@intentius/chant 0.121.1 → 0.122.0

package/dist/cli/commands/build.d.ts

@@ -1,6 +1,7 @@
 import { build } from "../../build.js";
 import type { Serializer } from "../../serializer.js";
 import type { LexiconPlugin } from "../../lexicon.js";
+import { runPostSynthChecks, type PostSynthDiagnostic } from "../../lint/post-synth.js";
 import { type FoldRankResult } from "../../discovery/fold-rank.js";
 /**
  * Build command options
@@ -109,6 +110,17 @@ export interface BuildResult {
     /** This build's resolved build-time parameters (#1064) — see `BuildResult.buildParams` (../../build.ts). Empty when the project declares/supplies none. */
     buildParams?: import("../../provenance.js").BuildParamProvenance[];
 }
+/**
+ * Run each lexicon plugin's own post-synth checks over a build result, each
+ * plugin seeing only its own lexicon's output. Shared by `chant build` and
+ * `chant lint` (#3750), so the two run the same checks over the same scoping;
+ * each caller then applies `lint.presets`, `lint.rules` and inline
+ * suppressions its own way. A plugin with no checks yields no entry.
+ */
+export declare function runLexiconPostSynthChecks(plugins: readonly LexiconPlugin[], result: Parameters<typeof runPostSynthChecks>[1], env: string | undefined, opts?: Parameters<typeof runPostSynthChecks>[3]): Array<{
+    plugin: LexiconPlugin;
+    diagnostics: PostSynthDiagnostic[];
+}>;
 /**
  * Execute the build command
  */

package/dist/cli/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAepC,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAiBnD,OAAO,EAAuC,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMrG;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;OAKG;IACH,WAAW,CAAC,EAAE;QAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;KAAE,CAAC;CAChF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2JAA2J;IAC3J,WAAW,CAAC,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CACjE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA2wB9E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,MAAM,CAMrF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAsBpF;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAepC,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAgBrF,OAAO,EAAuC,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMrG;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;OAKG;IACH,WAAW,CAAC,EAAE;QAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;KAAE,CAAC;CAChF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2JAA2J;IAC3J,WAAW,CAAC,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CACjE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,MAAM,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAChD,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAC9C,KAAK,CAAC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC,CAsBtE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA0vB9E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,MAAM,CAMrF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAsBpF;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}

package/dist/cli/commands/lint.d.ts

@@ -42,6 +42,15 @@ export declare function loadPluginRules(plugins: string[], configDir: string): P
  * project" this id exists to prevent.
  */
 export declare const LEXICON_RESOLUTION_RULE_ID = "LEX001";
+/**
+ * The diagnostic id `chant lint` reports a lint target that does not build
+ * under (chant #3750). The lexicons' post-synth checks read a build result, so
+ * when the build fails they cannot run; this says so instead of letting the
+ * lint pass in silence. Like {@link LEXICON_RESOLUTION_RULE_ID} it is not a
+ * rule: it has no severity setting and no disable form. The message is the
+ * build's own.
+ */
+export declare const BUILD_FAILURE_RULE_ID = "LEX002";
 /**
  * Lint command options
  */
@@ -70,6 +79,13 @@ export interface LintOptions {
      * `sandbox` option (../../components/discover.ts).
      */
     sandbox?: boolean;
+    /**
+     * chant #3750 — run each loaded lexicon's post-synth checks over an
+     * in-memory build of the target (default `true`, what the CLI always does).
+     * `false` lints source alone; it exists for test harnesses that check an
+     * example's source rules, not for hiding findings from a user.
+     */
+    postSynth?: boolean;
 }
 /**
  * Lint command result

package/dist/cli/commands/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AA8BzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAmBhC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,WAAW,CAAC;AA+JnD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAiVD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAqN3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAsCzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAmBhC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,WAAW,CAAC;AAsBnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AA2I9C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AA+cD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA+N3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.121.1",
+  "version": "0.122.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/build.ts

@@ -170,6 +170,42 @@ export interface BuildResult {
   buildParams?: import("../../provenance").BuildParamProvenance[];
 }
 
