@intentius/chant 0.122.0 → 0.124.0

package/dist/workspace/trust/gate-seal.d.ts

@@ -0,0 +1,96 @@
+/**
+ * A gate approval's seal (#3163, ws-080), checked with node:crypto (#3763).
+ *
+ * `chant approve --sign` seals an approval with `ssh-keygen -Y sign` in the
+ * `chant-gate` namespace, over {@link gateSealPayload}. Signing shells to
+ * ssh-keygen; checking does not. This module checks a seal with node:crypto
+ * and no zod, and `checkGateSeal` (`./seal.ts`) and `sealedApprovalRule` use
+ * it, so an apply job needs no ssh-keygen. A tool that decides a gate from one bundled file
+ * (terragucci's apply job) runs the same rule: `@intentius/chant/gate-decision`
+ * exports it.
+ *
+ * An SSHSIG (OpenSSH's PROTOCOL.sshsig) holds the public key, the namespace,
+ * the hash algorithm and the signature over `"SSHSIG"`, the namespace, the
+ * reserved field, the algorithm and the message's hash. Ed25519, ECDSA (P-256,
+ * P-384, P-521), RSA with SHA-2, and the security-key forms of Ed25519 and
+ * P-256 verify, with the touch flag required, as ssh-keygen requires it for a
+ * signers line with no `no-touch-required` option (which the signers parser
+ * does not accept). An RSA signature over SHA-1 does not verify.
+ */
+import type { Signer } from "./trust-files.js";
+/**
+ * The ssh signature namespace of a gate approval's seal (#3163, ws-080), so a
+ * verdict, record or commit signature can't stand in for one.
+ */
+export declare const GATE_SEAL_NAMESPACE = "chant-gate";
+/** The gate approval a seal covers (#3163): the fields of a gate resolution line that say what was approved, by whom and when. */
+export interface SealedGateApproval {
+    op: string;
+    gate: string;
+    environment?: string;
+    planDigest?: string;
+    resolvedBy: string;
+    /** Who relayed the approval for `resolvedBy` (#3402), when someone did. */
+    relayedBy?: string;
+    timestamp: string;
+    seal?: unknown;
+}
+/**
+ * The bytes a gate approval's seal signs (#3163): the op (or component), the
+ * gate, the environment, the plan digest, the approver and the time, joined
+ * by LF with no final newline. An approval that binds no environment or plan
+ * signs an empty line for it. A relayed approval (#3402) signs a seventh line,
+ * `relayed-by <principal>`, so the relay can't be added, changed or removed
+ * after sealing; an approval nobody relayed signs the six lines it always did,
+ * so seals made before #3402 still verify.
+ */
+export declare function gateSealPayload(a: SealedGateApproval): Buffer;
+/** `SHA256:<base64>`, the fingerprint ssh-keygen prints for a public key blob. */
+export declare function sshKeyFingerprint(blob: Buffer): string;
+/** What {@link verifySshSignatureWith} found. */
+export type SshSignatureCheck = {
+    ok: true;
+    key: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Whether `armored`, an SSHSIG as `ssh-keygen -Y sign` writes it, signs
+ * `message` in `namespace` with one of `keys` (public key blobs, ssh wire
+ * format). Never throws. On success, `key` is the signing key's fingerprint.
+ */
+export declare function verifySshSignatureWith(armored: string, message: Buffer, namespace: string, keys: readonly Buffer[]): SshSignatureCheck;
+/**
+ * The key blob an armored SSHSIG carries, or null when it is not one. For
+ * `ssh-keygen -Y check-novalidate`'s question, whether the signature is
+ * intact whoever's key it is: verify against this key.
+ */
+export declare function sshSignatureKey(armored: string): Buffer | null;
+/**
+ * The signers a sealed gate is judged by, read at base. chant's own
+ * `TrustPolicy` (`./policy.ts`) is one; `gateSignersAt` in
+ * `@intentius/chant/gate-decision` reads one without zod.
+ */
+export interface GateSigners {
+    /** The commit the signers were read at, or null when there is no base. */
+    base: string | null;
+    /** The signers path used. */
+    signersPath: string;
+    /** Whether a signers file exists at base. False: no seal verifies, so a sealed gate passes nothing. */
+    active: boolean;
+    signers: Signer[];
+    /** Why the trust config could not be read, when it could not. `active` is false then. */
+    problems: string[];
+}
+/** Whether ssh-keygen's `namespaces="..."` pattern list admits `namespace`: a `*`/`?` pattern matches, and a `!` pattern that matches refuses. */
+export declare function namespaceAllowed(list: string | undefined, namespace: string): boolean;
+/**
+ * Why this approval does not count toward a sealed gate, or null when it
+ * does: its seal verifies, for the approver it names, against a key `signers`
+ * lists for that approver in the `chant-gate` namespace. With no signers file
+ * at base, nothing counts. The same rule as `sealedApprovalRule` in
+ * `../../op/gate-review.ts`, which checks with ssh-keygen.
+ */
+export declare function gateSealRefusal(signers: GateSigners, a: SealedGateApproval): string | null;
+//# sourceMappingURL=gate-seal.d.ts.map

