/** Reset the record list (test isolation). */
+export declare function clearHelmRenderRecords(): void;
+//# sourceMappingURL=render-records.d.ts.map

package/dist/render-records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-records.d.ts","sourceRoot":"","sources":["../src/render-records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4GAA4G;IAC5G,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IAC1C,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAID,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAE/D;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,IAAI,SAAS,gBAAgB,EAAE,CAElE;AAED,8CAA8C;AAC9C,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}

package/dist/render.d.ts

@@ -30,7 +30,7 @@
  *   values: { installCRDs: true },
  * });
  */
-import { type HelmCapabilityProfile, type HelmCapabilityProfileRef } from "./config.js";
+import { type HelmCapabilityProfileRef } from "./config.js";
 export interface HelmRenderProps {
     /** Logical name for the render (used in cache key + composite name). */
     name: string;
@@ -85,52 +85,6 @@ export interface HelmRenderProps {
      */
     sourceRef?: string;
 }
-/**
- * What one `HelmRender` invocation recorded about itself. `capabilityProfile`
- * is the profile identity the render was pinned against; `undefined` means
- * the render was unpinned and its bytes depend on the local helm binary's
- * defaults.
- *
- * Pinned renders (profile present — the v1 gate, see #1237) also carry the
- * digest pair:
- *
- * - `inputDigest` — `sha256:` over the canonical JSON of the declared inputs
- *   (chart reference, version, values, capability facts). Shared with the
- *   release-ledger digest #1243 records on deploy, via `helmInputDigest`.
- *   Answers "same inputs?" without touching any bytes.
- * - `contentDigest` — `sha256:` over the canonical rendered bytes
- *   (`canonicalizeRender`). The artifact identity: answers "same bytes on
- *   the cluster?".
- *
- * They diverge exactly when the render is not a function of its declared
- * inputs — `renderStability` in ./render-digest.ts names that.
- *
- * Unpinned renders record neither digest. Their bytes are a function of the
- * local helm binary's defaulted capabilities, so a digest over them would
- * assert an identity the render does not have — it would differ across
- * machines that did nothing differently, and equal digests would still
- * prove nothing about a cluster. No digest is the honest record.
- */
-export interface HelmRenderRecord {
-    /** The render's logical name (`HelmRenderProps.name`) — also the helm release name baked into the bytes. */
-    name: string;
-    chart: string;
-    version?: string;
-    capabilityProfile?: HelmCapabilityProfile;
-    /** Input-side identity (#1237/#1243). Present only for pinned renders. */
-    inputDigest?: string;
-    /** Content-side identity over canonical rendered bytes (#1237). Present only for pinned renders. */
-    contentDigest?: string;
-    /**
-     * The build-time coalesced-values probe's digest (#1251), present only
-     * when the probe ran — a pinned render of a local chart (the probe needs
-     * the chart source on disk, so a repo-fetched chart never gets one).
-     */
-    coalescedValuesDigest?: string;
-}
-/** Every render recorded in this process, in invocation order. */
-export declare function getHelmRenderRecords(): readonly HelmRenderRecord[];
-/** Reset the record list (test isolation). */
-export declare function clearHelmRenderRecords(): void;
+export { getHelmRenderRecords, clearHelmRenderRecords, type HelmRenderRecord } from "./render-records.js";
 export declare const HelmRender: import("@intentius/chant").CompositeDefinition<HelmRenderProps, import("@intentius/chant").CompositeMembers>;
 //# sourceMappingURL=render.d.ts.map

package/dist/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAeH,OAAO,EAA4B,KAAK,qBAAqB,EAAE,KAAK,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAU/G,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4GAA4G;IAC5G,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IAC1C,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAID,kEAAkE;AAClE,wBAAgB,oBAAoB,IAAI,SAAS,gBAAgB,EAAE,CAElE;AAED,8CAA8C;AAC9C,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAmRD,eAAO,MAAM,UAAU,8GAsFP,CAAC"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAeH,OAAO,EAAwD,KAAK,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAY/G,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA8RvG,eAAO,MAAM,UAAU,8GAsFP,CAAC"}

package/dist/rules/whm503.ts

@@ -22,8 +22,11 @@
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import yaml from "js-yaml";
 