+/**
+ * Run each lexicon plugin's own post-synth checks over a build result, each
+ * plugin seeing only its own lexicon's output. Shared by `chant build` and
+ * `chant lint` (#3750), so the two run the same checks over the same scoping;
+ * each caller then applies `lint.presets`, `lint.rules` and inline
+ * suppressions its own way. A plugin with no checks yields no entry.
+ */
+export function runLexiconPostSynthChecks(
+  plugins: readonly LexiconPlugin[],
+  result: Parameters<typeof runPostSynthChecks>[1],
+  env: string | undefined,
+  opts?: Parameters<typeof runPostSynthChecks>[3],
+): Array<{ plugin: LexiconPlugin; diagnostics: PostSynthDiagnostic[] }> {
+  const batches: Array<{ plugin: LexiconPlugin; diagnostics: PostSynthDiagnostic[] }> = [];
+  for (const plugin of plugins) {
+    if (!plugin.postSynthChecks) continue;
+    const checks = plugin.postSynthChecks();
+    if (checks.length === 0) continue;
+
+    // Scope outputs to this plugin's lexicon so cross-lexicon outputs don't
+    // interfere. Outputs are keyed by the serializer's lexicon name (the
+    // build partition key), which differs from plugin.name for a dialect like
+    // forgejo (plugin "forgejo", serializer "github").
+    const outputKey = plugin.serializer.name;
+    const scopedOutputs = new Map<string, string | SerializerResult>();
+    const pluginOutput = result.outputs.get(outputKey);
+    if (pluginOutput !== undefined) {
+      scopedOutputs.set(outputKey, pluginOutput);
+    }
+
+    const scopedResult = { ...result, outputs: scopedOutputs };
+    batches.push({ plugin, diagnostics: runPostSynthChecks(checks, scopedResult, env, opts) });
+  }
+  return batches;
+}
+
 /**
  * Execute the build command
  */
@@ -549,24 +585,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   }
 
   if (result.errors.length === 0 && options.plugins) {
-    for (const plugin of options.plugins) {
-      if (!plugin.postSynthChecks) continue;
-      const checks = plugin.postSynthChecks();
-      if (checks.length === 0) continue;
-
-      // Scope outputs to this plugin's lexicon so cross-lexicon outputs don't
-      // interfere. Outputs are keyed by the serializer's lexicon name (the
-      // build partition key), which differs from plugin.name for a dialect like
-      // forgejo (plugin "forgejo", serializer "github").
-      const outputKey = plugin.serializer.name;
-      const scopedOutputs = new Map<string, string | SerializerResult>();
-      const pluginOutput = result.outputs.get(outputKey);
-      if (pluginOutput !== undefined) {
-        scopedOutputs.set(outputKey, pluginOutput);
-      }
-
-      const scopedResult = { ...result, outputs: scopedOutputs };
-      const postDiags = runPostSynthChecks(checks, scopedResult, env, { activityContracts, telemetry });
+    for (const { plugin, diagnostics: postDiags } of runLexiconPostSynthChecks(options.plugins, result, env, { activityContracts, telemetry })) {
       // `lint.presets` (chant #2113) filters WHICH check ids are reported at
       // all, before `lint.rules`/inline suppression act on the reported
       // ones. It's a no-op for a lexicon that ships no `lintPresets()` (the

package/src/cli/commands/carve-emit-state.test.ts

@@ -317,9 +317,15 @@ resource "aws_s3_bucket_public_access_block" "assets" {
       expect(text).toContain("aws_s3_bucket_versioning.assets (VersioningConfiguration)");
       expect(text).toContain("aws_s3_bucket_public_access_block.assets (PublicAccessBlockConfiguration)");
 
-      // And the emitted project still lints clean (no errors).
+      // And the emitted project still lints clean (no errors). Since #3750 the
+      // lint runs the aws post-synth checks too, and WAW042 is expected here:
+      // the Terraform declares no bucket policy, so the carved bucket faithfully
+      // has no TLS-only deny either. The carve reproduces what was declared; it
+      // does not add policy, so that one finding is allowed and nothing else.
       const lint = await lintCommand({ path: out, format: "stylish" });
-      expect(lint.diagnostics.filter((d) => d.severity === "error")).toEqual([]);
+      const errors = lint.diagnostics.filter((d) => d.severity === "error");
+      expect(errors.filter((d) => d.ruleId !== "WAW042")).toEqual([]);
+      expect(errors.map((d) => d.ruleId)).toEqual(["WAW042"]);
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }

