@intentius/chant 0.13.0 → 0.15.0

package/dist/components/verbs/vuln-scan.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Vulnerability scanning of an already-generated SBOM (#626, epic #551
+ * supply-chain follow-up to the SBOM stack #606/#613/#614/#609/#610). An SBOM
+ * says *what's in* an artifact; a scanner says *which of those have known
+ * CVEs*. This module produces findings; ./vex.ts suppresses the ones that
+ * don't matter and ./vuln-gate.ts fails the deploy on the ones that do.
+ *
+ * Prefer scanning the **SBOM** (already generated + persisted, keyed by
+ * digest) over re-scanning the image: deterministic (same SBOM -> same
+ * findings), fast, and reuses work already done. Real backends shell out to
+ * `grype`/`trivy` through the injectable `ProcessRunner` (./process-runner.ts),
+ * exactly like ./tool-sbom-generator.ts's deep-scan backend — tests inject a
+ * `MockVulnScanner` (./__tests__/mock-vuln-scanner.ts) and never invoke a real
+ * scanner, network, or vuln DB. The scanner's vuln DB currency is the tool's
+ * job, not chant's.
+ */
+import type { Capability } from "../capability.js";
+import type { SbomDocument } from "./sbom-generator.js";
+import { type ProcessRunner } from "./process-runner.js";
+/** CVE severity, highest to lowest. `unknown` sorts lowest so it never trips a threshold gate by accident. */
+export type Severity = "critical" | "high" | "medium" | "low" | "negligible" | "unknown";
+/** Severity rank (higher = more severe) so a gate can ask "severity >= critical". */
+export declare const SEVERITY_RANK: Record<Severity, number>;
+/** Normalize a scanner's free-form severity string ("High", "CRITICAL", "Negligible", …) to a `Severity`. Unrecognized -> `unknown`. */
+export declare function normalizeSeverity(raw: string | undefined): Severity;
+/** One known vulnerability affecting one package in the scanned artifact. */
+export interface VulnFinding {
+    /** Advisory id, e.g. `"CVE-2024-12345"` or `"GHSA-…"` — the join key with VEX statements (./vex.ts). */
+    cveId: string;
+    severity: Severity;
+    /** Affected package name. */
+    package: string;
+    installedVersion: string;
+    /** First version that fixes it, when the scanner reports one. */
+    fixedVersion?: string;
+    /** True when a fix exists (upgradeable) — the beginner-safe default gate blocks only fixable findings, since an unfixable one can't be actioned by bumping. */
+    fixable: boolean;
+}
+export interface ScanInput {
+    /** The SBOM to scan (the artifact's already-generated SPDX/CycloneDX doc). */
+    sbom: SbomDocument;
+    /** Artifact digest the SBOM belongs to — informational, for logging/keying. */
+    digest?: string;
+}
+/**
+ * Injectable vulnerability-scan boundary — the scan-side analogue of
+ * `SbomGenerator` (./sbom-generator.ts) and `CloudExecutor`
+ * (./cloud-executor.ts). A real implementation shells out to `grype`/`trivy`;
+ * tests substitute `MockVulnScanner` (./__tests__/mock-vuln-scanner.ts) and
+ * never touch a real tool, network, or vuln DB.
+ */
+export interface VulnScanner {
+    /** Scan an SBOM, returning every known vulnerability it surfaces. */
+    scan(input: ScanInput): Promise<VulnFinding[]>;
+}
+/** Which real CLI scanner a `ProcessRunner`-backed scanner shells out to. */
+export type ScannerTool = "grype" | "trivy";
+/** Parse `grype -o json` stdout into findings. Exported for tests to assert parsing without a live tool. */
+export declare function parseGrypeOutput(stdout: string): VulnFinding[];
+/** Parse `trivy sbom --format json` stdout into findings. */
+export declare function parseTrivyOutput(stdout: string): VulnFinding[];
+/**
+ * A real `VulnScanner` that writes the SBOM to a temp file and scans it with
+ * `grype` (default) or `trivy`, through the injectable `ProcessRunner`.
+ * `requireTool` throws `ToolNotAvailableError` if the scanner is absent — a
+ * missing scanner is a hard stop (like ./verify.ts's missing `cosign`), never
+ * a silent "no vulns found," because that would let an unscanned artifact
+ * through a gate. Never used in tests.
+ */
+export declare function createToolVulnScanner(tool?: ScannerTool, processRunner?: ProcessRunner): VulnScanner;
+/**
+ * Thrown by `notImplementedVulnScanner` — the "no real scanner wired yet"
+ * signal, mirroring `SbomGeneratorNotImplementedError` (./sbom-generator.ts).
+ * The default is loud-and-specific rather than a silent empty scan, so a
+ * caller that forgets to inject a scanner (or a mock in tests) fails obviously
+ * instead of appearing to find zero vulnerabilities.