package/dist/workspace/trust/gate-seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/gate-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD,kIAAkI;AAClI,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAG7D;AA8BD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAmCD,iDAAiD;AACjD,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CA0CtI;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU9D;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID,kJAAkJ;AAClJ,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAYrF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAmB1F"}

package/dist/workspace/trust/policy.d.ts

@@ -22,47 +22,8 @@
  */
 import { z } from "zod";
 import type { RecordSource } from "../record-source.js";
-/** The trust config, relative to the repository root. Fixed: it is how the signers path is overridden. */
-export declare const TRUST_CONFIG_PATH = ".chant/trust.json";
-/** Where the signers are when `trust.json` names no other path. */
-export declare const DEFAULT_SIGNERS_PATH = ".chant/allowed_signers";
-/** One usable signer: a principal and the public key it signs with. */
-export interface Signer {
-    principal: string;
-    /** `<type> <base64>`, with no comment. */
-    key: string;
-    /** The `namespaces="..."` option as written, or undefined when the key may sign any namespace. */
-    namespaces?: string;
-    /** 1-based line in the signers file. */
-    line: number;
-}
-/** A line of the signers file that is not used, and why. */
-export interface ExcludedSigner {
-    line: number;
-    reason: string;
-}
-export interface SignerSet {
-    signers: Signer[];
-    excluded: ExcludedSigner[];
-}
-/**
- * Parse an allowed_signers file, keeping only lines whose meaning does not
- * depend on anything the signer controls.
- *
- * Refused, each with a reason, rather than passed to ssh-keygen:
- *
- * - `valid-after` and `valid-before`. git checks them against the commit's own
- *   date, which whoever makes the commit sets. A backdated commit would pass a
- *   window its key has left. Revocation is by position in history (#2553),
- *   never by date.
- * - `cert-authority`. A certificate's validity is also a date, and a CA key
- *   vouches for keys this file never names.
- * - Principal patterns (`*`, `?`, `!`). A signer is named by one exact
- *   principal, so role grants can name it.
- */
-export declare function parseAllowedSigners(text: string): SignerSet;
-/** The signers as an allowed_signers file ssh-keygen reads, holding only the usable lines. */
-export declare function renderAllowedSigners(signers: Signer[]): string;
+import { type ExcludedSigner, type Signer } from "./trust-files.js";
+export { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, renderAllowedSigners, type ExcludedSigner, type Signer, type SignerSet, } from "./trust-files.js";
 export declare const trustConfigSchema: z.ZodObject<{
     schema: z.ZodLiteral<1>;
     signers: z.ZodOptional<z.ZodString>;

package/dist/workspace/trust/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,0GAA0G;AAC1G,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAe7D,uEAAuE;AACvE,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAmDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAkD3D;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAM9D;AAcD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;kBA4DnB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,+FAA+F;AAC/F,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,kEAAkE;AAClE,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,qEAAqE;IACrE,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,iDAAiD;IACjD,eAAe,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,iHAAiH;IACjH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/E;AAED,0HAA0H;AAC1H,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAG5D;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAI9D;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,GAAE,MAAM,EAAO,GAAG,WAAW,CAErF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAiDtF;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,CAE3E;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKnF"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAgE,KAAK,cAAc,EAAE,KAAK,MAAM,EAAE,MAAM,eAAe,CAAC;AAE/H,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,eAAe,CAAC;AAcvB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;kBA4DnB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,+FAA+F;AAC/F,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,kEAAkE;AAClE,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,qEAAqE;IACrE,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,iDAAiD;IACjD,eAAe,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,iHAAiH;IACjH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/E;AAED,0HAA0H;AAC1H,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAG5D;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAI9D;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,GAAE,MAAM,EAAO,GAAG,WAAW,CAErF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAiDtF;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,CAE3E;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKnF"}

