@intentius/chant 0.100.0 → 0.101.0

package/dist/workspace/trust/test-repo.d.ts

@@ -36,6 +36,19 @@ export declare class TestRepo {
     sshSign(key: Key, payload: Buffer, namespace: string): string;
     cleanup(): void;
 }
+/**
+ * Write `<signers>.rotation.json` for the signers file now in the working
+ * tree, as the next version after `previousText`, signed by `by` in the
+ * rotation namespace (#2553).
+ */
+export declare function writeRotation(repo: TestRepo, opts: {
+    previousText: string;
+    version: number;
+    threshold?: number;
+    by: Array<[string, Key]>;
+    namespace?: string;
+    signersPath?: string;
+}): void;
 /** A record kind reading `records/*.md`, and its schema, written into `repo`. */
 export declare function writeRecordKind(repo: TestRepo): string;
 export declare function note(id: string, body?: string): string;

package/dist/workspace/trust/test-repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-repo.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/test-repo.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,eAAO,MAAM,YAAY,SAA2E,CAAC;AAErG,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,QAAQ;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,KAAK,EAAE,MAAM;IASzB,GAAG,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM,CAAC,UAAU;IAc1D,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAO,GAAG,MAAM;IAIjG,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG;IAOtB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAKvC,wFAAwF;IACxF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM;IAO5E,IAAI,IAAI,MAAM;IAId;;;;OAIG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM;IAgBvE,gEAAgE;IAChE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAO7D,OAAO,IAAI,IAAI;CAGhB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAqBtD;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,SAAK,GAAG,MAAM,CAElD"}
+{"version":3,"file":"test-repo.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/test-repo.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,eAAO,MAAM,YAAY,SAA2E,CAAC;AAErG,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,QAAQ;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,KAAK,EAAE,MAAM;IASzB,GAAG,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM,CAAC,UAAU;IAc1D,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAO,GAAG,MAAM;IAIjG,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG;IAOtB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAKvC,wFAAwF;IACxF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM;IAO5E,IAAI,IAAI,MAAM;IAId;;;;OAIG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM;IAgBvE,gEAAgE;IAChE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAO7D,OAAO,IAAI,IAAI;CAGhB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtI,IAAI,CAON;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAqBtD;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,SAAK,GAAG,MAAM,CAElD"}

package/dist/workspace/trust/verify.d.ts

@@ -14,6 +14,7 @@
 import { type CommitAttestor, type ProvenanceLevel } from "./attestor.js";
 import { type BaseSource, type RecordProvenance } from "./provenance.js";
 import { type ExcludedSigner } from "./policy.js";
+import { type RotationRefusalCode } from "./rotation.js";
 export interface CommitVerdict extends RecordProvenance {
     commit: string;
     subject: string;
@@ -46,6 +47,20 @@ export interface ChangeReport {
     /** Protected paths whose content differs between the merge base and head. */
     protectedChanged: string[];
     protectedWrites: ProtectedWrite[];
+    /**
+     * When the change edits the signer set (#2553): the version it proposes and
+     * who signed it, or, when the new set is refused, the version it had to
+     * follow and why.
+     */
+    rotation: {
+        from: number;
+        to: number;
+        signedBy: string[];
+    } | {
+        from: number;
+        code: RotationRefusalCode;
+        reason: string;
+    } | null;
     notes: string[];
     failures: string[];
     ok: boolean;

package/dist/workspace/trust/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAA+C,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACnH,OAAO,EAAiC,KAAK,cAAc,EAAoB,MAAM,UAAU,CAAC;AAEhG,MAAM,WAAW,aAAc,SAAQ,gBAAgB;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE;QACN,MAAM,EAAE,OAAO,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,EAAE,EAAE,OAAO,CAAC;CACb;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;CACtC;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAUnG;AAQD,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,CAqG9D"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAA+C,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACnH,OAAO,EAAiC,KAAK,cAAc,EAAoB,MAAM,UAAU,CAAC;AAChG,OAAO,EAAoD,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExG,MAAM,WAAW,aAAc,SAAQ,gBAAgB;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE;QACN,MAAM,EAAE,OAAO,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC;;;;OAIG;IACH,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChI,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,EAAE,EAAE,OAAO,CAAC;CACb;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;CACtC;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAUnG;AAQD,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,CAoH9D"}