+ */
+export declare class VulnScannerNotImplementedError extends Error {
+    constructor();
+}
+/** Kept for tests and for a caller that wants the old loud "no scanner wired" behavior; no longer the registered default (#634). */
+export declare const notImplementedVulnScanner: VulnScanner;
+/**
+ * A `VulnScanner` that picks a real backend at scan time — `grype` if present,
+ * else `trivy`. Unlike SBOM generation there is no hermetic fallback (a scan
+ * needs a real vuln DB), so when neither tool is on `PATH` this throws a
+ * `ToolNotAvailableError` naming what to install — an error a config-only user
+ * can act on — rather than `VulnScannerNotImplementedError`, which told them to
+ * edit code. This is the vuln-side analog of #630's hermetic-by-default SBOM
+ * generator: the registered `scan-vulnerabilities`/`vuln-gate` capabilities now
+ * work the moment a scanner is installed, with no code wiring.
+ */
+export declare function autoDetectVulnScanner(processRunner?: ProcessRunner): VulnScanner;
+/** The default `VulnScanner` the `scan-vulnerabilities`/`vuln-gate` capabilities fall back to when none is supplied: auto-detects `grype`/`trivy` and throws `ToolNotAvailableError` if neither is installed (#634). */
+export declare function defaultVulnScanner(): VulnScanner;
+export interface ScanVulnerabilitiesInput {
+    /** The SBOM to scan. */
+    sbom: SbomDocument;
+    /** Artifact digest the SBOM belongs to (recorded on the output). */
+    digest?: string;
+}
+export interface ScanVulnerabilitiesOutput {
+    findings: VulnFinding[];
+    /** Echoed back so a downstream `vuln-gate` step can key results to the artifact. */
+    digest?: string;
+}
+/**
+ * `scan-vulnerabilities` capability — scan an SBOM for known CVEs via the
+ * injectable `VulnScanner`. Produces findings only; suppression (VEX) and the
+ * pass/fail decision live in ./vuln-gate.ts, so a composition can scan once
+ * and reuse the findings, or run the gate directly (which scans for you).
+ */
+export declare function createScanVulnerabilitiesCapability(scanner?: VulnScanner): Capability<ScanVulnerabilitiesInput, ScanVulnerabilitiesOutput>;
+/** Default `scan-vulnerabilities` capability, backed by the not-implemented scanner (inject a real/mock one). */
+export declare const scanVulnerabilitiesCapability: Capability<ScanVulnerabilitiesInput, ScanVulnerabilitiesOutput>;
+//# sourceMappingURL=vuln-scan.d.ts.map

package/dist/components/verbs/vuln-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vuln-scan.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/vuln-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAA+D,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAInH,8GAA8G;AAC9G,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,YAAY,GAAG,SAAS,CAAC;AAEzF,qFAAqF;AACrF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAOlD,CAAC;AAEF,wIAAwI;AACxI,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAInE;AAED,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,wGAAwG;IACxG,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+JAA+J;IAC/J,OAAO,EAAE,OAAO,CAAC;CAClB;AAID,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,IAAI,EAAE,YAAY,CAAC;IACnB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAChD;AAED,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC;AAuB5C,4GAA4G;AAC5G,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CAa9D;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CAgB9D;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,GAAE,WAAqB,EAC3B,aAAa,GAAE,aAAsC,GACpD,WAAW,CAkBb;AAED;;;;;;GAMG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;;CAQxD;AAED,oIAAoI;AACpI,eAAO,MAAM,yBAAyB,EAAE,WAIvC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,GAAE,aAAsC,GAAG,WAAW,CAcxG;AAID,wNAAwN;AACxN,wBAAgB,kBAAkB,IAAI,WAAW,CAGhD;AAID,MAAM,WAAW,wBAAwB;IACvC,wBAAwB;IACxB,IAAI,EAAE,YAAY,CAAC;IACnB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,WAAkC,GAC1C,UAAU,CAAC,wBAAwB,EAAE,yBAAyB,CAAC,CAQjE;AAED,iHAAiH;AACjH,eAAO,MAAM,6BAA6B,EAAE,UAAU,CAAC,wBAAwB,EAAE,yBAAyB,CACnE,CAAC"}

package/dist/components/verbs/wait-verify.d.ts

@@ -0,0 +1,85 @@
+/**
+ * wait / verify family — poll until a deploy reaches a terminal or healthy
+ * state. The *agnostic* members live here: `wait-cluster-healthy` (a Neo4j
+ * bolt/quorum probe over the core `CloudExecutor`), and the HTTP waits
+ * `wait-endpoint` / `health-gate` (over an injectable `fetch`). The
+ * cloud-specific members — `wait-for-stack` (CloudFormation),
+ * `wait-steady-state` (ECS), `wait-job` (EMR) — moved to the aws lexicon
+ * alongside their executor clients (see docs/components/cloud-boundary).
+ */
+import type { Capability } from "../capability.js";
+import { type CloudExecutor } from "./cloud-executor.js";
+/** Minimal fetch surface the HTTP waits (`wait-endpoint`, `health-gate`) need — injectable for tests. */
+type Fetcher = (url: string) => Promise<{
+    status: number;
+    ok: boolean;
+}>;
+export interface WaitClusterHealthyInput {
+    /**
+     * Cluster identifier — a comma-separated list of `host:port` bolt
+     * endpoints. Optional because a per-instance fan-out phase (e.g. the Neo4j
+     * pilot) calls this once per instance without repeating the cluster's
+     * member list on every step; when omitted, falls back to
+     * `ctx.vars.clusterEndpoints` (env config resolved by the caller) or,
+     * failing that, `ctx.component` as a single-endpoint identifier.