-import type { HelmRenderRecord } from "../../render";
-import { getHelmRenderRecords } from "../../render";
+// From ./render-records, NOT ./render: this barrel is edge-imported by the
+// hosted audit, and render.ts's static graph reaches the TypeScript compiler
+// through the @intentius/chant barrel — whose module init crashes workerd.
+import type { HelmRenderRecord } from "../../render-records";
+import { getHelmRenderRecords } from "../../render-records";
 import { loadRenderManifest, readRenderDocument } from "../../render-store";
 
 interface ParsedSecretDoc {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-helm",
-  "version": "0.53.1",
+  "version": "0.54.1",
   "description": "Helm chart lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -86,7 +86,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.53.1",
+    "@intentius/chant": "^0.54.1",
     "typescript": "^5.9.3",
     "zod": "^4.3.6"
   }

package/src/lint/post-synth/whm503.ts

@@ -22,8 +22,11 @@
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import yaml from "js-yaml";
 
-import type { HelmRenderRecord } from "../../render";
-import { getHelmRenderRecords } from "../../render";
+// From ./render-records, NOT ./render: this barrel is edge-imported by the
+// hosted audit, and render.ts's static graph reaches the TypeScript compiler
+// through the @intentius/chant barrel — whose module init crashes workerd.
+import type { HelmRenderRecord } from "../../render-records";
+import { getHelmRenderRecords } from "../../render-records";
 import { loadRenderManifest, readRenderDocument } from "../../render-store";
 
 interface ParsedSecretDoc {

package/src/list-artifacts.test.ts

@@ -11,11 +11,37 @@ vi.mock("node:child_process", async () => {
   } };
 });
 
+const ledgerMock = vi.fn();
+vi.mock("@intentius/chant/lifecycle/release-ledger", async () => {
+  const actual = await vi.importActual<typeof import("@intentius/chant/lifecycle/release-ledger")>(
+    "@intentius/chant/lifecycle/release-ledger",
+  );
+  return { ...actual, readReleaseLedger: (env: string) => ledgerMock(env) };
+});
+
 const { listArtifacts } = await import("./list-artifacts");
 
+/** One ledger line as the helm deploy activity records it (#1243). */
+function ledgerRecord(overrides: Record<string, unknown>): Record<string, unknown> {
+  return {
+    version: 1,
+    component: "web",
+    env: "prod",
+    digest: "sha256:input-digest",
+    gitSha: "deadbeef",
+    runId: "run-1",
+    timestamp: "2026-08-30T00:00:00.000Z",
+    actor: "ci-bot",
+    ...overrides,
+  };
+}
+
 describe("helm listArtifacts", () => {
   beforeEach(() => {
     execMock.mockReset();
+    ledgerMock.mockReset();
+    // Default: no ledger readable — the join contributes nothing.
+    ledgerMock.mockRejectedValue(new Error("no lifecycle branch"));
   });
 