package/dist/workspace/work-evidence.d.ts

@@ -20,7 +20,7 @@
  */
 import { type EvidenceResult, type WorkAcceptance } from "./work.js";
 /** Why evidence was not attached. Closed. Nothing is written with any of them. */
-export declare const WORK_EVIDENCE_ERROR_CODES: readonly ["kind-unreadable", "kind-invalid", "schema-unreadable", "schema-id-mismatch", "schema-invalid", "location-missing", "write-usage-invalid", "write-input-invalid", "record-not-found", "amend-id-immutable", "record-closed", "amend-supersede-instead", "record-sign-failed", "ratify-quorum-not-met", "record-unparseable", "record-schema-invalid", "record-id-duplicate", "record-supersedes-unknown", "record-supersedes-conflict", "record-remediates-unknown", "record-remediates-not-closed", "session-seal-mismatch", "session-verdict-unknown-record", "work-kind-missing", "work-kind-ambiguous", "work-item-unknown", "work-item-closed", "work-criterion-unknown", "work-acceptance-self-verified", "lease-held", "lease-not-held", "lease-token-mismatch", "not-a-git-repository"];
+export declare const WORK_EVIDENCE_ERROR_CODES: readonly ["kind-unreadable", "kind-invalid", "schema-unreadable", "schema-id-mismatch", "schema-invalid", "location-missing", "write-usage-invalid", "write-input-invalid", "record-not-found", "amend-id-immutable", "record-closed", "amend-supersede-instead", "record-sign-failed", "ratify-quorum-not-met", "write-scope-member", "write-scope-kind", "agent-unknown", "record-unparseable", "record-schema-invalid", "record-id-duplicate", "record-supersedes-unknown", "record-supersedes-conflict", "record-remediates-unknown", "record-remediates-not-closed", "record-seal-mismatch", "session-seal-mismatch", "session-verdict-unknown-record", "work-kind-missing", "work-kind-ambiguous", "work-item-unknown", "work-item-closed", "work-criterion-unknown", "work-acceptance-self-verified", "lease-held", "lease-not-held", "lease-token-mismatch", "not-a-git-repository"];
 export type WorkEvidenceErrorCode = (typeof WORK_EVIDENCE_ERROR_CODES)[number];
 export interface AttachWorkEvidenceRequest {
     /** Where the workspace is found, and what `path` and `kind` resolve against. */

package/dist/workspace/work-evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"work-evidence.d.ts","sourceRoot":"","sources":["../../src/workspace/work-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,EAAwD,KAAK,cAAc,EAAyB,KAAK,cAAc,EAAE,MAAM,QAAQ,CAAC;AAG/I,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,2wBAYI,CAAC;AAC3C,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E,MAAM,WAAW,yBAAyB;IACxC,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4DAA4D;AAC5D,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,4FAA4F,CAAC;AAExI,UAAU,OAAO;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,sFAAsF;AACtF,MAAM,MAAM,oBAAoB,GAAG,OAAO,GACxC,CACI;IACE,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,wDAAwD;IACxD,UAAU,EAAE,cAAc,CAAC;CAC5B,GACD;IAAE,KAAK,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAC9D,CAAC;AAWJ,sGAAsG;AACtG,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+DtG"}
+{"version":3,"file":"work-evidence.d.ts","sourceRoot":"","sources":["../../src/workspace/work-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,EAAwD,KAAK,cAAc,EAAyB,KAAK,cAAc,EAAE,MAAM,QAAQ,CAAC;AAG/I,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,81BAYI,CAAC;AAC3C,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E,MAAM,WAAW,yBAAyB;IACxC,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4DAA4D;AAC5D,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,4FAA4F,CAAC;AAExI,UAAU,OAAO;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,sFAAsF;AACtF,MAAM,MAAM,oBAAoB,GAAG,OAAO,GACxC,CACI;IACE,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,wDAAwD;IACxD,UAAU,EAAE,cAAc,CAAC;CAC5B,GACD;IAAE,KAAK,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAC9D,CAAC;AAWJ,sGAAsG;AACtG,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+DtG"}