package/dist/workspace/trust/seal.d.ts

@@ -23,15 +23,12 @@
  */
 import type { SealCode } from "../records.js";
 import { type TrustPolicy } from "./policy.js";
+import { type SealedGateApproval } from "./gate-seal.js";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, type SealedGateApproval } from "./gate-seal.js";
 /** The ssh signature namespace of a verdict seal. */
 export declare const REVIEW_SEAL_NAMESPACE = "chant-review";
 /** The ssh signature namespace of a record's author seal (#2688). */
 export declare const RECORD_SEAL_NAMESPACE = "chant-record";
-/**
- * The ssh signature namespace of a gate approval's seal (#3163, ws-080), so a
- * verdict, record or commit signature can't stand in for one.
- */
-export declare const GATE_SEAL_NAMESPACE = "chant-gate";
 /** A seal as a review entry holds it. */
 export interface VerdictSeal {
     /** The principal who signed: the reviewer, as the signers file names them. */
@@ -68,28 +65,6 @@ export declare function reviewSealPayload(record: string, digest: string, verdic
  * states signs an empty last line.
  */
 export declare function recordSealPayload(record: string, digest: string, author: string, state: string | null): Buffer;
-/** The gate approval a seal covers (#3163): the fields of a gate resolution line that say what was approved, by whom and when. */
-export interface SealedGateApproval {
-    op: string;
-    gate: string;
-    environment?: string;
-    planDigest?: string;
-    resolvedBy: string;
-    /** Who relayed the approval for `resolvedBy` (#3402), when someone did. */
-    relayedBy?: string;
-    timestamp: string;
-    seal?: unknown;
-}
-/**
- * The bytes a gate approval's seal signs (#3163): the op (or component), the
- * gate, the environment, the plan digest, the approver and the time, joined
- * by LF with no final newline. An approval that binds no environment or plan
- * signs an empty line for it. A relayed approval (#3402) signs a seventh line,
- * `relayed-by <principal>`, so the relay can't be added, changed or removed
- * after sealing; an approval nobody relayed signs the six lines it always did,
- * so seals made before #3402 still verify.
- */
-export declare function gateSealPayload(a: SealedGateApproval): Buffer;
 /** The record an author seal covers (#2688). */
 export interface SealedRecord {
     record: string | null;

package/dist/workspace/trust/seal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kKAAkK;IAClK,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvH;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9G;AAED,kIAAkI;AAClI,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAG7D;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf;AAoBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,GAAG,SAAS,CAYjF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,GAAG,SAAS,CAgB/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,SAAS,CASnF;AAkED,oCAAoC;AACpC,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAuBzG;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE9I;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAEpI;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,GAAG,WAAW,CAEpF"}
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAmG,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEvJ,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE5F,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kKAAkK;IAClK,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvH;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9G;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf;AAoBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,GAAG,SAAS,CAYjF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,GAAG,SAAS,CAgB/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,SAAS,CASnF;AAgFD,oCAAoC;AACpC,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAuBzG;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE9I;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAEpI;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,GAAG,WAAW,CAEpF"}