+     */
+    cluster?: string;
+    /** Minimum healthy member count required. */
+    size?: number;
+    /** Require quorum (majority of expected members healthy) rather than an exact size. Default: false. */
+    quorum?: boolean;
+    /** Poll interval in ms. Default: 5000. */
+    intervalMs?: number;
+    /** Overall timeout in ms. Default: 5 minutes. */
+    timeoutMs?: number;
+}
+export interface WaitClusterHealthyOutput {
+    /** Number of healthy members observed. */
+    healthyCount: number;
+}
+/**
+ * Poll a multi-node cluster (e.g. Neo4j) via a bolt-port TCP probe until it
+ * reports healthy: `size` members reachable (exact-count mode, used by a
+ * cluster's seed instance) or a majority of the expected member list
+ * (`quorum` mode, used once followers exist). No rollback: a health probe is
+ * read-only.
+ */
+export declare function createWaitClusterHealthyCapability(executor?: CloudExecutor): Capability<WaitClusterHealthyInput, WaitClusterHealthyOutput>;
+/** Default `wait-cluster-healthy` capability, backed by the real `CloudExecutor`. */
+export declare const waitClusterHealthyCapability: Capability<WaitClusterHealthyInput, WaitClusterHealthyOutput>;
+export interface WaitEndpointInput {
+    /** URL to poll. */
+    url: string;
+    /** Expected HTTP status codes. Default: [200]. */
+    expectStatus?: number[];
+    /** Poll interval in ms. Default: 5000. */
+    intervalMs?: number;
+    /** Overall timeout in ms. */
+    timeoutMs?: number;
+}
+export interface WaitEndpointOutput {
+    /** Observed status code on success. */
+    status: number;
+}
+/** Poll an HTTP(S) endpoint until it responds with an expected status. Cloud-agnostic. */
+export declare function createWaitEndpointCapability(fetcher?: Fetcher): Capability<WaitEndpointInput, WaitEndpointOutput>;
+/** Default `wait-endpoint` capability, backed by the global `fetch`. */
+export declare const waitEndpointCapability: Capability<WaitEndpointInput, WaitEndpointOutput>;
+export interface HealthGateInput {
+    /** Health check path or full URL. */
+    path: string;
+    /** Number of consecutive successes required. Default: 1. */
+    consecutiveSuccesses?: number;
+    /** Poll interval in ms. Default: 5000. */
+    intervalMs?: number;
+}
+export interface HealthGateOutput {
+    /** True once the health check passed the required consecutive count. */
+    healthy: boolean;
+}
+/** Block progression until a health check passes — the generic post-deploy verification gate. Cloud-agnostic. */
+export declare function createHealthGateCapability(fetcher?: Fetcher): Capability<HealthGateInput, HealthGateOutput>;
+/** Default `health-gate` capability, backed by the global `fetch`. */
+export declare const healthGateCapability: Capability<HealthGateInput, HealthGateOutput>;
+export {};
+//# sourceMappingURL=wait-verify.d.ts.map

package/dist/components/verbs/wait-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wait-verify.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/wait-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAA+B,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEnF,yGAAyG;AACzG,KAAK,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAKzE,MAAM,WAAW,uBAAuB;IACtC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,GAAE,aAAsC,GAC/C,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,CAAC,CAoB/D;AAED,qFAAqF;AACrF,eAAO,MAAM,4BAA4B,EAAE,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,CACjE,CAAC;AAIvC,MAAM,WAAW,iBAAiB;IAChC,mBAAmB;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0FAA0F;AAC1F,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,OAAwB,GAAG,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAsBjI;AAED,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,EAAE,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,CAAkC,CAAC;AAIxH,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,iHAAiH;AACjH,wBAAgB,0BAA0B,CAAC,OAAO,GAAE,OAAwB,GAAG,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAyB3H;AAED,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAgC,CAAC"}

package/dist/config.d.ts

@@ -1,11 +1,15 @@
 import { z } from "zod";
 import type { LintConfig } from "./lint/config.js";
 import type { OwnershipMarker } from "./ownership.js";
+import { type SbomFormat } from "./components/verbs/sbom-generator.js";
+import type { Severity } from "./components/verbs/vuln-scan.js";
+import type { VulnPolicy } from "./components/verbs/vuln-gate.js";
 /**
  * Zod schema for ChantConfig validation.