package/dist/workspace/write-scope.d.ts

@@ -0,0 +1,199 @@
+/**
+ * Write scope per member and record kind, for each principal class, and the
+ * agent sessions bound to one member (#2524 D5, D20; #2548; ws-067).
+ *
+ * The declaration's `writeScope` block gives a restricted class the members
+ * whose files it may write and the record kinds it may write, with which
+ * verbs (`new`, `amend`, `review`, `close`). A class with no entry is not
+ * restricted. The declaration's `agents` list names agent sessions, each
+ * bound to one member: a session writes that member's files, and the records
+ * of kinds that member or the workspace declares, as `writeScope.agent`
+ * allows. An agent's members can't be widened.
+ *
+ * Two places apply it, both reading the scope from the base revision so a
+ * change can't widen its own scope (#2524 threat model):
+ *
+ * - The write paths: `chant workspace records new|amend|review|close` and the
+ *   MCP record tools refuse a write outside the writer's scope with
+ *   `write-scope-member` or `write-scope-kind`, and an unknown session with
+ *   `agent-unknown`. The session comes from `CHANT_AGENT`.
+ * - The enforcement boundary: `chant workspace check --changes <range>`
+ *   judges every commit in the range, by its `Chant-Agent` trailer, its
+ *   attested principal, or its author, and reports each path written outside
+ *   that writer's scope. Run in CI with an attestation policy, the principal
+ *   is the signer the policy at base trusts; on a developer machine it is
+ *   detection only (ws-002).
+ *
+ * A principal's class comes from the role grants in the trust policy at base,
+ * through {@link principalClass} alone (the agent, runner and service roles),
+ * or from naming an agent session. Claiming a session only ever narrows what
+ * a writer may do, so an unverified `CHANT_AGENT` or trailer is safe to honour.
+ */
+import { type AgentDeclaration, type ClassScope, type Declaration, type PrincipalClass, type WriteVerb } from "./declaration.js";
+import { type TrustPolicy } from "./trust/policy.js";
+/** The environment variable naming the agent session a write is made in. */
+export declare const AGENT_ENV = "CHANT_AGENT";
+/** The commit trailer naming the agent session a commit was made in. */
+export declare const AGENT_TRAILER = "Chant-Agent";
+/** Why a write is outside its writer's scope. Closed. */
+export declare const WRITE_SCOPE_CODES: readonly ["write-scope-member", "write-scope-kind", "agent-unknown"];
+export type WriteScopeCode = (typeof WRITE_SCOPE_CODES)[number];
+/**
+ * The role grants a class is read from. Every read of roles for write scope
+ * goes through here, so where the grants live (`.chant/trust.json` today,
+ * possibly the declaration, #2547) is decided in one place: the policy.
+ */
+export declare function roleGrants(policy: TrustPolicy): Record<string, string[]>;
+/** The class a principal is in: the first of agent, runner and service whose role it holds at base, or human. */
+export declare function principalClass(policy: TrustPolicy, principal: string | null): PrincipalClass;
+/** Who is writing, as the scope judges it. */
+export interface Writer {
+    /** The principal named, or null when none is. */
+    principal: string | null;
+    class: PrincipalClass;
+    /** The agent session the writer is bound to, or null. */
+    agent: AgentDeclaration | null;
+}
+export declare class WriteScopeError extends Error {
+    readonly code: WriteScopeCode;
+    constructor(code: WriteScopeCode, message: string);
+}
+/**
+ * The writer: in the session `agent` names (refused with agent-unknown when
+ * the declaration declares none by that name), in the session that lists
+ * `principal`, or else in the class `principal`'s roles give it.
+ */
+export declare function resolveWriter(declaration: Declaration | null, policy: TrustPolicy, given: {
+    agent?: string | null;
+    principal?: string | null;
+}): Writer;
+/** The scope that applies to `writer`, or null when its class is not restricted. An agent is always restricted to its member. */
+export declare function scopeOf(declaration: Declaration | null, writer: Writer): ClassScope | null;
+export type ScopeVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    code: Exclude<WriteScopeCode, "agent-unknown">;
+    message: string;
+};
+/** The record kind a write goes to, as the scope reads it. */
+export interface ScopedKind {
+    /** The kind file's `recordKind.name`. */
+    name: string;
+    /** The name the declaration gives it, or null. */
+    declaredName: string | null;
+    /** The member that declares the kind, or null for the workspace's own kinds. */
+    member: string | null;
+    /** True when the declaration names the kind; an undeclared kind belongs to the member holding its records. */
+    declared: boolean;