package/dist/workspace/trust/trust-files.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The trust files' plain readers (#3763): the signers file's parser, and a
+ * check of `.chant/trust.json` that says what `./policy.ts`'s zod schema
+ * says, so a bundle can read both without zod. `./policy.ts` re-exports the
+ * parser; `trust-files.test.ts` holds the check to the schema.
+ */
+/** The trust config, relative to the repository root. Fixed: it is how the signers path is overridden. */
+export declare const TRUST_CONFIG_PATH = ".chant/trust.json";
+/** Where the signers are when `trust.json` names no other path. */
+export declare const DEFAULT_SIGNERS_PATH = ".chant/allowed_signers";
+/** One usable signer: a principal and the public key it signs with. */
+export interface Signer {
+    principal: string;
+    /** `<type> <base64>`, with no comment. */
+    key: string;
+    /** The `namespaces="..."` option as written, or undefined when the key may sign any namespace. */
+    namespaces?: string;
+    /** 1-based line in the signers file. */
+    line: number;
+}
+/** A line of the signers file that is not used, and why. */
+export interface ExcludedSigner {
+    line: number;
+    reason: string;
+}
+export interface SignerSet {
+    signers: Signer[];
+    excluded: ExcludedSigner[];
+}
+/**
+ * Parse an allowed_signers file, keeping only lines whose meaning does not
+ * depend on anything the signer controls.
+ *
+ * Refused, each with a reason, rather than passed to ssh-keygen:
+ *
+ * - `valid-after` and `valid-before`. git checks them against the commit's own
+ *   date, which whoever makes the commit sets. A backdated commit would pass a
+ *   window its key has left. Revocation is by position in history (#2553),
+ *   never by date.
+ * - `cert-authority`. A certificate's validity is also a date, and a CA key
+ *   vouches for keys this file never names.
+ * - Principal patterns (`*`, `?`, `!`). A signer is named by one exact
+ *   principal, so role grants can name it.
+ */
+export declare function parseAllowedSigners(text: string): SignerSet;
+/** The signers as an allowed_signers file ssh-keygen reads, holding only the usable lines. */
+export declare function renderAllowedSigners(signers: Signer[]): string;
+/** A repository-relative path: no `..`, not absolute, `/` separators. */
+export declare function isRepoPath(p: unknown): p is string;
+/**
+ * What is wrong with a parsed `.chant/trust.json`, one line per field, or an
+ * empty list when it is valid. It accepts exactly what `trustConfigSchema`
+ * in `./policy.ts` accepts, so a reader without zod treats a file as chant
+ * does: an invalid one turns attestation off.
+ */
+export declare function trustConfigProblems(raw: unknown): string[];
+//# sourceMappingURL=trust-files.d.ts.map

package/dist/workspace/trust/trust-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-files.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/trust-files.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,0GAA0G;AAC1G,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAe7D,uEAAuE;AACvE,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAmDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAkD3D;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAM9D;AASD,yEAAyE;AACzE,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAElD;AAOD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CA8C1D"}