  */
 export declare const ChantConfigSchema: z.ZodObject<{
     lexicons: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;
     environments: z.ZodOptional<z.ZodArray<z.ZodString>>;
     sourceDir: z.ZodOptional<z.ZodString>;
     lint: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -14,6 +18,53 @@ export declare const ChantConfigSchema: z.ZodObject<{
         env: z.ZodOptional<z.ZodString>;
         enabled: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
+    release: z.ZodOptional<z.ZodObject<{
+        autoRecord: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    sbom: z.ZodOptional<z.ZodObject<{
+        format: z.ZodOptional<z.ZodEnum<{
+            spdx: "spdx";
+            cyclonedx: "cyclonedx";
+        }>>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    signing: z.ZodOptional<z.ZodObject<{
+        keyless: z.ZodOptional<z.ZodBoolean>;
+        oidcIssuer: z.ZodOptional<z.ZodString>;
+        identity: z.ZodOptional<z.ZodString>;
+        identityIsRegexp: z.ZodOptional<z.ZodBoolean>;
+        key: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    vulnPolicy: z.ZodOptional<z.ZodObject<{
+        failSeverity: z.ZodOptional<z.ZodEnum<{
+            unknown: "unknown";
+            critical: "critical";
+            high: "high";
+            medium: "medium";
+            low: "low";
+            negligible: "negligible";
+        }>>;
+        fixableOnly: z.ZodOptional<z.ZodBoolean>;
+        warnSeverity: z.ZodOptional<z.ZodEnum<{
+            unknown: "unknown";
+            critical: "critical";
+            high: "high";
+            medium: "medium";
+            low: "low";
+            negligible: "negligible";
+        }>>;
+        failOnLicense: z.ZodOptional<z.ZodBoolean>;
+        failOnUnknownSeverity: z.ZodOptional<z.ZodBoolean>;
+        license: z.ZodOptional<z.ZodObject<{
+            allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        scanner: z.ZodOptional<z.ZodEnum<{
+            grype: "grype";
+            trivy: "trivy";
+        }>>;
+        vexSources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
 }, z.core.$loose>;
 /**
  * Top-level chant project configuration.
@@ -23,6 +74,16 @@ export declare const ChantConfigSchema: z.ZodObject<{
 export interface ChantConfig {
     /** Lexicon package names to load (e.g. ["aws"]) */
     lexicons?: string[];
+    /**
+     * Capability plugin package names to load in addition to the built-in
+     * starter set (e.g. ["acme"] loads `@intentius/chant-capability-acme`),
+     * mirroring `lexicons` — see {@link CapabilityPlugin} in
+     * `./components/capability-plugin.ts` and `buildCapabilityRegistry` in
+     * `./components/capability-plugin-loader.ts` (#559, epic #551). The
+     * built-in starter verb set (`./components/starter-plugin.ts`) is always
+     * loaded regardless of this field.
+     */
+    capabilities?: string[];
     /** Environment names (e.g. ["staging", "prod"]) */
     environments?: string[];
     /**
@@ -49,6 +110,87 @@ export interface ChantConfig {
         /** Set false to disable stamping even when `stack` is present. */
         enabled?: boolean;
     };
+    /**
+     * Release-ledger recording behavior (#597, epic #551). Auto-emitting a
+     * release record on a successful `chant run --components <name> --env
+     * <env>` deploy is ON by default — this is opt-**out**, not opt-in, per
+     * #597's "populate the ledger by construction." See {@link
+     * resolveAutoReleaseDisabled}.
+     */
+    release?: {
+        /** Set false to disable auto-emitting a release record after a successful component deploy project-wide. The `--no-release-record` CLI flag overrides this per-invocation. */
+        autoRecord?: boolean;
+    };
+    /**
+     * Project-wide SBOM generation defaults (#606, epic #551 follow-up to
+     * #564/#568). Consumed by the `generate-sbom` capability
+     * (./components/verbs/sbom.ts) via {@link resolveSbomFormat} — a
+     * component's own `build.sbom.format` (see `BuildSpec` in
+     * ./components/component.ts) always wins over this project default when
+     * set, mirroring how `ownership`/`release` are project-wide defaults a
+     * more specific caller can override.
+     */
+    sbom?: {
+        /** Default SBOM format for every `generate-sbom` step that doesn't specify its own. Defaults to `DEFAULT_SBOM_FORMAT` ("spdx", see ./components/verbs/sbom-generator.ts) when unset — BuildKit natively emits SPDX attestations for images. */
+        format?: SbomFormat;
+        /** Set false to opt this project out of SBOM generation entirely — components composing a `generate-sbom` step still run it explicitly, but this is the project-wide switch a component author can point to when deciding whether to include the step at all. Purely advisory: `generate-sbom` has no implicit/automatic invocation to suppress (a component's composition always decides), so this flag has no effect unless a component's own authoring code reads it. */
+        enabled?: boolean;
+    };
+    /**
+     * Project-wide signing/verification defaults (#622, epic #551 follow-up to
+     * #614's reproducibility/provenance material). Consumed by
+     * `./components/verbs/sign.ts`'s `sign`/`attest-provenance` capabilities and
+     * `./components/verbs/verify.ts`'s `verify` gate via {@link
+     * resolveSigningDefaults}. **Keyless is the default** — `keyless: false`
+     * plus `key` is the opt-in override for a team with an existing KMS/file
+     * key policy (see `./components/verbs/sign.ts`'s module doc for why keyless
+     * is never something a beginner has to turn on). `oidcIssuer`/`identity`
+     * are the one identity-setup step #622 asks projects to document: the
+     * expected signer for `verify`'s identity policy (e.g. GitHub Actions'
+     * OIDC issuer + a workflow ref).