+}
+/** Whether `writer` may write a record of `kind` with `verb`. A delete is never in a restricted scope. */
+export declare function judgeRecord(declaration: Declaration | null, writer: Writer, kind: ScopedKind, verb: WriteVerb | "delete"): ScopeVerdict;
+/** Whether `writer` may write the file at `path`, from the workspace root. */
+export declare function judgePath(declaration: Declaration | null, writer: Writer, path: string): ScopeVerdict;
+/** The declaration and policy a write on this machine is judged by. */
+export interface ScopeSource {
+    declaration: Declaration | null;
+    /** Where the declaration was read: the base revision, or the working tree when there is no base or no declaration at it. */
+    from: "base" | "working-tree" | null;
+    /** The workspace root on disk, or null without a declaration. */
+    rootOnDisk: string | null;
+    /** The workspace root from the git root, "." for the git root, or null without a declaration. */
+    root: string | null;
+    policy: TrustPolicy;
+}
+/**
+ * The scope for a write from `cwd`: the declaration and the trust policy at
+ * the base revision (`origin/HEAD`, `main` or `master`), so a write can't
+ * widen its own scope by editing its copy of the declaration. Without a base,
+ * or without a declaration at it, the working tree's declaration.
+ */
+export declare function scopeSource(cwd: string): ScopeSource;
+/**
+ * The kind a write goes to, as {@link judgeRecord} reads it: the declared
+ * entry whose file is `kindFile`, or, for a kind the declaration does not
+ * name, the member holding `recordsDir`.
+ */
+export declare function scopedKind(source: ScopeSource, kindName: string, kindFile: string, recordsDir: string): ScopedKind;
+/**
+ * Refuse a record write outside the writer's scope (#2548): throws a
+ * {@link WriteScopeError}. `agent` is the session the write names
+ * (`CHANT_AGENT`), and `principal` who the write names as its author.
+ */
+export declare function refuseRecordWrite(cwd: string, write: {
+    kindName: string;
+    kindFile: string;
+    recordsDir: string;
+    verb: WriteVerb;
+    agent?: string | null;
+    principal?: string | null;
+}): void;
+/** A commit as the scope check judged it. */
+export interface ScopeCommit {
+    commit: string;
+    subject: string;
+    /** The attested principal, or the author's email when the commit is not attested. */
+    principal: string;
+    /** Whether the principal is a signer the policy at base attests, or only the author the commit claims. */
+    attested: boolean;
+    class: PrincipalClass;
+    /** The agent session, from the Chant-Agent trailer or the principal, or null. */
+    agent: string | null;
+    /** Paths in the workspace the commit writes. */
+    paths: number;
+}
+export interface ScopeFinding {
+    /** `finding:<code>:<commit>:<path>`, or `finding:agent-unknown:<commit>`. */
+    id: string;
+    code: WriteScopeCode;
+    commit: string;
+    /** From the workspace root, or null for a finding on the whole commit. */
+    path: string | null;
+    principal: string;
+    class: PrincipalClass;
+    agent: string | null;
+    /** For a record file: how it was written, as the records commands name it, or delete. */
+    verb: WriteVerb | "delete" | null;
+    message: string;
+}
+export interface ScopeReport {
+    /** The commit the declaration and the trust policy were read at. */
+    base: string;
+    /** The classes with a writeScope entry, and agent when any session is declared. */
+    restricted: PrincipalClass[];
+    agents: string[];
+    commits: ScopeCommit[];
+    findings: ScopeFinding[];
+}
+/** A record kind the check knows, to tell a record file from another path. */
+export interface CheckKind {
+    scoped: ScopedKind;
+    /** The records directory, from the repository root. */
+    dir: string;
+    match: RegExp;
+    /** The reviews field, when the kind has one; the verdicts field of a session kind. */
+    reviewFields: string[];
+    /** The state field and closed states of a session kind, for telling a close. */
+    session: {
+        stateField: string;
+        closed: string[];
+        fills: string[];
+    } | null;
+    format: string;
+}
+/**
+ * Judge every commit in `base..head` against the write scope the declaration
+ * at `base` gives (#2548). Returns null when that declaration restricts no
+ * one: no writeScope block and no agent session. Merges are skipped; the
+ * commits they bring are judged instead.
+ */
+export declare function checkWriteScope(q: {
+    top: string;
+    base: string;
+    head: string;
+    /** The workspace root from the repository root, "" for the top. */
+    prefix: string;
+    declaration: Declaration;
+    kinds: CheckKind[];
+}): Promise<ScopeReport | null>;
+//# sourceMappingURL=write-scope.d.ts.map