package/dist/workspace/work-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"work-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/work-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAaL,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAmC,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAKrG,0DAA0D;AAC1D,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,2BAA2B,sFAAsF,CAAC;AAE/H,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAQnF,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AAErD,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,kKAQa,CAAC;AAC3C,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,UAAU,OAAO;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,MAAM,iBAAiB,GAAG,OAAO,GACrC,CACE;IACE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,iBAAiB,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;CAC9F,GACD;IAAE,KAAK,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CACpD,CAAC;AAEJ,uDAAuD;AACvD,qBAAa,SAAU,SAAQ,KAAK;IAEhC,QAAQ,CAAC,IAAI,EAAE,aAAa;IAD9B,YACW,IAAI,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,EAGhB;CACF;AAED,0GAA0G;AAC1G,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CA0C5G;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8EAA8E;AAC9E,wBAAsB,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+BjF;AAQD,mFAAmF;AACnF,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,0FAA0F,CAAC;AAErI,+CAA+C;AAC/C,eAAO,MAAM,wBAAwB,uHAMK,CAAC;AAC3C,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;AAEhE,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,QAAQ,CAAC;IAChB,yCAAyC;IACzC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACxF;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,mGAAmG;IACnG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uEAAuE;IACvE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,8EAA8E;IAC9E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,MAAM,mBAAmB,GAC3B;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,gGAAgG;IAChG,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,uHAAuH;IACvH,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG;QAAE,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC1E,gCAAgC;IAChC,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,+CAA+C;IAC/C,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAC7H,qDAAqD;IACrD,QAAQ,EAAE,YAAY,CAAC;IACvB,sDAAsD;IACtD,IAAI,EAAE,WAAW,EAAE,CAAC;CACrB,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,oBAAoB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEjH,wFAAwF;AACxF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,IAAI,GAAE,SAAS,WAAW,EAAO,GAAG,UAAU,EAAE,CAwB5J;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAKhH;AAED,gDAAgD;AAChD,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,CAG5F;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiC/G;AAED,yCAAyC;AACzC,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,MAAM,CAahG;AAiFD,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8C3E"}
+{"version":3,"file":"work-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/work-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAcL,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAmC,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAKrG,0DAA0D;AAC1D,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,2BAA2B,sFAAsF,CAAC;AAE/H,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAQnF,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AAErD,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,kKAQa,CAAC;AAC3C,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,UAAU,OAAO;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,MAAM,iBAAiB,GAAG,OAAO,GACrC,CACE;IACE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,iBAAiB,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;CAC9F,GACD;IAAE,KAAK,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CACpD,CAAC;AAEJ,uDAAuD;AACvD,qBAAa,SAAU,SAAQ,KAAK;IAEhC,QAAQ,CAAC,IAAI,EAAE,aAAa;IAD9B,YACW,IAAI,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,EAGhB;CACF;AAED,0GAA0G;AAC1G,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CA0C5G;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8EAA8E;AAC9E,wBAAsB,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgCjF;AAQD,mFAAmF;AACnF,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,0FAA0F,CAAC;AAErI,+CAA+C;AAC/C,eAAO,MAAM,wBAAwB,uHAMK,CAAC;AAC3C,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;AAEhE,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,QAAQ,CAAC;IAChB,yCAAyC;IACzC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACxF;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,mGAAmG;IACnG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uEAAuE;IACvE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,8EAA8E;IAC9E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,MAAM,mBAAmB,GAC3B;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,gGAAgG;IAChG,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,uHAAuH;IACvH,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG;QAAE,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC1E,gCAAgC;IAChC,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,+CAA+C;IAC/C,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAC7H,qDAAqD;IACrD,QAAQ,EAAE,YAAY,CAAC;IACvB,sDAAsD;IACtD,IAAI,EAAE,WAAW,EAAE,CAAC;CACrB,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,oBAAoB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEjH,wFAAwF;AACxF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,IAAI,GAAE,SAAS,WAAW,EAAO,GAAG,UAAU,EAAE,CAwB5J;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAKhH;AAED,gDAAgD;AAChD,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,CAG5F;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiC/G;AAED,yCAAyC;AACzC,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,MAAM,CAahG;AAiFD,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8C3E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.122.0",
+  "version": "0.124.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -50,6 +50,7 @@
       "default": "./src/cli/index.ts"
     },
     "./workspace/*.schema.json": "./src/workspace/*.schema.json",
+    "./notify.schema.json": "./src/notify.schema.json",
     "./workspace/factory-rules": {
       "development": "./src/workspace/factory-rules.ts",
       "types": "./dist/workspace/factory-rules.d.ts",
@@ -95,6 +96,18 @@
       "types": "./dist/agents/index.d.ts",
       "default": "./src/agents/index.ts"
     },
+    "./notify-verify": {
+      "development": "./src/notify-verify.ts",
+      "types": "./dist/notify-verify.d.ts",
+      "import": "./dist/notify-verify.js",
+      "default": "./src/notify-verify.ts"
+    },
+    "./notify": {
+      "development": "./src/notify.ts",
+      "types": "./dist/notify.d.ts",
+      "import": "./dist/notify.js",
+      "default": "./src/notify.ts"
+    },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
@@ -102,7 +115,7 @@
     }
   },
   "scripts": {
-    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete",
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) ! -path dist/notify.js ! -path dist/notify-verify.js -delete",
     "prepack": "npm run build"
   },
   "dependencies": {

package/src/cli/commands/build.ts

@@ -585,7 +585,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   }
 
   if (result.errors.length === 0 && options.plugins) {
-    for (const { plugin, diagnostics: postDiags } of runLexiconPostSynthChecks(options.plugins, result, env, { activityContracts, telemetry })) {
+    for (const { plugin, diagnostics: postDiags } of runLexiconPostSynthChecks(options.plugins, result, env, { activityContracts, telemetry, projectDir: configDir, projectConfig: config as unknown as Record<string, unknown> })) {
       // `lint.presets` (chant #2113) filters WHICH check ids are reported at
       // all, before `lint.rules`/inline suppression act on the reported
       // ones. It's a no-op for a lexicon that ships no `lintPresets()` (the

package/src/cli/commands/check-lexicon.ts

@@ -709,7 +709,9 @@ export async function checkLexicon(dir: string): Promise<CheckResult> {
     pass: hasTypecheckTest,
   });
 