+     */
+    signing?: {
+        /** Set false only alongside `key` to opt into key-based signing instead of the keyless default. Omit (or leave `true`) for the default keyless flow. */
+        keyless?: boolean;
+        /** Expected OIDC issuer for keyless signing/verification (e.g. `"https://token.actions.githubusercontent.com"` for GitHub Actions). Required for `verify`'s identity policy; optional for `sign`/`attest-provenance`, which can rely on cosign's own ambient OIDC detection in CI. */
+        oidcIssuer?: string;
+        /** Expected signer identity (e.g. a workflow ref URI) `verify` checks the certificate against. Required for `verify`'s identity policy. */
+        identity?: string;
+        /** Treat `identity` as a regexp rather than a literal match — see `IdentityPolicy.identityIsRegexp` in `./components/verbs/verify.ts`. */
+        identityIsRegexp?: boolean;
+        /** Opt-in key-based override (a path, or `kms://`/`awskms://`/... reference) for `sign`/`attest-provenance`/`verify` alike. Presence alone does not disable keyless — pair with `keyless: false` for clarity, though a capability call that explicitly sets its own `key`/`policy.key` always wins over this project default either way. */
+        key?: string;
+    };
+    /**
+     * Project-wide vulnerability/license policy-gate defaults (#626, epic #551
+     * supply-chain follow-up to the SBOM stack). Consumed by
+     * `./components/verbs/vuln-gate.ts`'s `vuln-gate` capability via {@link
+     * resolveVulnPolicy}. **Beginner-safe defaults** (see `DEFAULT_VULN_POLICY`
+     * in `./components/verbs/vuln-gate.ts`): block only `critical` + `fixable` +
+     * not-VEX-suppressed findings, warn on `high`, license report-only. Every
+     * field here overrides one of those defaults.
+     */
+    vulnPolicy?: {
+        /** Minimum severity that FAILS the gate. Default `"critical"`. */
+        failSeverity?: Severity;
+        /** Only fixable findings at/above `failSeverity` block. Default `true`. */
+        fixableOnly?: boolean;
+        /** Minimum severity reported as a warning. Default `"high"`. */
+        warnSeverity?: Severity;
+        /** Block on a license violation (else report-only). Default `false`. */
+        failOnLicense?: boolean;
+        /** Block on an `unknown`-severity finding (always warned regardless). Default `false`. */
+        failOnUnknownSeverity?: boolean;
+        /** License allow/deny lists evaluated against the SBOM's declared licenses. */
+        license?: {
+            allow?: string[];
+            deny?: string[];
+        };
+        /** Which real scanner a `ProcessRunner`-backed `vuln-gate`/`scan-vulnerabilities` shells out to. Default `"grype"`. Read where the capability/scanner is constructed. */
+        scanner?: "grype" | "trivy";
+        /** Default VEX document paths (OpenVEX/CycloneDX) applied to every gate. Read where the gate step is composed. */
+        vexSources?: string[];
+    };
 }
 /**
  * Resolved project configuration with metadata about how it was loaded.
@@ -75,4 +217,67 @@ export declare function loadChantConfig(dir: string): Promise<ResolvedConfig>;
  * ownership marking is off (no `stack`, or `enabled: false`).
  */
 export declare function resolveOwnershipMarker(config: ChantConfig): OwnershipMarker | undefined;
+/**
+ * Whether auto-emitting a release-ledger record after a successful `chant
+ * run --components` deploy should be skipped (#597). Opt-out, not opt-in:
+ * recording happens unless the CLI's `--no-release-record` flag was passed
+ * (`cliFlag`) or the project config sets `release.autoRecord: false` — the
+ * flag always wins for that one invocation, regardless of config.
+ */
+export declare function resolveAutoReleaseDisabled(config: ChantConfig, cliFlag?: boolean): boolean;
+/**
+ * Resolve which SBOM format a `generate-sbom` step should request (#606),
+ * given the project's `chant.config.ts` `sbom.format` and an optional
+ * component/step-level override. Precedence, most to least specific:
+ * `stepFormat` (the component's own `build.sbom.format` or an explicit
+ * `generate-sbom` step input) > `config.sbom.format` (project default) >
+ * `DEFAULT_SBOM_FORMAT` ("spdx", ./components/verbs/sbom-generator.ts).
+ * Never hardcodes one format as *the* format — this is purely precedence
+ * resolution over the two first-class formats SPDX/CycloneDX.
+ */
+export declare function resolveSbomFormat(config: ChantConfig, stepFormat?: SbomFormat): SbomFormat;
+/**
+ * Resolved signing defaults a `sign`/`attest-provenance`/`verify` capability
+ * call can spread its own `keyless`/`key`/`policy` input over (#622). Shaped
+ * to match `./components/verbs/sign.ts`'s `KeyBasedSigningConfig` (the `key`
+ * field) and `./components/verbs/verify.ts`'s `IdentityPolicy` (`expectedIssuer`/
+ * `expectedIdentity`/`identityIsRegexp`) so a caller can do
+ * `{ ...resolveSigningDefaults(config).identityPolicyDefaults, ...override }`
+ * without a config module import inside `./components/verbs/*` (no verb
+ * module imports `../../config.ts` directly — same convention `resolveSbomFormat`'s
+ * callers already follow: the orchestrator/caller resolves config, capabilities
+ * stay config-free).