package/src/cli/commands/lint.test.ts

@@ -1,10 +1,12 @@
 import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
-import { lintCommand, isLintRule, loadPluginRules, LEXICON_RESOLUTION_RULE_ID, type LintOptions } from "./lint";
+import { lintCommand, isLintRule, loadPluginRules, LEXICON_RESOLUTION_RULE_ID, BUILD_FAILURE_RULE_ID, type LintOptions } from "./lint";
 import { loadPlugins, resolveProjectLexicons } from "../plugins";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { execFileSync } from "node:child_process";
+import { mkdtempSync, realpathSync, symlinkSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { params, setBuildParams } from "../../params";
 
 describe("lintCommand", () => {
@@ -959,3 +961,109 @@ describe("lintCommand build-time parameters (#2249)", () => {
     expect(params).toEqual({});
   });
 });
+
+/**
+ * chant #3750 — `chant lint` runs each loaded lexicon's own post-synth checks
+ * over an in-memory build of the lint target, the ones `chant build` runs.
+ * The sql lexicon's SQLCH101 is the issue's repro: `ENGINE = MergeTre` failed
+ * the build and linted clean. The project imports the workspace's sql
+ * lexicon through a `node_modules` link, as an installed project would.
+ */
+describe("lintCommand — lexicon post-synth checks (#3750)", () => {
+  const repoNodeModules = resolve(fileURLToPath(new URL(".", import.meta.url)), "../../../../../node_modules");
+  let root: string;
+
+  const schema = (engine: string, idType = "UInt64") =>
+    'import { database, table } from "@intentius/chant-lexicon-sql/clickhouse";\n' +
+    "export const shopDb = database`CREATE DATABASE shop ENGINE = Atomic`;\n" +
+    "export const events = table`\n" +
+    `  CREATE TABLE \${shopDb}.events (id ${idType}, kind String)\n` +
+    `  ENGINE = ${engine}\n` +
+    "  ORDER BY (kind, id)`;\n";
+
+  async function project(engine: string, rules?: Record<string, string>, idType?: string): Promise<void> {
+    await writeFile(
+      join(root, "chant.config.json"),
+      JSON.stringify({ lexicons: ["sql"], sql: { dialect: "clickhouse" }, ...(rules ? { lint: { rules } } : {}) }),
+    );
+    await writeFile(join(root, "src", "schema.ts"), schema(engine, idType));
+  }
+
+  beforeEach(async () => {
+    root = realpathSync(mkdtempSync(join(tmpdir(), "chant-3750-")));
+    await mkdir(join(root, "src"), { recursive: true });
+    symlinkSync(repoNodeModules, join(root, "node_modules"), "dir");
+    process.env.NO_COLOR = "1";
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+    delete process.env.NO_COLOR;
+  });
+
+  test("a lexicon post-synth error fails the lint, at the project root and at src", async () => {
+    await project("MergeTre");
+    for (const path of [root, join(root, "src")]) {
+      const result = await lintCommand({ path, format: "stylish" });
+      expect(result.success).toBe(false);
+      const diag = result.diagnostics.find((d) => d.ruleId === "SQLCH101");
+      expect(diag, result.output).toBeDefined();
+      expect(diag!.severity).toBe("error");
+      expect(diag!.message).toContain('"MergeTre"');
+      // No line of its own: reported at 1:1 in the file that declared the table.
+      expect(diag!.file).toBe(join(root, "src", "schema.ts"));
+      expect([diag!.line, diag!.column]).toEqual([1, 1]);
+      expect(result.output).toContain("SQLCH101");
+    }
+  });
+
+  test("a column type the pinned server does not have is reported (SQLCH121)", async () => {
+    await project("MergeTree", undefined, "UInt46");
+    const result = await lintCommand({ path: root, format: "stylish" });
+    expect(result.success).toBe(false);
+    const diag = result.diagnostics.find((d) => d.ruleId === "SQLCH121");
+    expect(diag, result.output).toBeDefined();
+    expect(diag!.message).toContain("UInt46");
+  });
+
+  test("postSynth: false lints source alone", async () => {
+    await project("MergeTre");
+    const result = await lintCommand({ path: root, format: "stylish", postSynth: false });
+    expect(result.diagnostics.some((d) => d.ruleId === "SQLCH101")).toBe(false);
+  });
+
+  test("a clean project reports nothing from the post-synth pass", async () => {
+    await project("MergeTree");
+    const result = await lintCommand({ path: root, format: "stylish" });
+    expect(result.diagnostics.filter((d) => /^SQL|^LEX/.test(d.ruleId)), result.output).toEqual([]);
+  });
+
+  test("lint.rules overrides a post-synth finding's severity, and turns it off", async () => {
+    await project("MergeTre", { SQLCH101: "warning" });
+    const warned = await lintCommand({ path: root, format: "stylish" });
+    expect(warned.diagnostics.find((d) => d.ruleId === "SQLCH101")?.severity).toBe("warning");
+    expect(warned.success).toBe(true);
+
+    await project("MergeTre", { SQLCH101: "off" });
+    const off = await lintCommand({ path: root, format: "stylish" });
+    expect(off.diagnostics.some((d) => d.ruleId === "SQLCH101")).toBe(false);
+  });
+
+  test("a target that does not build reports the build error and skips the checks", async () => {
+    await project("MergeTre");
+    // A table interpolating a name that is not declared does not build.
+    await writeFile(
+      join(root, "src", "broken.ts"),
+      'import { table } from "@intentius/chant-lexicon-sql/clickhouse";\n' +
+        'import { events } from "./schema";\n' +
+        "export const copy = table`CREATE TABLE shop.copy (id UInt64) ENGINE = MergeTree ORDER BY ${(events as any).columns.nope}`;\n",
+    );
+    const result = await lintCommand({ path: root, format: "stylish" });
+    expect(result.success).toBe(false);
+    const failures = result.diagnostics.filter((d) => d.ruleId === BUILD_FAILURE_RULE_ID);
+    expect(failures.length, result.output).toBeGreaterThan(0);
+    expect(failures.every((d) => d.severity === "error")).toBe(true);
+    expect(failures.map((d) => d.message).join("\n")).toContain("is undefined");
+    expect(result.diagnostics.some((d) => d.ruleId === "SQLCH101")).toBe(false);
+  });
+});