package/dist/workspace/write-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-scope.d.ts","sourceRoot":"","sources":["../../src/workspace/write-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAI/D,4EAA4E;AAC5E,eAAO,MAAM,SAAS,gBAAgB,CAAC;AAEvC,wEAAwE;AACxE,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAE3C,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,sEAAuG,CAAC;AACtI,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAKhE;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAExE;AAED,iHAAiH;AACjH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAK5F;AAED,8CAA8C;AAC9C,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,cAAc,CAAC;IACtB,yDAAyD;IACzD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAChC;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,cAAc;gBAApB,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM;CAKlB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,MAAM,CAsBvJ;AAED,iIAAiI;AACjI,wBAAgB,OAAO,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAI1F;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAgBzH,8DAA8D;AAC9D,MAAM,WAAW,UAAU;IACzB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,8GAA8G;IAC9G,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,YAAY,CA4BvI;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAWrG;AAID,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,4HAA4H;IAC5H,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAC;IACrC,iEAAiE;IACjE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iGAAiG;IACjG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;CACrB;AAYD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAUpD;AAID;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAQlH;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACnI,IAAI,CAMN;AAID,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,0GAA0G;IAC1G,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,iFAAiF;IACjF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,yFAAyF;IACzF,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,UAAU,CAAC;IACnB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gFAAgF;IAChF,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAkCD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA6D9B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.100.0",
+  "version": "0.101.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/build.ts

@@ -1,6 +1,7 @@
 import type { Declarable } from "./declarable";
 import type { Serializer, SerializerResult } from "./serializer";
 import type { OwnershipMarker } from "./ownership";
+import type { TelemetryAttribution } from "./telemetry-attribution";
 import type { BuildError, DiscoveryErrorType } from "./errors";
 import type { IntrinsicDef, BuildRootContribution, BuildRootContributor } from "./lexicon";
 import { getProvenance, type BuildParamProvenance } from "./provenance";
@@ -194,6 +195,12 @@ export interface BuildOptions {
    */
   ownership?: OwnershipMarker;
 
+  /**
+   * Telemetry attribution facts (#2558), passed to each serializer's
+   * {@link SerializeContext}. Resolved by the build command; unset at level 0.
+   */
+  telemetry?: TelemetryAttribution;
+
   /**
    * The resolved project configuration, passed through to each serializer's
    * {@link SerializeContext} so a dialect can read its lexicon-scoped settings.
@@ -876,6 +883,7 @@ async function buildFromDiscoveryResult(
       const serialized = serializer.serialize(applyBound, lexiconLexiconOutputs, {
         ownership: options?.ownership,
         config: options?.config,
+        ...(options?.telemetry ? { telemetry: options.telemetry } : {}),
         ...(receipts.size > 0 ? { receipts } : {}),
       });
       // Collect any non-fatal serializer diagnostics into the build warnings.

package/src/cli/build-options.ts

@@ -64,6 +64,8 @@ export interface ProjectBuildOptionsInput {
   ownership?: OwnershipMarker;
   /** This build's resolved build-time parameters (#1064). */
   buildParams?: BuildParamProvenance[];
+  /** Telemetry attribution facts (#2558), from `resolveTelemetryAttribution`; unset at level 0. */
+  telemetry?: import("../telemetry-attribution").TelemetryAttribution;
 }
 
 /**
@@ -75,7 +77,7 @@ export interface ProjectBuildOptionsInput {
  * in this function, never at a call site.
  */
 export function resolveProjectBuildOptions(input: ProjectBuildOptionsInput): BuildOptions {
-  const { config, configDir, plugins, modes, ownership, buildParams } = input;
+  const { config, configDir, plugins, modes, ownership, buildParams, telemetry } = input;
 