+ */
+export interface ResolvedSigningDefaults {
+    /** False only when the project opted into the key-based override (`signing.keyless === false`). True (keyless) otherwise — the #622 default. */
+    keyless: boolean;
+    /** `./components/verbs/sign.ts`'s `KeyBasedSigningConfig`, present only when key-based signing is configured (`signing.key` set). */
+    key?: {
+        key: string;
+    };
+    /** Partial `./components/verbs/verify.ts` `IdentityPolicy` fields resolved from project config — a caller still supplies any per-call override and must ensure `expectedIssuer`/`expectedIdentity` end up set before calling `verify` (config alone does not guarantee both are present). */
+    identityPolicyDefaults: {
+        expectedIssuer?: string;
+        expectedIdentity?: string;
+        identityIsRegexp?: boolean;
+        key?: string;
+    };
+}
+/**
+ * Resolve project-wide signing defaults from `chant.config.ts`'s `signing`
+ * section (#622). Keyless unless `signing.keyless === false` — the same
+ * "default is the safe choice, override is explicit" precedence
+ * `resolveOwnershipMarker`/`resolveAutoReleaseDisabled` already use for their
+ * respective opt-outs.
+ */
+export declare function resolveSigningDefaults(config: ChantConfig): ResolvedSigningDefaults;
+/**
+ * Resolve the `vuln-gate` policy overrides from `chant.config.ts`'s
+ * `vulnPolicy` section (#626). Returns only the fields the project set; the
+ * gate merges these over its own `DEFAULT_VULN_POLICY`
+ * (`./components/verbs/vuln-gate.ts`), so an empty/absent section yields the
+ * beginner-safe defaults. `scanner`/`vexSources` are not policy fields — they
+ * configure how the capability is constructed and are read separately.
+ */
+export declare function resolveVulnPolicy(config: ChantConfig): Partial<VulnPolicy>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;iBAUd,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,2EAA2E;QAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,qCAAqC;QACrC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,kEAAkE;QAClE,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,MAAM,EAAE,WAAW,CAAC;IAEpB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAgB,CAAC;AAEpD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmB1E;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,CAIvF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE/D;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsCd,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,2EAA2E;QAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,qCAAqC;QACrC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,kEAAkE;QAClE,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,8KAA8K;QAC9K,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IAEF;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,+OAA+O;QAC/O,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,4cAA4c;QAC5c,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE;QACR,wJAAwJ;QACxJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,sRAAsR;QACtR,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,2IAA2I;QAC3I,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,0IAA0I;QAC1I,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,4UAA4U;QAC5U,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE;QACX,kEAAkE;QAClE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,2EAA2E;QAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,gEAAgE;QAChE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,wEAAwE;QACxE,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,0FAA0F;QAC1F,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,+EAA+E;QAC/E,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAChD,yKAAyK;QACzK,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAC5B,kHAAkH;QAClH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,MAAM,EAAE,WAAW,CAAC;IAEpB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAgB,CAAC;AAEpD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmB1E;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,CAIvF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAG1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,CAE1F;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,gJAAgJ;IAChJ,OAAO,EAAE,OAAO,CAAC;IACjB,qIAAqI;IACrI,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,6RAA6R;IAC7R,sBAAsB,EAAE;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,uBAAuB,CAanF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAW1E"}

package/dist/index.d.ts

@@ -59,6 +59,10 @@ export * from "./codegen/typecheck.js";
 export * from "./codegen/coverage.js";
 export * from "./codegen/validate.js";
 export * from "./codegen/docs.js";
+export * from "./codegen/surface-snapshot.js";
+export { regenLexicon, writeSurfaceSnapshot, SNAPSHOT_FILENAME, type RegenOptions, type RegenResult, type RegenFailure, } from "./codegen/lexicon-regen.js";
+export { checkRollingUpgrade, classifyDelta, diffRollingSurface, computeAzureApiVersionDelta, diffAzureApiVersions, extractAzureProvider, type RollingLexicon, type RollingUpgradeResult, type CheckRollingUpgradeOptions, type AzureApiVersionChange, } from "./codegen/rolling-upgrade.js";
+export { checkPinnedUpgrade, applyPinnedVersionBump, isNewer, parseVersion, isPreRelease, type LexiconId, type UpgradeCheckResult, type CheckPinnedUpgradeOptions, type UpstreamResolver, } from "./codegen/pinned-upgrade.js";
 export * from "./runtime.js";
 export * from "./runtime-adapter.js";
 export * from "./resource-attributes.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,QAAQ,CAAC;AACvB,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAElC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAClE,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5F,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,QAAQ,CAAC;AACvB,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAElC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAClE,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5F,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}

package/dist/lexicon.d.ts

@@ -7,6 +7,8 @@ import type { TypeScriptGenerator } from "./import/generator.js";
 import type { ArtifactIntegrity } from "./lexicon-integrity.js";
 import type { CompletionContext, CompletionItem, HoverContext, HoverInfo, CodeActionContext, CodeAction } from "./lsp/types.js";
 import type { McpToolContribution, McpResourceContribution } from "./mcp/types.js";
+import type { DriverComponent } from "./components/driver.js";
+import type { RuleMeta } from "./audit/catalog.js";
 /**
  * Manifest for a packaged lexicon — metadata embedded in the tarball.