   test("queries `helm list -A -o json` and maps releases to artifacts", async () => {
@@ -91,4 +117,79 @@ describe("helm listArtifacts", () => {
     const result = await listArtifacts({ environment: "prod", entities: new Map() });
     expect(result).toEqual({});
   });
+
+  describe("render identity read back from the release ledger (#2031)", () => {
+    const webRelease = { name: "web", namespace: "default", revision: "1", status: "deployed", chart: "web-1.0.0", app_version: "1.0" };
+
+    test("an unpinned chant deploy reports its inputDigest", async () => {
+      execMock.mockResolvedValue({ stdout: JSON.stringify([webRelease]), stderr: "" });
+      ledgerMock.mockResolvedValue({ records: [ledgerRecord({})], malformed: 0 });
+
+      const result = await listArtifacts({ environment: "prod", entities: new Map() });
+      expect(ledgerMock).toHaveBeenCalledWith("prod");
+      expect(result["release/default/web"].attributes).toMatchObject({ inputDigest: "sha256:input-digest" });
+      expect(result["release/default/web"].attributes!.contentDigest).toBeUndefined();
+    });
+
+    test("a pinned deploy reports contentDigest and inputDigest — joinable to `helm renders`", async () => {
+      execMock.mockResolvedValue({ stdout: JSON.stringify([webRelease]), stderr: "" });
+      ledgerMock.mockResolvedValue({
+        records: [ledgerRecord({ digest: "sha256:content-digest", inputDigest: "sha256:input-digest" })],
+        malformed: 0,
+      });
+
+      const result = await listArtifacts({ environment: "prod", entities: new Map() });
+      expect(result["release/default/web"].attributes).toMatchObject({
+        inputDigest: "sha256:input-digest",
+        contentDigest: "sha256:content-digest",
+      });
+    });
+
+    test("the latest record per component wins", async () => {
+      execMock.mockResolvedValue({ stdout: JSON.stringify([webRelease]), stderr: "" });
+      ledgerMock.mockResolvedValue({
+        records: [
+          ledgerRecord({ digest: "sha256:older", timestamp: "2026-08-01T00:00:00.000Z" }),
+          ledgerRecord({ digest: "sha256:newer", timestamp: "2026-08-30T00:00:00.000Z" }),
+        ],
+        malformed: 0,
+      });
+      const result = await listArtifacts({ environment: "prod", entities: new Map() });
+      expect(result["release/default/web"].attributes!.inputDigest).toBe("sha256:newer");
+    });
+
+    test("a release deployed outside chant reports nothing — absent is the honest answer", async () => {
+      execMock.mockResolvedValue({
+        stdout: JSON.stringify([webRelease, { ...webRelease, name: "manual", chart: "manual-0.1.0" }]),
+        stderr: "",
+      });
+      ledgerMock.mockResolvedValue({ records: [ledgerRecord({})], malformed: 0 });
+
+      const result = await listArtifacts({ environment: "prod", entities: new Map() });
+      expect(result["release/default/web"].attributes!.inputDigest).toBe("sha256:input-digest");
+      expect(result["release/default/manual"].attributes!.inputDigest).toBeUndefined();
+      expect(result["release/default/manual"].attributes!.contentDigest).toBeUndefined();
+    });
+
+    test("one name in several namespaces is ambiguous against a namespace-less record — neither joins", async () => {
+      execMock.mockResolvedValue({
+        stdout: JSON.stringify([webRelease, { ...webRelease, namespace: "staging-ns" }]),
+        stderr: "",
+      });
+      ledgerMock.mockResolvedValue({ records: [ledgerRecord({})], malformed: 0 });
+
+      const result = await listArtifacts({ environment: "prod", entities: new Map() });
+      expect(result["release/default/web"].attributes!.inputDigest).toBeUndefined();
+      expect(result["release/staging-ns/web"].attributes!.inputDigest).toBeUndefined();
+    });
+
+    test("an unreadable ledger joins nothing rather than failing the snapshot", async () => {
+      execMock.mockResolvedValue({ stdout: JSON.stringify([webRelease]), stderr: "" });
+      ledgerMock.mockRejectedValue(new Error("not a git repository"));
+
+      const result = await listArtifacts({ environment: "prod", entities: new Map() });
+      expect(result["release/default/web"]).toBeDefined();
+      expect(result["release/default/web"].attributes!.inputDigest).toBeUndefined();
+    });
+  });
 });

package/src/list-artifacts.ts

@@ -17,9 +17,45 @@ import { promisify } from "node:util";
 import type { ArtifactMetadata } from "@intentius/chant/lexicon";
 import { loadChantConfigUpward } from "@intentius/chant/config";
 import { resolveClusterTarget } from "@intentius/chant/kubectl-context";
+import { readReleaseLedger, latestPerComponent, type ReleaseRecord } from "@intentius/chant/lifecycle/release-ledger";
 
 const execAsync = promisify(exec);
 
+/**
+ * The render identity a chant deploy recorded for a release (#2031). `helm
+ * list` cannot know which bytes a release was installed from — but the
+ * release ledger already records it on deploy (#1243): the input digest for
+ * an unpinned deploy, contentDigest + inputDigest for a pinned one. This
+ * reads that record back, so an observed release joins `helm renders` /
+ * `helm diff` by digest instead of by chart-name prefix matching.
+ *
+ * The join key is the ledger record's `component`, which the helm deploy
+ * activity defaults to the release name (`args.component ?? args.name`,
+ * ./op/activities/helm.ts). Deliberately best-effort and honest about
+ * absence:
+ *
+ *  - a release deployed outside chant has no record, and reports nothing;
+ *  - a ledger that cannot be read (no repo, no lifecycle branch) joins
+ *    nothing rather than failing the snapshot;
+ *  - two observed releases sharing one name (different namespaces) are
+ *    ambiguous — the record does not carry a namespace — so neither joins;
+ *  - a record whose `component` was overridden away from the release name
+ *    does not join (the honest miss, same as today).
+ */
+function renderIdentityOf(
+  record: ReleaseRecord | undefined,
+): { inputDigest?: string; contentDigest?: string } {
+  if (!record) return {};
+  if (record.inputDigest) {
+    // Pinned deploy (#1242): `digest` is the render's contentDigest, the
+    // input identity rides alongside.
+    return { inputDigest: record.inputDigest, contentDigest: record.digest };
+  }
+  // Unpinned deploy: the record is keyed by the input digest itself
+  // (`ReleaseRecord.inputDigest` is "absent when digest is already input-side").
+  return { inputDigest: record.digest };
+}
+
 interface HelmListEntry {
   name?: string;
   namespace?: string;
@@ -75,9 +111,29 @@ export async function listArtifacts(options: {
     return result;
   }
 