   // #1039 — each loaded plugin's registered intrinsics (e.g. AWS's `Sub`), so
   // a file using a registered intrinsic tagged template folds instead of
@@ -90,6 +92,7 @@ export function resolveProjectBuildOptions(input: ProjectBuildOptionsInput): Bui
 
   return {
     ownership,
+    ...(telemetry ? { telemetry } : {}),
     config: config as unknown as Record<string, unknown>,
     fold: modes.fold,
     sandbox: modes.sandbox,

package/src/cli/commands/build.ts

@@ -8,6 +8,7 @@ import {
   resolveKnowledgeDir,
 } from "../../config";
 import { resolveBuildModes, resolveProjectBuildOptions } from "../build-options";
+import { resolveTelemetryAttribution } from "../../telemetry-attribution";
 import { loadOkfBundle } from "../../okf-read";
 import { unknownEnvError } from "../../env";
 import type { OwnershipMarker } from "../../ownership";
@@ -320,6 +321,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
       modes,
       ownership,
       buildParams: paramsResolution.provenance,
+      telemetry: await resolveTelemetryAttribution(configDir, config as unknown as Record<string, unknown>, env),
     }),
   );
 

package/src/cli/commands/import-live.test.ts

@@ -6,7 +6,8 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import type { LexiconPlugin, ExportedTemplate, ResourceSelector } from "../../lexicon";
 import type { TypeScriptGenerator } from "../../import/generator";
-import type { TemplateIR } from "../../import/parser";
+import type { TemplateIR, ParseContext } from "../../import/parser";
+import type { EmbeddedContentImporter } from "../../import/embedded";
 
 const generator: TypeScriptGenerator = {
   generate(ir: TemplateIR) {
@@ -151,4 +152,71 @@ describe("liveImportFromPlugins (#114)", () => {
     expect(result.success).toBe(true);
     expect(seenStack).toBe("loom-backend");
   });
+
+  // #2995: an export with `reparse` goes through the same embedded-content
+  // delegation as file import.
+  describe("embedded content (#2995)", () => {
+    const configText = "service:\n  pipelines: {}\n";
+
+    function hostExporter(): LexiconPlugin {
+      const parse = (context?: ParseContext): TemplateIR => {
+        const ref = context?.embedded?.resolve({
+          host: "fake",
+          hostType: "Fake::ConfigMap",
+          location: "ConfigMap cfg data[\"config.yaml\"]",
+          directory: "cfg",
+          text: configText,
+          expectedOwner: { lexicon: "owner", what: "an owner config" },
+        });
+        return {
+          resources: [{ logicalId: "cfg", type: "Fake::ConfigMap", properties: { data: ref ?? configText } }],
+          parameters: [],
+        };
+      };
+      return {
+        ...fakeExporter("fake", { resources: [], parameters: [] }),
+        async exportResources(): Promise<ExportedTemplate> {
+          return { ...parse(), reparse: (context) => parse(context) };
+        },
+      };
+    }
+
+    const importer: EmbeddedContentImporter = {
+      what: "an owner config",
+      matches: (c) => typeof c.document === "object" && c.document !== null && "service" in c.document,
+      import: () => ({
+        files: [{ path: "config.ts", content: "export const config = {};\n" }],
+        value: { bindings: [{ from: "config.ts", name: "config" }], shape: "single" },
+      }),
+    };
+    const owner: LexiconPlugin = {
+      name: "owner",
+      serializer: {} as never,
+      generate: async () => {},
+      validate: async () => {},
+      coverage: async () => {},
+      package: async () => {},
+      embeddedImporters: () => [importer],
+    };
+
+    test("a loaded owner imports the content and its modules are written beside the host's", async () => {
+      const result = await liveImportFromPlugins([hostExporter(), owner], { environment: "prod", output: outputDir, force: true });
+      expect(result.success).toBe(true);
+      expect(result.warnings).toEqual([]);
+      expect(result.generatedFiles).toEqual(["main.ts", "cfg/config.ts"]);
+      const main = await readFile(join(outputDir, "main.ts"), "utf-8");
+      expect(main).toContain('"$embedded"');
+      expect(main).toContain('"from":"cfg/config.ts"');
+      expect(await readFile(join(outputDir, "cfg/config.ts"), "utf-8")).toContain("export const config");
+    });
+
+    test("with no owner the content is kept as read, with a warning", async () => {
+      const result = await liveImportFromPlugins([hostExporter()], { environment: "prod", output: outputDir, force: true });
+      expect(result.success).toBe(true);
+      expect(result.generatedFiles).toEqual(["main.ts"]);
+      expect(result.warnings.join("\n")).toContain("no installed lexicon imports it");
+      const main = await readFile(join(outputDir, "main.ts"), "utf-8");
+      expect(main).toContain(JSON.stringify(configText));
+    });
+  });
 });