  */
@@ -148,6 +150,64 @@ export interface InitTemplateSet {
  * Required lifecycle methods enforce consistency: every lexicon must support
  * generate, validate, coverage, and package operations.
  */
+/**
+ * Where a lexicon pins an upstream schema/spec version, and where to look for a
+ * newer one — the lexicon's own declaration for the self-upgrade tooling
+ * (`chant dev pinned-upgrade`), so core never hard-codes per-lexicon upstream
+ * repos or version-constant locations. See ./codegen/pinned-upgrade.ts.
+ */
+export interface UpstreamPin {
+    /** Source file (relative to the lexicon package root) holding the pinned version constant. */
+    readonly file: string;
+    /** Regex whose first capture group is the current pinned version in `file`. */
+    readonly pattern: RegExp;
+    /** Rebuild a line that matched `pattern`, substituting the new version. */
+    replace(newVersion: string, line: string): string;
+    /** Where to query for the latest stable upstream tag. */
+    readonly upstream: {
+        readonly owner: string;
+        readonly repo: string;
+        /** `releases` = published releases; `tags` = every git tag. */
+        readonly kind: "releases" | "tags";
+        /** Only consider tags ending with this suffix (e.g. "-ee" for GitLab). */
+        readonly tagSuffix?: string;
+    };
+}
+/** One CI job in a generated pipeline (generate mode) — a thin trigger for one component in one wave. */
+export interface ComponentPipelineJob {
+    /** CI job name (safe as a YAML key). */
+    jobName: string;
+    /** The component this job triggers. */
+    component: string;
+    /** The stage/wave this job runs in. */
+    stage: string;
+    /** Direct dependency job names this job waits on (mirrors the component's `dependsOn`). */
+    needs: string[];
+}
+/** Generic knobs for generate mode, applied once across every generated job (never per component). */
+export interface ComponentPipelineOptions {
+    /** Target environment threaded into the trigger command. */
+    env?: string;
+    /** The trigger command per component, argv with `{name}` substituted. */
+    runCommand?: string[];
+    /** Extra script lines appended to every job. */
+    extraScript?: string[];
+    /** Script lines run before the trigger command in every job. */
+    beforeScript?: string[];
+    /** Container image every job runs in. */
+    image?: string;
+    /** Top-level CI `variables:` block. */
+    variables?: Record<string, string>;
+}
+/** The synthesized CI pipeline for a component graph (generate mode). */
+export interface ComponentPipelineResult {
+    /** The synthesized CI YAML (e.g. `.gitlab-ci.yml` content). */
+    yaml: string;
+    /** Wave-ordered stage names (matches the driver's graph waves 1:1). */
+    stages: string[];
+    /** Every generated job, in emit order. */
+    jobs: ComponentPipelineJob[];
+}
 export interface LexiconPlugin {
     /** Human-readable name (e.g. "aws", "gcp") */
     readonly name: string;
@@ -177,6 +237,14 @@ export interface LexiconPlugin {
     declarativeRules?(): RuleSpec[];
     /** Return post-synthesis checks for build validation */
     postSynthChecks?(): PostSynthCheck[];
+    /**
+     * Audit catalog metadata (title/tier/fix/authority/category) for this
+     * lexicon's `postSynthChecks`, keyed by check id — the per-provider half of
+     * `chant audit`'s rule catalog (#687, epic #350). Core aggregates these over
+     * its static catalog via `resolveAuditCatalog` (./audit/catalog.ts). Omit
+     * for lexicons whose rule metadata still lives in core's static catalog.
+     */
+    auditCatalog?(): Record<string, RuleMeta>;
     /** Return intrinsic function definitions */
     intrinsics?(): IntrinsicDef[];
     /** Return pseudo-parameter names (e.g. "MyDomain::StackName") */
@@ -197,6 +265,16 @@ export interface LexiconPlugin {
     initTemplates?(template?: string): InitTemplateSet;
     /** Optional initialization hook */
     init?(): void | Promise<void>;
+    /** How this lexicon pins its upstream schema version + where to check for a newer one (self-upgrade tooling — see ./codegen/pinned-upgrade.ts). Omit for lexicons with no pinned upstream. */
+    readonly upstreamPin?: UpstreamPin;
+    /**
+     * Generate a CI pipeline from the discovered component graph — the
+     * `chant build --components --generate <name>` seam. Only CI-provider
+     * lexicons (gitlab, github, forgejo) implement this; core owns the generic
+     * driver (discovery + graph waves) and dispatches here. Omit for lexicons
+     * that are not CI providers.