-  const hasRoundtripTest = findFiles(join(dir, "src"), (n) => n === "roundtrip.test.ts").length > 0;
+  // A round trip over a large corpus can be an end-to-end test, kept out of the unit project's
+  // per-test budget under the e2e name.
+  const hasRoundtripTest = findFiles(join(dir, "src"), (n) => n === "roundtrip.test.ts" || n === "roundtrip.e2e.test.ts").length > 0;
   items.push({
     name: "roundtrip.test.ts exists",
     tier: 3,

package/src/cli/commands/lint-post-synth.e2e.test.ts

@@ -0,0 +1,117 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { lintCommand, BUILD_FAILURE_RULE_ID } from "./lint";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { mkdtempSync, realpathSync, symlinkSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+// Each case builds a small project against the workspace's sql lexicon and runs its post-synth
+// checks; the first loads the lexicon and took 3.1s on CI, near the unit project's 5s budget, so the
+// block is an e2e file (#3793). The rest of lintCommand's tests are in lint.test.ts.
+
+/**
+ * chant #3750 — `chant lint` runs each loaded lexicon's own post-synth checks
+ * over an in-memory build of the lint target, the ones `chant build` runs.
+ * The sql lexicon's SQLCH101 is the issue's repro: `ENGINE = MergeTre` failed
+ * the build and linted clean. The project imports the workspace's sql
+ * lexicon through a `node_modules` link, as an installed project would.
+ */
+describe("lintCommand — lexicon post-synth checks (#3750)", () => {
+  const repoNodeModules = resolve(fileURLToPath(new URL(".", import.meta.url)), "../../../../../node_modules");
+  let root: string;
+
+  const schema = (engine: string, idType = "UInt64") =>
+    'import { database, table } from "@intentius/chant-lexicon-sql/clickhouse";\n' +
+    "export const shopDb = database`CREATE DATABASE shop ENGINE = Atomic`;\n" +
+    "export const events = table`\n" +
+    `  CREATE TABLE \${shopDb}.events (id ${idType}, kind String)\n` +
+    `  ENGINE = ${engine}\n` +
+    "  ORDER BY (kind, id)`;\n";
+
+  async function project(engine: string, rules?: Record<string, string>, idType?: string): Promise<void> {
+    await writeFile(
+      join(root, "chant.config.json"),
+      JSON.stringify({ lexicons: ["sql"], sql: { dialect: "clickhouse" }, ...(rules ? { lint: { rules } } : {}) }),
+    );
+    await writeFile(join(root, "src", "schema.ts"), schema(engine, idType));
+  }
+
+  beforeEach(async () => {
+    root = realpathSync(mkdtempSync(join(tmpdir(), "chant-3750-")));
+    await mkdir(join(root, "src"), { recursive: true });
+    symlinkSync(repoNodeModules, join(root, "node_modules"), "dir");
+    process.env.NO_COLOR = "1";
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+    delete process.env.NO_COLOR;
+  });
+
+  test("a lexicon post-synth error fails the lint, at the project root and at src", async () => {
+    await project("MergeTre");
+    for (const path of [root, join(root, "src")]) {
+      const result = await lintCommand({ path, format: "stylish" });
+      expect(result.success).toBe(false);
+      const diag = result.diagnostics.find((d) => d.ruleId === "SQLCH101");
+      expect(diag, result.output).toBeDefined();
+      expect(diag!.severity).toBe("error");
+      expect(diag!.message).toContain('"MergeTre"');
+      // No line of its own: reported at 1:1 in the file that declared the table.
+      expect(diag!.file).toBe(join(root, "src", "schema.ts"));
+      expect([diag!.line, diag!.column]).toEqual([1, 1]);
+      expect(result.output).toContain("SQLCH101");
+    }
+  });
+
+  test("a column type the pinned server does not have is reported (SQLCH121)", async () => {
+    await project("MergeTree", undefined, "UInt46");
+    const result = await lintCommand({ path: root, format: "stylish" });
+    expect(result.success).toBe(false);
+    const diag = result.diagnostics.find((d) => d.ruleId === "SQLCH121");
+    expect(diag, result.output).toBeDefined();
+    expect(diag!.message).toContain("UInt46");
+  });
+
+  test("postSynth: false lints source alone", async () => {
+    await project("MergeTre");
+    const result = await lintCommand({ path: root, format: "stylish", postSynth: false });
+    expect(result.diagnostics.some((d) => d.ruleId === "SQLCH101")).toBe(false);
+  });
+
+  test("a clean project reports nothing from the post-synth pass", async () => {
+    await project("MergeTree");
+    const result = await lintCommand({ path: root, format: "stylish" });
+    expect(result.diagnostics.filter((d) => /^SQL|^LEX/.test(d.ruleId)), result.output).toEqual([]);
+  });
+
+  test("lint.rules overrides a post-synth finding's severity, and turns it off", async () => {
+    await project("MergeTre", { SQLCH101: "warning" });
+    const warned = await lintCommand({ path: root, format: "stylish" });
+    expect(warned.diagnostics.find((d) => d.ruleId === "SQLCH101")?.severity).toBe("warning");
+    expect(warned.success).toBe(true);
+
+    await project("MergeTre", { SQLCH101: "off" });
+    const off = await lintCommand({ path: root, format: "stylish" });
+    expect(off.diagnostics.some((d) => d.ruleId === "SQLCH101")).toBe(false);
+  });
+
+  test("a target that does not build reports the build error and skips the checks", async () => {
+    await project("MergeTre");
+    // A table interpolating a name that is not declared does not build.
+    await writeFile(
+      join(root, "src", "broken.ts"),
+      'import { table } from "@intentius/chant-lexicon-sql/clickhouse";\n' +
+        'import { events } from "./schema";\n' +
+        "export const copy = table`CREATE TABLE shop.copy (id UInt64) ENGINE = MergeTree ORDER BY ${(events as any).columns.nope}`;\n",
+    );
+    const result = await lintCommand({ path: root, format: "stylish" });
+    expect(result.success).toBe(false);
+    const failures = result.diagnostics.filter((d) => d.ruleId === BUILD_FAILURE_RULE_ID);
+    expect(failures.length, result.output).toBeGreaterThan(0);
+    expect(failures.every((d) => d.severity === "error")).toBe(true);
+    expect(failures.map((d) => d.message).join("\n")).toContain("is undefined");
+    expect(result.diagnostics.some((d) => d.ruleId === "SQLCH101")).toBe(false);
+  });
+});