+  // The environment's latest release record per component (#2031) — the
+  // deploy-side identity read back. Best-effort: an unreadable ledger joins
+  // nothing rather than blocking the snapshot.
+  let recorded: Map<string, ReleaseRecord> = new Map();
+  try {
+    const { records } = await readReleaseLedger(options.environment);
+    recorded = latestPerComponent(records);
+  } catch {
+    recorded = new Map();
+  }
+
+  // A name observed in several namespaces is ambiguous against a record that
+  // carries no namespace — neither joins.
+  const nameCounts = new Map<string, number>();
+  for (const entry of entries) {
+    if (entry.name) nameCounts.set(entry.name, (nameCounts.get(entry.name) ?? 0) + 1);
+  }
+
   for (const entry of entries) {
     if (!entry.name || !entry.namespace) continue;
     const key = `release/${entry.namespace}/${entry.name}`;
+    const record = nameCounts.get(entry.name) === 1 ? recorded.get(entry.name) : undefined;
+    const { inputDigest, contentDigest } = renderIdentityOf(record);
     result[key] = {
       type: "Helm::Release",
       physicalId: `${entry.namespace}/${entry.name}`,
@@ -88,6 +144,8 @@ export async function listArtifacts(options: {
         revision: entry.revision,
         appVersion: entry.app_version,
         namespace: entry.namespace,
+        inputDigest,
+        contentDigest,
       }),
     };
   }

package/src/render-records.ts

@@ -0,0 +1,79 @@
+/**
+ * The in-process ledger of `HelmRender` invocations — split out of
+ * `./render.ts` so a post-synth check can read it without importing the
+ * render machinery (#1979 follow-up, found by the hosted audit's bump).
+ *
+ * WHM503 (`./lint/post-synth/whm503.ts`) scans these records, and post-synth
+ * barrels are edge-imported by the hosted audit service: everything they
+ * reach through static imports must be safe to initialize on workerd.
+ * `render.ts` is not — it imports the full `@intentius/chant` barrel, whose
+ * static graph reaches the TypeScript compiler (fold-import), and
+ * TypeScript's own module init touches `__filename`, which crashes the
+ * worker at startup. This module carries only the record shape and the
+ * ledger, imports nothing but a type, and keeps the barrel edge-clean;
+ * `render.ts` re-exports it all, so the lexicon's public surface is
+ * unchanged.
+ */
+
+import type { HelmCapabilityProfile } from "./config";
+
+/**
+ * What one `HelmRender` invocation recorded about itself. `capabilityProfile`
+ * is the profile identity the render was pinned against; `undefined` means
+ * the render was unpinned and its bytes depend on the local helm binary's
+ * defaults.
+ *
+ * Pinned renders (profile present — the v1 gate, see #1237) also carry the
+ * digest pair:
+ *
+ * - `inputDigest` — `sha256:` over the canonical JSON of the declared inputs
+ *   (chart reference, version, values, capability facts). Shared with the
+ *   release-ledger digest #1243 records on deploy, via `helmInputDigest`.
+ *   Answers "same inputs?" without touching any bytes.
+ * - `contentDigest` — `sha256:` over the canonical rendered bytes
+ *   (`canonicalizeRender`). The artifact identity: answers "same bytes on
+ *   the cluster?".
+ *
+ * They diverge exactly when the render is not a function of its declared
+ * inputs — `renderStability` in ./render-digest.ts names that.
+ *
+ * Unpinned renders record neither digest. Their bytes are a function of the
+ * local helm binary's defaulted capabilities, so a digest over them would
+ * assert an identity the render does not have — it would differ across
+ * machines that did nothing differently, and equal digests would still
+ * prove nothing about a cluster. No digest is the honest record.
+ */
+export interface HelmRenderRecord {
+  /** The render's logical name (`HelmRenderProps.name`) — also the helm release name baked into the bytes. */
+  name: string;
+  chart: string;
+  version?: string;
+  capabilityProfile?: HelmCapabilityProfile;
+  /** Input-side identity (#1237/#1243). Present only for pinned renders. */
+  inputDigest?: string;
+  /** Content-side identity over canonical rendered bytes (#1237). Present only for pinned renders. */
+  contentDigest?: string;
+  /**
+   * The build-time coalesced-values probe's digest (#1251), present only
+   * when the probe ran — a pinned render of a local chart (the probe needs
+   * the chart source on disk, so a repo-fetched chart never gets one).
+   */
+  coalescedValuesDigest?: string;
+}
+
+const renderRecords: HelmRenderRecord[] = [];
+
+/** Append one invocation's record (called by `HelmRender`, ./render.ts). */
+export function recordHelmRender(record: HelmRenderRecord): void {
+  renderRecords.push(record);
+}
+
+/** Every render recorded in this process, in invocation order. */
+export function getHelmRenderRecords(): readonly HelmRenderRecord[] {
+  return renderRecords;
+}
+
+/** Reset the record list (test isolation). */
+export function clearHelmRenderRecords(): void {
+  renderRecords.length = 0;
+}