+     */
+    generateComponentPipeline?(components: DriverComponent[], options?: ComponentPipelineOptions): ComponentPipelineResult;
     /** Provide completions for LSP */
     completionProvider?(ctx: CompletionContext): CompletionItem[];
     /** Provide hover information for LSP */

package/dist/lexicon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lexicon.d.ts","sourceRoot":"","sources":["../src/lexicon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC7H,OAAO,KAAK,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG,SAAS,CAAC;IAC7C,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;yEACqE;IACrE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,gCAAgC;IAChC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,2BAA2B;IAC3B,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5E;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAE5B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,kCAAkC;IAClC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAEhC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9E,iDAAiD;IACjD,OAAO,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGzE,iDAAiD;IACjD,SAAS,CAAC,IAAI,QAAQ,EAAE,CAAC;IAEzB,+DAA+D;IAC/D,gBAAgB,CAAC,IAAI,QAAQ,EAAE,CAAC;IAEhC,wDAAwD;IACxD,eAAe,CAAC,IAAI,cAAc,EAAE,CAAC;IAErC,4CAA4C;IAC5C,UAAU,CAAC,IAAI,YAAY,EAAE,CAAC;IAE9B,iEAAiE;IACjE,gBAAgB,CAAC,IAAI,MAAM,EAAE,CAAC;IAE9B;;;;OAIG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IAExC,+DAA+D;IAC/D,cAAc,CAAC,IAAI,cAAc,CAAC;IAElC,yDAAyD;IACzD,iBAAiB,CAAC,IAAI,mBAAmB,CAAC;IAE1C,6CAA6C;IAC7C,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;IAE7B,wEAAwE;IACxE,aAAa,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAEnD,mCAAmC;IACnC,IAAI,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG9B,kCAAkC;IAClC,kBAAkB,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAAC;IAE9D,wCAAwC;IACxC,aAAa,CAAC,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;IAEzD,mCAAmC;IACnC,kBAAkB,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,UAAU,EAAE,CAAC;IAG1D,mCAAmC;IACnC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGtD,oCAAoC;IACpC,QAAQ,CAAC,IAAI,mBAAmB,EAAE,CAAC;IAEnC,wCAAwC;IACxC,YAAY,CAAC,IAAI,uBAAuB,EAAE,CAAC;IAG3C;;;;;;OAMG;IACH,eAAe,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IAG5D;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,CAAC,OAAO,EAAE;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;QAC9E;;;;;WAKG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE9C;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,CAAC,OAAO,EAAE;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;KAC/E,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAG9C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,eAAe,CAAC,CAAC,OAAO,EAAE;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;QAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG;IAC1C,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;CACrC,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAkBtE"}
+{"version":3,"file":"lexicon.d.ts","sourceRoot":"","sources":["../src/lexicon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC7H,OAAO,KAAK,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG,SAAS,CAAC;IAC7C,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;yEACqE;IACrE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,gCAAgC;IAChC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,2BAA2B;IAC3B,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5E;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,+DAA+D;QAC/D,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;QACnC,0EAA0E;QAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,yGAAyG;AACzG,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,sGAAsG;AACtG,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,yEAAyE;AACzE,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0CAA0C;IAC1C,IAAI,EAAE,oBAAoB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAE5B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,kCAAkC;IAClC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAEhC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9E,iDAAiD;IACjD,OAAO,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGzE,iDAAiD;IACjD,SAAS,CAAC,IAAI,QAAQ,EAAE,CAAC;IAEzB,+DAA+D;IAC/D,gBAAgB,CAAC,IAAI,QAAQ,EAAE,CAAC;IAEhC,wDAAwD;IACxD,eAAe,CAAC,IAAI,cAAc,EAAE,CAAC;IAErC;;;;;;OAMG;IACH,YAAY,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE1C,4CAA4C;IAC5C,UAAU,CAAC,IAAI,YAAY,EAAE,CAAC;IAE9B,iEAAiE;IACjE,gBAAgB,CAAC,IAAI,MAAM,EAAE,CAAC;IAE9B;;;;OAIG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IAExC,+DAA+D;IAC/D,cAAc,CAAC,IAAI,cAAc,CAAC;IAElC,yDAAyD;IACzD,iBAAiB,CAAC,IAAI,mBAAmB,CAAC;IAE1C,6CAA6C;IAC7C,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;IAE7B,wEAAwE;IACxE,aAAa,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IAEnD,mCAAmC;IACnC,IAAI,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,8LAA8L;IAC9L,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IAEnC;;;;;;OAMG;IACH,yBAAyB,CAAC,CACxB,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,CAAC,EAAE,wBAAwB,GACjC,uBAAuB,CAAC;IAG3B,kCAAkC;IAClC,kBAAkB,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAAC;IAE9D,wCAAwC;IACxC,aAAa,CAAC,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;IAEzD,mCAAmC;IACnC,kBAAkB,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,UAAU,EAAE,CAAC;IAG1D,mCAAmC;IACnC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGtD,oCAAoC;IACpC,QAAQ,CAAC,IAAI,mBAAmB,EAAE,CAAC;IAEnC,wCAAwC;IACxC,YAAY,CAAC,IAAI,uBAAuB,EAAE,CAAC;IAG3C;;;;;;OAMG;IACH,eAAe,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IAG5D;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,CAAC,OAAO,EAAE;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;QAC9E;;;;;WAKG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE9C;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,CAAC,OAAO,EAAE;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;KAC/E,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAG9C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,eAAe,CAAC,CAAC,OAAO,EAAE;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;QAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG;IAC1C,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;CACrC,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAkBtE"}