package/src/cli/commands/lint.test.ts

@@ -1,12 +1,10 @@
 import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
-import { lintCommand, isLintRule, loadPluginRules, LEXICON_RESOLUTION_RULE_ID, BUILD_FAILURE_RULE_ID, type LintOptions } from "./lint";
+import { lintCommand, isLintRule, loadPluginRules, LEXICON_RESOLUTION_RULE_ID, type LintOptions } from "./lint";
 import { loadPlugins, resolveProjectLexicons } from "../plugins";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { execFileSync } from "node:child_process";
-import { mkdtempSync, realpathSync, symlinkSync } from "node:fs";
-import { fileURLToPath } from "node:url";
 import { params, setBuildParams } from "../../params";
 
 describe("lintCommand", () => {
@@ -887,7 +885,7 @@ describe("lintCommand — a declared lexicon that cannot be resolved (#2222)", (
  * `lintCommand` has no flags to read and passed nothing, so `params` stayed
  * empty and OPS012 reported the activity contract violated for source that
  * lints clean from a shell. That is how the root-examples gate
- * (examples/root-examples-gate.test.ts) went red on github-pr-preview while
+ * (examples/root-examples-gate.e2e.test.ts) went red on github-pr-preview while
  * `chant lint .` in the same directory exited 0, and it applied equally to
  * `handleLint` over MCP and to test-utils' example harness.
  *
@@ -962,108 +960,5 @@ describe("lintCommand build-time parameters (#2249)", () => {
   });
 });
 