package/src/render.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect, beforeAll, beforeEach, afterEach } from "vitest";
-import { mkdirSync, writeFileSync, rmSync, existsSync, readFileSync, mkdtempSync } from "node:fs";
+import { mkdirSync, writeFileSync, rmSync, existsSync, readFileSync, readdirSync, mkdtempSync } from "node:fs";
 import { delimiter, join } from "node:path";
 import { execFileSync } from "node:child_process";
 import { tmpdir } from "node:os";
@@ -237,6 +237,39 @@ describe.skipIf(!fixtureAvailable)("HelmRender", () => {
     expect(dep.props.spec.replicas).toBe(3);
   });
 
+  test("CHANT_HELM_RENDER_ROOT redirects the unpinned cache — the air-gapped handoff (#2035)", () => {
+    // Before #2035 the unprofiled path hardcoded ~/.chant/helm-renders and
+    // honoured no environment variable, so a hermetic build had no way to be
+    // handed a pre-rendered chart short of pre-warming $HOME.
+    const root = mkdtempSync(join(tmpdir(), "chant-helm-render-root-"));
+    const origRoot = process.env.CHANT_HELM_RENDER_ROOT;
+    process.env.CHANT_HELM_RENDER_ROOT = root;
+    try {
+      const first = HelmRender({ name: "rel-rooted", chart: CHART_DIR });
+      expect(Object.keys(first.members as Record<string, unknown>).length).toBeGreaterThanOrEqual(2);
+      // The cache landed under the override, not under $HOME.
+      const cached = readdirSync(root).filter((d) => !d.startsWith("_"));
+      expect(cached.length).toBe(1);
+      expect(existsSync(join(root, cached[0], "manifests.yaml"))).toBe(true);
+
+      // A machine with no helm at all renders from the handed-over store.
+      const emptyDir = join(tmpdir(), "chant-helm-render-empty-path");
+      if (!existsSync(emptyDir)) mkdirSync(emptyDir);
+      const origPath = process.env.PATH;
+      process.env.PATH = emptyDir;
+      try {
+        const second = HelmRender({ name: "rel-rooted", chart: CHART_DIR });
+        expect(Object.keys(second.members as Record<string, unknown>).length).toBeGreaterThanOrEqual(2);
+      } finally {
+        process.env.PATH = origPath;
+      }
+    } finally {
+      if (origRoot === undefined) delete process.env.CHANT_HELM_RENDER_ROOT;
+      else process.env.CHANT_HELM_RENDER_ROOT = origRoot;
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
   test("cache reuse: second render with same args skips helm CLI", () => {
     // First, render with cache enabled.
     const first = HelmRender({

package/src/render.ts

@@ -34,7 +34,7 @@
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { Composite } from "@intentius/chant";
@@ -51,8 +51,10 @@ import {
   loadRenderContent,
   persistHelmRender,
   renderCacheKey,
+  renderStoreRoot,
 } from "./render-store";
 import { probeCoalescedValues, type CoalescedValuesProbe } from "./values-probe";
+import { recordHelmRender } from "./render-records";
 
 export interface HelmRenderProps {
   /** Logical name for the render (used in cache key + composite name). */
@@ -109,61 +111,11 @@ export interface HelmRenderProps {
   sourceRef?: string;
 }
 