package/src/cli/commands/import.ts

@@ -1,10 +1,10 @@
 import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync } from "fs";
 import { join, resolve, basename, dirname } from "path";
 import { formatSuccess, formatWarning, formatError } from "../format";
-import type { TemplateIR, ResourceIR, ParameterIR, TemplateParser } from "../../import/parser";
+import type { TemplateIR, ResourceIR, ParameterIR, ParseContext } from "../../import/parser";
 import type { GeneratedFile, TypeScriptGenerator } from "../../import/generator";
 import { listInstalledLexicons, loadPlugin, loadPlugins, resolveProjectLexicons } from "../plugins";
-import type { LexiconPlugin, ResourceSelector } from "../../lexicon";
+import type { ExportedTemplate, LexiconPlugin, ResourceSelector } from "../../lexicon";
 import { parseYAMLDocument, splitYAMLDocuments } from "../../yaml";
 import { importLexiconPackage } from "../../lexicon-module";
 import { EmbeddedImports, type EmbeddedContent, type RegisteredEmbeddedImporter } from "../../import/embedded";
@@ -427,14 +427,15 @@ export async function importFromContent(options: ContentImportOptions): Promise<
 
 /**
  * The importers for the content a host's parser offered (#2962): those of the
- * project's lexicons, and of each installed lexicon whose `detectTemplate`
- * recognizes one of the offered documents. The recognizing is done with the
+ * plugins already loaded, of the project's lexicons, and of each installed
+ * lexicon whose `detectTemplate` recognizes one of the offered documents
+ * (#2995 adds the loaded ones). The recognizing is done with the
  * lexicon's light `/detect` module, so a lexicon is loaded in full only when
  * it may own something; one that fails to load is skipped.
  */
 async function embeddedImportersFor(
   offered: readonly EmbeddedContent[],
-  host: LexiconPlugin,
+  loaded: readonly LexiconPlugin[],
   projectDir: string,
 ): Promise<RegisteredEmbeddedImporter[]> {
   const documents = offered.map((c) => c.document).filter((d) => typeof d === "object" && d !== null);
@@ -446,7 +447,8 @@ async function embeddedImportersFor(
   } catch {
     projectNames = [];
   }
-  const candidates: string[] = [...projectNames];
+  // Plugins already loaded (the host, or live import's exporters) are asked too.
+  const candidates: string[] = [...new Set([...loaded.map((p) => p.name), ...projectNames])];
   for (const name of listInstalledLexicons(projectDir)) {
     if (candidates.includes(name)) continue;
     try {
@@ -471,7 +473,7 @@ async function embeddedImportersFor(
   for (const name of candidates) {
     let plugin: LexiconPlugin;
     try {
-      plugin = name === host.name ? host : await loadPlugin(name);
+      plugin = loaded.find((p) => p.name === name) ?? (await loadPlugin(name));
     } catch {
       continue;
     }
@@ -488,22 +490,24 @@ async function embeddedImportersFor(
 