-/**
- * chant #3750 — `chant lint` runs each loaded lexicon's own post-synth checks
- * over an in-memory build of the lint target, the ones `chant build` runs.
- * The sql lexicon's SQLCH101 is the issue's repro: `ENGINE = MergeTre` failed
- * the build and linted clean. The project imports the workspace's sql
- * lexicon through a `node_modules` link, as an installed project would.
- */
-describe("lintCommand — lexicon post-synth checks (#3750)", () => {
-  const repoNodeModules = resolve(fileURLToPath(new URL(".", import.meta.url)), "../../../../../node_modules");
-  let root: string;
-
-  const schema = (engine: string, idType = "UInt64") =>
-    'import { database, table } from "@intentius/chant-lexicon-sql/clickhouse";\n' +
-    "export const shopDb = database`CREATE DATABASE shop ENGINE = Atomic`;\n" +
-    "export const events = table`\n" +
-    `  CREATE TABLE \${shopDb}.events (id ${idType}, kind String)\n` +
-    `  ENGINE = ${engine}\n` +
-    "  ORDER BY (kind, id)`;\n";
-
-  async function project(engine: string, rules?: Record<string, string>, idType?: string): Promise<void> {
-    await writeFile(
-      join(root, "chant.config.json"),
-      JSON.stringify({ lexicons: ["sql"], sql: { dialect: "clickhouse" }, ...(rules ? { lint: { rules } } : {}) }),
-    );
-    await writeFile(join(root, "src", "schema.ts"), schema(engine, idType));
-  }
-
-  beforeEach(async () => {
-    root = realpathSync(mkdtempSync(join(tmpdir(), "chant-3750-")));
-    await mkdir(join(root, "src"), { recursive: true });
-    symlinkSync(repoNodeModules, join(root, "node_modules"), "dir");
-    process.env.NO_COLOR = "1";
-  });
-
-  afterEach(async () => {
-    await rm(root, { recursive: true, force: true });
-    delete process.env.NO_COLOR;
-  });
-
-  test("a lexicon post-synth error fails the lint, at the project root and at src", async () => {
-    await project("MergeTre");
-    for (const path of [root, join(root, "src")]) {
-      const result = await lintCommand({ path, format: "stylish" });
-      expect(result.success).toBe(false);
-      const diag = result.diagnostics.find((d) => d.ruleId === "SQLCH101");
-      expect(diag, result.output).toBeDefined();
-      expect(diag!.severity).toBe("error");
-      expect(diag!.message).toContain('"MergeTre"');
-      // No line of its own: reported at 1:1 in the file that declared the table.
-      expect(diag!.file).toBe(join(root, "src", "schema.ts"));
-      expect([diag!.line, diag!.column]).toEqual([1, 1]);
-      expect(result.output).toContain("SQLCH101");
-    }
-  });
-
-  test("a column type the pinned server does not have is reported (SQLCH121)", async () => {
-    await project("MergeTree", undefined, "UInt46");
-    const result = await lintCommand({ path: root, format: "stylish" });
-    expect(result.success).toBe(false);
-    const diag = result.diagnostics.find((d) => d.ruleId === "SQLCH121");
-    expect(diag, result.output).toBeDefined();
-    expect(diag!.message).toContain("UInt46");
-  });
-
-  test("postSynth: false lints source alone", async () => {
-    await project("MergeTre");
-    const result = await lintCommand({ path: root, format: "stylish", postSynth: false });
-    expect(result.diagnostics.some((d) => d.ruleId === "SQLCH101")).toBe(false);
-  });
-
-  test("a clean project reports nothing from the post-synth pass", async () => {
-    await project("MergeTree");
-    const result = await lintCommand({ path: root, format: "stylish" });
-    expect(result.diagnostics.filter((d) => /^SQL|^LEX/.test(d.ruleId)), result.output).toEqual([]);
-  });
-
-  test("lint.rules overrides a post-synth finding's severity, and turns it off", async () => {
-    await project("MergeTre", { SQLCH101: "warning" });
-    const warned = await lintCommand({ path: root, format: "stylish" });
-    expect(warned.diagnostics.find((d) => d.ruleId === "SQLCH101")?.severity).toBe("warning");
-    expect(warned.success).toBe(true);
-
-    await project("MergeTre", { SQLCH101: "off" });
-    const off = await lintCommand({ path: root, format: "stylish" });
-    expect(off.diagnostics.some((d) => d.ruleId === "SQLCH101")).toBe(false);
-  });
-
-  test("a target that does not build reports the build error and skips the checks", async () => {
-    await project("MergeTre");
-    // A table interpolating a name that is not declared does not build.
-    await writeFile(
-      join(root, "src", "broken.ts"),
-      'import { table } from "@intentius/chant-lexicon-sql/clickhouse";\n' +
-        'import { events } from "./schema";\n' +
-        "export const copy = table`CREATE TABLE shop.copy (id UInt64) ENGINE = MergeTree ORDER BY ${(events as any).columns.nope}`;\n",
-    );
-    const result = await lintCommand({ path: root, format: "stylish" });
-    expect(result.success).toBe(false);
-    const failures = result.diagnostics.filter((d) => d.ruleId === BUILD_FAILURE_RULE_ID);
-    expect(failures.length, result.output).toBeGreaterThan(0);
-    expect(failures.every((d) => d.severity === "error")).toBe(true);
-    expect(failures.map((d) => d.message).join("\n")).toContain("is undefined");
-    expect(result.diagnostics.some((d) => d.ruleId === "SQLCH101")).toBe(false);
-  });
-});
+// The lexicon post-synth pass over a project that imports the sql lexicon (#3750) builds
+// that project and loads the lexicon; it is in lint-post-synth.e2e.test.ts (#3793).