package/src/cli/commands/lint.ts

@@ -1,4 +1,4 @@
-import { resolve, join, relative } from "path";
+import { resolve, join, relative, dirname } from "path";
 import type { BuildParamProvenance } from "../../provenance";
 import { readFileSync, writeFileSync, readdirSync } from "fs";
 import { runLint, parseDisableComments } from "../../lint/engine";
@@ -24,6 +24,14 @@ import { walkDiscovery, workspaceMemberDirs } from "../../discovery/walk";
 import { buildParamValues, resolveBuildParams } from "../../build-params";
 import { setBuildParams } from "../../params";
 import { isNoLexiconDetected } from "../../detectLexicon";
+import { build } from "../../build";
+import { loadChantConfigUpward, resolveOwnershipEnv, resolveOwnershipMarker } from "../../config";
+import { resolveBuildModes, resolveProjectBuildOptions } from "../build-options";
+import { resolveTelemetryAttribution } from "../../telemetry-attribution";
+import { applyConfiguredPreset, applyConfiguredSeverity, resolvePresetIds } from "../../lint/config";
+import { applyInlineSuppressions } from "../../lint/suppressions";
+import { getProvenance } from "../../provenance";
+import { runLexiconPostSynthChecks } from "./build";
 
 // Import config loader
 import { loadConfig, resolveRulesForFile, resolveConfiguredSeverity, findProjectRoot } from "../../lint/config";
@@ -130,6 +138,16 @@ function lexiconResolutionDiagnostic(projectRoot: string, error: Error): LintDia
   };
 }
 