 /**
  * Parse, resolving embedded content (#2962). A first parse with a probe
- * collects what the parser offers; when it offers anything, the owners'
- * importers are loaded and the content is parsed again with them. A parser
- * that offers nothing is parsed once, and nothing is loaded.
+ * collects what the parsers offer; when they offer anything, the owners'
+ * importers are loaded and each is parsed again with them, through one
+ * resolver so their directories stay distinct. A parse is a template
+ * parser over a file's content, or an export's `reparse` (#2995). Parsers
+ * that offer nothing are parsed once, and nothing is loaded. `loaded` are
+ * plugins already loaded, reused when one of them owns content.
  */
 async function parseWithEmbedded(
-  plugin: LexiconPlugin,
-  parser: TemplateParser,
-  content: string,
+  parses: ReadonlyArray<(context: ParseContext) => TemplateIR>,
+  loaded: readonly LexiconPlugin[],
   projectDir: string,
-): Promise<{ ir: TemplateIR; embedded?: EmbeddedImports }> {
+): Promise<{ irs: TemplateIR[]; embedded?: EmbeddedImports }> {
   const probe = new EmbeddedImports([], { quiet: true });
-  const ir = parser.parse(content, { embedded: probe });
-  if (probe.offered.length === 0) return { ir };
-  const importers = await embeddedImportersFor(probe.offered, plugin, projectDir);
+  const irs = parses.map((parse) => parse({ embedded: probe }));
+  if (probe.offered.length === 0) return { irs };
+  const importers = await embeddedImportersFor(probe.offered, loaded, projectDir);
   const embedded = new EmbeddedImports(importers);
-  return { ir: parser.parse(content, { embedded }), embedded };
+  return { irs: parses.map((parse) => parse({ embedded })), embedded };
 }
 
 /** The shared tail of every template import: parse → generate → write. */
@@ -535,7 +539,9 @@ async function parseAndWrite(
   let embedded: EmbeddedImports | undefined;
   try {
     const parser = plugin.templateParser();
-    ({ ir, embedded } = await parseWithEmbedded(plugin, parser, content, projectDir));
+    let irs: TemplateIR[];
+    ({ irs, embedded } = await parseWithEmbedded([(context) => parser.parse(content, context)], [plugin], projectDir));
+    ir = irs[0];
   } catch (err) {
     return {
       success: false,
@@ -701,6 +707,7 @@ export async function liveImportFromPlugins(
   options: LiveImportOptions,
 ): Promise<ImportResult> {
   const outputDir = resolve(options.output ?? "./infra/");
+  const projectDir = resolve(options.output ? dirname(options.output) : ".");
   const warnings: string[] = [];
 
   let exporters = plugins.filter((p) => p.exportResources && p.templateGenerator);
@@ -720,10 +727,10 @@ export async function liveImportFromPlugins(
   }
 
   // Collect IR from every exporter, tagging which lexicon produced output.
-  const irParts: TemplateIR[] = [];
+  let irParts: ExportedTemplate[] = [];
   let generatorLexicon: LexiconPlugin | undefined;
   for (const plugin of exporters) {
-    let ir: TemplateIR;
+    let ir: ExportedTemplate;
     try {
       ir = await plugin.exportResources!({
         environment: options.environment,
@@ -754,6 +761,23 @@ export async function liveImportFromPlugins(
     warnings.push("Multiple lexicons exported resources; generated with the first. Use --lexicon to target one.");
   }
 
+  // Content embedded in exported resources goes to the lexicon that owns it,
+  // as in file import (#2995). An export without `reparse` keeps it as read.
+  let embedded: EmbeddedImports | undefined;
+  if (irParts.some((part) => part.reparse)) {
+    try {
+      const parses = irParts.map((part) => part.reparse ?? (() => part));
+      let irs: TemplateIR[];
+      ({ irs, embedded } = await parseWithEmbedded(parses, plugins, projectDir));
+      irParts = irs;
+    } catch (err) {
+      warnings.push(
+        `Embedded content is kept as written, because resolving it failed: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+    if (embedded) warnings.push(...embedded.warnings);
+  }
+
   const ir = mergeIR(irParts);
   const generator = generatorLexicon.templateGenerator!();
 
@@ -761,8 +785,10 @@ export async function liveImportFromPlugins(
     mkdirSync(outputDir, { recursive: true });
   }
 
-  const { files, warnings: layoutWarnings } = generateOrganizedFiles(ir, generator);
+  const { files: hostFiles, warnings: layoutWarnings } = generateOrganizedFiles(ir, generator);
   warnings.push(...layoutWarnings);
+  // The owners' modules for embedded content, each in a directory of its own.
+  const files = [...hostFiles, ...(embedded?.files ?? [])];
   const generatedFiles: string[] = [];
   for (const file of files) {
     const filePath = join(outputDir, file.path);