-/**
- * What one `HelmRender` invocation recorded about itself. `capabilityProfile`
- * is the profile identity the render was pinned against; `undefined` means
- * the render was unpinned and its bytes depend on the local helm binary's
- * defaults.
- *
- * Pinned renders (profile present — the v1 gate, see #1237) also carry the
- * digest pair:
- *
- * - `inputDigest` — `sha256:` over the canonical JSON of the declared inputs
- *   (chart reference, version, values, capability facts). Shared with the
- *   release-ledger digest #1243 records on deploy, via `helmInputDigest`.
- *   Answers "same inputs?" without touching any bytes.
- * - `contentDigest` — `sha256:` over the canonical rendered bytes
- *   (`canonicalizeRender`). The artifact identity: answers "same bytes on
- *   the cluster?".
- *
- * They diverge exactly when the render is not a function of its declared
- * inputs — `renderStability` in ./render-digest.ts names that.
- *
- * Unpinned renders record neither digest. Their bytes are a function of the
- * local helm binary's defaulted capabilities, so a digest over them would
- * assert an identity the render does not have — it would differ across
- * machines that did nothing differently, and equal digests would still
- * prove nothing about a cluster. No digest is the honest record.
- */
-export interface HelmRenderRecord {
-  /** The render's logical name (`HelmRenderProps.name`) — also the helm release name baked into the bytes. */
-  name: string;
-  chart: string;
-  version?: string;
-  capabilityProfile?: HelmCapabilityProfile;
-  /** Input-side identity (#1237/#1243). Present only for pinned renders. */
-  inputDigest?: string;
-  /** Content-side identity over canonical rendered bytes (#1237). Present only for pinned renders. */
-  contentDigest?: string;
-  /**
-   * The build-time coalesced-values probe's digest (#1251), present only
-   * when the probe ran — a pinned render of a local chart (the probe needs
-   * the chart source on disk, so a repo-fetched chart never gets one).
-   */
-  coalescedValuesDigest?: string;
-}
-
-const renderRecords: HelmRenderRecord[] = [];
-
-/** Every render recorded in this process, in invocation order. */
-export function getHelmRenderRecords(): readonly HelmRenderRecord[] {
-  return renderRecords;
-}
-
-/** Reset the record list (test isolation). */
-export function clearHelmRenderRecords(): void {
-  renderRecords.length = 0;
-}
+// The invocation-record ledger lives in ./render-records.ts — a module with
+// no runtime imports — so WHM503 (edge-imported via the post-synth barrel)
+// can read it without pulling this module's heavy static graph. Re-exported
+// here to keep the lexicon's public surface unchanged.
+export { getHelmRenderRecords, clearHelmRenderRecords, type HelmRenderRecord } from "./render-records";
 
 interface RenderedDoc {
   apiVersion?: string;
@@ -172,7 +124,18 @@ interface RenderedDoc {
   [k: string]: unknown;
 }
 
-const CACHE_ROOT = join(homedir(), ".chant", "helm-renders");
+/**
+ * Root of the legacy unpinned cache — the same directory (and the same
+ * `CHANT_HELM_RENDER_ROOT` override) as the content-addressed render store
+ * (#2035). Before this the unprofiled path hardcoded `~/.chant/helm-renders`
+ * and honoured no environment variable, so a hermetic or air-gapped build
+ * had no way to hand it a pre-rendered chart short of pre-warming `$HOME`.
+ * A function, not a module-level constant, so the override is read when a
+ * render happens rather than when this module loaded.
+ */
+function cacheRoot(): string {
+  return renderStoreRoot();
+}
 
 /**
  * Legacy cache key — truncated, unprefixed, input-derived. Since #1238 this
@@ -251,7 +214,7 @@ function renderViaHelm(props: HelmRenderProps, profile?: HelmCapabilityProfile):
         "--repository-config",
         "/dev/null",
         "--repository-cache",
-        join(CACHE_ROOT, "_helm-repo-cache"),
+        join(cacheRoot(), "_helm-repo-cache"),
       ]
     : [];
 
@@ -302,7 +265,7 @@ function loadOrRender(props: HelmRenderProps, profile?: HelmCapabilityProfile):
   if (props.noCache) {
     return renderViaHelm(props, profile);
   }
-  const cacheDir = join(CACHE_ROOT, cacheKey(props, profile));
+  const cacheDir = join(cacheRoot(), cacheKey(props, profile));
   const cachePath = join(cacheDir, "manifests.yaml");
   if (existsSync(cachePath)) {
     return readFileSync(cachePath, "utf8");
@@ -490,7 +453,7 @@ export const HelmRender = Composite<HelmRenderProps>((props) => {
       }
     : {};
 
-  renderRecords.push({
+  recordHelmRender({
     name: props.name,
     chart: props.chart,
     version: props.version,