+/**
+ * The diagnostic id `chant lint` reports a lint target that does not build
+ * under (chant #3750). The lexicons' post-synth checks read a build result, so
+ * when the build fails they cannot run; this says so instead of letting the
+ * lint pass in silence. Like {@link LEXICON_RESOLUTION_RULE_ID} it is not a
+ * rule: it has no severity setting and no disable form. The message is the
+ * build's own.
+ */
+export const BUILD_FAILURE_RULE_ID = "LEX002";
+
 /**
  * The plugins of lexicons that the project's source imports from and that are not in `configured`, for their
  * property-kind class names (#3184). A package that is not installed, or that fails to load, is skipped.
@@ -295,6 +313,13 @@ export interface LintOptions {
    * `sandbox` option (../../components/discover.ts).
    */
   sandbox?: boolean;
+  /**
+   * chant #3750 — run each loaded lexicon's post-synth checks over an
+   * in-memory build of the target (default `true`, what the CLI always does).
+   * `false` lints source alone; it exists for test harnesses that check an
+   * example's source rules, not for hiding findings from a user.
+   */
+  postSynth?: boolean;
 }
 
 /**
@@ -630,6 +655,132 @@ async function runOpCheckDiagnostics(
   return { diagnostics, suppressed };
 }
 
+/**
+ * Run each loaded lexicon's own post-synth checks (#3750), the ones `chant
+ * build` runs after it serializes, over an in-memory build of the lint target.
+ *
+ * The build is `chant build`'s: the same `build()` call with options from the
+ * same assembler (`../build-options.ts`), and the same per-lexicon scoping of
+ * outputs (`runLexiconPostSynthChecks`, ./build.ts). Nothing is written. It
+ * builds `infraPath`, the target the caller asked to lint, never the project
+ * root above it, so `chant lint <dir>` costs a build of `<dir>` and nothing
+ * more (the same scoping {@link runOpCheckDiagnostics} documents). It is
+ * skipped outright when no loaded lexicon ships post-synth checks, which keeps
+ * a project with no lexicon, and every core-only fixture, from building at
+ * all.
+ *
+ * A target that does not build reports each build error under
+ * {@link BUILD_FAILURE_RULE_ID} and skips the checks. Findings go through
+ * `lint.presets`, then `lint.rules`, then inline `chant-ignore` comments, the
+ * order `chant build` applies them in. A finding carries no line (see
+ * ../../lint/post-synth.ts's `PostSynthDiagnostic`), so it is reported at
+ * `1:1` in the file that declared its entity, or at the config file (the
+ * project root without one) when it names none.
+ */
+async function runLexiconPostSynthDiagnostics(
+  infraPath: string,
+  plugins: readonly LexiconPlugin[],
+  buildParams?: BuildParamProvenance[],
+  sandbox?: boolean,
+): Promise<{ diagnostics: LintDiagnostic[]; suppressed: Array<LintDiagnostic & { reason?: string }> }> {
+  const diagnostics: LintDiagnostic[] = [];
+  const suppressed: Array<LintDiagnostic & { reason?: string }> = [];
+  const withChecks = plugins.filter((plugin) => (plugin.postSynthChecks?.() ?? []).length > 0);
+  if (withChecks.length === 0) return { diagnostics, suppressed };
+
+  const projectRoot = findProjectRoot(infraPath);
+  const lintConfig = loadConfig(projectRoot);
+  // Where a finding that names no declared entity is reported: the config the
+  // build loads once it is known (past a lint-only fragment), else the nearest.
+  let fallbackFile = findProjectConfig(projectRoot).configPath ?? projectRoot;
+  const buildFailure = (message: string, at?: { file?: string; line?: number; column?: number }): LintDiagnostic => ({
+    file: at?.file ?? fallbackFile,
+    line: at?.line ?? 1,
+    column: at?.column ?? 1,
+    ruleId: BUILD_FAILURE_RULE_ID,
+    severity: "error",
+    message,
+  });
+
+  let result: Awaited<ReturnType<typeof build>>;
+  let env: string | undefined;
+  let telemetry: Awaited<ReturnType<typeof resolveTelemetryAttribution>>;
+  try {
+    const loaded = await loadChantConfigUpward(infraPath);
+    const config = loaded.config;
+    const configDir = loaded.configPath ? dirname(loaded.configPath) : infraPath;
+    if (loaded.configPath) fallbackFile = loaded.configPath;
+    // The caller's parameters when it resolved them (the CLI does, from the
+    // same upward config walk); otherwise the declared defaults and `env`
+    // mappings of the config this build loads. Not lintCommand's own fallback:
+    // that one reads the config at the lint root, which may be a lint-only
+    // fragment with no `buildParams` (a `src/chant.config.json`).
+    const params = buildParams ?? resolveBuildParams(config.buildParams, { env: process.env }).provenance;
+    env = resolveOwnershipEnv(config, params);
+    telemetry = await resolveTelemetryAttribution(configDir, config as unknown as Record<string, unknown>, env);
+    // Every lexicon the lint loaded, as `chant build` serializes with every
+    // lexicon it loaded: a check may read another lexicon's entities, and the
+    // outputs are scoped per plugin below either way.
+    result = await build(
+      infraPath,
+      plugins.map((plugin) => plugin.serializer),
+      undefined,
+      resolveProjectBuildOptions({
+        config,
+        configDir,
+        plugins,
+        modes: resolveBuildModes(config, { sandbox }),
+        ownership: resolveOwnershipMarker(config, params),
+        buildParams: params,
+        telemetry,
+      }),
+    );
+  } catch (err) {
+    diagnostics.push(buildFailure(err instanceof Error ? err.message : String(err)));
+    return { diagnostics, suppressed };
+  }
+
+  if (result.errors.length > 0) {
+    const seen = new Set<string>();
+    for (const error of result.errors) {
+      const at = error as unknown as { file?: string; line?: number; column?: number };
+      const key = `${at.file ?? ""}:${at.line ?? ""}:${error.message}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      diagnostics.push(buildFailure(error.message, at));
+    }
+    return { diagnostics, suppressed };
+  }
+
+  const activityContracts = await loadActivityContracts(plugins);
+  const fileOf = (entity?: string): string => {
+    const declared = entity ? result.entities.get(entity) : undefined;
+    return (declared && getProvenance(declared)?.sourceFile) || fallbackFile;
+  };
+  const toLint = (d: { checkId: string; severity: LintDiagnostic["severity"]; message: string; entity?: string; lexicon?: string }): LintDiagnostic => ({
+    file: fileOf(d.entity),
+    line: 1,
+    column: 1,
+    ruleId: d.checkId,
+    severity: d.severity,
+    message: `${d.entity ? `[${d.entity}] ` : ""}${d.message}`,
+  });
+
+  for (const { plugin, diagnostics: raw } of runLexiconPostSynthChecks(withChecks, result, env, { activityContracts, telemetry })) {
+    const presetIds = resolvePresetIds(plugin.lintPresets?.(), lintConfig.presets?.[plugin.name] ?? "recommended");
+    const afterPreset = applyConfiguredPreset(raw, presetIds, lintConfig.rules).diagnostics;
+    const afterConfig = applyConfiguredSeverity(afterPreset, lintConfig.rules).diagnostics;
+    const inline = applyInlineSuppressions(afterConfig, result.entities, lintConfig.rules);
+    for (const d of inline.diagnostics) diagnostics.push(toLint(d));
+    for (const d of inline.suppressed) suppressed.push({ ...toLint(d), reason: "chant-ignore" });
+    for (const m of inline.meta) {
+      diagnostics.push({ file: m.file, line: m.line, column: 1, ruleId: m.checkId, severity: m.severity, message: m.message });
+    }
+  }
+
+  return { diagnostics, suppressed };
+}
+
 /**
  * Apply fixes to a file
  */
@@ -817,6 +968,16 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
     suppressed.push(...postOpResult.suppressed);
   }
 
+  // chant #3750: each lexicon's own post-synth checks, over an in-memory
+  // build of the lint target. Run once, after any `--fix` above, so it sees
+  // the source as fixed; a post-synth finding has no fix of its own. Skipped
+  // when a lexicon failed to resolve, which LEX001 below already reports.
+  if (!loaded.lexiconError && options.postSynth !== false) {
+    const lexiconResult = await runLexiconPostSynthDiagnostics(infraPath, loaded.plugins, options.buildParams, options.sandbox);
+    diagnostics.push(...lexiconResult.diagnostics);
+    suppressed.push(...lexiconResult.suppressed);
+  }
+
   // chant #2222: a lexicon the project declared but this run could not
   // resolve. Appended here, after the `--fix` re-lint block above has finished
   // reassigning `diagnostics`, so it survives every path; it is a property of